Privacy Policy

Last updated: 7 November 2026

This privacy policy covers the game Superkrass in the browser, the later apps on the App Store and Google Play, and the website superkrass.com. It is written under the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR and the UK Data Protection Act 2018.

1. Controller

Hypez LTD
Office TW, Greengate Business Centre
Greengate Street
Oldham OL4 1FN
United Kingdom
Director: Ismail Ramadan
Email: hallo@superkrass.com

We have not appointed a data protection officer, as we are not required to. For privacy questions, please write to the email address above.

2. EU representative

As we are established outside the EU, we are appointing a representative in the EU under Art. 27 GDPR. Until that appointment is complete, please contact us directly at the email address above. We answer requests from the EU the same way as all others.

3. Guest account and game progress

When you open the game for the first time, our server creates a guest account automatically. You do not have to give an email address or a name.

We process:

a randomly generated key (token) that is stored on your device and links your device to the guest account,
a short player ID (for example "ABCD-1234") shown in the profile menu,
your game state, such as SuperCoins, Blitze, boss cards, boosters, trophies, league rank, purchases and progress.

The purpose is to provide the game and save your progress. The legal basis is Art. 6(1)(b) GDPR (contract for the use of the game).

If you clear your browser data or lose the device, the token is gone. Without sign-in, we can then usually no longer link the guest account to a device.

4. Storage on your device

The token is stored in the local storage of your browser or the app. This is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG). We do not use cookies or similar technologies for advertising.

5. Gameplay events for balancing and bug fixing

The game sends events from your matches to our own server, for example the boss you picked, round results, boosters used or match length. These events are linked to your player ID but contain no name and no email address.

We use them to balance the game, find bugs and detect cheating. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a fair and stable game. The data is not passed to third parties for advertising.

6. Server logs

When you use the game or the website, our servers process technically necessary data such as IP address, time, requested address, browser type and error messages. This keeps the service secure and helps fend off attacks. The legal basis is Art. 6(1)(f) GDPR.

7. Purchases with real money

In the browser, purchases of Blitze are handled by RevenueCat Web Billing, with payment processing by Stripe. You enter your payment details (such as card number) directly with these providers. We do not receive them. We receive information about the purchase such as product, price, time, transaction ID and payment status, and where given, the email address you enter at checkout.

In the apps, purchases run through the Apple App Store or Google Play. Their own privacy notices also apply there.

Our server uses this information to credit the purchase to your player account. The legal basis is Art. 6(1)(b) GDPR. For keeping transaction records, Art. 6(1)(c) GDPR applies together with statutory retention duties.

8. Player name and sign-in with Google or Apple

You can give yourself a player name in the game. We store it with your account. Other players see it in online duels. We refuse names containing insults and may reset them.

You can save your account with Google or Apple to keep playing on several devices. The provider then gives us a fixed user identifier and, if you allow it, your email address. With Apple you can hide your email address. We never receive your password. We use this only to recognise your account.

The legal basis is Art. 6(1)(b) GDPR. If you delete your account, we delete the name and the link as well. The sign-in itself is also covered by Google's or Apple's privacy notices.

Data from your Google account. When you sign in with Google, we only request the "openid" and "email" scopes. This gives us your Google user ID and your email address and nothing else: no contacts, no files, no calendar, no access to other Google services. We use the user ID only to recognise your game account, and the email address only to help you with support requests about your account. We do not share this data with third parties, do not sell it and do not use it for advertising or to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove the link at any time in your Google account under "Third-party apps with account access", or delete your Superkrass account in the game under Profile → Support → Delete account.

Profile picture. You can choose a photo as your profile picture. The app crops it to a small square on your device before it is sent. If you are signed in with Google or Apple, we store the picture with your account so it comes back on another device. Only you see it; other players see your boss picture. If you remove the picture or delete your account, we delete it. The legal basis is Art. 6(1)(b) GDPR.

