Privacy

Last updated: October 9, 2026. Versão em português

This Privacy Policy describes what personal data AMEBOOM™ processes, why, with whom, and what your rights are. It applies to the Android app, the web browser game, the ameboom.com website (ameboom.com.br redirects to it), the test version at beta.ameboom.com, and related services (the “Service”).

Your use of the Service is also governed by the Terms of Service.

1. Who controls the data

Controller: Ricardo Seiji Sato
Email: contato@ameboom.com
Contact form: ameboom.com/contact.html

Requests about your data should be sent to that email or form.

2. What data we collect

It depends on whether you play with or without signing up, sign in with Google, make purchases, watch ads, or contact us.

2.1. Account

• guest account (automatic): when you open the game for the first time, we create an account with a 6-character identifier and a secret key. It keeps your progress and purchases, even without sign-up. We do not ask for your name, email, or age for this;
• sign-up (optional): email, password (stored only as a cryptographic hash, never in plain text), and username (@username). To confirm your email or change your password, we send a code to your email;
• Sign in with Google (optional): the Google account identifier, name, and email that Google returns, according to the permissions you accept there;
• amoeba name and appearance (color and skin), which you choose to play;
• account backup on Google (app only): the account identifier and key are stored encrypted on the device and copied to Google’s backup service (Block Store), so the account comes back if you reinstall the app or switch phones. The copy only leaves the device when Google backup is on and protected by the screen lock.

2.2. Game and purchases

• progress: level, EVO, points, records, skins, gems, VIP Pass, saved amoeba (cyst), and match history needed for the leaderboard and to operate the Service;
• Google Play purchases: the order identifier, the product, the receipt (purchase token), and the status (paid, pending, refunded). When you buy, we send Google a code derived from your account that does not reveal the real identifier. We do not receive card numbers or bank details;
• website purchases (browser only, signed-up accounts only): the order identifier, the product, the amount, the currency, the payment method (Pix or card), and the status (pending, paid, refunded, disputed). Payment is made on the page of the payment provider (Mercado Pago or Stripe), which collects your payment data itself. We do not receive card numbers or bank details; we only receive the provider’s confirmation of the payment;
• rewarded ads: the reward request (respawn, gem, try a skin) and Google’s notice that the ad was watched.

2.3. Technical and usage data

• IP address, app version, operating system, device model, language, crashes, and game errors;
• app activity: session time, time spent in each part of the game (menu, shop, match), mode played, and ad usage. The app sends a summary of this to our server. This is not screen recording or logging of what you type outside the game;
• device and app integrity (app only): through Google’s Play Integrity API, we receive a result that says whether the app is the original from Google Play and whether the device passes Google’s checks. We use it only against cheating and fraud; we do not receive the list of apps or personal data through it;
• Android advertising ID, used by Google AdMob to show and measure ads (section 5);
• country: we derive your country from your IP address and store only the country on your account (for example, to show it on the leaderboard and choose a server). We do not store your IP address for this, and we never use GPS. IP Geolocation by DB-IP;
• website visits and the game in the browser (not the app): we use Umami, a privacy-focused analytics tool, to count visits. It records the page viewed, where the visit came from, browser, operating system, device type, screen size, language, your country (derived from the IP address, which is not stored), and clicks on buttons such as PLAY. In the game played in the browser it also counts steps such as opening the game, starting a match, opening the store, going to payment and completing a purchase (product, payment method and amount; never card or bank details), not linked to your account. It uses no cookies, does not build a profile of you or follow you across other sites, and we honor your browser’s “Do Not Track” signal;
• ads on the website (not the app): the page where you play in the browser shows ads from Google AdSense. Google and its partners may use cookies and similar technologies, your IP address, and device and browser data to show and measure those ads (section 5.2);
• in the web browser, the game keeps settings and the account in the browser’s local storage (section 9).

