Just a Squire Privacy Policy

Last updated: September 25th, 2026

Introduction

Whale Played Ltd. (“Whale Played”, “we”, “our”, “us”) respects your privacy and commits to protecting your personal data under Israel's Protection of Privacy Law (PPL) and, where applicable, other data protection laws, including the GDPR and CCPA. This Policy covers our game Just a Squire, available as a Telegram Mini App and as a mobile app for Android (and for iOS, when released), together with our related websites (the “Service”).

Whale Played Ltd. is registered in Israel, with its business address at Avital 18, Yokneam Illit, 2067018.

By using the Service, you acknowledge that your personal data will be processed as described in this Policy.

Information We Collect

When you play inside Telegram

Telegram hands the game a signed set of launch data when you open it. From it we take and store your Telegram user id, username, first name, language code, whether you have Telegram Premium, and whether you have allowed our bot to send you messages. Our server verifies this data with Telegram's signature on every launch. We do not receive your phone number, and we do not store your last name, profile photo or contacts.

When you play the mobile app or the web version

The game generates a random identifier on your device the first time it runs and uses it to recognise your account on later launches. It is not derived from your device's hardware identifiers or your Google account, and we do not receive your name, email address or any account information from your device. We receive something from Google only if you choose to save your progress with Google, as described next.

Saving your progress with Google (Android app only)

In the Android app you can choose to save your progress with Google, in the game's Settings, so that you can load it again after reinstalling the game or on another phone. If you do, Google tells us a unique identifier for your Google account. We store it only to find your save. Google's sign-in response also contains your email address, your name and a link to your profile picture, which we discard without storing. We never receive your Google password. Saving with Google is optional: if you do not use it, we receive nothing from Google about your account.

If the Google account you choose already has a save, the game asks before loading it. Once you load it, the phone opens that save from then on, and the progress that was on the phone is replaced. The replaced progress is not deleted: we keep it on our servers, marked as replaced by the save you loaded, and it can no longer be opened in the app.

Game data

Your progress and saved state: in-game currencies, energy, upgrades, class rank, chapters completed, wins and losses, badges, VIP status, purchase history, participation in time-limited events, your in-game settings, and a snapshot of a run in progress so you can resume it. Progress is stored on our servers so that it follows your account.

Technical and gameplay data

Through our analytics provider we record the type and version of your operating system and browser or app shell, screen size, device performance characteristics (such as processor cores, memory, graphics renderer and network type), the app version you are running, error and crash reports, and gameplay events (for example which chapter you played, what you rolled, tapped or bought, which rewarded ads you watched and what each one earned, and how long a session lasted). We do not intentionally collect special categories of personal data (such as health data or biometric data).

Crash reporting (mobile app only)

The mobile app uses Firebase Crashlytics, a Google service, so that we learn when the app stops working. If the app crashes or freezes, it sends a report containing the technical details of the failure — the stack trace, the model of device and the version of Android or iOS it is running, the version of the app, how much memory and storage were free, whether the app was in the foreground, and the time of the crash. It also sends a random installation identifier generated by Google so that repeated crashes on one device can be recognised as the same device.

This is separate from the error reports described above, and it exists because it can see failures our own reporting cannot: our reporting is written in the game's own code, so it stops the moment the app itself stops. We use these reports only to find and fix faults. They are not used for advertising, and they are not combined with your game account.

IP address and approximate location

Our servers see your IP address when the game connects. We use it briefly, in memory only, to limit abuse, and we pass it to our analytics provider so it can estimate your city or country. We do not store IP addresses in our database.

How you found the game

When you first open the game through an invite, promotion or partner link, we record which link it was. If a friend invited you, this includes your friend's Telegram id and name, so we can credit them.

Advertising ID and install attribution (mobile app only)

The mobile app uses Adjust, a marketing-attribution service, to work out which advertisement, campaign or link an installation came from. This lets us tell whether the money we spend inviting people to the game is working, and it is the only purpose we use it for.

For this, the app may read your device's advertising identifier: the Google Advertising ID on Android, and Apple's Advertising Identifier (IDFA) on iOS if and when an iOS version is released. This identifier is provided by the operating system, it is not tied to your name, and you can reset it or switch it off at any time in your device settings, as described under Your choices below. Adjust also receives your IP address, basic device and operating-system details, the referral information Google Play provides about the installation, and an identifier Adjust generates for the installation itself. In the Android app we also tell Adjust what each rewarded ad you watch earned, so that the return on a campaign includes its ad revenue.