9. TikTok LIVE

Creators can connect their TikTok LIVE to Superkrass. Gifts and likes from viewers then affect the running duel. To do this, we process publicly visible event data from the LIVE, in particular the viewer's username, the gift type and the count. We receive this data through the connector service Euler Stream (eulerstream.com).

Towards the creator, the legal basis is Art. 6(1)(b) GDPR. Towards viewers, it is Art. 6(1)(f) GDPR. Our legitimate interest is to provide the in-game interaction the creator asked for. We process these events only in the server's memory while the match is running and do not store them afterwards.

Superkrass is not affiliated with TikTok. TikTok's own privacy policy applies to processing by TikTok.

10. Creator characters

If a creator wants their own playable character, we process the photos they send, their name or creator name and their contact details. From these, we produce concept art, a 3D model and animations. The legal basis is Art. 6(1)(b) GDPR, based on the individual creator agreement. To pay out revenue shares, we also process payment and invoicing details.

11. Support

When you write to us, we process your message, your email address and whatever you send along, such as your player ID or a receipt. The legal basis is Art. 6(1)(b) or (f) GDPR.

12. Website analytics

We do not use third-party analytics tools or tracking cookies on the website or in the game. We store game events, such as the boss picked or the round result, on our own server with your player ID to improve the game and balance the bosses. The legal basis is Art. 6(1)(f) GDPR.

13. Advertising in the apps

The website and the browser game show no ads. In the iOS and Android apps you can choose to watch short ad videos to get rewards in the game, for example SuperCoins. Nothing plays by itself; a video only starts when you tap the offer.

The videos come from Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). For this, Google processes your device's advertising ID, your IP address (from which it derives an approximate location), device information and how you interact with the ads. When you start the app in the EU, the UK or Switzerland, you are asked whether Google may show personalised ads. On iPhone, Apple also asks whether the app may track you; if you decline, the advertising ID is not shared. Without consent, Google shows only non-personalised ads. You can change your choice at any time in the settings of your device.

The legal basis for personalised ads is your consent (Art. 6(1)(a) GDPR). For non-personalised ads, it is our legitimate interest in financing a free game (Art. 6(1)(f) GDPR). If you told us at the start that you are under 16, we mark the ad requests accordingly and Google does not show personalised ads. More information: policies.google.com/technologies/partner-sites

We do not sell personal data and do not build advertising profiles ourselves.

14. Hosting and service providers

We use service providers who process data on our behalf (Art. 28 GDPR):

Railway (hosting of game server and website), data centre in the EU (Netherlands),
Supabase (PostgreSQL database), data centre in Ireland (Dublin),
RevenueCat (checkout in the browser) and Stripe (payment processing),
Euler Stream (TikTok LIVE events),
Cloudflare (DNS for the superkrass.com domain),
Google and Apple (only if you use sign-in with Google or Apple),
Google AdMob (ad videos in the apps, see section 13; Google acts as an independent controller for its own purposes).

15. Transfers to third countries

We are based in the United Kingdom, for which the European Commission has issued an adequacy decision. Some service providers are based in the USA. Where data is transferred there or can be accessed from there, we rely on the EU-US Data Privacy Framework if the provider is certified, or on the European Commission's standard contractual clauses.

16. Retention

Guest account and game state: as long as the account is used. We delete guest accounts that have not been used for 24 months and are not linked to a Google or Apple account.
Gameplay events: 12 months, then deleted or anonymised.
Server logs: 30 days.
Purchase records: for the statutory retention period, 6 years under UK law.
Support requests: until resolved, then at most 12 months.

17. Children and teenagers

Superkrass has no age check. Minors may use the game. For the guest account we deliberately collect no names or contact details. Minors may only make purchases with real money with the consent of a parent or guardian. Parents and guardians can contact us at any time to request access or deletion.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).

So we can find your guest account, please tell us your player ID from the profile menu.

We do not use automated decision-making within the meaning of Art. 22 GDPR.

19. Right to complain

You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live. In the United Kingdom, the competent authority is the Information Commissioner's Office (ICO), ico.org.uk.

20. Changes

We update this policy when the game or the law changes, for example when we add new features. The version published here applies.