2.4. Contact and feedback

• whatever you write in the contact form, in in-game feedback, or to support, and the contact details you provide for a reply. The website contact form sends your message to our email and keeps a copy on the website server. In app feedback and in the contact form, the IP address is stored only as a cryptographic hash.

3. Why we use it and on what legal basis

The Service is operated from Brazil, and the legal basis is Brazilian Law No. 13,709/2018 (LGPD, Brazil’s General Data Protection Law).

• Performance of the Service (art. 7, V): create and maintain the account, including guest and Google accounts, let you play, save progress, confirm payment and deliver items and the VIP Pass, restore the account after reinstalling, send confirmation codes, answer support, and send operational notices (maintenance, security, changes to terms).
• Legitimate interest (art. 7, IX), limited to what is necessary and proportionate: measure session time and game usage, understand retention and failures, improve performance, prevent cheating and fraud (including with Play Integrity and the verification of ads and purchases), and protect the ponds. Where legitimate interest does not apply, we use another basis provided for in the LGPD.
• Consent (art. 7, I): personalized ads, the advertising ID, and the cookies of website ads, where required by law or by the platform. You can withdraw consent in your device settings or in the privacy message shown on the website (section 5). Withdrawing does not affect processing done before.
• Legal obligation (art. 7, II): comply with orders from authorities, tax record-keeping of transactions, and data subject rights.
• Regular exercise of rights (art. 7, VI): defend the Service in billing, refund, chargeback, or disputes.

We do not make decisions based solely on automated processing that produce significant legal effects on you, beyond the leaderboard, anti-cheat, and item delivery rules described in the Terms.

4. Data safety on Google Play

In the Play Store data safety form we declare, among others: app activity (interactions and usage time), device identifiers (advertising ID, shared with Google AdMob for advertising, analytics, and fraud prevention), app info and performance (crashes and diagnostics), personal info (email, name, and user IDs, from the optional sign-up and Sign in with Google), approximate location (your country from your IP address; Google AdMob also estimates your general area from it), messages you send in in-game feedback, and purchase history. None of this is sold. Data is transmitted with encryption and you can request deletion (section 11).

5. Ads

5.1. In the Android app

In the Android app, ads are provided by Google AdMob (Google LLC), in these formats:

• rewarded, which you choose to watch: to respawn in a match, continue a saved amoeba, earn 1 gem in the shop, or try a skin;
• banner on the online match list and next to the end-of-life screen;
• full-screen (interstitial) when leaving a finished match, with a frequency cap and never in your first matches.

To show and measure ads and prevent fraud, AdMob receives the advertising ID, the IP address, and device data, and processes them according to the Google Privacy Policy. For rewarded ads, the app gives AdMob your account’s internal identifier and a request code, and Google notifies our server that the ad was watched, so the reward can be unlocked. We do not send AdMob your name, email, @username, or usage summary.

With an active VIP Pass, no ads are shown in the app.

You can limit personalized ads or delete your advertising ID in Android settings (Google › Ads). Non-personalized ads may still appear.

5.2. On the website

On the website, ads appear only on the page where you play in the browser (ameboom.com/play/), around the game and never inside the match, and are provided by Google AdSense (Google LLC). The game itself, loaded inside that page, shows no ads. To show and measure these ads and prevent fraud, Google and its partners may set and read cookies and similar identifiers on your browser, and receive your IP address and browser and device data, according to the Google policy on how it uses data from sites that use its services and the Google Privacy Policy. We do not send AdSense your account, name, email, or @username.

Consent and choices. Where the law requires (for example in the European Economic Area, the United Kingdom, and some U.S. states), the website shows a privacy message from Google where you can accept, refuse, or manage ads and cookies, and, in the United States, opt out of the “sale” or “sharing” of personal information. You can reopen it from the link the message leaves on the page, change the choice at any time, or manage personalized ads at adssettings.google.com. Refusing does not block the game, but non-personalized ads may still appear. The VIP Pass removes the ads inside the game and the app, but does not remove the ads of the play page on the website.

