TommyTrace1. Who this policy applies to
This policy applies to TommyTrace users on the web and supported mobile platforms. “TommyTrace”, “we”, “us” and “our” refer to the TommyTrace service and the developer/operator identified on the applicable official app-store listing. This policy should be read together with the TommyTrace Terms & Conditions.
2. Information we collect or process
The information handled by TommyTrace depends on the features you use.
| Category | Examples | Why it is used |
|---|---|---|
| Account and authentication | Account identifier, email address, Google account name/profile information made available through Google sign-in, sign-in provider and authentication status. | Create and secure your account, restore access across devices, enforce account-only features and prevent abuse. |
| TommyTrace profile | Username, selected country/flag, avatar, cosmetic ownership, equipped items, level, XP, Coins and account settings. | Display your profile, personalize the Service and maintain progression and virtual items. |
| Gameplay and competitive activity | Scores, guesses, match results, regions/modes played, Daily Challenge progress, DUEL rating, wins/losses, streaks, multiplayer room activity and Solo recovery state. | Operate gameplay, leaderboards, matchmaking, reconnect/resume features, progression, rewards, anti-cheat and support. |
| Purchases and virtual currency | Product/pack purchased, amount, currency, transaction/session identifiers, purchase status, timestamps, failure reason and Coins credited. | Verify purchases, deliver Coins, prevent duplicate credit, handle refunds/recovery, fraud checks and payment support. |
| Advertising and rewards | Rewarded-ad events, reward nonce/status and information processed by the advertising SDK such as advertising identifiers, app interaction and diagnostics where permitted. | Show rewarded ads, verify rewards, measure ad delivery, prevent reward abuse and comply with advertising requirements. |
| Safety and moderation | Player reports, moderation notes, bans, anti-cheat flags, diagnostic events and related account identifiers. | Protect players, investigate cheating/abuse, enforce rules and maintain Service integrity. |
| Friends, chat and voice | Friend requests, friendship/block relationships, friends-only text messages, unread/read status, and temporary WebRTC signaling/network information used to establish opt-in DUEL voice. | Provide social features, deliver messages, establish voice connections, prevent abuse and support safety/moderation. TommyTrace V35 does not record DUEL voice audio. |
| Technical and network information | IP address and network metadata processed by hosting/service providers, device/browser/app information, connection state, error/diagnostic information and usage events. | Deliver the Service, troubleshoot outages, secure accounts, prevent abuse and understand service reliability. |
| Approximate country suggestion | A country code inferred from your network/IP address when the profile country suggestion feature is used. | Suggest a country flag for your profile. You can change the suggestion manually. |
3. Google sign-in and guest use
TommyTrace supports Google authentication for persistent accounts. When you choose Google sign-in, Google and our authentication provider process the sign-in flow and make basic account information available to TommyTrace as permitted by the authorization flow. Some limited gameplay may be available as a guest, but certain features, rewards, event claims, purchases, progression, multiplayer or account recovery may require an authenticated account.
4. Maps and Street View
TommyTrace uses Google Maps Platform and Google Street View to provide geography gameplay, maps, panoramas and results. Requests to Google Maps may include technical information such as your IP address, browser/app information and map interaction data as part of providing those services. The locations shown during gameplay are game locations and are not your device’s precise location.
5. Purchases and payment information
Web purchases may be processed by Stripe. Android in-app purchases, when offered through the Google Play version of TommyTrace, may be processed by Google Play Billing. Payment providers collect and process payment credentials under their own privacy practices. TommyTrace receives transaction information needed to verify the purchase and deliver the correct digital item or Coin amount, but TommyTrace does not need to store your full payment-card number or card security code.
6. Advertising
The Android version may use Google AdMob to provide rewarded advertising. AdMob and related Google services may process device identifiers (including the advertising identifier where available and permitted), app interactions, diagnostics, approximate location derived from network information, and other advertising-related data depending on your device, region, consent choices and Google’s configuration. TommyTrace uses rewarded-ad completion information to determine whether an in-game reward should be granted.
7. Service providers and sharing
We do not sell your personal information. We may disclose or make information available to service providers that process it for TommyTrace or provide functionality you request. These may include:
- Supabase for authentication, database storage, server functions and real-time multiplayer infrastructure.
- Google for Google sign-in, Google Maps/Street View, Google Play services, Google Play Billing where applicable, and AdMob advertising.
- Stripe for web payment processing and payment verification.
- Vercel and related hosting/network providers for website delivery, deployment and technical infrastructure.
