Privacy Policy

Version: privacy-v7-2026-10-05 Last updated: 5 October 2026

Who we are

Blob League, a sole trader based in the United Kingdom, is the data controller for Blob League.

We have not appointed a Data Protection Officer. One is required only where an organisation monitors people systematically on a large scale or handles special-category data at scale, and Blob League does neither.

The short version

Blob League is for players of every age. Players under the age at which they can agree to the use of their data themselves (13 in the UK and the US) get a restricted account: no chat, no name or bio of their own, no friend requests and no paying real money, until a parent or guardian says yes.
How a parent says yes: the child asks from the game by giving us the parent's email address. A company called Kids Web Services writes to the parent and checks that they are an adult, and the parent then answers on our website. We do not keep the parent's email address.
You can play as a guest. We still create an account for you, because the game needs one.
Your display name, bio and chat are public. Everything else is not.
We do not sell your data, there is no advertising in Blob League, and we do not track you.
You can download everything we hold from inside the game, and delete your account there.

What we collect, why, and on what basis

Your account

Data	Why	Legal basis
Account ID, sign-in identifier (Firebase)	To have an account at all	Contract
The year you were born, asked once when you first play	To set your account up for your age (see "Children"). Never shown to anyone	Legal obligation
Display name, bio	Shown to other players. A restricted account gets a name we make up and no bio	Contract
Your Google account's ID, email and name, if you sign in with Google	So your progress survives a lost device. Held by our sign-in provider (Firebase Authentication), not copied onto your account	Contract
Guest recovery token (hashed)	To restore a guest account after a reinstall	Contract
Settings and preferences	To sync them across your devices	Contract
A log of security events on your account (a sign-in linked, a recovery used, a deletion asked for)	To help you if your account is taken	Legitimate interests
A parent or guardian's email address, when a child asks them for permission	To send them the request. We pass it to Kids Web Services (see "Who we share it with") and do not keep it. We keep a scrambled form of it, which cannot be turned back into the address, and a hint like `s*@e*.com`	Legal obligation / legitimate interests
The record of a parent's answer: when they were asked, when they were confirmed to be an adult, whether they said yes or no and to which notice, and whether it was later taken back	To show that a child's account was opened up with a parent's permission, and to act on it	Legal obligation

Playing

Data	Why	Legal basis
Match results, scores, statistics, rank	To run matches, ladders and progression	Contract
Items owned, Stardust balance, pass progress	To give you what you own	Contract
Friends, party members, clubs	Social features you chose to use	Contract
Approximate region and connection quality	To put you on a nearby server	Contract
IP address	Unavoidable in any online game; also used to work out which country your account is in	Contract / legitimate interests
A one-way hash of your IP address, kept for 30 days	To detect someone evading a suspension by making a new account. We store a scrambled form, never the address itself: it can tell us two accounts connected from the same place, and nothing else	Legitimate interests
A random id for your app installation	Same purpose. It is made by the app, is not your device's identifier, and is new if you reinstall	Legitimate interests
Your country	Statistics about where the game is played, and the age rules that apply to you	Legitimate interests / legal obligation
Which days you played, roughly how long, which modes and which parts of the game you used	To count how many people play and come back, and see which parts of the game are used, so we know what to fix and build. Kept under a scrambled id that we can link to your account only while the account exists	Legitimate interests

Chat and moderation

Data	Why	Legal basis
Chat messages	To deliver them, and to moderate	Contract / legitimate interests
Suspensions and chat mutes on your account: what was done, why, when, and by which member of staff	So enforcement is consistent, reviewable, and can be reversed if it was wrong	Legitimate interests
Reports you file, and reports about you, with the reported player's own chat lines from that match	To investigate abuse and keep the game usable	Legitimate interests

Inside Blob League, only the staff who moderate can read chat messages, and bios exactly as they were typed. Each time a member of staff opens a player's record or a match's chat, that is recorded.

Purchases

Data	Why	Legal basis
What you bought, when, and the store's transaction reference	To deliver it, support refunds, and meet tax obligations	Contract / legal obligation

Payments go through Apple or Google. We never see your card details. A restricted account cannot pay real money for anything.

Crash reports

We do not collect crash reports at the moment. When we start, we will use Sentry, with its collection of IP addresses and personal identifiers turned off, and we will update this policy before we do.

Notifications

We do not send notifications and do not collect a notification token.

What we do not do

We do not sell your personal data.
We do not show advertising, and there are no advertising SDKs in the game.
We do not track you across other apps or websites.
We do not use precise location. We work out your country from your IP address, using a database that sits on our own server. Your IP address is never sent to a location service.
We do not use your data to make automated decisions with legal effects. Automatic chat filtering can hide a message and anti-cheat can restrict an account; a person will review it if you ask. Restricting a child's account is decided by the year of birth and the country, as described below.

Who we share it with

Google (Firebase and Google Cloud): sign-in, the database, the game's servers, logs, and hosting for this website.
Upstash: a fast database for things that last seconds or minutes: who is online, parties, match searches.
Apple / Google: payments, as their own controllers.
Kids Web Services (Kids Web Services Ltd, a UK company in the Epic Games group): only when a child asks a parent for permission. We give it the parent's email address, the child's country and a request number. We do not give it the child's name, account or year of birth. It writes to the parent and checks that they are an adult, for example with a payment card or an identity document; we are told only that the check was passed, never how. So that a parent is not asked to prove their age twice, it keeps its own record of adults it has already checked. For that check and that record it answers for the data itself, under its own privacy policy at https://www.kidswebservices.com.
No location provider. Country is resolved on our own server against a local copy of DB-IP's IP-to-Country Lite database (https://db-ip.com, CC BY 4.0), so no third party is involved.
Anyone we are legally required to disclose to, or where it is necessary to investigate serious abuse or to protect someone from harm.

