Privacy Policy

Dieses Dokument ist auf Englisch und Spanisch verfügbar und wird unten auf Englisch angezeigt. Wenn du Hilfe beim Verständnis brauchst, schreib uns.

This Privacy Policy explains how Juan Andrés Peñaloza Torres, an independent developer operating under the brand Debugeo, domiciled in Bucaramanga, Santander, Colombia ("Debugeo", "we", "us" or "our"), collects, uses, shares and protects information when you use the Patosapo mobile game, the website https://patosapo.debugeo.com and our related support channels (together, the "Service").

We designed Patosapo to need as little information about you as possible. You do not have to give us your name, email address, phone number or a password to play. By installing or using the Service you acknowledge that you have read this Policy. Where the law requires your consent or authorization, we ask for it separately inside the game, and you can withdraw it at any time.

1. Who is responsible for your data

The controller (in Colombia, "Responsable del Tratamiento") of the personal data described in this Policy is Juan Andrés Peñaloza Torres, operating as Debugeo, Bucaramanga, Santander, Colombia. Contact for any privacy matter: soporte@debugeo.com.

This Policy also serves as our personal data processing policy under Colombian Statutory Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015), and as our privacy notice for the European Union and United Kingdom General Data Protection Regulations (GDPR and UK GDPR), the Brazilian General Data Protection Law (LGPD), the California Consumer Privacy Act as amended (CCPA) and other applicable laws.

2. The short version

You play with an anonymous player account. We do not know your name or email unless you write to us.
Most of your game lives on your device. If you use cloud save, a copy of your game state is stored on our servers so you can recover it.
Payments are handled by Apple or Google. We never see your card details.
Ads only appear when you choose to watch one for a reward, and personalized ads are only used with your consent where the law requires it.
Analytics, crash reports and similar tools are optional and are only used with your permission where the law requires it.
We do not sell your personal information.
You can delete your data from the game (Settings → Account) or by writing to us.

3. Information we process

Depending on the features you use and the choices you make, we process the following categories of information:

Game data on your device: your progress, coins, gems, tickets, outfits, garden, kitchen upgrades, reward ledger, settings, language and accessibility preferences. This data is stored locally and stays on your device unless you use cloud save.
Anonymous player account: when the game connects to our services, Google Firebase Authentication creates an anonymous user identifier ("player ID"), together with account creation and last sign-in times and technical authentication tokens. The player ID lets us link your cloud save and purchases to you without knowing who you are.
Cloud save: if cloud save is available and enabled, a copy of your game state (as described above), the app version, platform, save timestamps and your player ID are stored on infrastructure operated by Cloudflare, Inc. on our behalf.
Purchases and subscriptions: purchases are processed by Apple or Google. Through our purchase management provider RevenueCat, Inc. we receive your player ID or an anonymous app user ID, the store, product identifiers, transaction and order identifiers, purchase, renewal, cancellation and expiration dates, price, currency, country or storefront, trial and refund status and subscription entitlement status. We do not receive your name, billing address or payment card details.
Advertising: if you choose to watch a rewarded ad, Google AdMob (Google LLC or Google Ireland Limited) and its certified partners may collect device identifiers such as the Android Advertising ID or Apple IDFA (only if you allow tracking on iOS), IP address, device model, operating system, language, app and ad interaction data and approximate location derived from the IP address, to deliver, measure, limit the frequency of and, with your consent, personalize ads, and to prevent fraud.
Consent records: your consent and privacy choices (for example, from the Google User Messaging Platform or Apple App Tracking Transparency prompt) are stored on your device and, where applicable, by the consent provider.
Optional analytics, performance and crash data: only if you allow it where the law requires consent, we use Google Firebase Analytics, Firebase Crashlytics and Firebase Performance Monitoring to understand how the game is used and to fix problems. These tools may process pseudonymous app instance identifiers, gameplay and screen events, session length, device model, operating system, app version, crash traces, performance measurements, and country or region derived from the IP address.
Notifications: game reminders are local notifications scheduled on your own device. We ask for notification permission only when you turn reminders on. We do not currently collect push notification tokens; if that changes, this Policy will be updated.
Shared images: when you share a picture of your Patosapo, the image is created on your device and handed to the app you choose (for example a messaging app). We do not receive it. The policies of the app you share with apply.
Support communications: if you contact us, we process your email address, the content of your message, any attachments, and any information you give us such as your player ID, device model or order number.
Website: our website is served by Cloudflare, which processes IP addresses, browser user agent, requested URLs and timestamps in server logs for security, abuse prevention and delivery. The website does not use advertising or analytics cookies. It only stores your theme and language preference in your browser's local storage.

We do not intentionally collect sensitive personal data (such as health, biometric, religious or political data), precise geolocation, your contacts, your photo library, your microphone or your camera. Please do not send us sensitive data through support.

4. Why we use it and legal bases

To provide the game, keep your progress, sync your cloud save and deliver purchased items (performance of our contract with you under the Terms of Use).
To process, verify and restore purchases and subscriptions, prevent fraud and comply with tax and accounting duties (performance of contract and legal obligation).
To show rewarded ads that you choose to watch and grant the reward, including frequency capping and fraud prevention (legitimate interest in funding a free game; consent where the law requires it, and always consent for personalized ads in the EEA, UK and Switzerland).
To measure usage, fix crashes and improve performance and game balance (consent where required; otherwise our legitimate interest in keeping the game working, which you can object to at any time).
To protect the Service and other players, detect cheating, tampering with saves or reward ledgers, and abuse (legitimate interest).
To answer support requests and handle privacy requests (performance of contract, legitimate interest and legal obligation).
To comply with the law, respond to lawful requests from authorities and defend legal claims (legal obligation and legitimate interest).

