Privacy policy

This is a courtesy translation. The binding version is the Spanish one, at panicdrop.app/privacidad: it is the one drawn up under the GDPR and Spanish Organic Law 3/2018, and the one that prevails in case of any discrepancy.

Last updated: 3 October 2026

This Privacy Policy describes how the personal data of the users (hereinafter, the “User” or the “Users”) of the PanicDrop mobile application (hereinafter, the “Application”), available for iOS and Android devices, is collected, used, kept and protected, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data Controller

• Name / Legal entity: Álvaro González
• Tax ID (NIF): 50549409K
• Registered / business address: C/ Ocaña 37 — 28047 Madrid (Spain)
• Contact email address: hello@panicdrop.app

2. Applicable Principles and Privacy by Design Commitment

PanicDrop has been designed under the principles of data minimisation and privacy by default and by design (Art. 25 GDPR):

• No conventional sign-up: The Application does not ask for a real name, surname, email address, telephone number or sign-in credentials tied to third-party platforms (such as Google accounts or an Apple ID).
• Dissociated, anonymous identity: When the Application is installed and first started, a random technical account identifier is generated and held locally on the device.
• No active geolocation: The operating system's location permission is not requested, the GPS chip is not accessed, and no position is inferred from the IP address.
• No commercial trackers: The Application does not embed advertising identifiers (IDFA or Google Advertising ID), behavioural advertising SDKs or third-party commercial analytics tools.

3. Data Processed, Purposes and Legal Basis

The full catalogue of personal and technical data processed is set out below:

• Game profile: Nickname/alias chosen by the User (or the handset model by default) and the emoji selected as an avatar.
  • Purpose: To identify the User in game rooms, standings and group games within their clubs.
  • Legal basis: Performance of the contract / Terms of Service (Art. 6.1.b GDPR).
• Regional settings: Time zone, country code and language set as default in the operating system.
  • Purpose: To deliver alerts within suitable time bands (avoiding night hours) and to offer the interface in the matching language.
  • Legal basis: Legitimate interest (Art. 6.1.f GDPR).
• Push communications: Token/identifier of the push notification service (APNs / FCM) and the handset platform (iOS or Android).
  • Purpose: To send the instant technical alert that sets off the mechanics of the game.
  • Legal basis: Performance of the contract (Art. 6.1.b GDPR) and consent through the operating system permission (Art. 6.1.a GDPR).
• Game activity: Club membership, response timestamps (in milliseconds), results, power-ups applied and the capacity to host games (PanicDrop Plus).
  • Purpose: To record how games unfold, to calculate standings and to validate the technical execution of the game.
  • Legal basis: Performance of the contract (Art. 6.1.b GDPR).
• Telemetry and stability: Application version, operating system version, device manufacturer and model, alert delivery timestamps and the date of the last session.
  • Purpose: To guarantee technical fairness between players, to monitor the stability of the service and to resolve performance incidents.
  • Legal basis: Legitimate interest (Art. 6.1.f GDPR).
• Fraud prevention (free trial): On Android, the ANDROID_ID identifier scoped to the Application's signature. On iOS, a binary status query through Apple's DeviceCheck API.
  • Purpose: To prevent systematic abuse of the free trial period through repeated uninstalls and reinstalls of the software.
  • Legal basis: Legitimate interest (Art. 6.1.f GDPR).
• Voluntary diagnostics (“Something went wrong”): Text supplied voluntarily by the User, battery optimisation and notification status, and metrics from the last ten rounds played.
  • Purpose: To diagnose and resolve specific technical faults reported proactively by the User themselves.
  • Legal basis: Consent of the data subject when they trigger the report (Art. 6.1.a GDPR).

Visibility of Data between Users

The other members of the clubs the User joins can only see their nickname, their avatar, their competitive results in shared games and a binary indicator of whether they hold the capacity to start games (PanicDrop Plus active). Under no circumstances is the nature of that subscription revealed (paid or promotional), nor its expiry date, nor any other personal or technical data from the handset.

