Privacy Policy
This policy explains what personal data the game Cameo: Guess the Gems ("Cameo", "the game") uses, why, who else receives it, how long it is kept and what your rights are. We have tried to keep the game simple: you can play without giving us your name or email address, and we only keep what the game needs to work.
1. Who is responsible for your data
The data controller is:
- Oldani Informatica di Oldani Davide, trading as Lomeni Games
- Address: Via Lomeni 13, 20013 Magenta (MI), Italy
- Email for privacy matters: lomenigames@gmail.com
We have not appointed a Data Protection Officer, as the law does not require one for a service of this size. Write to the address above for anything about your data.
2. What data we use
Your game account (everyone)
The first time the game connects to our server, it creates an account for you automatically. You do not have to sign up. The account is identified by:
- an install ID: a random code made up by the game on your phone. It is not your phone's hardware ID or advertising ID;
- a Player ID: the random code of your account on our server. You can see it under Settings → Account.
Even though we do not know who you are, these codes are linked to your activity in the game, so we treat them as personal data.
Your game activity
- daily challenge results: attempts, guesses, time taken, win or loss;
- your streak, points, achievements and collected frames;
- friends you add, and challenges you create, accept and play, with their results.
Your profile, if you sign in
Friends, challenges and leaderboards need you to sign in with Google and choose a nickname. In that case we also keep:
- the nickname you choose. It must not contain your real name, phone number or other contact details. Names made only of digits or containing long runs of digits are refused;
- the picture and frame you choose from the game's own set. You cannot upload photos;
- your Google account ID, a number Google uses for your account, so you can get your progress back on a new phone. Our server deletes the name, email address and profile photo that Google passes along at sign-in as soon as it receives them. We do not keep or show them.
Signing in is optional. Guests can play the whole game apart from the online features above.
Technical data
When the game talks to our server, the server necessarily sees your IP address and the time of the request. It also writes technical logs (errors, warnings) that may contain your Player ID and IP address. These are used only to keep the service running and safe.
Notifications, if you allow them
If you are signed in and allow notifications, the game sends our server the notification token of this install (a random ID made by Firebase Cloud Messaging) and the game's language. We use it only to tell you that a friend challenged you or sent you a friend request. The text shows the other player's nickname. You can turn notifications off at any time under Settings → Notifications or in your phone's settings. The token is then removed from our server.
Data stored only on your phone
The game saves on your phone the install ID, a copy of your profile, your settings (sound, language, game options), your achievements and the pictures you share. This stays on your phone and is removed when you uninstall the game.
Advertising and statistics
The game shows ads through Google AdMob, measures how it is used with Google Analytics for Firebase and reports crashes with Firebase Crashlytics. What these services collect is described in section 5 and section 6.
We do not collect your real name, email address, phone number, date of birth, precise location, contacts, photos, or messages. The game has no chat.
3. Why we use the data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running your account, saving your progress, daily challenge, streaks, collection | Install ID, Player ID, game activity | Performance of the service you asked for (Art. 6(1)(b)) |
| Leaderboards, friends and challenges | Nickname, picture, frame, results | Performance of the service you asked for (Art. 6(1)(b)) |
| Notifications about challenges and friend requests | Notification token, language | Your consent (Art. 6(1)(a)): the system permission and the switch in the settings |
| Getting your progress back on another phone | Google account ID | Performance of the service you asked for (Art. 6(1)(b)) |
| Keeping the service secure and working, preventing cheating and abuse, fixing errors | IP address, logs, game activity | Our legitimate interest in a safe and fair game (Art. 6(1)(f)) |
| Showing ads that pay for the free game (non-personalised) | See section 5 | Our legitimate interest in funding the game (Art. 6(1)(f)). Where storing or reading information on your device is involved, your consent |
| Personalised ads | See section 5 | Your consent (Art. 6(1)(a)), asked in the consent form |
| Usage statistics | See section 6 | Your consent (Art. 6(1)(a)) where the GDPR applies |
| Crash reports, to find and fix errors | See section 6, "Crash reports" | Our legitimate interest in a game that works (Art. 6(1)(f)) |
| Answering privacy requests and meeting legal obligations | What you send us | Legal obligation (Art. 6(1)(c)) |
We do not sell your data. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. What other players can see
If you sign in and choose a nickname, other players can see:
- your nickname, picture and frame;
- your position, number of attempts and time on the daily leaderboards;
- the challenges you open to everyone, and the results of challenges you play with someone.
