Privacy

GOAL TCG Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how we handle personal data when you use GOAL TCG: Football Card Game on Android, iOS and, where available, the web. It covers the game and related account, purchase, advertising, measurement, social and support features.

1. Who is responsible for your data?

The data controller is:

App Growth Maksymilian Pawłowski, operating under the Apphill brand
ul. Legnicka 50, 59-500 Złotoryja, Poland
NIP: 6941690129
REGON: 382980152
Email: hello@apphill.agency

You can contact us at this address about privacy, your information or a data deletion request.

2. Playing locally and using an account

You can start playing without creating an account. In local mode, your game progress is stored on your device. Uninstalling the game or clearing its storage can remove local progress.

Playing without an account does not mean that no information leaves your device. Advertising, app analytics, purchase verification, technical requests and any optional measurement you enable can still involve the data described below.

If you connect a Google or Apple account, we use authentication and cloud services to identify your game account and save or restore progress. These services may provide an account identifier, email address, display name and authentication information. Sign in with Apple may provide a private relay email address. We do not receive your Google or Apple password.

3. What information do we process?

Depending on the features you use, your platform and your privacy choices, we process:

  • Account and profile information: game account ID, nickname, avatar selection, authentication provider, sign-in information, support ID and nickname reservations.
  • Game progress and activity: owned cards and duplicate copies, squads, match results, ratings, fans, missions, rewards, inventory, in-game currencies, settings, event participation and activity timestamps.
  • Social information: friend codes, invitations, friend relationships, referrals, shared squad information, Premium status and recent activity information.
  • Purchase and subscription information: product IDs, order or transaction IDs, purchase dates, amounts and currencies, verification records, purchase tokens or receipts where needed to verify a transaction, and entitlement or subscription status. We do not receive your full payment card number or bank account details from Apple or Google.
  • Device and technical information: app and operating system versions, device model, language, IP address, app-instance or installation identifiers, network information and technical error or security records. Advertising identifiers may be processed where available and permitted. Advertising services may derive an approximate region from an IP address.
  • Usage and advertising information: app launches and sessions, gameplay and feature events, ad impressions and interactions, rewarded-ad events, ad revenue and campaign attribution information.
  • Notification information: notification permission status, push tokens and information needed to schedule or deliver a relevant reminder.
  • Privacy choices: consent decisions and timestamps, advertising choices and operating-system permission status.
  • Support information: your email address, messages, screenshots and other information you choose to send us.

We receive information directly from you, through your use of the game, and from providers such as sign-in services, app stores, advertising services and measurement partners. Social invitations and referrals may also originate from another player.

4. Why we use information and our legal bases

Where the EU or UK GDPR applies, we rely on the following legal bases, according to the purpose:

  • Providing the service and performing our contract with you: running the game, maintaining your account and cloud save, providing requested social and competitive features, verifying purchases and delivering digital items or subscription benefits.
  • Consent: optional Singular campaign measurement, and advertising personalization, tracking, non-essential device storage or access, and other optional processing where consent is required by applicable law.
  • Legitimate interests: protecting accounts and services, preventing cheating and purchase fraud, maintaining service reliability, resolving support issues and evaluating necessary operational performance, where these interests are not overridden by your rights. This basis does not replace consent where consent is legally required.
  • Legal obligations: retaining records required by applicable tax or accounting law and responding to binding legal requests.

Providing account or transaction information is necessary if you want the associated sign-in, cloud or purchase features. Optional campaign measurement is not required to play, save progress or receive purchases.

Acknowledging this Privacy Policy is not consent to every type of processing. Notification permission, advertising choices, Apple’s tracking permission and Singular campaign measurement are separate choices.

5. Information visible to other players

When you use account-based rankings or social features, other players may see your nickname, selected avatar, ranking position, rating, relevant game statistics and shared squad. Friends may also see your Premium indicator and a recent-activity or last-active indication.

Friend codes and referral information are used to connect players and administer referral rewards. Your account email address, sign-in credentials, private purchase records and support correspondence are not displayed as part of your public game profile.

Choose a nickname that you are comfortable sharing. Do not put sensitive personal information into it.

6. Advertising and advertising privacy

We use Google AdMob to display ads and measure advertising performance. AdMob mediation can also involve supported advertising networks, including Unity/ironSource and Meta Audience Network, depending on platform and advertising configuration.

These providers can process device and app identifiers, IP addresses, device information, ad impressions, clicks and other ad interactions to deliver ads, measure their performance and detect invalid traffic.

