Privacy policy

Version 2.0 · in effect from 7th of September, 2026.

Who we are

Drill Run is made by Grumpy Studio, based in Poland. Grumpy Studio, to be clear, is what we are calling ourselves at this point in time. However, since we aren't making any money at this moment, we have no legal obligation under Polish law to establish a legal entity. For data protection purposes Michal Gromann and Konrad Markiewicz are joint controllers of the information described here. A request to either of us reaches both, and either of us can act on it — so there is no wrong person to contact. Contact: [email protected].

Playing without an account

If you never sign up, the game does not send us anything. Your settings and best runs are stored on your device only, and they disappear when you uninstall. We cannot recover them and we cannot see them.

What we collect if you make an account

Username

Identifies your account when you log in. Only you and we see it.

Nickname

The name shown in-game and on the public leaderboard. Choose something you are comfortable having in public — it is the one field other players see.

Email address

Used to confirm the account is real, to send you a verification code, and to let you prove it is yours if you ask us to delete it. We do not send newsletters or marketing.

Password

Stored only as a one-way hash. We never see or store what you typed and we cannot recover it for you.

Scores and runs

The score and level a run finished on, the difficulty, and when it happened, for the runs the game syncs. Your best score per difficulty appears on the public leaderboard next to your nickname.

Sign-in tokens

A refresh token per signed-in device, so you don't have to log in every time. Revoked when you sign out or delete your account.

Server logs

Our server records requests it receives, which includes your IP address and the time. This is ordinary infrastructure logging used to keep the service running and to spot abuse. Logs are kept for 90 days and then deleted.

That is the complete list. The game contains no advertising identifiers, no analytics or crash-reporting SDK, no location access, no contacts access and no device fingerprinting.

Why we are allowed to hold it

Under the GDPR we rely on two grounds. Your username, nickname, email, password hash, scores and tokens are processed because they are necessary to provide the account you asked us for (Article 6(1)(b) — performance of a contract). Server logs and the abuse limits on our forms rest on our legitimate interest in keeping the service secure and available (Article 6(1)(f)).

We do not rely on consent for any of the above, which is why there is no cookie banner and no consent toggle: if you don't want the processing, don't make an account, and if you already have one, delete it.

Cookies

This website sets one cookie, and only if you use the deletion form: a session cookie that carries a security token to stop other sites submitting the form on your behalf. It is strictly necessary, holds nothing about you, and expires when you close the browser. There are no tracking or advertising cookies here.

Age

You must be at least 16 to create an account. The game itself is playable at any age without one, and we receive nothing from players without accounts.

If you are a parent or guardian and believe a child under 16 has created an account, email [email protected] and we will remove it. We will only ask for enough information to identify the account — never for proof of identity or a copy of any document.

Who else touches your data

We use a small number of services to run the game. They act on our instructions and are not allowed to use your data for their own purposes:

• Cloudflare — tunnels and encrypts access to the server and database we personally run.
• Brevo — delivers verification and deletion emails. They see your address and the content of those messages.
• Google Play — distributes the app and handles any purchases. Google's own handling of your data is covered by their privacy policy, not ours.

We do not sell your data, we do not share it for advertising, and nobody outside these providers and the two of us has access to it.

Where it is stored

Our server and database are located in Poland. Where a provider processes data outside the European Economic Area, that transfer is covered by the European Commission's standard contractual clauses.

How long we keep it

• Account details and scores: until you delete your account.
• Accounts that never confirm their email address: deleted automatically after 14 days.
• Verification codes: 15 minutes, then removed.
• Server logs: 90 days.
• Record that a deletion request was completed: kept indefinitely, with the email address stored only as an irreversible hash.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or object to processing we base on legitimate interest. The fastest route for deletion is the deletion form, which is automatic and immediate. For anything else, email [email protected] and we will respond within 30 days.

Your nickname, email address and scores can be exported on request in a machine-readable format.

If you think we have handled your data badly, you can complain to your national data protection authority. In Poland that is the Urząd Ochrony Danych Osobowych. We would rather you told us first.

Security

Passwords are hashed. Traffic between the game and our server is encrypted with TLS. Verification codes are stored hashed, expire quickly and lock out after a few wrong attempts. We are two people, not a security team, so we keep the amount of data we hold as small as we can — that is the main defence.

If we ever have a breach affecting your data, we will tell you by email and notify the supervisory authority as required.

Changes

If we change what we collect, we will update this page and change the version number at the top. If the change is significant, the game will ask you to acknowledge it the next time you sign in.