Privacy Policy — Italy Champion

DRAFT — requires legal review. This text is not yet in force; the items in double square brackets must be completed before publication.

Last updated: 1 October 2026

This Privacy Policy explains how personal data is processed when you play Italy Champion (the "Game"), a free, advertising-supported geography guessing game available on the website www.mapchampion.com and as an Android app distributed through Google Play.

It is written to meet the information requirements of Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and of the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).

An Italian version of this policy is available. In case of any discrepancy, the Italian version prevails.

1. Data controller

The data controller is:

[[CONTROLLER_LEGAL_NAME]]
[[ADDRESS]]
Email: [email protected]

In this policy, "we", "us" and "our" mean the data controller.

We have not appointed a Data Protection Officer, as we are not required to.

2. EU representative (Article 27 GDPR)

The controller is established outside the European Union. In accordance with Article 27 GDPR, it has designated the following representative in the Union, whom you and supervisory authorities may contact on any matter relating to the processing of your personal data:

[[EU_REPRESENTATIVE_NAME]]
[[EU_REPRESENTATIVE_ADDRESS]]
Email: [[EU_REPRESENTATIVE_EMAIL]]

3. What the Game does, in short

The Game shows the name of a place; you tap the map where you think it is, and your guess is scored by its distance from the real place. You can play alone or in an optional 1v1 mode against another player.

There are no accounts. You never give us an email address, a password, a phone number or a social login. The Game creates an anonymous player record automatically on first launch.

4. What data we process

On your device

The website keeps the following in your browser's local storage; the app keeps the equivalent in its own storage on the device:

• a session token that lets our servers recognise your anonymous player record;
• your display name, if you choose one;
• your preferences (sound, the usage-statistics setting) and your personal best score;
• a random analytics identifier, created only if you consent to usage analytics.

On our servers

• a random player ID, an optional display name, the creation date, a daily count of games and 1v1 matches started, and your 1v1 record (matches played, won and lost);
• a one-way hash of your session token (never the token itself);
• game records: the places asked, where you tapped on the map, the distance error, the score and the timing of each step;
• leaderboard entries: display name, score, level reached, number of correct answers and date;
• 1v1 match records: both players' display names, their map taps, distance errors, scores and the result;
• short-lived technical records used to pair players and keep a 1v1 connection open.

Technical data

When your device talks to our servers, your IP address and basic request data (such as the time of the request and the browser or app version) are necessarily processed by our hosting infrastructure in order to deliver the response and protect the service from abuse. We do not store IP addresses in player, game or leaderboard records. Technical logs are kept for no longer than [[LOG_RETENTION_PERIOD]].

What we do NOT collect

The map coordinates we store are where you tapped on the game map, not your real location. Neither the website nor the app requests, receives or stores your device's location. We do not access your camera, microphone, contacts, photos or files, and the app does not send notifications.

Data processed by Google

Advertising and (if you consent) analytics are provided by Google, which may process cookies, device and advertising identifiers, IP address and interaction data as described in sections 8 and 9 and in Google's own privacy policy.

5. Purposes and legal bases

• Providing the Game — creating your anonymous session, running games and 1v1 matches, scoring guesses, keeping your progress and record. Data: session token and hash, player record, game and match records. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).
• The public leaderboard and 1v1 opponent display — showing your display name, score and result to other players. Data: display name, scores. Legal basis: performance of the service (Art. 6(1)(b)). Choosing a display name is optional; without one you appear as anonymous.
• Security, fraud and abuse prevention — daily game limits, protecting the servers, detecting cheating and invalid ad traffic. Data: player record, technical data. Legal basis: our legitimate interest in keeping the service secure and affordable to run (Art. 6(1)(f)).
• Advertising — showing ads, measuring them, frequency capping and fraud prevention; personalised advertising only where you have agreed. Data: cookies or the device advertising identifier, IP address, interaction data. Legal basis: your consent, collected through the consent message described in section 10 (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). Where the consent message presents a purpose on the basis of legitimate interest (Art. 6(1)(f)), you can object to it in that same message.
• Usage analytics — understanding how the Game is used so we can improve it (Google Analytics 4). Data: analytics identifier, usage events, device information. Legal basis: your consent (Art. 6(1)(a)).
• Answering your messages — feedback and problem reports you send us by email. Data: your email address, the message and the diagnostic details it contains (including your player ID). Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or taking steps you request (Art. 6(1)(b)).
• Legal obligations and defence of rights — complying with the law and orders of authorities, establishing or defending legal claims. Legal basis: Art. 6(1)(c) and Art. 6(1)(f).

Storing the session token and your preferences on your device is strictly necessary to provide the Game you asked for and does not require consent (Art. 122(1) of the Italian Privacy Code).

Providing data is not a legal or contractual requirement. Without the session token the Game cannot work; everything else (display name, analytics, personalised ads) is optional.

We do not carry out automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR). The 1v1 opponent is simply whoever else is waiting at the same moment.

6. The leaderboard and your display name

If you choose a display name it is public: it appears on the leaderboard and is shown to your 1v1 opponent. You do not need to use your real name, and we recommend that you do not.

Leaderboard entries contain your display name, score, level reached, number of correct answers and date. They form the permanent record of the board and do not expire automatically (see section 11). You can ask us to delete any entry (see section 12).

7. 1v1 matches

The 1v1 mode is optional. During and after a match your opponent can see your display name (if you set one), where you tapped on the map, your distance error, your score and the result. There is no chat: apart from the display name, players cannot send each other any text. 1v1 matches are not written to the leaderboard.

