Privacy policy

This policy explains which personal data The Bugs Land processes, for what purpose, for how long and how you can exercise your rights. We only collect what's needed for you to play.

1. Data controller

The controller of your data is the owner of The Bugs Land. Their contact details will be published on this page.

2. Data we process

Account data: player name, e-mail address, chosen clan, language, and the date and version of the terms you accepted when creating the account. We don't ask for your date of birth, real name, address or phone number.

Credentials: your password, which we store only as an encrypted digest (salted hash); we never know it in plain text.

Game data: your collection of characters, eggs and fusions and the date you got them; your level, experience, trophies, league, missions and gear; and the history of your BUUL coin balance (each movement with its reason), which keeps your balance always correct.

Fight data: the result of each fight and the actions you took in it (hits, timings, damage). We use them only to validate rewards, detect cheating and resolve issues; the detailed actions of each fight are deleted after 90 days and we keep only the result and the points.

Technical data: session identifiers and, in server logs, IP address and browser type, which are needed to keep the service secure.

Account security: an encrypted digest of the browser, system and network you sign in from, to warn you when you sign in from a new device.

Security alerts: when you sign in from a new device we use the IP address of that sign-in and an approximate location (country, region and city), which we obtain by sending only that IP to the ipquery.io geolocation service, solely to include them in the alert e-mail we send you. The location is not stored.

3. Data visible to other players

In the public rankings (league, Hive Tournament and Clan War) other players can see your player name, level, clan, league and points. We never show your e-mail.

That's why your player name shouldn't include your real name or other personal data. Names go through a filter of inappropriate words.

There's no chat or messaging between players, so nobody can write to you through the game.

4. What we use it for

To create and protect your account, keep you signed in, show your wallet, let you play and fuse characters, send you service emails (for example, the password recovery link), prevent cheating and abuse, and improve the game.

We don't sell your data, we don't show third-party ads and we don't use your data for personalized advertising or to build behavioral profiles.

5. Legal basis

We process your data to perform the contract you accept when creating your account (the Terms), based on our legitimate interest in keeping the service secure and, where needed, with your consent, which you can withdraw at any time.

6. Password recovery

When you ask to recover your password we send you a 6-digit code that expires in 10 minutes, allows 5 attempts and works only once. We only store an encrypted digest of the code. Changing your password signs you out of your other sessions and we let you know by e-mail.

7. Storage on your device

We keep your session identifier, your preferred language and your game options in your browser's local storage. If you install the website as an app, the game files are also cached so it loads faster and works offline.

We don't use analytics cookies or third-party analytics (no Google Analytics or similar).

Our own anonymous statistics: to know whether the game runs smoothly and is easy to start, your browser sends us some usage data with no account or name: the screens opened, the first steps in the game, how long a session lasts, whether a fight is abandoned and smoothness in ranges (frames per second). They carry a random identifier that only exists while the tab is open: it is not stored on your device or linked to your account. They are deleted after 14 days and only totals remain. You can turn them off in the game, under Options › Family › “Share anonymous statistics”, and they are not sent if your browser asks not to be tracked (Do Not Track or Global Privacy Control).

Error reports: if a screen fails, your browser sends us a technical report with the error message, the part of the code where it happened, the page (without parameters), the app version and the browser type. It never includes your e-mail, your player name or your session keys, and it is deleted after 14 days.

8. Sign in with Google

If you choose “Continue with Google”, we receive from Google (Firebase Authentication) your Google identifier, your verified e-mail and your name to create your account or sign in to the account that already has that e-mail. We never receive your Google password.

9. Who we share data with

Only with providers that help us run the service: hosting, e-mail delivery (Resend) and Google Firebase (only for Google sign-in). They act on our instructions with the safeguards required by law, or when a competent authority requires it.

10. How long we keep it

For as long as your account is active. If you delete it, we'll erase or anonymize your data, except what we must keep by law. Sessions expire after 30 days and recovery codes after 10 minutes.

The detailed actions of each fight are kept for 90 days; anonymous statistics and error reports, 14 days; the server's technical logs, the minimum time needed to keep the service secure.

11. Security

We apply technical and organizational measures: encrypted passwords, single-use links, sign-in attempt limits and encrypted connections (HTTPS).

12. Minors

We don't ask for a date of birth: accepting the terms is enough to create an account. If you're a minor, you need the authorization of your mother, father, guardian or another responsible adult.

We don't knowingly collect more data than needed to play: no real name, address, phone number, photos or precise location. There's no chat, no third-party ads, no behavioral advertising and no third-party analytics: only our own anonymous statistics, which can be turned off.

A mother, father or guardian can at any time ask to see, correct or delete the data of a minor in their care through the contact channel published on this page. If we detect a minor's data without authorization, we will delete it.

13. Your rights

You can request access to, correction, deletion or restriction of your data, object to its processing, and ask for its portability. You can also file a complaint with your country's data protection authority.

To exercise them, or to delete your account, write to us from your account's e-mail, including your player name, through the contact channel that will be published on this page. Deleting the account removes your collection, balances and fight history.

14. Changes to this policy

We'll publish any change on this page with its date and let you know if it's significant.