Privacy Policy — DON'T OPEN

Last updated: 26 July 2026
Applies to: the mobile game DON'T OPEN (Android package one.vzl.dont_open) and its backend service.

This policy explains what personal data the game collects, why, who it is shared with, and what rights you have. If you do not agree with it, please do not use the game.

1. Who is responsible

The game and its backend are operated by the individual developer who publishes DON'T OPEN on Google Play (the "developer", "we"). The developer is the data controller for the data described below.

Contact for any privacy question or request: gaming@vzl.one

2. What we collect

Data	When	Why
Google account data — your Google account identifier, email address, display name and profile picture URL	Only if you choose to sign in with Google. The game also offers a guest mode that does not require an account.	To identify your account, restore your progress on a new device, and prevent one player from tampering with another player's data.
Game progress — coins, inventory, stored items, containers, missions, contracts, boosters, achievements, settings and similar in-game state	Continuously while you play.	To run the game, keep openings server-authoritative (so rewards cannot be forged), and let you continue where you left off.
Gameplay analytics — events such as "container opened" or "reward revealed", together with in-game properties (rarity, item id, screen, result)	While you play.	To understand how the game is played, balance the economy, and find bugs. Analytics events are stored against a salted one-way hash of your player id, not against your email or name.
Push notification token — a Firebase Cloud Messaging registration token for your device	Only if you allow notifications.	To send you in-game notifications (for example, that a container is about to expire).
Advertising data — your device advertising identifier, IP address, and ad interaction data, collected by Google	When a rewarded ad is requested or shown.	To show rewarded ads through Google AdMob. See section 5.
Technical data — IP address, request paths and timestamps	On every request to our backend.	Security and abuse prevention. Our own rate limiting uses your IP only in memory and does not store it. Google Cloud keeps standard server request logs on our behalf.

We do not collect your contacts, photos, precise location, microphone or camera data, and we do not ask for any of those permissions. We do not sell personal data.

3. Legal bases (GDPR)

Where the EU/UK GDPR applies, we rely on:

Performance of a contract — account data and game progress; without them the game cannot save or restore your state.
Legitimate interests — security, abuse and fraud prevention, and aggregate gameplay analytics used to balance and fix the game.
Consent — push notifications, and personalised advertising where a consent prompt is shown. You can withdraw consent at any time (section 7).

4. Where your data is stored

The backend runs on Google Cloud Run and stores data in Google Cloud Firestore, hosted in the European Union. Data may be processed by Google in other countries under Google's own safeguards, including the European Commission's Standard Contractual Clauses.

5. Who we share data with

We do not sell your data and do not share it with third parties for their own marketing. We use the following service providers, each acting under its own privacy policy:

Google Cloud (Cloud Run, Firestore) — hosting and storage of accounts, progress and analytics. Privacy notice
Google Sign-In / Google Play Games Services — authentication, and achievements and leaderboards if you use them. Privacy policy
Firebase Cloud Messaging — delivery of push notifications. Privacy information
Google AdMob — rewarded advertising. Google acts as an independent controller for the advertising data it collects. How Google uses data

We may also disclose data where we are legally required to do so, or where it is necessary to establish or defend legal claims.

6. Advertising choices

The game shows optional rewarded ads through Google AdMob. In the European Economic Area, the United Kingdom and Switzerland you are shown a consent prompt before ads are personalised, and you can change or withdraw that choice at any time from the in-game settings. You can also reset or delete your advertising identifier in your Android system settings, under Settings → Privacy → Ads.

7. Your rights

Subject to applicable law, you may request: access to your data; correction of inaccurate data; deletion of your data; restriction of or objection to processing; a copy of your data in a portable format; and withdrawal of any consent you have given.

To delete your account and its data, use the form at /delete-account. For anything else, email gaming@vzl.one from the address linked to your game account, or state your in-game player id. We will respond within 30 days. Deleting your account deletes your game progress permanently and it cannot be restored.

If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

8. Retention

We keep data for as long as we need it to run the game, and no longer. In practice:

Account data and game progress — kept for as long as your account exists, so your progress is still there when you come back. Deleted when you ask us to (section 7).
Push notification token — stored as part of your account record and deleted together with it. It also stops being usable on its own once you turn notifications off or uninstall the game.
Analytics events — kept in pseudonymous form for as long as they are useful for balancing and fixing the game. They are tied to a one-way hash of your player id, so once your account is deleted they can no longer be linked back to you.
Server request logs — retained by Google Cloud under its own default retention period (currently 30 days); we do not extend it.

We do not run an automatic deletion schedule for inactive accounts. If you want your data gone sooner, use the deletion form — that is the fastest route.

9. Children

The game is not directed to children. You must confirm that you are at least 14 years old before you can sign in and play, and we do not knowingly collect data from anyone younger. If you believe a child has provided us with personal data, email us and we will delete it.

10. Security

All traffic between the game and our backend uses HTTPS. Access to the backend administration tools requires Google authentication and is restricted to the developer. Reward outcomes are decided on the server so that they cannot be manipulated from the device. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

11. Changes to this policy

We may update this policy as the game changes. The "last updated" date at the top always reflects the current version. Material changes will be announced in the game before they take effect.

12. Contact

Questions, requests or complaints: gaming@vzl.one

DON'T OPEN — one.vzl.dont_open. This page is served by the game's own backend and is the authoritative version of this policy.