Privacy policy

Last updated: 29 September 2026

This policy explains what information Penalty Room ("the game") uses, why, and your rights. The game is run by Fadil Ahmed, a sole trader in the United Kingdom, trading as Penalty Room ("we", "us"). We are the data controller for the information described here.

The short version:

• We never ask for your name, email address, phone number, home address or date of birth.
• We never see your payment card details: Apple and Google handle every payment.
• Your game account is a random ID tied to your device, plus the nickname you choose.
• Ads are shown by Google AdMob. Personalised ads only with your permission.
• You can delete your account at any time in Settings.

1. What we collect and why

• Your game account: a random account ID, a coded (one-way hashed) form of an ID the app creates when it is installed, and an automatic player name (for example "Player 3F2A"). Why: to run your account and keep your progress. Legal basis: performing our contract with you (the terms).
• Your player name: the nickname you choose (for example "pengoat123"). Other players see it in online matches and on leaderboards. Please never use your real name. Names are checked by a filter, must be unique, and can be reported. Legal basis: contract.
• Game Center (iPhone), if you are signed in to it: the anonymous player ID Apple gives us for you, checked against Apple’s signature, so your player can come back on a new iPhone. We do not receive or keep your Game Center nickname, real name or email. Legal basis: contract.
• Reports and blocks: if you report or block another player, we keep who reported or blocked whom, the match, the reason and the name shown at the time, to review it and keep the game safe. Players are never told who reported them. A name reported by several players is replaced with an automatic one. We review reports ourselves and may reset a name or suspend a player from online play; we keep a record of those decisions. Legal basis: our legitimate interest in a safe game.
• Sign in with Apple or Google, only where the game offers it and you choose to link it: the anonymous account number Apple or Google gives us, so you can recover your player on a new device. We do not receive or keep your email address. Legal basis: contract.
• Game data: your coins and a record of every coin change, items you own and wear, your level, experience and rank, online matches and the moves made in them, daily rewards and season pass claims. Why: to run the game, settle matches, keep the game fair and investigate cheating or errors. Legal basis: contract, and our legitimate interest in a fair and secure game.
• Purchases: which store (Apple or Google), which product, the store’s transaction number and whether it was refunded. Why: to check purchases are genuine, deliver them, restore them and handle refunds. Legal basis: contract, and our legal duty to keep accounting records.
• Technical and security data: your IP address and basic request details in our server logs, used to run and protect the service (for example to limit abuse), and records of suspicious play (such as impossible timings). Legal basis: our legitimate interest in keeping the service secure.
• If you email us (for example to appeal a suspension): your email address and what you write, used only to reply and to review your case. We delete these emails within 12 months of the matter being closed. Appeals quote a short appeal code, so you never need to send anything else about yourself. Legal basis: our legitimate interest in answering you.
• Quick chat: the ready-made phrases and emojis you send in a match are passed to your opponent and are not stored. You cannot type your own messages.
• On your device only: your settings, offline progress and preferences are stored on your device and are not sent to us, except where offline rewards are synced to your account.

2. Advertising

The game shows ads using Google AdMob: a short ad after every 3 matches (not while you have the season pass). Google collects information such as your device’s advertising ID, IP address and device type to show and measure ads.

• In the UK, the EEA and Switzerland, Google’s consent form asks whether you agree to personalised ads before any are shown. If you don’t agree, you still see ads, but they aren’t personalised.
• On iPhone, Apple asks whether the game may track you. If you say no, your advertising ID is not shared.
• You can also reset or limit your advertising ID in your phone’s settings.

Google is responsible for the information it collects: see policies.google.com/privacy and policies.google.com/technologies/ads.

3. What we do not collect

We do not collect your real name, email address, phone number, postal address, date of birth, payment card or bank details, precise location, contacts, photos, camera or microphone. We do not sell your information to anyone.

4. Who we share it with

• Apple and Google, to process and verify purchases and, if you use them, Game Center and sign-in.
• Other players see your nickname, level and rank in online matches and on leaderboards. Nothing else about you is shown.
• Google AdMob, as described in section 2.
• The company that hosts our servers, which stores the data for us under contract and may not use it for anything else.
• Authorities, only where the law requires it.

5. Where your data is kept

Our servers are in the United Kingdom or the European Economic Area. Apple and Google may process data in other countries, including the United States; where they do, they use legal safeguards approved in the UK and EU (such as standard contractual clauses).

6. How long we keep it

• Your account and game data: until you delete your account.
• Server logs (including IP addresses): up to 30 days.
• Records of coin changes, purchases and matches: kept after an account is deleted for accounting and to prevent fraud, but then linked only to an anonymous, deleted account (purchase records are kept for up to 6 years, as UK tax law requires).

7. Deleting your account

Settings → Delete account removes, straight away: your device link, Game Center and sign-in links, player name (it becomes free for others), profile, items, unlocks, progress, minigame history and your blocks. Reports you made are kept for safety reviews but no longer point to anyone who can be identified. What remains (see section 6) no longer identifies you. Uninstalling the game alone does not delete your account.

8. Children

Penalty Room is suitable for all ages. We do not ask for or collect names, contact details or other information that identifies a child. There is no free-text chat: only ready-made phrases. Player names are filtered for offensive words, contact details and social-media handles, and any player can report or block another. If you are a parent or guardian and believe your child’s information needs deleting, use Settings → Delete account on their device or contact us. Parents can also turn off in-app purchases and ad tracking in the phone’s settings.

9. Your rights

Under UK and EU data protection law you can ask us to: see the information we hold about you, correct it, delete it, limit how we use it, object to how we use it, and give you a copy to take elsewhere. Where we rely on your consent (personalised ads) you can withdraw it at any time. Contact us (section 11); we reply within one month. Because we don’t hold your name, we may ask you to send the request from within the game or give details that help us find your account.

If you are unhappy with how we use your information, you can complain to the Information Commissioner’s Office (ico.org.uk) in the UK, or your local data protection authority.

If you live in California or another US state with privacy laws: we do not sell or share your personal information for money, and you have the rights above.

10. Keeping it safe

Our servers decide everything of value (coins, results, purchases), check every message the game sends, use short-lived encrypted sign-in tokens and encrypted connections, and keep a tamper-evident record of every coin change. No system is perfectly secure; if a breach ever put your information at risk, we would tell the regulator and, where required, you.

11. Contact and changes

Contact: Fadil Ahmed, Penalty Room, 66 Paul Street, London EC2A 4NA, United Kingdom. Email: penaltyroom1@gmail.com.

If we change this policy, we’ll update the date at the top and, for important changes, tell you in the game.