- IP geolocation provider for the optional network-based country suggestion shown in your profile.
We may also disclose information where reasonably necessary to comply with law, respond to valid legal process, protect users or the Service, investigate fraud or security incidents, or enforce our Terms.
8. Public and multiplayer information
Your username, country flag, equipped avatar, score, level, ranking, DUEL rating and similar game-facing profile information may be visible to other players through leaderboards, multiplayer rooms, match screens or other social/competitive features. Do not use a username that reveals information you do not want other players to see.
Friends, chat and DUEL voice
Friend requests and text chat are account features. Text messages are stored so they can be delivered across devices and may be processed when needed for safety, abuse prevention, support or legal compliance. Chat is limited to accepted friends in V35. DUEL voice is opt-in and uses WebRTC audio. Supabase is used for connection signaling; audio is intended to travel directly between players when possible and may later use a TURN relay where needed for connectivity. TommyTrace V35 does not record or store the voice audio itself.
9. How we use information
- Provide, maintain and personalize TommyTrace.
- Authenticate accounts and synchronize progression across supported devices.
- Operate Solo, Daily Challenge, multiplayer, Ranked DUEL, leaderboards and reconnect/resume features.
- Deliver Coins, cosmetics, promotions and event rewards.
- Verify payments and rewarded advertisements and prevent duplicate or fraudulent rewards.
- Detect cheating, fraud, abuse, security incidents and technical failures.
- Respond to support, moderation and account requests.
- Measure service reliability and improve performance and game design.
- Comply with legal, accounting, tax, consumer-protection and platform obligations where applicable.
10. Storage and security
We use reasonable technical and organizational safeguards appropriate to the nature of the information handled. Authentication and core player data are stored through our backend providers, access to administrative functions is restricted, payment crediting is verified server-side, and sensitive payment secrets are kept on server-side systems rather than exposed in the game client. No online service can guarantee absolute security, so you should also protect access to your Google account and device.
11. Data retention
Account, profile, gameplay and virtual-item information may be retained while your TommyTrace account remains active and for a reasonable period afterward where needed for account recovery, fraud prevention, dispute handling, security, legal obligations or legitimate operational records. Short-lived technical records and recovery data may be retained for shorter periods. Payment and transaction records may be retained where needed for accounting, fraud prevention, refunds, chargebacks or legal compliance. When information is no longer reasonably required, it may be deleted or de-identified.
12. Account and data deletion
You can permanently delete your TommyTrace account and associated active player data from inside Player Profile or through the public TommyTrace Account Deletion page. The deletion flow verifies your account, asks for explicit confirmation, removes the TommyTrace login account and deletes or de-identifies associated player data from active systems. Limited records may be retained only where reasonably required or permitted for security, fraud prevention, payment disputes, legal compliance or another lawful reason. Information held independently by a payment, app-store or advertising provider remains subject to that provider’s own retention and deletion practices.
13. Your choices and controls
Depending on the feature and applicable law, you may be able to change your username/country selection, choose whether to sign in, control advertising choices through your device/Google settings, sign out, request access/correction of account information, or request account deletion. Some processing is necessary to provide account-based or multiplayer functionality; if you do not want that processing, you may need to stop using the relevant feature or request account deletion.
14. Children and younger users
TommyTrace should be used in accordance with the age, parental-consent and supervision requirements that apply in the user’s jurisdiction and the TommyTrace Terms. We do not intentionally use the Service to solicit unnecessary personal information from children. If you are a parent or guardian and believe a child has provided personal information in a way that should not have occurred, please use the privacy contact mechanism described below.
15. International processing
TommyTrace uses cloud and technology providers that may process information in countries other than the country where you live. Where required, applicable contractual, technical or legal safeguards may be used for such processing. Availability and applicable privacy rights can differ by location.
16. Third-party services
Google, Supabase, Stripe, AdMob, app stores, hosting providers and other third-party services have their own terms and privacy practices. This TommyTrace Privacy Policy does not replace those third-party policies. You should review the privacy information presented by those providers where relevant to your use of their services.
17. Changes to this policy
We may update this Privacy Policy when TommyTrace features, providers, laws or platform requirements change. The effective date and version shown above will be updated when material changes are published. Where required, we will provide additional notice or obtain consent.
18. Privacy contact
For privacy questions, access/correction requests or account-deletion requests, use the official TommyTrace support/privacy contact mechanism provided in the app or on the official TommyTrace app-store listing. The developer/operator identity used on the applicable official store listing is the responsible TommyTrace contact for that distribution.