We do not use the information Adjust collects to choose the ads shown in the game, we do not build advertising profiles, and we do not sell or share it with advertising networks for their own purposes. The Just a Squire Telegram Mini App and our website contain no attribution software and read no advertising identifier.

Rewarded ads (Android app only)

The Android app offers optional rewarded videos: you can choose to watch an ad in return for an in-game reward, and an ad plays only when you choose one. The ads are served through AppLovin MAX, an advertising service of AppLovin Corporation. Owners of the Ad-Free card are shown no ads, and the ad software is not started for them; if you buy the card while playing, it stops loading ads at once. The Telegram Mini App and our website show no ads.

For everyone else, the ad software starts when the game opens and loads an ad in advance, so AppLovin receives the following even if you never watch an ad: your device's advertising identifier and Google's App Set ID, your IP address, information about your device and the app, and how you interact with the ads. AppLovin uses this information to choose, show and measure ads and to prevent fraud, and may share it with the advertising networks whose ads it serves. AppLovin's own privacy policy governs its use of this information.

So that AppLovin's server can confirm to ours that an ad was watched before the game pays its reward, we give AppLovin your game account's number, a random number we assign to your account (not the identifier on your device). We record what each ad earned, and report it to Adjust and to our analytics provider.

Your choices

On Android, open Settings → Privacy → Ads to delete or reset your advertising ID; deleting it stops apps receiving it. On iOS, open Settings → Privacy & Security → Tracking. You can also ask us to stop processing your attribution data, and to delete it, by writing to privacy@whaleplayed.com.

Purchases

Inside Telegram, purchases are made with Telegram Stars in Telegram's own payment sheet; Telegram is the payment processor and we never receive card, wallet or bank details. We store what you bought, the amount in Stars, an estimated value, the purchase status and time, and the payment confirmations Telegram sends us, which include your Telegram user details and Telegram's payment identifiers. In the mobile app, where in-app purchases are offered, they are processed by Google Play (and, on iOS, by Apple) under their own terms; we receive purchase confirmation data such as the product, an order identifier and a purchase token, which we use to deliver your purchase and prevent fraud.

What we do not collect

We do not collect precise location, contacts, photos, camera or microphone data. The Telegram Mini App and our website show no advertising, and the Android app shows only the optional rewarded ads described above. Advertising identifiers are read only by the mobile app, by Adjust for install attribution and by AppLovin for ads, as described above; the Telegram version reads none and contains no attribution or advertising software.

How We Use Your Information

We use your information to operate, maintain and improve Just a Squire: to sign you in and save your progress across launches and devices; if you choose, to save your progress with Google and load it again on another phone; to deliver purchases exactly once and prevent duplicate charges; to run the game economy fairly; to show the optional rewarded ads you choose to watch, and to confirm that an ad was watched before paying its reward; to analyse usage, balance the game and run controlled experiments (players are randomly assigned to test groups); to diagnose errors and performance problems; to attribute installs to invitations, promotions and advertising campaigns and credit the players who invited others; to measure whether our advertising is working; to prevent fraud and abuse; and to comply with legal obligations.

If you play inside Telegram and have allowed our bot to message you, we may send you a single reminder when your in-game energy is full. You can revoke this permission at any time in Telegram.

If you take part in a promotion run together with a partner game, we confirm to that partner, on request, whether you have completed the required chapter, and nothing more.

Legal bases: performance of a contract (providing the game and your purchases), legitimate interests (analytics, game balancing, fraud prevention, security), and compliance with legal obligations.

Sharing Your Information

We share your information with service providers and processors that help us run the Service: Heroku (Salesforce) and MongoDB Atlas (hosting and database), Cloudflare (web hosting and delivery), Mixpanel (analytics), Adjust (install attribution for the mobile app, as described above), AppLovin (rewarded ads in the Android app, as described above), Google (Firebase Crashlytics for crash reporting and Firebase Cloud Messaging for notifications, both in the mobile app), Telegram (the Mini App platform and Telegram Stars payments), and Google Play and Apple (app distribution and, where offered, in-app payments).

