Hoopline GM is a basketball manager game for iOS and Android. This policy explains what the app collects, why, who else sees it, and how you get rid of it. It covers the app and, in section 8, the website hooplinegm.com — not any other website or service it links to.
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address and password, or the identifier returned by Google or Apple if you sign in that way. Passwords are stored only as a hash; we never see them. | To create your account and let you sign back into it on another device. | Performance of a contract |
| Username, which you choose during onboarding and can change at any time in Settings (and, for accounts created before 21 September 2026, the favourite team chosen then). It does not need to be your real name. | To identify you inside the game. Your username is visible to other players, and it appears on any card you choose to share (see "Shareable cards" below), where people outside Hoopline GM can see it. | Performance of a contract |
| Age: during onboarding the app asks for the month and year you were born. We do not keep them. We keep only when you answered and, if you were under 18, the date from which you certainly are 18. (Accounts that confirmed "18 or older" before 23 September 2026 are kept as adults, with the date they confirmed.) | To apply the minimum age of 16 in our terms, and to show non-personalised ads, suitable for teenagers, to anyone under 18. It is a declaration, not an identity check: we ask for no document. | Performance of a contract; for the ad settings, legal obligation |
| Game data: your leagues, squads, results, transfers, achievements, the players you mark as favourites, and your balances of in-game coins, gems and energy. | This is the saved game. Without it there is nothing to come back to. | Performance of a contract |
| A push notification token and the platform it belongs to, if you allow notifications. | To tell you when something in your league needs you: an auction you are in, a player you follow going up for auction, a playoff game that has been waiting a day. You can turn every category off in the app, and revoking the OS permission stops them entirely. | Consent |
| Purchase records: which product you bought, when, at what price, and the transaction identifier the store gave it. We never receive your card details — the payment happens inside Apple's or Google's store and we are only told the result. | To credit what you paid for, to keep a subscription's status correct, and because tax law requires a record of a sale. | Contract, and legal obligation |
| Purchase consents: for each paid purchase, which product it was, the language and version of the texts you were shown, and the time you ticked the box — requesting immediate supply (for Premium, that it start at once) and acknowledging what that means for your right of withdrawal. | EU consumer law only lets the right of withdrawal end on delivery if you ask for it and acknowledge it beforehand, and we must be able to show that you did. | Legal obligation |
| Purchase confirmation emails: the email address your account has, and the confirmation we send it after each paid purchase — what you bought, when, at what price, and the consent you gave — with the time it was sent. | The law requires us to confirm the contract, including that consent, on a durable medium, and to be able to show that we did. | Legal obligation |
| Rewarded-ad records: the identifier the ad network gives a completed ad, and what it was worth. | To credit the reward once and only once, and to enforce the daily limit. | Legitimate interest (preventing repeated claims) |
| Advertising and device identifiers, collected by Google's ad SDK when an ad is shown. | To select and measure ads. See section 3 — what is collected depends on the choice you make in the consent form. | Consent |
| Product analytics: a small, fixed list of things you did in the game — finishing a draft, using the automatic lineup, opening the store, watching a rewarded ad, opening the share menu with a card (only which kind of card: season, achievement or career — never the image or anything on it, nor where you share it), playing a playoff day or finishing the season early, opening the player search (never what you type in it), putting a star on a player or taking it off (only which of the two, never which player), an auction of yours closing, starting a subscription — plus the app being opened, backgrounded, installed or updated. Each one carries the time, your device model, operating system, app version and language, and the country your connection appears to be in. They are tied to your account identifier, not to a device or advertising id. | To see how many people come back after a week, how the game is actually played, and where people stop — the questions that decide what gets built next. There is no advertising use and nothing is shared with advertisers. | Legitimate interest (understanding and improving our own game) |
| Crash and error reports: the error, where in the app it happened, and the same device and version details as above. | To find and fix defects. Without this, a crash that only happens on one phone model is something we never learn about. | Legitimate interest (keeping the app working) |
We do not collect your name, address, phone number, contacts, photos, precise location, or health data. There is no session recording, no screen recording and no heatmapping — the analytics are a counted list of named events, not a picture of what you did. Nothing you type is collected.
You can switch off the analytics and error reports at any time in Settings, with the switch Share usage and crash data. From then on no new analytics events or error reports are recorded for your account. They are based on legitimate interest, not on consent, so the switch is how you object to them; you can also exercise any of your rights by writing to us, as section 5 explains.
Shareable cards. The app can draw a card — a season, an achievement or your career — for you to share. The card is made on your device and shared through your phone's own share menu, to whichever app you choose. We do not receive, publish or store the image or anything on it. A card includes your username and the information shown on it, so anyone who sees it where you share it can see those. Once shared, it is governed by the terms and privacy policy of the platform you shared it on, not by ours.
The app is run by one person, not a company with departments. These are the services that hold or see data on our behalf:
Some of these process data outside the European Economic Area. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
We do not sell your data, and we do not share it with anyone beyond the services above.
The app shows rewarded ads only — an ad you choose to watch in exchange for energy, gems, or a doubled reward. There are no banners, and no ad you cannot decline. Nothing about the game is locked behind watching one.
