Privacy policy
Which pseudonymous data the game processes, why, for how long and how to delete it.
Last updated:
Data controller
| Item | Value |
|---|---|
| Controller | Sergi Pinós |
| Tax ID (NIF) | 46355419T |
| Contact | info@p51.xmassoftware.com |
P-51 Cadillac of the Sky has no sign-up, email or password. This policy describes precisely the few pseudonymous data the game processes and what the website sees.
What data is processed and why
When you open the game for the first time an anonymous pilot is created on your device. This is all the data processed:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Callsign and four-digit tag (for example Halcón#4821) | Identify you to friends and other pilots | Performance of the service you ask for (GDPR art. 6.1.b) | Until you delete the pilot; pilots inactive for 24 months are removed |
| Hash (SHA-256) of the device secret and sessions | Authenticate your pilot without email or password | Performance of the service | Same as the pilot; sessions expire after one hour |
| Friendships, requests, blocks and text messages between friends (up to 200 characters) | Social features of the game | Performance of the service | Same as the pilot |
| Scores, runs and achievements | Leaderboards and friends’ profile | Performance of the service | Same as the pilot |
| Reports you send or receive | Moderation and safety | Legitimate interest (art. 6.1.f) | As long as needed to resolve them |
| IP address in technical logs | Security, anti-abuse (per-IP limits) and diagnostics | Legitimate interest | 48 hours |
Your progress, money and upgrades are stored only on your device. Achievements are replicated on the server so your friends can see them.
This website does not collect personal data by itself: it has no accounts or forms. The providers listed below take part in running the site and the downloads.
Matches between players
Co-op matches are direct connections between the host and the guest, with no game server. To set them up, a rendezvous point exchanges both network addresses, so each of you can see the other’s IP address while the connection lasts. The API does not show IP addresses in room lists.
Play with strangers only if you are comfortable with it; you can play solo, in private games or with friends only.
Recipients and processors
We do not sell or give away your data. These providers take part:
- Cloudflare, Inc.: website hosting (Cloudflare Workers), cookieless visit analytics (Web Analytics), the Turnstile check when you request a download, and storage and delivery of the game files (R2).
- The hosting provider of the API server and its database, which processes the data in the table above on behalf of the owner.
The game has no ads, no third-party analytics and no purchases. Android push notifications are not enabled.
International transfers
Cloudflare may process technical data outside the European Economic Area, including the United States, with the safeguards it offers (standard contractual clauses and, where applicable, the EU-US Data Privacy Framework).
Your rights and how to exercise them
You can access, rectify and erase your data, object, restrict processing and request portability.
The quickest way is from the game itself: exporting your data as JSON and the immediate, total deletion of your pilot (your friendships, blocks, scores and achievements disappear) are in Options. You can also change your callsign and renew the device secret.
For any other request write to info@p51.xmassoftware.com stating your callsign with the tag. As there is no email or password, we can only handle access or erasure requests if we can check the pilot is yours (for example, from the game itself); otherwise we cannot identify you and will say so. We answer within one month.
If you think your data is not handled properly you can complain to the Spanish Data Protection Agency (aepd.es).
Minimum age
The game is for people aged 14 and over, the minimum age to consent to data processing in Spain. If you are younger, do not use it without the permission of your parents or guardians; if we detect a minor’s pilot without that permission we will delete it.
Security
The server stores only the hash of your device secret, which the device itself protects with the system’s secure store. Communications are encrypted (TLS), the API validates everything it receives and abuse limits apply. Technical logs with the IP are deleted after 48 hours.
Changes
If data processing changes we will update this policy and its date. The current version is the one on this page.
Contact: info@p51.xmassoftware.com