Privacy Policy

Last updated: 7 November 2026

This policy explains what data the LotusOrb game uses, why, who it is shared with and what your rights are. It applies to every version of the game (Google Play, App Store, Steam, Windows).

1. Who is responsible

The game is published by Marcin Nykiel, the controller of personal data within the meaning of the GDPR ("we", "us"). Contact: LotusOrbApp@gmail.com.

2. In short

Without an account, the game keeps your data on your device and we do not see it. The campaign and the tower need no account; it is needed for the editor, online play, players' levels, rankings and cloud saves (section 7). The game has no advertising, no analytics and no tracking, and we do not sell your data or share it for advertising. It connects to the internet to check the time, to download the music you ask for, for online play, and for the features of an account.

3. Data stored on your device

Your nickname and avatar, your progress (levels, stars, times, lotuses, deaths), gems, skins, avatars won, Daily Quests and chests, the maps you build in the editor with their names, the songs you download with their Newgrounds IDs, and your settings (sound, language). A technical log of errors is written on the device by the Unity engine.

Without an account, none of this is sent to us and we have no access to it. With an account, the part named in section 7 is also kept on our server. What is on the device stays there until you uninstall the game.

4. Connections and third-party services

Time check (Google): to stop chests being opened early by changing the device clock, the game asks www.google.com for the current time. Only the time is read from the answer; nothing about you is sent with the question apart from the IP address every connection reveals.

Music (Newgrounds): the game downloads no songs from Newgrounds. When you type a song ID, the game opens that song's page on www.newgrounds.com in your browser; there you listen to it and, where its author allows it, download it yourself. You then choose the downloaded file and the game keeps a copy of it on your device. It checks the file only on the device, by its name and its fingerprint (SHA-256), which a map stores together with the song ID. When the file does not name its author, the game reads only the author's name from the song's public page on www.newgrounds.com (your device asks for that page as a browser would, giving only the song's ID).

Online play (Epic Online Services, run by Epic Games, Inc.): to play in online rooms, the game signs in to Epic's service with an anonymous identifier made for this device; no Epic account is asked for. Epic carries the connection, directly or through its relay, so Epic and the other players in the room may receive your IP address, and they see your nickname. Playing on a local network involves only the devices on that network.

Links: the YouTube icon and the Newgrounds pages open in your browser.

The website (lotusorb.app): it is hosted by Cloudflare, Inc., which delivers it and protects it from attacks, and so processes your IP address and the technical details of your browser's requests on our behalf. The site uses no cookies for tracking, no analytics and no advertising.

E-mails to us: when you write to us, your message and your e-mail address are kept in our mailbox, run by Google (Gmail), for as long as needed to deal with the matter and, where needed, to defend against claims.

The game engine (Unity Technologies): the engine may send Unity anonymous technical data about the device (such as its model and system) under Unity's own privacy policy.

The stores (Google Play, Apple App Store, Steam): downloads, updates and payments go through the store, under its own terms and privacy policy; we do not receive your payment details.

Every connection reveals your device's IP address to the server it reaches. Google, Newgrounds, YouTube, Unity, Epic Games and the stores are independent controllers of the data they receive and act under their own privacy policies.

5. What we do not collect

Without an account: no password and no e-mail address. With or without one: no location, no contacts, no microphone or camera, no advertising identifiers, no crash reports sent anywhere. The only device identifier is the anonymous one used for online play (section 4). We do not ask for your real name; do not put it in your nickname.

6. Purposes and legal bases

Running the game you asked for, saving your progress and maps, and downloading the music you choose – performance of the contract (Art. 6(1)(b) GDPR). Protecting the game's rewards from cheating with the time check – our legitimate interest (Art. 6(1)(f) GDPR). Handling your messages and requests, and keeping records of moderation decisions, bans and reports to establish, exercise or defend legal claims – our legitimate interest (Art. 6(1)(f) GDPR).

