Last updated: June 27, 2026
This policy explains what personal data SpiritClicker ("the Game", "we", "our") collects, why, and what rights you have. It applies to everyone who plays the Game. We aim to collect as little as possible.
The data controller is the operator of SpiritClicker (StropeVerse). For any privacy question or request, email us at StropeVerse@outlook.com (or reach us via @StropeVerse on X).
| Data | Why |
|---|---|
| Email address (if you sign up with email, or the email address from your Google account if you sign in with Google) | Authentication, account recovery, transactional email (sign-up confirmation, password reset). |
| Telegram account ID, plus your Telegram display name used once to suggest a starting username (only if you play via our Telegram Mini App — optional; you can change the username) | Authentication and to link your progress to your Telegram account. |
| Username + chosen avatar | To identify you in-game and on leaderboards. |
| Game save (your gameState: level, currencies, upgrades, codex, settings) | To persist your progress across sessions and devices. |
| Leaderboard entry (username, score, level, total kills) | To run the public and PvP leaderboards. |
| Friends list (other players you add) | To show your friends' progress. |
| Wallet address + cached NFT inventory (only if you link an Enjin wallet — optional) | To grant optional NFT-based in-game boosts. The Game is fully playable without it. |
| Technical data: IP address (used transiently for rate-limiting — login, saves and error reports — and abuse prevention), and error / anti-cheat audit logs (which may include your user id) | Security, fraud/cheat prevention, and fixing bugs. |
We do not collect your real name, address, payment-card data, precise location, or browsing history. We do not run advertising or third-party tracking, and we do not use analytics or tracking cookies.
We use only functional browser storage — no tracking or advertising cookies, so there is no consent banner to click through. Specifically: a Supabase authentication token (to keep you logged in) and your game settings (plus, inside the Telegram app, a small flag remembering your login preference). These live on your device and you can clear them any time via your browser.
We use a small set of service providers ("processors") strictly to run the Game. We do not sell your data to anyone.
Your account and save data are stored in the European Union (Supabase, Ireland). Some providers (e.g. CDN edges, email delivery) may process technical data outside the EU under standard contractual safeguards.
Under the GDPR you have the right to access, correct, delete, export (port), restrict or object to the processing of your personal data, and to withdraw consent (e.g. by unlinking your wallet in Settings). To exercise any of these, email us at StropeVerse@outlook.com. You can change your username in-game and manage your linked login methods (wallet, Google, Telegram) in Settings → Account at any time. You also have the right to lodge a complaint with your local data protection authority — in Belgium, the Gegevensbeschermingsautoriteit.
Data is transmitted over HTTPS and stored on Supabase with row-level security so players can only read their own account data. Passwords are hashed by Supabase Auth — we never see them. Saves and leaderboard scores are validated server-side to prevent tampering.
SpiritClicker is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
We may update this policy occasionally. Material changes will be announced on the login screen or in-game. The "last updated" date above always reflects the current version.