6. Who we share it with

We do not sell player data. We share only what is necessary with:

• providers that operate the Service on our behalf: server and website hosting, database (Supabase), email delivery, and website visit statistics (Umami Cloud, section 2.3);
• payment providers for purchases on the website: Mercado Pago (Brazil; Pix and card, in reais) and Stripe (United States; card, in U.S. dollars). They are independent controllers of the payment data you give them and process it under their own privacy policies. They send us the order identifier, the status, and the amount, and we send them the order identifier, the product, the amount, and the currency;
• Google: Sign in with Google, Google Play (payment, subscription, refund, and app integrity), account backup (Block Store), Google AdMob (ads in the app), and Google AdSense (ads on the website);
• public authorities, when required by law;
• a successor, if the Service is transferred, to the extent necessary to continue operating it.

Other players see your amoeba’s name and appearance, level, and points in matches and on the leaderboard. Your @username, email, and usage time are not shown to other players. There is no chat between players.

7. Where the data is stored

The game server and the database are located in Brazil (São Paulo). If you live outside Brazil (for example, in the United States), your data is transferred to and stored in Brazil, under Brazilian law. Google and other providers (including Umami Cloud, for website visit statistics, and Stripe, for card payments in U.S. dollars) may process data outside Brazil; in that case, processing follows the LGPD and the applicable safeguards (contractual clauses, a country with an adequate level of protection, or another legal basis).

8. How long we keep it

• account and progress: as long as the account exists, plus any additional period needed to defend rights or comply with the law;
• usage time: up to 6 months, or until the account is deleted, whichever comes first;
• purchase and refund records, including those from the website: for the periods required by tax and consumer protection law, even after the account is deleted (without profile data);
• server logs: generally 30 days, up to 6 months when needed to investigate abuse or fraud;
• contact, feedback, and support: until the request is resolved and for the related legal periods;
• guest accounts with no sign-up and no purchases, inactive for more than 180 days, may be deleted.

When the period ends, the data is deleted or anonymized, unless we are required to keep it.

9. Cookies and local storage

In the web browser, the game uses local storage (localStorage) to keep the guest account, settings, and saved amoeba. The website’s visit counter (Umami, section 2.3) does not use cookies. The page where you play in the browser shows ads from Google AdSense, which can set advertising cookies from Google and its partners on your browser (section 5.2); outside that page, the website sets none. You can accept, refuse, or manage them in the privacy message of the website and in your browser settings. Clearing your browser data erases this information from the device, including access to the guest account if it has no sign-up.

In the app, the account is kept in Android’s encrypted storage (Keystore) and in the Google backup described in section 2.1.

10. Children and teens

The game content is rated for all ages, but the Service is intended for people aged 13 and older. We do not knowingly collect data from children under 13. Teens should use the Service and make purchases with the knowledge of a parent or legal guardian.

If we learn that we have collected data from a child in violation of the LGPD, we delete or anonymize whatever we can. A parent or guardian can request this through the contact below. Purchases made with someone else’s payment method are the responsibility of whoever authorized that use, as set out in the Terms of Service.

11. Your rights (LGPD)

To the extent provided by law, you may request:

• confirmation that we process your data, and access to it;
• correction of incomplete or outdated data;
• anonymization, blocking, or deletion of unnecessary or excessive data;
• portability, where applicable;
• deletion of data processed based on consent, unless the law requires us to keep it;
• information about sharing;
• information about the option of not consenting and its consequences;
• withdrawal of consent;
• review of automated decisions, where the law grants it;
• objection to processing based on legitimate interest, in the cases provided by law.

Requests: contact form or contato@ameboom.com. We may ask you to confirm your identity. We respond within the periods set by the LGPD. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD).

To delete your account or data instantly, without contacting us: in the game (Settings) or at ameboom.com/delete-account.html and ameboom.com/delete-data.html. Deletion erases the account, the progress, and the usage summary linked to it, and removes the amoeba from the leaderboard; if there is a VIP Pass subscription on Google Play, it is canceled first. Virtual items are not refunded because of the deletion, except as set out in the refund policy of the Terms of Service and where required by law. The financial record of the purchase is kept for the legal period (section 8).