4. Payments and Subscriptions (PanicDrop Plus)

The purchase of subscriptions or paid features is handled entirely and exclusively through the payment gateways of Apple Inc. (App Store) or Google LLC (Google Play Store).

The Data Controller does not access, collect or store banking data, credit card numbers or financial credentials. Those platforms send our servers only a cryptographic receipt or purchase token attesting to the technical validity of the subscription.

5. Recipients and International Data Transfers

The personal data processed through the Application will not be sold, assigned or shared with advertising companies or data brokers. Access is granted only to the following data processors, strictly necessary to provide the service:

• Supabase Inc.: Provider of technical infrastructure, database and server hosting. The data is stored on servers located within the European Economic Area (Ireland region, EU).
• Apple Inc. (Apple Push Notification service — APNs): For the delivery of operational alerts to iOS handsets.
• Google LLC (Firebase Cloud Messaging — FCM): For the delivery of operational alerts to Android handsets.

To the extent that certain auxiliary providers or parent companies of those corporate services may process technical metadata on servers located outside the European Economic Area (mainly in the United States), such transfers are carried out under the corresponding adequacy decisions (EU-U.S. Data Privacy Framework) or through the prior signing of Standard Contractual Clauses (SCC) approved by the European Commission, guaranteeing a level of protection equivalent to that of the GDPR.

6. Data Retention and Account Deletion

Personal data will be kept for as long as the User keeps the Application installed and their account operative.

The User may request the complete and immediate deletion of their account at any time, directly from within the Application itself (Settings → “Delete my account”).

Once deletion is triggered:

• Immediate erasure: The nickname, avatar, push notification token, time zone, device model and any incident reports sent are irreversibly deleted.
• Anonymisation of the game history: So as not to distort the competitive history or harm the experience of the remaining members of a club, the timestamps and historical scores obtained in group games are kept under the dissociated label “Deleted player”, permanently detached from any identifying trace. Ownership of the clubs founded by the User is transferred automatically to the longest-standing member.
• Dissociated anti-fraud record: The hardware-derived identifier (ANDROID_ID or the DeviceCheck record) is kept dissociated from any profile, for the sole and legitimate purpose of establishing whether that handset has already used up its free trial period in the event of a reinstall.
• Aggregate metrics: Purely statistical global metrics are preserved (device country and language, registration and deletion dates) which do not allow Users to be re-identified.
• Backups: Definitive erasure from rotating technical backup systems takes effect within a maximum of 30 calendar days.

7. Exercise of Rights

In accordance with Articles 15 to 22 GDPR, the User has the right to exercise the following rights at any time and free of charge:

• Access: To know which of their personal data is being processed.
• Rectification: To correct data that is inaccurate or incomplete.
• Erasure (“right to be forgotten”): To request the deletion of their data, provided primarily through the native deletion feature inside the Application.
• Restriction of processing: To request that the processing of their data be suspended in the cases provided for by law.
• Portability: To receive their personal data in a structured, commonly used and machine-readable format.
• Objection: To object to the processing of data based on legitimate interest.

To exercise these rights, the User may send a written communication to the email address hello@panicdrop.app, stating the right they wish to exercise and supplying the internal account identifier available in the settings section of the Application.

The User also has the right to lodge a complaint with the competent supervisory authority, in particular the Spanish Data Protection Agency (AEPD) (https://www.aepd.es), should they consider their rights to have been infringed.

8. Processing of Minors' Data

The Application is neither aimed at nor designed for children under 14. In accordance with Article 8.1 GDPR and Article 7 LOPDGDD, in Spanish territory the use and processing of data of children under 14 is prohibited without the proper authorisation of their parents or legal guardians.

Should the Controller gain actual knowledge of an account or of data associated with a minor below that age threshold (or below the applicable age of digital consent in their EU Member State of residence), the account will be immediately closed and technically erased.

9. Updates and Amendments

This Privacy Policy may be amended to adapt to legislative or case-law developments or to technical changes in the Application. Any substantial amendment will be notified to Users through a prominent notice inside the Application before it takes effect, and the date in the header of the document will be updated.