Google and Upstash process data only on our instructions. So does Kids Web Services, for sending the message to the parent.

Where your data goes

The database that holds your account is in Google's European region, in Belgium and the Netherlands.
The service the app talks to runs in London.
The game servers run in Frankfurt.
Upstash runs in Belgium.
Sign-in (Firebase Authentication) and our server logs are Google services that may be processed outside the UK and the EU, including in the United States.
Kids Web Services is in the United Kingdom, and uses providers in the United States and other countries, under standard contract clauses of its own.

Where data leaves the UK or the EU, it is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses that Google offers as part of its terms, and by the EU-US Data Privacy Framework, under which Google is certified.

Google keeps its own record of every request to our service for 30 days, including the IP address it came from. Our own code never writes your IP address down.

How long we keep it

While your account exists: as long as you keep playing.
After you delete it: if you signed in with Google, it is disabled immediately and permanently deleted after 30 days; sign in before then to cancel. A guest account is deleted at once and for good when you delete it.
Guest accounts: deleted automatically after 7 days without playing, in the same way as an account you delete: the same things are removed and the same records below are kept. Signing in with Google before then keeps the account. A guest account is not removed while it is suspended or muted, so that the suspension cannot be escaped by waiting.
Kept after deletion, deliberately:
Match records, with your name replaced by "Player" and your account reference severed. They are your opponents' history too, and after the change they no longer identify you.
Purchase records, kept for 7 years, because UK tax law requires business records to be kept for six years after the end of the accounting period they relate to.
Abuse reports about you, and the messages they quote, kept for 2 years, so that deleting an account cannot erase evidence of harassment.
Chat messages: 30 days, then deleted. A reported player's own lines are kept with the report instead (see above).
Hashed IP addresses and install ids: 30 days, then deleted. This is deliberately short: it is long enough to spot a suspended player immediately returning on a new account, and too short to build any picture of where you have been.
Which days you played: 100 days.
A request to a parent: if it is not answered, deleted after 14 days; a "no" after one day. A parent's yes is kept for as long as the child's account, with the date it was taken back if it was, and is deleted with the account.
Enforcement records (a suspension or mute, and the reason for it) are kept even if you delete your account, for the same reason abuse reports are: otherwise deleting an account would erase the record of why it was suspended, and the suspension could simply be restarted.

Your rights

You can:

See and download everything: Menu → Account → Download my data. It includes your account, your progress, your suspensions and mutes, the reports you filed, your chat from the last 30 days, and the record of any request to a parent.
Delete your account: Menu → Account → Delete account, or https://blobleague.com/account/delete without the app (for an account signed in with Google).
Correct your details: change your name and bio in the game.
Object to processing we base on legitimate interests.
Complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU, the regulator where you live.

We answer within one month. There is nothing to pay.

We do not need you to prove who you are beyond being signed in. Being able to sign in is the proof. This is also why we cannot help with an account you can no longer access: we have no way to tell it is yours.

Children

Blob League is for every age. The first time you play, we ask the year you were born. We ask everyone, and we do not show it to anyone.

If you are younger than the age at which you can agree to the use of your data yourself where you live (13 in the UK and the US; between 13 and 16 in the countries of the EU), your account is restricted until a parent or guardian says yes:

no chat: you cannot type messages, and you are not shown other players' messages;
no name or bio of your own: you play under a name we make up;
no friend requests, either way;
no starting a club, because a club's name is public;
no paying real money for anything. Stardust earned in the game can still be spent.

Everything else is the same as for anyone: every mode, ranked play, the Blob Pass and everything you earn. For a restricted account we collect only what is needed to run the game and keep it safe: the account, its progress, the year of birth and country, and the scrambled signals in "Playing". We do not collect chat from a restricted account, because there is none.

Asking a parent. In the game, a child with a restricted account can tap "Ask a parent" and type a parent or guardian's email address. We pass that address to Kids Web Services, which writes to them and checks that the person answering is an adult. That person then arrives on a page of our website which says what is switched off, what we would collect and who would see it, and answers yes or no there. Only that yes changes anything. One email address can give permission for up to five accounts.

What a yes switches on: chat, a name and bio of the child's own choosing, friend requests, starting a club and paying real money. From then on the account is like any other player's, and the rest of this policy describes what we collect from it. The name, the bio and chat messages can be seen by other players; chat is filtered, and any player can be reported or blocked.

Taking it back. A parent or guardian can change their mind at any time: in the game, under Menu → Account → Parent or guardian, or by writing to admin@blobleague.com from the address that gave the permission. The account is restricted again at once: its name goes back to one we make up and its bio is removed. Friends, the club it is in and anything already bought are kept.

A parent's rights. A parent or guardian can write to admin@blobleague.com to see what we hold about their child's account, to have it deleted, or to stop us collecting more, which is what taking the permission back does. We check that the request comes from the address that gave the permission. A guest account is deleted after 7 days without playing, and the permission goes with it.

Changes to this policy

We will post an updated version here with a new version string. If a change matters, we will tell you in the game rather than quietly changing the page.

Contact

admin@blobleague.com, Blob League, United Kingdom