If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your choice through Google's consent form before requesting any ad, and passes that choice to Google. Choosing not to consent means you see non-personalised ads; it does not remove the feature. You can reopen that form at any time from the app's settings.
If you are 16 or 17, the app tells Google's ad service that you are under the age of consent: you only see non-personalised ads, and whatever your age, every ad is limited to content suitable for teenagers.
Your account and game data, including your age answer, are kept for as long as the account exists. Delete the account and they are deleted with it.
Purchase records, purchase consents and purchase confirmation emails are the exception. They are kept for five years from the purchase, whether or not the account still exists, because they are the evidence of a contract: five years is the general period in which a claim about it can be brought in Spain (Civil Code, art. 1964), and it also covers the four years tax law requires for a record of a sale. Once the account is deleted they are blocked: kept apart from everything else, not used for anything, and available only to establish, exercise or defend legal claims, or to courts and public authorities that are entitled to them (Spanish Data Protection Act, LOPDGDD, art. 32). After five years they are deleted automatically, unless a claim or a legal obligation still requires them.
Ad reward records are kept for 30 days, which is what the daily limit needs, and then removed. Product analytics and crash reports are kept for up to 12 months and are then deleted. Two different things stop or remove them: switching analytics off in Settings stops new ones being recorded, and leaves the ones already recorded to be deleted when their 12 months are up; deleting your account deletes the account and its data, stops anything new, and lets you ask us to delete the analytics and crash reports already recorded for it (see section 5).
Under the GDPR you may ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, and object to processing based on legitimate interest. You may also withdraw a consent at any time, which does not affect what was done before you did.
How to ask, in the app. Open More, scroll to Account, and tap Delete account. Confirming deletes everything immediately — there is nothing to fill in, no reason to give, and no waiting period, because the app calls the same function that removes the account rather than a person actioning a request by hand.
How to ask without the app. If you cannot or would rather not sign in, email hooplinegm@gmail.com from the address your account uses, with the words delete my account in the subject. We action it within 30 days and reply to confirm when it is done. Deleting the app from your phone does neither — it does not delete the account either way; the saved game lives on our servers so you can come back to it on another device.
What is deleted. Everything the account is: your sign-in and password, your username and favourite team, your age answer, every league you created and every team, squad, fixture, result, transfer and bid inside it, your achievements and trophies, your balances of coins, gems and energy, the cosmetics you own and have equipped, your push notification token, and the record of which rewarded ads you watched. Ask us at the same time and we will delete the analytics and crash reports tied to your account identifier as well — those are held by a separate service and do not go automatically. All of it goes at once, permanently, and none of it can be recovered afterwards.
What is kept, and for how long. The evidence of your purchases, and nothing else: which product you bought, when, at what price and with which transaction identifier; the consent you gave before paying; and the confirmation email we sent you. They are kept blocked for five years from each purchase, as section 4 explains, carry no game data, and are then erased.
If you think we have handled your data badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).
Hoopline GM is for people aged 16 or over. When you create an account, the app asks for the month and year you were born; if you are under 16 you cannot continue. We do not keep that date, only whether you are under 18 and, if so, until when. That answer is your declaration; we do not verify your identity or age. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has created an account, write to us and we will delete it.
The app stores your session token and your settings on the device itself so that you stay signed in. To share a card, it writes the image to a temporary file that your phone's share menu reads; nothing in it is sent to us. This is not a cookie and is not readable by anyone else. Google's ad SDK stores its own identifiers on the device, governed by the choice you make in the consent form.
This section covers the website hooplinegm.com, not the game. The website does not use cookies, analytics or advertising, and its fonts and images are served from the same domain.
When you visit the website, technical data about the connection is processed to deliver the pages and to keep the service secure: your IP address, the date and time, the page requested, and technical details such as the browser and device type your browser sends. The website is delivered through Cloudflare, Inc., which provides our infrastructure and security services. Cloudflare may process technical information about visitors, including IP addresses and security-related event data, as necessary to provide and secure the service. Depending on the processing involved, Cloudflare may act on our behalf or as an independent controller for its own security and operational purposes. Further information is available in Cloudflare’s Privacy Policy.
We use this data only to deliver the content, protect the website against abuse and keep it working. The legal basis is our legitimate interest in running and securing the website (Article 6(1)(f) GDPR).
We have not enabled HTTP request log retention, Cloudflare Web Analytics or Logpush for this website. We therefore do not maintain a separate log of visitors or send website request logs to another service. Cloudflare may nevertheless process technical and security-related data as part of operating and protecting its network. Security Events available through Cloudflare may be retained for up to 31 days. For further information, please see Cloudflare’s Privacy Policy.
The page https://hooplinegm.com/auth/confirm opens when you tap the link in a
confirmation or password-recovery email. It sends the one-time code in the link to Supabase, our
authentication provider, to confirm your account or to let you set a new password, and removes the
code from the address bar. It does not keep any of this information itself and does not use
cookies.
If this policy changes in a way that affects you, the date at the top changes and the app tells you the next time you open it. The current version always lives at this address.
Questions, requests, or complaints: hooplinegm@gmail.com.