Privacy policy
Last updated: 2 August 2026
Candy Bonboria is made by one person. This page says what the game collects, what it does not collect, and how to have your data deleted. It is written to be read, not to be long.
Playing without an account
The game can be played without creating an account. In that case your progress is stored on your device only and is sent nowhere. Clearing the site data, or uninstalling the app, erases it for good.
If you create an account
An account lets you find your progress elsewhere and appear in the ranking. The following is then stored:
- your email address and password, handled by Firebase Authentication (Google). The password is encrypted and never readable;
- your username (3 to 16 characters);
- the avatar you pick from the set in the game;
- your save: levels finished, stars, best scores, gems, lives, boosters, tickets and settings;
- the date of your last save.
What the game does not collect
No name, no address, no phone number. No location. No access to the camera or the microphone. No advertising identifier.
Your age is not kept. It is asked at sign-up to check that you are at least 13, and then it is not stored.
There is no advertising, no third-party tracker and no analytics tool such as Google Analytics.
What is public
If you appear in the ranking, four things are visible to everyone: your username, your avatar, your number of stars and the level you reached. Nothing else — your email never appears there.
So pick a username you are happy to make public. You can ask to change it, or to be removed from the ranking, at the address below.
Game statistics
The game measures what players get stuck on — win rate per level, buttons used, errors encountered — so that it can be improved.
These measurements are aggregated counters: “level 214 has been lost 1,380 times”. They contain no identifier, no per-player timestamp, and no way to link two actions together. It is therefore impossible to reconstruct anyone’s path from them — including for me.
Where the data goes
The game relies on Firebase (Google) for authentication, the database and hosting. Google acts as a technical processor; no data is sold, rented or passed to a third party for commercial purposes.
A session token is kept on your device to keep you signed in. It is not an advertising cookie: it does only that, and it disappears when you sign out.
Your rights
You can ask to see, correct or delete your data, as well as to delete your account entirely. Write to:
Please state the username you use in the game — that is what makes it possible to find the right record. Deletion is permanent and means losing the progress saved online.
Children
The game is intended for people aged 13 and over. No data is knowingly collected from a younger child. If you are responsible for a child who has created an account, write to me: I will delete the account and its data.
Purchases
The in-game shop is processed by Paddle, our merchant of record. Your payment details (card, billing address) are entered with Paddle and never pass through the game — see Paddle’s privacy policy. The game only records the delivery: the item bought and its quantity, tied to your account, kept as a receipt. Details and refunds: terms of sale.
Changes
Any change to this page will be dated at the top. Significant changes will be announced in the game.