Privacy information

Controller and contact

The controller for Extract & Expand and this website is Ing. Josef Šebánek, sole trader, Business ID 30127351, U Elektrárny 59, 252 46 Vrané nad Vltavou, Czech Republic. Contact: extractandexpand@gmail.com. Android app: com.extractandexpand.game.

Exceptional requests, failed automated deletion and requests from players who cannot access their account are handled personally by the operator, Ing. Josef Šebánek, at extractandexpand@gmail.com. Describe your request and include your player name and account email if known. Proportionate verification of account ownership may be needed before disclosure or deletion; entering an email address alone is not proof. Do not send passwords, sign-in codes or your private deletion receipt. Exceptional cases are not handled automatically.

Account, gameplay and communication

Firebase Authentication handles sign-in. Implemented Google and email/password sign-in uses an account identifier, email and available name. The game stores a profile, progress, Pulses wallet, buildings, parcels, inventory, production, research, trades, quests and transport. Support receives the content and attachments you send.

Friends and alliances use player identifiers, names, relationships, invitations, membership, contributions and messages. Authorised alliance members can read alliance messages. Avoid putting your home address or sensitive information into public names or messages.

Location, maps and visibility

With location permission, the game uses precise coordinates, accuracy and sample time for the map and nearby activities. Selected actions send coordinates to the server. Buildings, parcels, stations and transport routes have stored geographical positions. These records can reveal areas where you play; they do not automatically constitute a continuous movement history.

World buildings and parcels include ownership links and locations. Some world information is publicly readable; other transport and alliance information is available to signed-in players or members. The public economic atlas shows regional prices and aggregates, not private inventory or individual live GPS positions. Private friend prices are excluded from public VWAP.

You can revoke Android location permission, which may limit nearby features. Background behaviour of the distributed build still needs verification; this notice does not promise that background location is never used.

Services and international transfers

Google/Firebase provides authentication, the database, server functions and web hosting. Deployed deletion functions run in us-central1 (USA); this does not establish the location of all other data. Processing may occur outside the EEA. The detailed assessment of contracting entities and international transfer safeguards for the public game release is not yet complete. You may request information about recipients and transfers of your data from the controller at the contact above. See Firebase privacy information and its processing terms.

OpenStreetMap supplies map tiles: requests identify the displayed area and expose the requesting IP address to the provider. Server-side Overpass requests retrieve geographical data for selected areas. TomTom receives route endpoint coordinates; the reviewed routing request does not include an email address or player UID. Routes are stored for reuse.

The web atlas uses OpenStreetMap and Photon/komoot city search. Submitting a search sends the entered text and exposes your IP address to the provider. The website does not request device GPS location. Hosting processes technical information needed to deliver and secure the website.

Purchases and refunds

Google Play billing is implemented in source, but is not presented in this notice as an available payment service. This section describes a version in which purchases are enabled.

Google Play processes payment. The game server validates a purchase token and records its hash, player UID association, the account identifier hash supplied to Google Play, product, order number, quantity, granted Pulses, timestamps, consumption and refund status. Hashing does not automatically anonymise data. Private records support purchase delivery, duplicate prevention and refunds. Refunded paid Pulses already spent become an in-game debt recovered from later paid purchases; advertising rewards are not removed.

Advertising, device storage and diagnostics

Live rewarded advertising is disabled in the current configuration. AdMob, UMP and server reward verification are prepared; publishing this notice does not enable them. Actual SDKs, partners, consent choices, transfers and retention must be reviewed before activation. The reward verification flow uses the player UID and an advertising session identifier.

The device stores sign-in state, settings, map cache and pending operations, which can include coordinates or session identifiers. Uninstalling does not delete the server account. The reviewed code does not establish enabled Firebase Analytics/Crashlytics, but the complete distributed build and cloud logging configuration remain unverified; this is not a promise of zero diagnostics.

Purposes and lawful bases

This website provides information about the game and a way to contact its operator. Necessary delivery and security of the website serve the legitimate interest of operating it safely. Access, correction and deletion requests, and proportionate verification of the requester, serve the controller's applicable GDPR obligations. Ordinary correspondence is processed to respond to your enquiry.

Game processing serves accounts and progress, location-based play, requested trades and social features, security and fraud prevention. Detailed assignment of lawful bases for the public game release, including precise location and visibility to other players, is still under assessment. This page does not confirm legal readiness of the public game release. Android permission, Google sign-in and an 18+ label do not themselves replace the necessary lawful basis or separate consent. Advertising is not activated.

Retention and deletion

After an authenticated deletion request is accepted, further game operations are blocked. Processing allows at least 15 minutes for earlier operations to finish; the worker runs every five minutes. We aim to complete active-account deletion within 24 hours. Failures or pending shared transactions may take longer. Your Google account is not deleted.

The process deletes the game profile, personal account data, owned buildings, parcel ownership links, personal transport and social links, and the game authentication account. Shared alliance property remains. An alliance founder must first transfer leadership. Authored personal alliance text is removed; numerical contributions remain under a random internal identifier without a reverse mapping to the account. Personal mentions written by other players may require individual review.

• New daily game-database backups have deletion scheduled at age 30 days. The storage provider performs this asynchronously. This does not cover every historical manual copy.
• In the game project, ordinary cloud logs are retained for 30 days; Google's mandatory audit-log category for 400 days. Other providers' retention is separate.
• Detailed completion evidence is eligible for cleanup 90 days after completion. Closed ordinary privacy requests expire 90 days after closure. Cleanup runs in daily batches; older backup copies may remain until their backup lifecycle completes. Open requests and documented holds remain for handling and review.
• The web status receipt is valid for at most 90 days from creation. Its server record is then eligible for daily cleanup. An export rate-limit record expires after 24 hours and is cleaned in daily batches.
• A minimal deleted-account UID marker and a separate deletion ledger remain without a fixed expiry to prevent restoration of deleted data. Purchase-token protection retains only a hashed-token key and a deleted-account marker, without the account UID, product or order. These protections are not automatically anonymous and require review of their continuing necessity.

Personal in-game purchase receipts are deleted with the account. This does not determine retention of Google's records or any separate accounting documents. Uninstalling the app does not delete server data. See account deletion and data export.

Your rights and access from age 18

Subject to applicable GDPR conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent without affecting prior lawful processing. Requests require proportionate identity verification; do not send passwords or sign-in codes. GDPR requires a response without undue delay, normally within one month; extensions need justification. You may complain to the Czech Office for Personal Data Protection or the competent supervisory authority.

The operator has changed the intended game audience to people aged 18 and over. In the prepared version, players enter a birth date before entering the game; those under 18 will not be admitted. This is self-declared information, not identity verification or age verification against a document. This gate is not yet deployed and has not been verified in a newly distributed Android build.

The birth date is sent to the server for assessment. For an admitted adult, this record does not retain the full birth date; it retains the decision, policy version, self-declaration method and assessment timestamps. For a blocked account, it also retains the date of the eighteenth birthday so immediately entering another date does not bypass the block. This date is personal data and allows the birth date to be inferred. These records belong to the account and are covered by its existing export and deletion process. Access to deletion or export requests does not require admission to gameplay.

An 18+ label does not itself replace the necessary lawful bases, consent choices or data safeguards. Advertising remains disabled.