Other players can add you as a friend by typing your exact nickname. They never see your Google account, your Player ID or your IP address. Guests appear on no leaderboard.
5. Ads and your consent
The game is free and shows ads through Google AdMob: a full-screen ad every few games, and an optional video you may choose to watch for an extra attempt in some modes. To show ads, Google receives information such as your device's advertising ID, IP address, device type and settings, and how you interact with the ads.
In the European Economic Area, the UK and Switzerland, the game shows Google's consent form (Google's User Messaging Platform) before any ad is requested. There you choose whether Google and its ad partners may use your data for personalised ads and the other listed purposes. If you do not consent, you can still play the whole game. Ads may then be limited or non-personalised. You can change your choice at any time under Settings → Privacy options.
No ads purchase. You can remove the full-screen ads with a one-time in-app purchase. Google Play handles the payment and keeps the purchase on your Google Play account: we never see your payment details, and we store nothing about the purchase on our server. The game only asks Google Play whether this Play account owns it, and remembers the answer on your phone. If you have bought it, the game still asks for your consent as described above, because the optional extra-attempt offer and the usage statistics depend on it.
Ads are limited to content suitable for teenagers (Google's "T" rating). You can also reset or delete your advertising ID in your phone's settings (Settings → Google → Ads, or Settings → Privacy → Ads, depending on the phone).
For personalised ads, Google acts as an independent controller. See how Google uses information from apps that use its services and Google's Privacy Policy.
6. Usage statistics and crash reports
We use Google Analytics for Firebase to understand how the game is played, for example which modes are popular and where new players get stuck, so we can improve it. It records events such as screens opened, games started and finished (mode, result, number of attempts, time), tutorial completed, sign-in, sharing, challenges, and ads shown or watched. With them, Firebase collects an app-instance ID, the device model, operating system and language, and an approximate location derived from the IP address.
- Where the GDPR applies, Firebase stays off until you give consent in the consent form. It only starts if you agree to storing/accessing information on your device and to measurement. You can withdraw your consent under Settings → Privacy options.
- We do not send Firebase your Player ID, nickname or Google account. We have also turned off the collection of the advertising ID by Firebase and its use for advertising.
- Statistics are kept by Google for 2 months.
Crash reports
If the game crashes or hits an internal error, it sends a report to Firebase Crashlytics (Google) so we can find and fix the problem. A report contains the technical details of the error (where in the game's code it happened), the device model, operating system version, free memory and disk space, whether the phone was rotated or in the background, the screens opened just before, and an anonymous installation ID created by Crashlytics.
- Reports contain no Player ID, nickname, Google account or advertising ID.
- Crash reporting does not depend on the consent form: it is needed to keep the game working (see section 3).
- Crash reports are kept by Google for 90 days.
7. Who receives the data
- Our game server runs on rented servers from Aruba S.p.A. in Italy. The provider acts as our processor. It only provides the machine and does not use the data for its own purposes. The server software (Nakama, by Heroic Labs) is installed on that machine by us: no data is sent to Heroic Labs.
- Google (Google Ireland Limited and its affiliates):
- Google Sign-In, only if you choose it;
- AdMob for ads (section 5);
- Firebase Analytics, only with consent (section 6);
- Firebase Cloud Messaging, to deliver notifications, only if you allow them;
- Google Play for downloads, the in-app review card and the "no ads" purchase.
