Your information

Privacy policy

Effective 25 September 2026 · Current Twinwinch test services

Webam Games operates Twinwinch and these account pages. Contact us about privacy or data rights at play@webamgames.com.

What we process

• Google sign-in: Firebase Authentication processes your Google account identifier, email, display name and available profile image information. We do not receive your Google password.
• Cloud game data: progress, results, badges, inventory, equipped items, virtual balances, lives and timers, active missions and operation identifiers. These support saving, recovery and prevention of duplicate rewards.
• Device-local data: offline campaign, controls and audio preferences, cached cloud data and pending actions. The game may record local diagnostic session information. Manually shared feedback or backups contain the information you choose to provide.
• Service diagnostics: Google infrastructure processes technical request information, including IP addresses, times and response codes, to operate and protect authentication, hosting and the API. We do not intentionally log authentication tokens or full game saves.
• Support: when you email us, we receive your email address and the contents you send.

Why we use it

We process account and gameplay data to provide the cloud features you request; security and operational information to protect the service and investigate faults; and support correspondence to answer your request. Where applicable, these purposes rely on providing the requested service and legitimate interests in security and reliability. We will request consent where a feature requires it.

Providers and sharing

Google Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Scheduler and Firebase Hosting provide authentication, storage, processing and hosting. The game database and API are configured in europe-west1; authentication and supporting infrastructure may process data in other locations under Google's terms and safeguards. See Firebase privacy information. We do not sell your personal data.

The current test release does not enable real-money purchases, production advertising, public rankings or automatic analytics/crash reporting. These integrations will require updated disclosures and applicable privacy controls before activation. Google Play independently handles installation and store-related information under its own terms.

Retention and deletion

Cloud account data is kept while your account exists. An accepted deletion request immediately blocks further cloud operations. A background process normally removes the live account tree, game and reward receipts and Firebase identity within 15 minutes; temporary service failures are retried. Contact support if deletion appears delayed.

A completion record containing a hashed account identifier, environment and dates is retained for 30 days to prevent delayed operations from recreating a deleted account, then removed automatically. Pending requests remain until resolved. Operational logs currently have a 30-day retention period; mandatory Google Cloud audit logs have a 400-day retention period. These logs are not used to restore a deleted game account. Firestore may retain internal historical document versions for up to one hour; point-in-time recovery is disabled. Support correspondence is retained as needed to resolve your request and any applicable legal obligations; contact us to request its removal.

Independent local campaigns and copies you exported are not removed remotely. Erase the local campaign from the game's Privacy & data screen, clear Android app storage or remove exported files yourself. Cached account data on other devices can remain while they are offline; it is cleared when the app detects the account deletion online. Development and production accounts are separate; you can request deletion from both.

Your choices and rights

You can play local/practice modes without a cloud account, sign out, or request account deletion. Depending on your location, you may request access, correction, deletion, restriction or portability of your information, object to processing based on legitimate interests, and contact your data protection authority. Send requests to play@webamgames.com; we may verify identity to protect your account.

Website storage

The deletion page uses Google verification and holds the application sign-in session in memory for this page. Google sign-in may use its own cookies or storage. These pages do not add advertising or analytics trackers.

Audience and changes

Twinwinch is designed for teenagers and adults, not for children under 13. Contact us if you believe a child has provided account information. We will update this policy when data practices or enabled services change, with the effective date shown above.