Privacy Policy

Last updated: 20 October 2026

This policy explains what Sunburnt Santa (the game, the app and sunburntsanta.com) collects, why, who helps us handle it, how long we keep it and what you can do about it. It is written to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth), and, for players in the UK and European Economic Area, the GDPR.

1. Who we are

Sunburnt Santa is made by Benjamin Cooney, trading as [trading name, e.g. Vibe DM], ABN [ABN], Yungaburra QLD, Australia ("we", "us"). Questions about privacy: [privacy email, or the support email].

2. The short version

• You can play every game as a guest without giving us your name or email.
• If you sign in, we keep your email, your public @handle, your scores and how you play, to run your account and the leaderboards.
• We use a random id for each install of the app and keep some device ids only in scrambled (hashed) form, to stop cheating and count real new players.
• The app shows ads from Google AdMob (not on the web, and not if you buy Remove Ads). Ads are non-personalised unless you agree to personalised ads where you are asked.
• We never sell your details. We only email you news if you tick the box. You can delete your account in the app at any time.

3. What we collect

When you sign in (Apple, Google or an email code)

• Your email address, and your name and profile picture if Apple or Google pass them to us.
• Your public @handle, which appears on the leaderboards. Leaderboards never show your email or real name.
• Optional details you choose to add: your TikTok and Instagram handles and your postcode.
• Whether you agreed to the data notice and whether you ticked "Keep me posted", and when.

When you play (guests and signed-in players)

• Scores and the taps and swipes of each scored round, so our server can replay the round and check the score is real.
• How you use the game: rounds started and finished, how each round ended (for example what you bumped into), retries, quits, how long you play, which levels and screens you open, settings you switch, where you share (for example "WhatsApp"), whether an ad showed, and notification opens.
• Your device and app: model, operating system and version, app version, screen size, language, region setting and time zone, and how the game runs on it (load times, frame rate and error reports).
• A random id created for this install of the app. For guests it is not linked to any name or email.
• Your best scores and settings, which are stored on your device.

Anti-cheat and fair recruiting

• Your phone's app-vendor id (iPhone) or Android id, stored only as a one-way hash and linked to your account. We use it to check that each Elf Recruiters recruit is a new player on their own device.
• Device integrity results from Apple App Attest or Google Play Integrity, which tell us whether a score came from the official, unmodified app.

Invites (elf codes)

• Your elf code, whose elf code or invite link you joined with, which players joined with yours, and whether they count as Verified Recruits under the Competition Rules.

Notifications

• A push notification token, only if you turn on the daily heads-up. You can turn it off on the Me tab or in your phone's settings.

Purchases

• If you buy Remove Ads: the store (Apple or Google), the product, transaction id, time and country, so the purchase works on all your devices and can be checked with the store. We never see your card or bank details; Apple and Google handle payment.

Problem reports

• If you send a report from the app: your description, the category, an optional reply email, and diagnostics (app version, platform, device model, install id, your account id if signed in, and the screen you came from).

Competition winners only

• If you win a prize under the Competition Rules, we ask for your full name, country, proof of age and payment details so we can verify and pay you.

What we don't collect: your contacts, your precise location, your photos (the share card is saved to your photos, never read from them) or, on iPhone, your advertising id (IDFA). We don't track you across other companies' apps or websites.

4. Why we use it

• To run the game and your account, save your scores and show the leaderboards (Top Santas, Elf Recruiters and Today's Door).
• To check scores and recruits are genuine and stop cheating.
• To run the competition in the Competition Rules, including contacting and paying winners.
• To send the daily heads-up if you turned it on, and emails about your rank, new levels and occasional news only if you ticked "Keep me posted".
• To answer problem reports and support emails.
• To see which levels people enjoy, where they get stuck and where players are, so we can make the game better.
• To show ads and process the Remove Ads purchase.
• To meet our legal obligations (for example tax records).

5. Ads (Google AdMob)

The iPhone and Android apps show a banner on the calendar and a full-screen ad after some rounds, never during play. The web game shows no ads, and buying Remove Ads (A$3.99, one-off) turns them off for good.

Ads are served by Google AdMob, which collects information to serve and measure ads, such as a device advertising id (Android), your IP address and approximate location derived from it, and how you interact with ads. Ads are non-personalised unless you agree to personalised ads in Google's consent form, which is shown to players in the UK and EEA (and you can change your choice any time from "Ad privacy choices" on the Me tab there). On iPhone we do not ask to track you and ads stay non-personalised. We ask AdMob for family-friendly (PG) ads and block categories such as alcohol and gambling.

See Google's policy at policies.google.com/technologies/partner-sites. More in our Ads & data notice.

6. Who helps us (service providers)

We share information only with providers who handle it for us, under their own privacy and security terms:

• Supabase (database, sign-in and server functions). Our project is hosted in Supabase's Singapore region, so your account and game data are stored outside Australia.
• Cloudflare (hosts sunburntsanta.com and the web game; sees your IP address when you visit).
• Apple and Google (sign-in with Apple or Google, the app stores, purchases, App Attest and Play Integrity).
• Expo (delivers push notifications to Apple's and Google's push services).
• Google AdMob (ads, see section 5).
• [Email provider, e.g. Resend] (sends sign-in codes and, if you opted in, emails).

Some of these providers store or process data in countries outside Australia, including Singapore and the United States. We take reasonable steps to make sure they protect it consistently with the Australian Privacy Principles.

We may also disclose information if the law requires it, or to protect players from fraud or cheating. We never sell personal information, and we never give it to anyone for their own marketing.

7. How long we keep it

• Account details, scores and recruit records: while your account exists. When you delete your account they are deleted, except as below.
• Hashed device ids: kept after an account is deleted (with no link to the deleted account) so the same device can't be counted as a new recruit twice.
• Usage events and diagnostics: [retention period, e.g. 24 months], then deleted or made anonymous.
• Problem reports: [retention period, e.g. 24 months], or deleted with your account.
• Purchase records and competition winner details: as long as tax and consumer law require (generally 5 to 7 years).
• Backups are overwritten on a rolling schedule set by our database provider.

8. Children

Sunburnt Santa is a family-friendly game for a general audience. To sign in you must be 13 or older. Players under 13 can play as guests, which needs no name or email. If you believe a child under 13 has given us personal information, contact us and we will delete it. Prizes can only be claimed by players 18 or older, or with a parent or guardian's written consent (see the Competition Rules).

9. Your choices and rights

• See or correct your details: the Me tab shows your handle, email and optional details, and you can edit them there. Ask us for a copy of anything else we hold.
• Delete your account and its data any time: Me tab → Delete my account. You can also ask by email. See Delete your account.
• Stop emails: untick "Keep me posted" (Me tab → Edit) or use the unsubscribe link in any email.
• Stop notifications: turn off the daily heads-up on the Me tab or in your phone's settings.
• Ads: buy Remove Ads, or change your consent choice where offered.
• In the UK and EEA you also have the rights to restrict or object to processing, to data portability, and to complain to your local data protection authority. Our legal bases are: running the service you asked for (contract), our legitimate interests (anti-cheat, improving the game), your consent (marketing emails, personalised ads, notifications) and legal obligations.

We reply to requests within 30 days. We may need to confirm it's you first.

10. Security

Data travels encrypted (HTTPS). Database access is locked down so players can only read and change their own details, scores are written only by our server after checking them, and device ids are hashed. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.

11. Complaints

Contact us first at [privacy email, or the support email] and we will try to fix it within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

12. Changes

If we change this policy we will update the date at the top, and tell you in the app if the change is significant.