Where applicable, Google User Messaging Platform (UMP) presents advertising privacy choices. You can revisit available advertising choices through the game’s privacy settings. Depending on your location, choices and provider support, ads may be personalized, non-personalized, limited or unavailable. Non-personalized advertising can still involve technical data and fraud-prevention processing.

On iOS, Apple’s App Tracking Transparency permission controls tracking across other companies’ apps and websites. It is separate from our in-app choices. Declining tracking permission prevents use of the IDFA for tracking; it does not mean that all operational data or all permitted measurement stops.

You can manage tracking and advertising identifier controls in your device settings. Advertising privacy choices do not automatically enable Singular measurement.

7. Optional campaign measurement with Singular

In our Android and iOS apps, we use Singular Labs, Inc. to understand which campaigns bring players to GOAL TCG and to measure campaign performance.

Singular measurement is optional and is off until you allow it. We ask for a separate decision in the app. You can change that decision under Settings → Privacy → Campaign measurement; wording may vary by language or app version.

When enabled, our Singular integration measures:

  • installation or first-launch attribution and subsequent app sessions;
  • verified in-app purchases;
  • subscription purchases made in the app and applicable trial or introductory-offer events;
  • ad impressions and the advertising revenue associated with them.

Data can include app and device identifiers, advertising identifiers when permitted, IP address, device model, operating system and app information, session and event timestamps, attribution information, product and transaction IDs, purchase amount and currency, and ad platform, placement, format and revenue.

Our event integration does not send Singular your email address, nickname, Firebase account ID, complete game save, payment card details, purchase receipt, purchase token or push token. Device-level identifiers can nevertheless make information personal data; the absence of your name does not make it anonymous.

On iOS, this integration also respects Apple’s tracking permission and limits advertising identifiers when tracking is not authorized. Allowing Singular measurement does not override an ATT refusal.

If you decline, the Singular integration does not initialize or send measurement events. If you withdraw consent, it stops further collection and submission by this integration and discards pending event details in our app-side queue. We do not backfill activity that occurred while measurement was disabled. Withdrawal does not automatically erase data already received by Singular; you can request deletion by contacting us.

The current Singular integration measures subscription purchases made in the app. It does not separately report background subscription renewals, cancellations or refunds to Singular. We still process subscription status with the app stores as needed to deliver and manage your subscription.

Singular processes app measurement data on our behalf. Depending on the campaign integrations we configure and the applicable privacy restrictions, measurement information may also be shared with the advertising partner responsible for a campaign. See Singular’s Privacy Policy.

8. Other analytics and campaign services

We use Google Analytics for Firebase to understand game usage and reliability, including sessions, progression, gameplay events, advertising events and purchases. This can involve app-instance identifiers and, for signed-in users, an internal game account ID.

We also use Meta App Events to measure advertising campaigns and selected game, purchase and advertising events. This can involve device information and, where permitted, an internal game account identifier. Our iOS integration limits tracking identifiers when ATT authorization has not been granted.

The Singular campaign-measurement switch controls Singular only. It is not a master switch for Firebase, Meta, advertising services or the processing needed to operate your account and purchases. Advertising privacy controls and device-level tracking permissions apply separately. You can contact us about other processing and your rights.

9. Notifications

If you allow notifications where permission is required, we may send game reminders such as available free packs, recovered players, mission resets, rewards and relevant in-game offers.

For example, a reminder may tell you that a legendary player missing from your collection is available in the player shop. Determining whether that reminder is relevant can involve comparing the shop offer with your collection.

We use local notifications and Firebase Cloud Messaging, together with the platform’s delivery services. Push tokens identify an app installation for delivery; they are not your phone number.

You can turn notifications off in device settings. Turning notifications on does not grant advertising or Singular measurement consent.

10. Purchases and subscriptions

Google Play and the Apple App Store process payments. We use their billing services and our verification backend to validate purchases, deliver items, restore eligible purchases, manage Premium benefits and handle subscription changes or refunds.

Records needed for purchase verification and entitlements are separate from optional advertising measurement. Declining Singular measurement does not prevent a purchase from being verified or delivered.

Deleting the app or your game account does not automatically cancel an app-store subscription. Manage or cancel it through Google Play or your Apple account.

11. Who receives information?

We use these categories of providers:

  • Google/Firebase: authentication, cloud storage and processing, configuration, analytics and push notifications. Firebase privacy information and Google Privacy Policy.
  • Google AdMob and UMP: ad delivery, measurement, fraud prevention and advertising privacy choices.
  • Unity/ironSource and Meta Audience Network: mediated advertising where enabled. Unity Game Player and App User Privacy Policy and Meta Privacy Policy.
  • Singular Labs, Inc.: optional campaign attribution and measurement described above.
  • Meta: app-event and campaign measurement described above.
  • Apple and Google Play: sign-in where used, distribution, purchases, subscription management and platform services. Apple Privacy Policy.
  • Hosting, communications and professional service providers: operating our services, answering support requests and meeting legal or accounting obligations.

