Just a Squire Privacy Policy

Last updated: September 5th, 2026

Introduction

Whale Played Ltd. (“Whale Played”, “we”, “our”, “us”) respects your privacy and commits to protecting your personal data under Israel's Protection of Privacy Law (PPL) and, where applicable, other data protection laws, including the GDPR and CCPA. This Policy covers our game Just a Squire, available as a Telegram Mini App and as a mobile app for Android (and for iOS, when released), together with our related websites (the “Service”).

Whale Played Ltd. is registered in Israel, with its business address at Avital 18, Yokneam Illit, 2067018.

By using the Service, you acknowledge that your personal data will be processed as described in this Policy.

Information We Collect

When you play inside Telegram

Telegram hands the game a signed set of launch data when you open it. From it we take and store your Telegram user id, username, first name, language code, whether you have Telegram Premium, and whether you have allowed our bot to send you messages. Our server verifies this data with Telegram's signature on every launch. We do not receive your phone number, and we do not store your last name, profile photo or contacts.

When you play the mobile app or the web version

The game generates a random identifier on your device the first time it runs and uses it to recognise your account on later launches. It is not derived from your device's hardware identifiers or your Google account, and we do not receive your name, email address or any account information from your device or from Google.

Game data

Your progress and saved state: in-game currencies, energy, upgrades, class rank, chapters completed, wins and losses, badges, VIP status, purchase history, participation in time-limited events, your in-game settings, and a snapshot of a run in progress so you can resume it. Progress is stored on our servers so that it follows your account.

Technical and gameplay data

Through our analytics provider we record the type and version of your operating system and browser or app shell, screen size, device performance characteristics (such as processor cores, memory, graphics renderer and network type), the app version you are running, error and crash reports, and gameplay events (for example which chapter you played, what you rolled, tapped or bought, and how long a session lasted). We do not intentionally collect special categories of personal data (such as health data or biometric data).

Crash reporting (mobile app only)

The mobile app uses Firebase Crashlytics, a Google service, so that we learn when the app stops working. If the app crashes or freezes, it sends a report containing the technical details of the failure — the stack trace, the model of device and the version of Android or iOS it is running, the version of the app, how much memory and storage were free, whether the app was in the foreground, and the time of the crash. It also sends a random installation identifier generated by Google so that repeated crashes on one device can be recognised as the same device.

This is separate from the error reports described above, and it exists because it can see failures our own reporting cannot: our reporting is written in the game's own code, so it stops the moment the app itself stops. We use these reports only to find and fix faults. They are not used for advertising, and they are not combined with your game account.

IP address and approximate location

Our servers see your IP address when the game connects. We use it briefly, in memory only, to limit abuse, and we pass it to our analytics provider so it can estimate your city or country. We do not store IP addresses in our database.

How you found the game

When you first open the game through an invite, promotion or partner link, we record which link it was. If a friend invited you, this includes your friend's Telegram id and name, so we can credit them.

Advertising ID and install attribution (mobile app only)

The mobile app uses Adjust, a marketing-attribution service, to work out which advertisement, campaign or link an installation came from. This lets us tell whether the money we spend inviting people to the game is working, and it is the only purpose we use it for.

For this, the app may read your device's advertising identifier: the Google Advertising ID on Android, and Apple's Advertising Identifier (IDFA) on iOS if and when an iOS version is released. This identifier is provided by the operating system, it is not tied to your name, and you can reset it or switch it off at any time in your device settings, as described under Your choices below. Adjust also receives your IP address, basic device and operating-system details, the referral information Google Play provides about the installation, and an identifier Adjust generates for the installation itself.

We do not use this information to show you advertisements inside the game, we do not build advertising profiles, and we do not sell or share it with advertising networks for their own purposes. The Just a Squire Telegram Mini App and our website contain no attribution software and read no advertising identifier.

Your choices

On Android, open Settings → Privacy → Ads to delete or reset your advertising ID; deleting it stops apps receiving it. On iOS, open Settings → Privacy & Security → Tracking. You can also ask us to stop processing your attribution data, and to delete it, by writing to privacy@whaleplayed.com.

Purchases

Inside Telegram, purchases are made with Telegram Stars in Telegram's own payment sheet; Telegram is the payment processor and we never receive card, wallet or bank details. We store what you bought, the amount in Stars, an estimated value, the purchase status and time, and the payment confirmations Telegram sends us, which include your Telegram user details and Telegram's payment identifiers. In the mobile app, where in-app purchases are offered, they are processed by Google Play (and, on iOS, by Apple) under their own terms; we receive purchase confirmation data such as the product, an order identifier and a purchase token, which we use to deliver your purchase and prevent fraud.

What we do not collect

We do not collect precise location, contacts, photos, camera or microphone data. The game shows no advertising. Advertising identifiers are read only by the mobile app, only for install attribution, and only as described above; the Telegram version reads none and contains no attribution software.