- Other players see what is listed in section 4.
- Authorities, only if the law requires it.
8. Transfers outside Europe
Our game server is in Italy. Google may process data in the United States and other countries. For transfers to the US, Google relies on its certification under the EU-U.S. Data Privacy Framework, which the European Commission recognises as adequate. For other countries it relies on the European Commission's Standard Contractual Clauses (Art. 45 and 46 GDPR). You can ask us for more details.
9. How long we keep it
| Data | How long |
|---|---|
| Account, progress, nickname, picture, friends, challenges, leaderboard entries, Google account ID | Until you delete your account (or your Google link, by signing out and deleting) |
| Challenges with a player who later deleted their account | Kept for the other player's history, with the deleted player shown only as "deleted player" |
| Notification token | Until you turn notifications off, sign out or delete your account. Tokens Google reports as no longer valid are removed |
| Server logs | Rotated automatically: normally gone within about 2 weeks |
| Database backups | At most 30 days, then deleted |
| Emails with privacy requests | Until the request is completed, then deleted |
| Data on your phone | Until you uninstall the game, sign out, or delete your account |
| Ads and statistics data held by Google | According to Google's policies and, for statistics, the period in section 6 |
| Crash reports (Firebase Crashlytics) | 90 days |
10. Deleting your account
You can delete your account and all the data linked to it at any time, whether you are signed in or playing as a guest:
- In the game: Settings → Account → Delete account, then confirm. Deletion is immediate.
- Without the game: follow the instructions at lomeni.com/privacy/cameo-delete-account.html.
Deletion removes your account, progress, nickname, picture, friends, the challenges nobody accepted yet, your leaderboard entries and your Google link. In challenges someone else already played with you, your name and ID are replaced by "deleted player". Copies in backups disappear when those backups expire, within 30 days.
Uninstalling the game does not delete your account on our server. Deleting your account in Cameo does not delete your Google account, and it does not cancel the "no ads" purchase: that stays on your Google Play account and comes back by itself (or with Settings → Restore purchases), even on a new phone.
11. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy;
- correct it. You can change your nickname and picture yourself in the game;
- delete it (section 10);
- restrict or object to its use, in particular to uses based on our legitimate interest;
- data portability: receive the data you gave us in a common machine-readable format;
- withdraw your consent at any time under Settings → Privacy options, without affecting what was done before.
To exercise them, write to lomenigames@gmail.com. Include your Player ID (Settings → Account → Copy Player ID), so we can find your account without asking for anything else. We answer within one month. This can be extended by two more months for complex requests, in which case we tell you.
You can also complain to a data protection authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it). You can also go to the authority of the EU country where you live or work.
12. Young players
Cameo is meant for players aged 13 and over. It is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 is using the game, write to us and we will delete the account.
In some countries, players under a certain age need a parent's or guardian's permission to agree to optional uses of their data, such as personalised ads and statistics. The age is 14 in Italy and between 13 and 16 elsewhere in the EU. If that applies to you, ask a parent before agreeing in the consent form, or simply choose not to consent: the game works the same.
To protect younger players, the game has no chat or free messaging. Nicknames are checked against offensive words and cannot be phone numbers. No contact details are ever shown to other players, and ads are limited to teen-suitable content.
13. Security
We protect your data with measures suited to the risk:
- all traffic between the game and our server is encrypted (HTTPS);
- the database and the administration console are not reachable from the internet, and administrator access needs a personal key;
- sessions expire after two hours;
- the game cannot change its saved data directly: every change goes through checks on the server;
- backups are kept on an encrypted disk.
No system is perfectly secure. If a breach puts your data at risk, we will act as the GDPR requires, including telling the authority and, where needed, you.
14. Changes and contact
If the game or the services it uses change, we will update this policy and the date at the top. Important changes will also be announced in the game or on the Google Play page.
Lomeni Games · lomenigames@gmail.com · lomeni.com