12. U.S. state privacy rights

If you live in a U.S. state with a consumer privacy law (for example California, Colorado, Connecticut, Texas, Utah, Virginia, and others), we offer you the rights below, wherever your state’s law gives them to you. We apply them to every player in the United States, whether or not the law of your state strictly requires it. This section adds to section 11; the LGPD rights there remain valid.

12.1. Your rights

• know / access the personal information we hold about you, the categories, the sources, and who receives it;
• correct inaccurate information;
• delete your personal information (in the game under Settings, or at ameboom.com/delete-account.html, section 11);
• portability: receive your data in a usable format;
• opt out of “sale” and “sharing” of personal information, and of targeted advertising (section 12.3);
• not be discriminated against for using these rights: we do not deny the Service, change prices, or lower quality because you used them.

12.2. What we collected in the last 12 months

In the terms used by U.S. state laws, and as described in section 2: identifiers (account identifier, username, email, advertising ID, IP address); internet and app activity (session time, usage, ads); commercial information (purchases of gems, skins, and the VIP Pass); approximate location (country derived from the IP address, never GPS); device information (model, operating system, app version, integrity result); and what you send us by email or form. We collect them from you, from your device, and from Google (sign-in, purchases, ads, integrity). We use them for the purposes in section 3 and share them only with the recipients in section 6. We do not collect sensitive personal information beyond what you choose to give us (such as the content of a message to support), and we do not use it to infer characteristics about you.

12.3. “Do Not Sell or Share”

We do not sell your personal information for money. But in the Android app, ads are provided by Google AdMob, which receives the advertising ID, the IP address, and device data (section 5). Under some state laws, that exchange can count as “sharing” for cross-context behavioral advertising or “sale”. To opt out:

• in the app (version 1.0.45 or later), open Settings and tap PRIVACY CHOICES. The button appears where the law requires it, and opens the “Do Not Sell or Share My Personal Information” form. You can come back to it at any time;
• or, on Android, limit personalized ads or delete your advertising ID (Settings › Google › Ads);
• or buy the VIP Pass, which shows no ads.

On the website, the ads of the play page are provided by Google AdSense, which can also count as “sharing” or “sale” under some state laws. Where the law requires, the privacy message of the website lets you opt out (section 5.2), and you can manage Google ads at adssettings.google.com. The website itself does not read a browser “Global Privacy Control” signal; the choice is made in the message above. Outside the play page, the website has no ad technology.

12.4. How to make a request

Send your request through the contact form or to contato@ameboom.com, saying you are a U.S. resident and which right you want to use. We may ask you to confirm your identity, usually by showing that you control the account or email. An authorized agent can make the request for you, with proof of authorization. We reply within 45 days (and may extend once by 45 more days, telling you why). Requests are free, up to the limits your state allows.

If we refuse a request, you can appeal by replying to our message or writing to the same email with “Appeal” in the subject. We answer the appeal within the period of your state’s law (generally 45 to 60 days). If you are still not satisfied, you can contact your state attorney general.

12.5. Age

The Service is for people aged 13 and older (section 10). We do not knowingly collect personal information from children under 13.

We do not sell personal information for money, so we offer no financial incentive for it.

13. Security

We take reasonable measures to protect data: encrypted connection (HTTPS), passwords stored only as cryptographic hashes, account stored encrypted on the device, restricted access to the database, verification of purchases and ads directly with Google, and app integrity checks. No system is completely secure. Let us know if you suspect unauthorized access to your account.

14. Changes to this policy

We may update this page. The date at the top shows the version in effect at ameboom.com/privacy.html. Relevant changes will be announced on the website or in the game, when required by law. Continued use after the effective date subjects you to the new version.

15. Contact

Ricardo Seiji Sato — AMEBOOM™
contato@ameboom.com · contact form