Privacy Policy
Last updated: 8 October 2026
Big Balls is a free-to-play duel game where players bet virtual “balls” against each other. Balls have no cash value and can never be exchanged for money. Balls can optionally be bought with real money, in the apps and on the website. This policy explains what personal data Big Balls collects, why, who it is shared with, and the choices and rights you have. It applies to the website bigballs.app and to the Big Balls apps for iPhone and Android. See also our Terms of Use.
1. Who is responsible for your data
Big Balls is operated by Valentin Lefebvre, an individual developer based in France, who is the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
Contact for any privacy question or request: dev@bigballs.app
2. Who can use Big Balls
Big Balls is intended for adults only. You must be 18 or older to create an account or play. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, contact us and we will delete it.
3. What data we collect
Account data — when you sign up: your email address, the player name (username) you choose, and your password. Sign-in is handled by our authentication provider, Clerk: your password is stored by Clerk in hashed form and is never visible to us. We also receive the unique account identifier Clerk assigns to you.
Gameplay data — your balls balance, wins, losses, ties and biggest win; the duels you play (who you played, the bets placed, the outcome and the times); the difficulty chosen when playing The House; and whether you tapped the optional “play for real money?” interest button.
Activity status — the time you were last active in the game, used to show other players whether you are online, and whether you are currently waiting in a duel (so a duel only starts when both players are present).
Notification data — if you allow notifications in the Big Balls app, a device notification identifier (a “push token”) created by Firebase Cloud Messaging and the type of device (Android or iPhone), so we can send notifications to your phone. We also store your notification choices (push on/off, email on/off) and a short record of the notification emails we send you (which player it was about, and when), used to avoid emailing you too often.
Purchase data — if you buy Balls: the pack you bought, the transaction identifier, where you bought it (Google Play, the App Store, or the website), the price and currency, the date, any bonus credited, and any refund. In the apps, payment is handled entirely by Google or Apple. On the website, payment is handled by Stripe, through our billing provider RevenueCat: the secure checkout page asks for your payment details and, where needed, your billing country or address (used for tax and fraud prevention), and we pre-fill the email address of your account so that your receipt reaches you. We never see or store your card or bank details. Your purchases are linked to your account through RevenueCat.
Technical data — like any online service, our hosting and infrastructure providers process your IP address, device and browser type, and request logs, which are used to deliver the service and keep it secure.
Data stored only on your device — if you play as a guest, your guest name, balance and score are kept only in your browser or app storage on your device, together with a few settings (for example “don’t ask me to confirm bets again” and challenges you chose to answer later). This data is not sent to us.
We do not collect your location, contacts, photos, or payment details (card or bank). Balls bought in the apps or on the website are for play only: they can never be withdrawn or exchanged for money.
4. What other players can see
Your player name, online status, biggest win and ranking are visible to other players (the World Rankings are also visible to visitors who are not signed in). In a duel, your bet is revealed to your opponent once both players have bet. Your email address is never shown to other players.
5. Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, running duels, balances and rankings | Performance of our contract with you (providing the game) |
| Sending you notifications (on your phone, or by email if you don’t use the app) when a player challenges you, accepts your challenge, or is waiting for you in a duel | Performance of contract / our legitimate interest in letting you respond to challenges |
| Selling Balls in the apps and on the website: crediting purchased Balls to your account, handling refunds, preventing payment fraud, and keeping purchase records | Performance of our contract with you; our legitimate interest in preventing fraud; legal obligation (accounting records) |
| Keeping the game fair and secure: preventing cheating, abuse, fraud and attacks, and applying the fair play limits (daily loss limit in live duels, limit on duels with the same player) | Our legitimate interest in a fair and secure game |
| Operating the game: the operator receives an internal alert with a player’s name when that player becomes active, to monitor activity and respond to challenges | Our legitimate interest in operating the service |
| Complying with the law and responding to lawful requests | Legal obligation |
We do not sell your data, show advertising, or use third-party advertising or analytics trackers.
6. Who we share data with
We use a small number of service providers (“processors”) that handle data on our behalf, only to run Big Balls:
| Provider | What for |
|---|---|
| Clerk | Sign-up, sign-in and account security (email, password hash, account identifier, sign-in device and IP data) |
| Supabase | Game database and real-time duels (hosted in the European Union, Ireland) |
| Netlify | Hosting of the website bigballs.app |
| Resend | Sending duel notification emails |
| Google Firebase Cloud Messaging | Delivering push notifications to the Android and iPhone apps (push token and the notification’s text) |
| Discord | Internal activity alerts sent to the operator (player name only) |
| Google Fonts | Serving the fonts used by the game (your device requests them from Google, which receives your IP address) |
| Apple App Store / Google Play | Distribution of the mobile apps, and processing of in-app payments, under their own privacy policies |
| RevenueCat | Managing purchases across Google Play, the App Store and our website checkout (account identifier, email address, purchase and transaction data) |
| Stripe | Processing card and other payments for purchases made on the website (payment details, billing country or address, email address, transaction data). Stripe acts on our behalf for the payment, and independently for its own fraud-prevention and legal obligations, under its own privacy policy |
Some of these providers are based in, or process data in, the United States. Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. We may also disclose data if required by law.
7. How long we keep your data
- Your account and gameplay data are kept for as long as your account exists.
- A device’s push token is deleted when you sign out on that device, when you delete your account, or automatically as soon as it stops working (for example after uninstalling the app).
- When you delete your account, your profile, player name, balance, statistics, duel history and interest signal are deleted from our database immediately, and your sign-in account is deleted from Clerk.
- Copies may remain for a limited time in our providers’ backups and security logs (generally up to 30 days) before being overwritten.
- Purchase records are kept for as long as required by accounting and tax law (up to 10 years in France). If you delete your account, your purchase records are kept without your player name or email.
- Guest data stays on your device until you clear the app’s or browser’s data, or uninstall the app.
8. Your rights
Under the GDPR you have the right to access your data, correct it, have it deleted, restrict or object to its use, and receive it in a portable format. To exercise any of these rights, email dev@bigballs.app from the address linked to your account; we answer within one month.
You can delete your account at any time directly in the game — see how to delete your account. You can change your email or password from Profile → Manage account.
You can switch push notifications and email notifications on or off at any time in Profile → Notifications, through your phone’s settings, or with the unsubscribe link at the bottom of every email.
If you believe your data is not handled properly, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority in your country.
9. Security
Connections to Big Balls are encrypted (HTTPS). Access to game data is restricted so that each player can only change their own data, and passwords are handled exclusively by our authentication provider. No system is perfectly secure, but we take reasonable measures to protect your data.
10. Changes to this policy
We may update this policy as the game evolves. The date at the top shows the latest version; for significant changes we will inform players in the game or by email.
Questions or feedback to dev@bigballs.app.