Providers may act as processors under our instructions or as independent controllers for their own services, depending on their role. A provider’s notice supplements, rather than replaces, our responsibilities for the data we share.

We may also disclose information where required by law, to protect legal rights or prevent fraud, or in connection with a business transfer subject to applicable safeguards. Information shared with other players is described in Section 5.

12. International transfers

We are based in Poland. Providers may process information in other countries, including the United States.

For transfers requiring safeguards under European or UK data protection law, the applicable arrangements must provide a lawful transfer mechanism, such as an adequacy decision or Standard Contractual Clauses with any necessary supplementary measures. The mechanism depends on the provider, destination and service. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

13. How long we keep information

We determine retention by the purpose of the processing, whether the data is still necessary to provide the feature, deletion requests, and applicable legal or dispute-resolution obligations:

  • Account and cloud progress: for as long as needed to maintain your game account and its features, unless you request deletion or another lawful reason requires limited retention.
  • Local saves and settings: until removed through the app or device storage controls. Copies may remain in device backups managed by you or your platform.
  • Social and ranking records: while needed for the relevant feature, competition, reward verification and handling disputes or abuse.
  • Purchase and subscription records: while needed to verify entitlements, resolve refunds or disputes, prevent fraud and comply with applicable accounting and tax retention duties.
  • Analytics and advertising records: for the applicable provider-configured retention period and only as needed for measurement, security or applicable legal requirements. A rights request may result in earlier deletion where required.
  • Support and security records: until the matter is resolved and for any additional period necessary to address related claims, security incidents or legal requirements.

Backups may retain copies until their normal replacement cycle. Where data must be retained after deletion, its use is restricted to the purpose justifying retention. Genuinely anonymized statistics may be kept because they no longer identify a person.

14. Your choices, rights and deletion requests

Depending on applicable law, you may request access, correction, deletion, restriction or a portable copy of your personal data. You may object to processing based on legitimate interests and to direct marketing, including related profiling.

You can withdraw consent at any time. This does not affect processing that was lawful before withdrawal. Declining or withdrawing optional Singular measurement does not remove your progress or purchased content.

To request account deletion:

  1. Open the game’s Settings and use Delete account and data, where available in your installed version. You may need to sign in again to confirm ownership.
  2. Alternatively, contact hello@apphill.agency with the subject GOAL TCG — Data deletion request. This route is also available without access to the app.
  3. Include your support ID or nickname and the sign-in method used, if known. Do not send passwords or full payment card details.

The in-app flow removes the selected game account’s cloud save and authentication account and resets its local game profile. For other associated information, including social, ranking, analytics or provider-held records, you can request deletion through the same contact address. We handle those requests subject to any applicable legal retention exceptions and coordinate with processors where necessary.

Uninstalling the app alone does not delete cloud or provider-held records. Deleting your GOAL TCG account does not delete your Google or Apple account.

See our Data Deletion Instructions. We may ask for proportionate information to verify identity. Where the GDPR applies, we normally respond within one month; if an extension is permitted and necessary, we explain the reason within that period.

You may complain to your local data protection authority. In Poland, this is the President of the Personal Data Protection Office (UODO). Information about complaints.

15. Children and younger users

GOAL TCG is intended for users aged 13 and older and is not directed to children under 13. A store age rating is not the same as the legal age for independently consenting to data processing.

Where local law requires parental authorization for consent-based processing, that authorization is required. If you believe that we have collected a child’s data without the authorization required by law, contact us so we can investigate and take appropriate action, including deletion where required.

16. Security and automated processing

We use measures designed to protect information, including encrypted transmission, authentication and access controls. No system can guarantee complete security.

Game systems automatically calculate rankings, rewards, matchmaking and feature eligibility. Advertising and measurement providers may also process activity to evaluate campaigns or personalize ads where permitted. These ordinary game calculations are not intended to make decisions with legal or similarly significant effects on you.

17. Changes and contact

We may update this policy when the game, our providers or legal requirements change. We will update the date above and provide additional notice or request a new choice where required. Publishing an updated policy does not itself grant consent to new optional processing.

Privacy contact: hello@apphill.agency
App Growth Maksymilian Pawłowski, ul. Legnicka 50, 59-500 Złotoryja, Poland.