Partners with whom we run joint promotions receive only confirmation of whether you completed the promoted chapter, for a Telegram id they already hold.

We share personal data only as necessary to provide the Service, operate our business, and comply with legal obligations. We do not sell personal data (as defined under applicable law), and apart from what the Android app's ad software sends to AppLovin, as described under Rewarded ads, we do not share it for advertising.

Legal disclosures may be made to authorities where required by law or to protect our rights.

International Data Transfers

Your personal data may be transferred to and processed in countries outside your jurisdiction. Our servers and database are hosted in the European Union, our analytics provider processes data in the United States, our attribution provider (Adjust, a company established in Germany) processes data in the European Union and the United States, our ad provider (AppLovin, a company established in the United States) processes ad data in the United States and other countries, and Google processes crash reports and notification data in the United States and other countries in which it operates.

For EEA/UK residents, we rely on Standard Contractual Clauses or other approved mechanisms for such transfers. Israel is recognised by the European Commission as providing an adequate level of protection. We implement appropriate safeguards in accordance with applicable law.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected as described in this Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When personal data is no longer required, we take reasonable steps to delete, anonymise, or securely store it in accordance with applicable law.

Your Rights

Depending on your location and applicable law, you may have certain rights regarding your personal data. These may include the right to:

You may exercise these rights by contacting us at privacy@whaleplayed.com. We may ask for reasonable information to verify your identity before fulfilling your request.

If you believe your privacy rights have not been respected, or if you have concerns about our handling of your personal data, you may also have the right to contact or file a complaint with your local data protection authority.

Deleting your account

In the Android app: from the main menu, open Settings, tap Delete account and confirm twice. From that moment the account can no longer be opened on any device, and the phone you used starts a new game. We erase the account 30 days later.

If your progress was saved with Google, you can change your mind during those 30 days: in Settings on any phone, tap Continue with Google, choose the same Google account and load the save. That cancels the deletion. If your progress was not saved with Google, the deletion cannot be undone.

On Telegram, or if you cannot use the app: email privacy@whaleplayed.com and tell us which version you play. For the Telegram version, include your Telegram username; for the mobile app, include the approximate date you started playing and, if you can, a screenshot of your progress screen, so we can locate the account. We will delete your account within 30 days.

When an account is erased, we delete its progress, balances, items, settings, the identifier of any Google account it was saved with, and its analytics profile. We keep records of completed purchases, for dispute resolution and financial record-keeping, as described under Data Retention. Purchases are not refunded. Uninstalling the mobile app or clearing its data removes the data held on your device but does not by itself delete your account on our servers.

Note for U.S. Residents

For residents of California and other U.S. states with applicable privacy laws, the rights described above, including the rights to access, correct and delete personal information, and, where applicable, to opt out of certain data uses, also apply.

Please note that we do not sell or share personal information as these terms are defined under U.S. privacy legislation.

For any privacy-related questions or requests, you can contact us at privacy@whaleplayed.com.

Children’s Privacy

The Service is not intended for children under the age of 13 (or other age as required by local law).

We do not knowingly collect personal data from children. If we become aware that such data has been collected, we will take steps to delete it. If you believe that we might have received information from a child, please contact us at privacy@whaleplayed.com.

Security

We implement appropriate technical and organisational measures to protect personal data. Telegram logins are verified cryptographically on every launch; the device identifier used by the mobile app is a random secret stored in the device's secure storage; all traffic between the game and our servers is encrypted; access to our systems is limited and controlled; and our hosting and database providers apply their own security controls and audits. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Cookies & Tracking

The game does not use cookies. Our analytics provider stores identifiers in your device's or browser's local storage to recognise the same device across sessions. Analytics are integral to operating and improving the game and are active whenever you play; the game does not currently offer a separate in-game analytics opt-out. You can remove the locally stored identifiers by clearing the app's or browser's site data, or by uninstalling the app.

Telegram-specific Information

Mobile App Information

Changes

We may update this Privacy Policy from time to time.

Where required, we will provide notice (e.g., in-game or via email).

Last updated: September 25th, 2026

Contact

For questions contact: privacy@whaleplayed.com.

Israel PPA complaints: Privacy Protection Authority.

Governing law: Israel.