7. Your online account

An account is optional: the campaign and the tower can be played without one, while the editor, online play, players' levels and rankings need one. An e-mail address and a password are needed only to create it. With an account we keep your e-mail address, your password (only in a protected, hashed form), your nickname, your saved game and results, the levels you publish with their titles, the IDs and names of the Newgrounds music used in them with the fingerprint (SHA-256 hash) of the song file, which only checks that other players use the same file and from which the music cannot be recreated – the server never receives or keeps the audio files themselves – and the recording of your run through them, the levels you beat with your ratings, likes and gems, the reports you send and the authors you block, and the moderators' decisions about your levels and account. If you use friends, we also keep your friends list, the friend requests and room invitations you send and receive, and when you were last online; your friends see whether you are online and which room you are in. Other players see your nickname, results and published levels, how many levels you created, your ranking points and gem totals, your campaign stars, tower floors and lotuses, and your avatar with its frame. The server's records also hold your IP address for security. Your progress belongs to your account: signing out saves it there and resets it on the device, and it comes back when you sign in.

Purposes and legal bases: the account, rankings, cloud saves and publishing (performance of the contract, Art. 6(1)(b)); moderating what players publish, handling reports and protecting the game and its players from abuse (our legitimate interest in a safe game, Art. 6(1)(f), and legal obligations, Art. 6(1)(c)). Titles and nicknames are checked automatically for forbidden words, and a level reported by 10 players within 7 days is hidden until a moderator has looked at it (see section 6 of the Terms). Nothing else about you is decided automatically: a ban is always a person's decision. You can delete your account with all of this in the game: Profile > My account > Delete account.

8. How long we keep data

Data on your device: until you uninstall the game. Online data: for as long as your account exists. Deleting your account removes it, with its levels, results, saved game and reports, at once; copies in service providers' backups and logs go as those providers delete them, normally within 30 days. What the law requires us to keep longer (for example records of reports of illegal content) is kept for as long as it requires. An account no one has signed in to for 24 months may be deleted with its data, after a warning sent by e-mail at least 30 days before. E-mails you send us: as section 4 says.

9. Recipients and transfers

We pass your data only to service providers working on our instructions: Supabase Inc. (the server, database and accounts, in its EU region in Ireland) Brevo (Sendinblue SAS, which sends the account e-mails and so receives your e-mail address), Cloudflare, Inc. (the website) and Google (our e-mail). Where a provider or its subcontractors process data outside the European Economic Area, it is protected with the safeguards the GDPR requires, such as the EU standard contractual clauses; you can ask us for a copy. Other players see what section 7 says. We disclose data to authorities only where the law requires it. If someone else takes over the game, your data passes to them with it, under this policy; we will tell you before that happens.

Their privacy policies: Supabase – supabase.com/privacy; Brevo – www.brevo.com/legal/privacypolicy; Cloudflare – cloudflare.com/privacypolicy; Google – policies.google.com/privacy; Epic Games – epicgames.com/site/privacypolicy; Unity – unity.com/legal/privacy-policy; Newgrounds – newgrounds.com/wiki/help-information/privacy-policy.

10. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16), to have it deleted (Art. 17), to restrict its processing (Art. 18), to take it with you (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You may withdraw a consent at any time. You may also complain to a data protection authority – in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) – or to the authority of the country you live in.

11. How to use your rights in the game

Settings → Your data shows everything the game keeps on the device; there you can change your avatar and save a copy of your data to a file. Uninstalling the game deletes everything it keeps on the device. An online account is deleted, with its data on the server, in the game: Profile > My account > Delete account. A copy of everything your account holds on the server is saved to a file in the same place (Account data, while you are signed in). For anything else, write to us at LotusOrbApp@gmail.com; we answer within one month.

12. Children

The game is for players of all ages and needs no personal data to be played. Do not put your real name or contact details in your nickname or in your levels. An online account, and giving an e-mail address, are only for people aged 13 or over; you confirm this when you create an account. Younger players can play the campaign and the tower without an account. A parent who believes their child gave us personal data can write to us and we will delete it.

13. Security

Data on the device is protected by the device's system. The game's connections to our server use encrypted HTTPS, and passwords are kept only in hashed form. No system is perfectly safe: use a password you do not use anywhere else. If a breach of security put your data at risk, we would report it to the supervisory authority within 72 hours and, where it is likely to put your rights at high risk, tell you without undue delay.

14. Changes

When this policy changes, the date above changes and the game asks you to accept the new version before you play on.

15. Contact

Questions about privacy and requests about your data: LotusOrbApp@gmail.com.