GDPR Information

1. Introduction

Egg Clash is committed to protecting your privacy and helping you understand how we process personal data in line with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). This notice supplements our Privacy Policy.

2. Data controller

The data controller for personal data processed in connection with Egg Clash is the operator of the Service. Contact: admin@eggclash.fun (subject: “GDPR inquiry”).

3. Categories of personal data

3.1 Account data

• Email address and authentication identifiers
• Password hash (if you use email/password)
• Display name / username
• Account creation and login timestamps

3.2 Game and profile data

• Game sessions, scores, rankings, and statistics
• Egg designs, colors, patterns, and optional drawings
• Lobby and invitation metadata

3.3 Usage and technical data

• Browser and device information
• IP address (security, abuse prevention, approximate location)
• Pages or features used

3.4 Donations

If you make a voluntary donation, payment processors may process billing and transaction data. We do not store full card numbers on our servers.

4. Purposes and legal bases

We process personal data for the following purposes and on these legal bases:

• Providing the Service (Art. 6(1)(b) GDPR — contract): accounts, gameplay, leaderboards, customization
• Security and fraud prevention (Art. 6(1)(f) GDPR — legitimate interests): protecting users and infrastructure
• Analytics (Art. 6(1)(a) or (f) GDPR — consent or legitimate interests, where applicable): understanding how the Service is used
• Compliance (Art. 6(1)(c) GDPR — legal obligation): tax, accounting, or lawful requests

5. Recipients and subprocessors

We use service providers that process data on our instructions, including:

• Supabase — database and authentication (appropriate safeguards for data hosting)
• Google — OAuth sign-in when you choose that option
• Google Analytics — where enabled, subject to your choices and our cookie notice
• PayPal — processing optional donations

6. Transfers outside the EEA

Data may be processed outside the EEA. Where we transfer personal data to countries not covered by an adequacy decision, we use appropriate safeguards such as Standard Contractual Clauses or equivalent measures.

7. Retention

We retain data only as long as necessary for the purposes described above. If you delete your account, we delete or anonymize personal data unless a longer retention period is required by law.

8. Your rights

Subject to applicable law, you may have the right to:

• Access your personal data
• Rectify inaccurate data
• Erasure (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent where processing is consent-based
• Lodge a complaint with a supervisory authority

To exercise your rights, contact us at admin@eggclash.fun. We typically respond within one month; extensions may apply for complex requests.

9. Cookies and similar technologies

We use cookies and similar technologies for session and security (essential cookies), and may use analytics cookies where permitted. You can manage preferences through your browser and any consent banner we provide.

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have, please contact us.

11. Supervisory authority

You have the right to lodge a complaint with your local data protection authority. EU authorities are listed here: https://edpb.europa.eu/about-edpb/board/members_en

12. Changes

We may update this GDPR information notice. Material changes will be reflected on this page and the “Last updated” date.

13. Contact

Email: admin@eggclash.fun
Subject: GDPR inquiry