Ploomies Privacy Policy
Last updated: 8 October 2026
This policy explains what personal data we process when you play Ploomies: the Android app (com.SixtyFourGames.Ploomies), the PC version on Steam and the game's websites (ploomies.com and ploapi.64train.com). It also explains what we use it for, who we share it with, where it is stored and how you can exercise your rights.
The Spanish version of this policy prevails in case of discrepancy.
1. Data controller
- Controller: 64 SOFTWARE TRAIN S.L.
- Tax ID (NIF): B56899636
- Registered office: Avda. Sor Teresa Prat, 15, Oficina 9, Polo Nacional de Contenidos Digitales, 29003 Málaga (Spain)
- Privacy contact email: support@64train.com
- Company website: 64train.com
You can send any privacy question to the email above or by post to our registered office.
2. What data we process and where it comes from
| Category | Data | Source |
|---|---|---|
| Account identity | On Android, your Google Play Games player ID. On PC, your SteamID. If you sign in on the website with Google, your Google Play Games player ID (we do not ask for your email). The public player name you choose and your play region. If you once linked an email and password (legacy option), those too. | Google Play Games, Steam and you. |
| Account linking | The link between your Android account and your Steam account when you link them on the website. | You, when you link them. |
| Game data | Progress, in-game coins, points, league, matches played and their results, unlocked and equipped items and characters, Season Pass, redeemed codes and in-game notifications we send you. | Generated as you play. |
| Technical and security data | IP address, browser (when you use the website), session tokens, and records of account linking, unlinking, merging and deletion. | Your device, when it connects to our servers. |
| Purchases | Whether you bought "Remove ads". Payment is handled by Google Play: we never receive your card or payment details. | Google Play. |
| Advertising (Android app only) | Device advertising ID, device and network data, IP address (from which an approximate location can be inferred), ad interactions, and your consent choices. Collected directly by the advertising providers listed in section 5. | Your device, through the advertising SDKs. |
| Voice (PC version only) | If you turn on voice chat in a PC match, your voice is streamed in real time to the other players in that match. We do not record or store it. The Android app has no voice chat and does not use the microphone. | Your microphone, only if you turn it on. |
We do not use our own or third-party analytics or crash-reporting tools (Unity Analytics and Unity Cloud Diagnostics are disabled). The advertising SDKs may collect diagnostic and crash data about their own components. We do not process your precise location, contacts, photos or other content on your device.
Online matches on Android. Match traffic goes through our relay server (relay.64train.com). That server only forwards match messages between players (positions, actions and the player name shown on screen) and does not store them. This connection is not encrypted: do not send through it anything you would not want other players to see. It never carries passwords, session tokens or payment data.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and maintaining your account, saving your progress, matchmaking, showing rankings and leagues, and giving you in-game rewards. | Performance of the contract (the Terms of Use), Art. 6(1)(b). |
| Linking your Android and Steam accounts, and merging them when you ask. | Performance of the contract, Art. 6(1)(b). |
| Recognising and restoring your "Remove ads" purchase. | Performance of the contract, Art. 6(1)(b). |
| Security, preventing cheating, account theft and abuse, rate limiting and audit logs. | Legitimate interest in protecting the service and players, Art. 6(1)(f). |
| Showing personalised ads in the Android app. | Your consent, Art. 6(1)(a). We ask for it with Google's consent form when you open the app in the EEA, UK and Switzerland. |
| Showing non-personalised ads, measuring their delivery and preventing ad fraud. | Legitimate interest in funding the free version (Art. 6(1)(f)), or your consent where the law requires it to access the device. |
| Complying with legal obligations and requests from authorities. | Legal obligation, Art. 6(1)(c). |
We do not make automated decisions that have legal effects on you. You can ask for a human to review any sanction for cheating or abuse (for example, an account suspension).
4. How long we keep it
- Account and game data: for as long as you have the account.
