This policy explains what personal information Marshmob (the game, this website and our servers) collects, why, who else processes it, how long we keep it and what you can do about it. Marshmob is made and operated by TMFI ("we", "us").
The short version
- No sign-up. The game makes an anonymous account on your device. We never ask for your email, phone number, real name, address, contacts, photos or location.
- We keep your player name and progress, your purchase and summon records, and simple gameplay events that help us fix and balance the game.
- Payments go through Apple or Google; we never see your card. Our servers run on Google Cloud. The app sends nothing to Unity, the maker of the game engine: we switched its reporting off.
- No ads, no advertising ID, no cross-app tracking, and we never sell personal information.
- You can delete your account at any time: in the game (Settings > Account > Delete account) or from this page.
1. What we collect
| Information | What exactly | Why |
|---|---|---|
| Account identifiers | A random device ID and secret that the app creates and keeps in your device's secure storage (iOS Keychain; Android Keystore and Google Block Store), your account number and your player tag (for example #K7Q2M). | To sign you in without a password and keep your progress, also after a reinstall. |
| Player name and profile | The name other players see (generated for you or chosen by you), your avatar and frame, your device language. | To show you to other players and in the right language. |
| Game data | Your units, items and currencies, match results and rating, rewards, the answers you give in the game (your age band, and whether a parent turned paid summons on) and the country or region of your App Store or Google Play account. | To run the game, matchmaking and rewards, and to apply the age and regional rules on paid random items. |
| Purchase history | Product and quantity, the store's transaction or order ID (a Google Play purchase token only as a one-way hash), the store country or region, time, store and environment; the result of every summon and pack. | To deliver what you bought, handle refunds, prevent fraud, and keep the records the law requires for purchases and probability-type items. |
| App interactions | Event names and screens with small values, such as a match start and end with your place, which screen you opened, or that a purchase started. Tagged with your account number, the app build and a session ID; no IP address or device ID. | Analytics to find bugs and balance the game. |
| Technical data | Your IP address and request details when your device talks to our servers; the commands each player sends in a match. | To connect you, pick a nearby match server, limit abuse, detect cheating and fix errors. |
We do not collect location, contacts, photos or other files, messages, health data, browsing history or your advertising ID. The game has no ads and no advertising SDK. This website sets no cookies and uses no analytics; it only remembers your language choice in your own browser.
2. How we use it, and on what basis
- To provide the game you asked for (contract): your account, progress, matches, purchases.
- To keep it fair and safe (legitimate interests): security, abuse limits, cheat detection, fraud and refund handling.
- To improve it (legitimate interests): pseudonymous gameplay analytics. We do not build advertising profiles.
- To meet legal duties (legal obligation): purchase records, tax and consumer protection, and the records of probability-type items.
Matchmaking uses your rating and the power you bring. How much you have spent is never an input.
3. Who else processes it
| Who | What they get | Why |
|---|---|---|
| Google Cloud (Google LLC) | Everything in section 1 | Hosts our servers and databases on our behalf (processor) |
| Apple (App Store), Google (Google Play) | Your purchase, with a random account token the app attaches to it so the purchase reaches your account; we receive a transaction record from them | Payment, refunds, store rules. They act under their own privacy policies |
| Other players | Your player name, tag, avatar, frame and match results | That is how a multiplayer game works |
The game is built with the Unity engine and its in-app purchase component (Unity IAP). Out of the box these report to Unity Technologies (purchase events with device identifiers, engine diagnostics, hardware statistics). We have switched all of that off in our builds and check it before every build, so the app sends nothing to Unity.
We share information with authorities only when the law requires it. If Marshmob is ever transferred to another company, we will tell you before your information moves and you can delete your account.
4. Transfers abroad
Our servers are in Tokyo, Japan and Oregon, USA (Google Cloud). Using the game online means your information travels there over an encrypted connection; a purchase also goes to Apple or Google, who run their stores worldwide.
| Recipient and contact | Country | Items | Purpose | When and how | Kept |
|---|---|---|---|---|---|
| Google LLC (Google Cloud), cloud.google.com/terms/cloud-privacy-notice | Japan, USA | All items in section 1 | Hosting and storage | Over the network, whenever you play online | As in section 5 |
| Apple Inc. (apple.com/legal/privacy/contact) / Google LLC (policies.google.com/privacy) | USA and others | Purchase and transaction, the account token | Payment and refunds | Through the store, at each purchase | Under their policies |
These transfers are needed to provide an online game. If you do not want them, do not use online play or purchases, or delete your account; the transfer to Apple or Google happens only when you make a purchase.
5. How long we keep it
- Account, profile and game data: until you delete your account, plus a 30-day grace period in which you can still restore it.
- Purchase records: your purchases and refunds, and what your paid Rubies and other paid items bought (paid summons included): 400 days in our live database, and an archive copy for up to 5 years, as consumer protection and tax law require for payment and supply records. After your account is deleted these records stay linked only to a random account number. The archive never keeps a player name; the live record of a rename keeps the name you chose until it expires (400 days).
- Store transaction records (order or transaction ID, product, purchase date and the random account number): 5 years from the purchase, so that the same purchase can never be credited twice or credited to another account. A purchase older than that is no longer credited.
- Other gameplay records and app interactions (free rewards and summons, match results, the events in section 1): 400 days in our live database and up to 13 months in our analytics archive, pseudonymous (account number only). After you delete your account they are gone within 13 months.
- Match records (with the names shown in that match): 90 days; match server logs 30 days; replays up to 365 days.
- Server request logs (with IP addresses): up to 30 days.
- Backups: daily backups are kept 14 days and recovery copies 7 days, so deleted data disappears from them within that time.
When the period ends we delete the information so it cannot be recovered (electronic records are erased; we keep no paper records).
6. Your choices and rights
- Delete your account in the game (Settings > Account > Delete account) or see Delete your account.
- Change your player name in your profile in the game.
- Access, correct, delete, restrict, object or take a copy of your information: write to contact@marshmob.app with your player tag (shown on your profile). We answer within 30 days (within 10 days for requests under Korean law).
- You can complain to your data protection authority. In Korea: the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cyber investigation (spo.go.kr, 1301) or the Korean National Police Agency cyber bureau (ecrm.police.go.kr, 182). In the EU or UK: your local supervisory authority. In Japan: the Personal Information Protection Commission.
- California residents: we do not sell or share personal information for cross-context behavioral advertising, and you can ask what we hold and ask us to delete it, without being treated differently.
7. Children
Marshmob is not for children under 13, or under 14 in Korea (the game does not collect the legal guardian's consent Korean law requires below that age), and we do not knowingly collect information from them. Paid summons and packs with random contents stay off for players who tell us they are minors, unless a parent turns them on in Settings. If you believe such a child is using the game, contact us and we will delete the account.
8. Security
All traffic between the app and our servers is encrypted (HTTPS/TLS), data is encrypted at rest on Google Cloud, server secrets are kept in a secrets manager, and access is limited to the people who need it to run the game. Your device credentials stay in your device's secure storage.
9. Changes
We will post any change here with a new effective date, and tell you in the game before a change that matters takes effect.
10. Contact
- Operator: TMFI · contact@marshmob.app
- Privacy desk (requests and complaints about your personal information): contact@marshmob.app
- Support: contact@marshmob.app · Support page