8. Advertising

The Game is free and funded by advertising. It may show banners, full-screen ads between levels and an optional rewarded video that gives you an extra life.

• Website: Google AdSense (including H5 Games Ads), provided by Google Ireland Limited. Google and its advertising partners may use cookies and similar technologies.
• Android app: Google AdMob, provided by Google Ireland Limited, which uses the device's advertising identifier instead of cookies. You can reset or delete the advertising identifier in your device settings at any time.

For advertising, Google acts as an independent controller of the data it collects. See how Google uses data from sites and apps that use its services: policies.google.com/technologies/partner-sites and Google's privacy policy: policies.google.com/privacy

Depending on the choices you make in the consent message, ads may be personalised, non-personalised or limited, or may not be shown. The Game remains fully playable whatever you choose.

9. Analytics

We use Google Analytics 4 only if you consent. Google acts as our processor for this service. You can also turn usage statistics off at any time with the separate setting in the Game's menu; that setting can only withdraw analytics, never grant what you refused in the consent message.

10. Cookies, consent and how to change your mind

On your first visit from the European Economic Area, the United Kingdom or Switzerland, the Game shows a consent message managed by Google's consent management platform — Google's Privacy & messaging on the website, Google's User Messaging Platform in the app — which is certified under the IAB Transparency & Consent Framework. It lists the purposes and the advertising partners concerned, and lets you accept, reject or choose purpose by purpose. Rejecting is as easy as accepting.

No advertising or analytics cookies or identifiers are used before you make a choice, except where strictly necessary.

You can change or withdraw your consent at any time from the Game's menu: Menu → Privacy settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Your choices are stored on your device (as a consent string read by Google and its partners). If you clear your browser data or reinstall the app, you will be asked again.

11. How long we keep data

• Session token and player record: deleted automatically 60 days after the last game you started. Each new game extends them by 60 days.
• Game and step records and 1v1 match records: deleted automatically 60 days after they are created.
• 1v1 pairing and connection records: deleted within hours.
• Leaderboard entries: kept indefinitely as the permanent record of the board, unless you ask us to delete them. Our legitimate interest in a stable, complete leaderboard is the reason; you can object at any time.
• Emails you send us: kept as long as needed to handle your request and any follow-up, then deleted.
• Data on your device: stays until you clear your browser data or uninstall the app.
• Data collected by Google: retained according to Google's own policies and your Google settings.

Because the player record expires, a player who returns after more than 60 days receives a new anonymous record, while their earlier leaderboard entries remain.

12. Your rights

Under Articles 15 to 22 GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate data rectified;
• have your data erased, including leaderboard entries;
• restrict processing;
• data portability for data you provided to us under contract or consent;
• object at any time to processing based on our legitimate interest;
• withdraw your consent at any time, as described in section 10.

To exercise a right, write to [email protected] (or to our EU representative, section 2). Because there are no accounts, we can only find your data from your player ID: the simplest way is to send your request with Menu → Report a problem, which adds your player ID automatically. We may ask for information needed to confirm the request is yours. We will answer within one month, extendable by two further months for complex requests, as allowed by Art. 12(3) GDPR.

You also have the right to lodge a complaint with the supervisory authority — in Italy, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it — or with the authority of the EU country where you live or work, or where the alleged infringement took place.

13. Recipients and processors

Personal data is shared only with:

• Amazon Web Services (Amazon Web Services EMEA SARL and Amazon Web Services, Inc.), our hosting, server and database provider, acting as processor under a data processing agreement;
• Google (Google Ireland Limited and Google LLC): as processor for Google Analytics, and as independent controller for AdSense and AdMob advertising, together with the advertising partners listed in the consent message;
• other players, who see your display name and scores on the leaderboard and in 1v1 matches;
• Google Play, which processes data under its own terms when you install the app;
• public authorities, where required by law.

We do not sell personal data, we send no marketing emails, and we do not use your display name for anything other than showing it in the Game.

14. Transfers outside the European Economic Area

Our servers and database are located in the United States (AWS region us-east-1). Google may also process data in the United States and other countries.

Transfers to the United States rely on the EU–US Data Privacy Framework, under which Amazon Web Services and Google are certified (European Commission adequacy decision of 10 July 2023), and, as a fallback, on the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR) included in the providers' data processing terms. You can request a copy of the relevant safeguards by writing to us.

The controller is itself established in Israel, a country for which the European Commission has adopted an adequacy decision (Decision 2011/61/EU, confirmed in January 2024), so data made available to the controller there needs no further safeguards.

15. Security

We take appropriate technical and organisational measures to protect personal data. Connections are encrypted (HTTPS). The session token is stored on our servers only as a one-way hash. Data scheduled for deletion is removed automatically at the end of its retention period. No method of transmission or storage is completely secure.

16. Children

The Game is not directed at children under 14. Under Italian law (Art. 2-quinquies of the Privacy Code), consent to information society services may be given by a minor only from the age of 14; below that age, consent must be given by a parent or guardian.

If you are under 14, please use the Game only with the involvement of a parent or guardian and do not set a display name that identifies you. We do not knowingly collect personal data from children under 14 on the basis of their own consent. If you believe a child has given us personal data, contact us and we will delete it.

17. Changes to this policy

We may update this policy, for example when the Game or the law changes. The date at the top shows the latest version. If a change materially affects how we process your data, we will inform you within the Game before it takes effect and, where required, ask for your consent again.

18. Contact

[[CONTROLLER_LEGAL_NAME]]
[[ADDRESS]]
[email protected]
www.mapchampion.com