- When you delete your account, deletion is immediate:
- we delete your player name, your email and password if you had them, your inventory, coins, progress, Season Pass, notifications and sessions;
- we unlink your Google Play Games and Steam identifiers and erase the IP addresses stored in your account records;
- we keep your match history anonymised, with nothing that identifies you, so that other players' results stay consistent.
- Security record after deletion: for 180 days we keep a record of the Steam or Google identifier that was unlinked and the date, without any IP address, to investigate account theft or abuse. It is then deleted automatically.
- Server technical logs: 14 days; after that they are deleted automatically.
- Advertising data: kept by each provider under its own policy.
5. Who we share data with
-
Hosting: our servers run on Oracle Cloud Infrastructure (OCI), by Oracle, acting as our processor. See section 6.
-
Platforms:
- Google (Google Play Games for sign-in and Google Play for the "Remove ads" purchase);
- Valve (Steam), for signing in on PC and for linking your Steam account.
These platforms verify your identity and purchases and process that data under their own privacy policies.
-
Advertising (Android app, free version): we use AppLovin MAX (AppLovin Corp.) and Unity Ads (Unity Technologies). Through AppLovin MAX, ads may also be served by Meta Audience Network (Meta Platforms), Pangle (ByteDance), Mintegral and Liftoff / Vungle. These providers collect the data listed in section 2 directly, including the advertising ID and the approximate location inferred from your IP address, and may act as independent controllers. The full list of partners and their policies is shown in the app's consent form. Main policies:
-
Other players: they see your player name, your character, your results and your ranking position.
-
Authorities: when required by law.
We do not sell your personal data.
6. Where data is stored and international transfers
Our servers run on Oracle Cloud Infrastructure in two regions: Madrid (Spain) and Mexico. Depending on where you connect from, your traffic and game data are processed in one region or the other.
Mexico is outside the European Economic Area and does not have an adequacy decision from the European Commission. Therefore, when your data is processed in the Mexico region, the transfer relies on the standard contractual clauses approved by the European Commission, included in our data processing agreement with Oracle (Art. 46(2)(c) GDPR).
Some advertising providers are also located outside the EEA (for example, in the United States or Asia). Those transfers rely on adequacy decisions (such as the EU-US Data Privacy Framework, for certified companies) or on standard contractual clauses.
You can ask us for more information or a copy of these safeguards at the email in section 1.
7. Advertising and consent
- When you open the app in the EEA, UK or Switzerland you will see Google's consent form (IAB TCF certified). You can accept, reject or choose what your data is used for.
- If you reject, you will see non-personalised ads.
- To change your choice at any time: Settings › General › Privacy options in the game.
- Advertising ID: you can also reset or delete it in Android settings (Settings › Privacy › Ads).
- "Remove ads": this purchase removes the ads shown between matches. Optional ads to earn coins remain available if you want to watch them.
8. Children
- Ploomies is not directed at children under 13 and we do not knowingly collect data from children under that age. If you are a parent or guardian and believe your child has given us data, contact us and we will delete it.
- If you are under the age of digital consent in your country (14 in Spain; up to 16 in other EEA countries), you need your parent's or guardian's permission to accept personalised ads.
9. Your rights
You can at any time exercise your rights of access, rectification, erasure, restriction of processing, portability and objection, and withdraw your consent without affecting anything we did before based on it.
- Delete your account:
- in the game: Settings › General › Delete my account;
- on the web, without having the game installed: ploapi.64train.com/delete-account;
- or by emailing us at the address in section 1 with your player name and the platform you play on.
- Other rights: email us at the address in section 1 or write to our registered office, stating which right you want to exercise. We will reply within one month.
- Complaints: if you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of your country.
10. Security
- Communications with our API and websites are encrypted (HTTPS/TLS).
- Match traffic through the relay is not encrypted, but it only contains game data, never credentials or payment data.
- Access to the servers is restricted, and sessions use tokens that are revoked when you delete your account.
11. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will also let you know in the game.