How We Use Your Information

We use your information to operate, maintain and improve Just a Squire: to sign you in and save your progress across launches and devices; to deliver purchases exactly once and prevent duplicate charges; to run the game economy fairly; to analyse usage, balance the game and run controlled experiments (players are randomly assigned to test groups); to diagnose errors and performance problems; to attribute installs to invitations, promotions and advertising campaigns and credit the players who invited others; to measure whether our advertising is working; to prevent fraud and abuse; and to comply with legal obligations.

If you play inside Telegram and have allowed our bot to message you, we may send you a single reminder when your in-game energy is full. You can revoke this permission at any time in Telegram.

If you take part in a promotion run together with a partner game, we confirm to that partner, on request, whether you have completed the required chapter, and nothing more.

Legal bases: performance of a contract (providing the game and your purchases), legitimate interests (analytics, game balancing, fraud prevention, security), and compliance with legal obligations.

Sharing Your Information

We share your information with service providers and processors that help us run the Service: Heroku (Salesforce) and MongoDB Atlas (hosting and database), Cloudflare (web hosting and delivery), Mixpanel (analytics), Adjust (install attribution for the mobile app, as described above), Google (Firebase Crashlytics for crash reporting and Firebase Cloud Messaging for notifications, both in the mobile app), Telegram (the Mini App platform and Telegram Stars payments), and Google Play and Apple (app distribution and, where offered, in-app payments).

Partners with whom we run joint promotions receive only confirmation of whether you completed the promoted chapter, for a Telegram id they already hold.

We share personal data only as necessary to provide the Service, operate our business, and comply with legal obligations. We do not sell personal data (as defined under applicable law) and we do not share it for advertising.

Legal disclosures may be made to authorities where required by law or to protect our rights.

International Data Transfers

Your personal data may be transferred to and processed in countries outside your jurisdiction. Our servers and database are hosted in the European Union, our analytics provider processes data in the United States, our attribution provider (Adjust, a company established in Germany) processes data in the European Union and the United States, and Google processes crash reports and notification data in the United States and other countries in which it operates.

For EEA/UK residents, we rely on Standard Contractual Clauses or other approved mechanisms for such transfers. Israel is recognised by the European Commission as providing an adequate level of protection. We implement appropriate safeguards in accordance with applicable law.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected as described in this Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When personal data is no longer required, we take reasonable steps to delete, anonymise, or securely store it in accordance with applicable law.

Your Rights

Depending on your location and applicable law, you may have certain rights regarding your personal data. These may include the right to:

You may exercise these rights by contacting us at privacy@whaleplayed.com. We may ask for reasonable information to verify your identity before fulfilling your request.

If you believe your privacy rights have not been respected, or if you have concerns about our handling of your personal data, you may also have the right to contact or file a complaint with your local data protection authority.

Deleting your account

To delete your Just a Squire account and the data associated with it, email privacy@whaleplayed.com from within the game's settings or directly, and tell us which version you play. For the Telegram version, include your Telegram username; for the mobile app, include the approximate date you started playing and, if you can, a screenshot of your progress screen, so we can locate the account. We will delete your account, progress and analytics profile within 30 days. Records of completed purchases may be retained as described under Data Retention. Uninstalling the mobile app or clearing its data removes the data held on your device but does not by itself delete your account on our servers.

Note for U.S. Residents

For residents of California and other U.S. states with applicable privacy laws, the rights described above, including the rights to access, correct and delete personal information, and, where applicable, to opt out of certain data uses, also apply.

Please note that we do not sell or share personal information as these terms are defined under U.S. privacy legislation.

For any privacy-related questions or requests, you can contact us at privacy@whaleplayed.com.

Children’s Privacy

The Service is not intended for children under the age of 13 (or other age as required by local law).

We do not knowingly collect personal data from children. If we become aware that such data has been collected, we will take steps to delete it. If you believe that we might have received information from a child, please contact us at privacy@whaleplayed.com.

Security

We implement appropriate technical and organisational measures to protect personal data. Telegram logins are verified cryptographically on every launch; the device identifier used by the mobile app is a random secret stored in the device's secure storage; all traffic between the game and our servers is encrypted; access to our systems is limited and controlled; and our hosting and database providers apply their own security controls and audits. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Cookies & Tracking

The game does not use cookies. Our analytics provider stores identifiers in your device's or browser's local storage to recognise the same device across sessions. Analytics are integral to operating and improving the game and are active whenever you play; the game does not currently offer a separate in-game analytics opt-out. You can remove the locally stored identifiers by clearing the app's or browser's site data, or by uninstalling the app.

Telegram-specific Information

Mobile App Information

Changes

We may update this Privacy Policy from time to time.

Where required, we will provide notice (e.g., in-game or via email).

Last updated: September 5th, 2026

Contact

For questions contact: privacy@whaleplayed.com.

Israel PPA complaints: Privacy Protection Authority.

Governing law: Israel.