In Colombia, we process data on the basis of the prior, express and informed authorization you give when you accept this Policy and the in-game choices, or on the other grounds allowed by Law 1581 of 2012. You may revoke your authorization at any time, unless we have a legal or contractual duty to keep the data.

We do not use your data to make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated checks may reject a cloud save or reward that appears to be manipulated; you can contact us to have a person review it.

6. International transfers

We are based in Colombia and our providers operate servers in the United States, the European Union and other countries. Your information may therefore be transferred to and processed in countries whose data protection laws differ from yours.

When we transfer data, we rely on appropriate safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses and equivalent UK instruments, the EU-US Data Privacy Framework where the provider is certified, and, for Colombia, transfers to countries with an adequate level of protection according to the Superintendence of Industry and Commerce or under the exceptions and contractual guarantees provided in Article 26 of Law 1581 of 2012. By accepting this Policy you authorize these transfers to the extent the law requires your authorization.

7. How long we keep it

Data on your device: until you delete it in the game, clear the app data or uninstall the game.
Anonymous player account and cloud save: while your account is active. We may delete accounts and cloud saves that have been inactive for 24 months. They are deleted within 30 days after you request deletion, and backups are overwritten within 90 days.
Purchase and transaction records: for as long as required by tax, accounting and commercial laws (in Colombia, generally up to 10 years), and for fraud prevention and legal claims.
Support emails: up to 3 years after your request is resolved, unless we need them longer to defend a legal claim.
Analytics and crash data: according to the retention settings of each provider, which we set to no more than 14 months for analytics and 90 days for crash reports where the provider allows it.
Website server logs: for short periods set by Cloudflare for security purposes.

When the retention period ends, we delete or anonymize the data.

8. Your rights and choices

Depending on where you live, you may have the right to know whether we process your data and access it; correct it; delete it; restrict or object to its processing; receive it in a portable format; withdraw consent at any time without affecting processing already carried out; and not be discriminated against for exercising your rights.

In-game controls: Settings → Account lets you review your ad and analytics choices, see your player ID and delete your data. Where available, the "Privacy options" button reopens the Google consent form.
Advertising: you can reset or delete your advertising ID or opt out of ads personalization in your Android settings, and allow or deny tracking for Patosapo in iOS Settings, Privacy and Security, Tracking.
European Union, EEA, UK and Switzerland: you may also lodge a complaint with your local data protection authority.
California and other US states: you have the right to know, access, correct and delete personal information, to opt out of its sale or sharing for cross-context behavioral advertising and targeted advertising, and to limit the use of sensitive personal information (we do not use sensitive personal information). You may use an authorized agent. We honor Global Privacy Control signals on our website. In the last 12 months we have not sold personal information for money; the categories we may have "shared" for advertising are identifiers, internet or app activity and approximate location, with advertising networks.
Brazil (LGPD): you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about the entities with which we share data and about the possibility of refusing consent, and revocation of consent. You may also petition the ANPD.
Colombia (Habeas Data, Law 1581 of 2012): you have the right to know, update and rectify your data; request proof of the authorization you gave; be informed about how your data is used; revoke the authorization and/or request deletion when there is no legal or contractual duty to keep it; access your data free of charge; and file complaints with the Superintendence of Industry and Commerce (SIC) after exhausting the consultation or claim procedure with us.

How to exercise your rights: write to soporte@debugeo.com with the subject "Privacy request" and include your player ID (Settings → Account) so we can find your data, since we do not otherwise know who you are. We may need to verify the request. We answer inquiries (consultas) within 10 business days, extendable by 5, and claims (reclamos) within 15 business days, extendable by 8, as provided by Colombian law, and in any case within the deadlines set by the law that applies to you (for example, one month under the GDPR, extendable where permitted).

9. Children

Patosapo is intended for teens and adults, where permitted by local law, and is not directed at children. Because the game includes simulated gambling features (such as prize wheels and a slot machine whose prizes are in-game items only), the age rating assigned by each store applies, for example 17+ on the Apple App Store, or 18+ where the store or local law requires it. In countries where the minimum age to consent to data processing is higher than 13 (for example, up to 16 in some EU countries), players below that age should only use the online features with the involvement of a parent or guardian.

We do not knowingly collect personal information from children under 13 (or the applicable age in their country). We ask ad networks not to serve content unsuitable for the game's audience. If we learn that we have collected personal information from a child without the required parental consent, we will delete it. Parents or guardians who believe this has happened can contact us at soporte@debugeo.com.

This Policy is intended to comply with the US Children's Online Privacy Protection Act (COPPA), Article 8 of the GDPR and the rights of children and adolescents recognized in Article 7 of Colombian Law 1581 of 2012.

10. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), access controls based on least privilege, authenticated APIs and reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal data, we will notify you and the competent authorities when the law requires it.

11. Cookies and similar technologies

Our website does not use advertising or analytics cookies and does not track you across other sites. In the game, the advertising and analytics SDKs described above use device identifiers and local storage in ways similar to cookies, only as allowed by your choices and applicable law.

12. Changes to this Policy

We may update this Policy to reflect changes in the game, in the services we use or in the law. We will change the "last updated" date and, if the changes are significant, we will let you know in the game or on this website before they take effect and ask for your consent again where the law requires it.

13. Contact

For any question or request about privacy, contact Juan Andrés Peñaloza Torres (Debugeo) at soporte@debugeo.com, Bucaramanga, Santander, Colombia. You can also read our Terms of Use, our Purchases and Subscriptions Terms and how to delete your data.