1. Scope and Controller
This Policy applies to the web version of Quirky Ball (the “web version”), which is played in a web browser and is mainly distributed embedded on CrazyGames (crazygames.com and its domains). The web version is operated in Germany by Junhee Choi under the name House Duck. It is a title-specific supplement to the shared House Duck Privacy Policy, which continues to apply to the Android and iOS apps and to the website houseduck.in. For the web version, this Policy applies together with the shared Policy, and where they differ, this Policy applies.
Controller: Junhee Choi, House Duck (하우스덕)
Address: Ringstr. 23, 61476 Kronberg im Taunus (Hessen), Germany
Email: support@houseduck.in
Phone: +82 10 7620 3959
CrazyGames. CrazyGames operates its own platform, any CrazyGames account and any ads shown there, under the CrazyGames Terms and Conditions and the CrazyGames Privacy Policy, and is responsible for its own processing, for example cookies, ads and platform analytics. This Policy covers only the data that House Duck processes.
This policy is a notice about personal-data processing. When you start the game you accept the Terms and this policy; from then on the service analytics described in Section 2 are processed while you play. The web version has no separate optional analytics choice.
2. Information We Process
| Information | When and why it is processed |
|---|---|
| Guest identifier (UID) and session token | Created automatically when you first play, and stored in your browser (IndexedDB/local storage) and on our server. They are used to recognize your guest account, keep you signed in as a guest and synchronize your progress. The web version has no sign-in: it does not use Google or Apple accounts and does not ask for your email address or profile name. |
| Game and account data | Nickname, display code, user-selected country, profile icon and other customization, progress and saved game state (for example lab progress and run results), virtual currencies and items (such as gems, reagent and tickets), rankings, mailbox items and missions. Stored in your browser and in Supabase. |
| Fair-play and reward records | Server-issued run tickets, play and reward records, and plausibility checks of time, score and currency changes, used to grant rewards correctly and to prevent cheating, duplicate rewards and abuse. |
| In-game reports and support requests | If you send a Quick Report in the game settings, the text you enter (up to 2,000 characters) is stored with your account ID, game version, build number, platform and language so that we can investigate the problem; we see your current nickname next to the report. Support emails and the contact details needed to reply are processed to answer the request. Please do not include passwords or payment details. |
| First-party usage analytics stored in Supabase | After you accept the Terms, as part of the service: session, screen and button interactions, game start/end, progress, scores, errors (including the code location of client errors), game version, platform, time-zone offset and distribution channel. Random installation/session identifiers are used and kept separate from the account UID. This data goes to House Duck’s own server; no other analytics provider receives it. Used only to improve the service (game balance, tutorial flow, bug fixing), never for advertising or personal profiling. |
| Browser settings | Language, sound and graphics settings and whether you accepted the Terms are stored in your browser. |
| Technical request data | When your browser loads the game or contacts our server, the servers involved (CrazyGames for the game files; Supabase for our server) process your IP address and HTTP request metadata for delivery, security and abuse prevention. |
The web version does not use an advertising SDK; the only third-party analytics House Duck uses there is Google Analytics for Firebase, after your consent (Section 8). It has no purchases, sign-in or push notifications, so House Duck does not collect advertising identifiers, purchase data, notification tokens or sign-in account data on the web. Our games are not designed to collect precise location, contacts, photos, camera, microphone, or other information unnecessary for the game.
Browser storage and guest accounts
The guest identifier, session token, settings and consent choices are stored in your browser (IndexedDB/local storage). We use this storage only to run the game and keep your guest account; we do not use it for advertising or tracking. If you clear browsing or site data, play in a private window, or use a browser (such as Safari) that deletes website storage after a period without a visit, the identifier may be lost and the guest account may become unrecoverable on that browser. We cannot restore it, and there is no transfer from a web guest account to a Quirky Ball app account. Playing in another browser or on another device creates a different guest account.
3. Purposes and Legal Bases
- Providing the game, guest accounts, rankings, mailbox, in-game reports and support: contract performance or pre-contractual steps (GDPR Art. 6(1)(b)).
- Legally required records and the handling of legal claims: legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).
- Security, fair play, stability, and error investigation necessary to operate and protect the service: legitimate interests (Art. 6(1)(f)).
- House Duck first-party service analytics stored in Supabase (service improvement and bug fixing): legitimate interests (Art. 6(1)(f)). Collected only after you accept the Terms; you can object at any time under Section 9.
- Google Analytics for Firebase usage statistics on the web version: your consent (Art. 6(1)(a) GDPR; for storing and reading identifiers in your browser, § 25(1) TDDDG). You can withdraw it at any time as described in Section 8.
The legitimate interests are protecting accounts, preventing fraudulent scores or duplicate rewards, investigating errors, handling reports efficiently, and maintaining service stability. Random installation/session identifiers do not by themselves make data anonymous. They also include improving the service by checking game balance and tutorial flow and fixing errors. These analytics are processed only on House Duck’s own servers, are never used for advertising, third-party analytics or personal profiling, and the raw events are deleted after 28 days (Section 6).
4. Service Providers and Recipients
House Duck does not sell personal information to data brokers for money. The following providers may process information as independent controllers or processors as applicable.
For customer data hosted in Supabase, House Duck remains the controller and Supabase processes that data as a processor acting on House Duck's instructions. Supabase's published Data Processing Addendum provides information about these roles.
| Service | Purpose |
|---|---|
| Supabase | Guest-account authentication, game state, rankings, mailbox, in-game reports, and first-party analytics storage |
| CrazyGames (independent controller for its platform) | Distribution platform on which the web version is mainly played, including its own accounts, ads and cookies under its own policies |
| Google Gemini API (Google affiliates) | Short summaries and categories of support messages and in-game reports for the operator, after email addresses, links, display codes, phone numbers and long identifiers are removed. Only the operator uses the result; it does not decide anything about you. |
| Google Analytics for Firebase (Google Ireland Limited; Google LLC) | Usage statistics for the web version (for example tutorial start and completion), only after your consent and without advertising features (Section 8) |
House Duck does not run an advertising network or advertising SDK in the web version for now. If ads are shown later, they come through the CrazyGames SDK under CrazyGames’ policies. Before House Duck itself adds any advertising or measurement SDK to the web version, we will update this Policy.
- CrazyGames Terms and Conditions
- CrazyGames Privacy Policy
- Supabase Privacy Policy
- Google Privacy Policy
5. Processing Countries and International Transfers
House Duck operates and processes personal data in Germany. The primary Supabase database for our games is in Ireland (AWS eu-west-1). This is the database location, not a promise that all support, delivery, or log processing remains in Ireland.
| Recipient/service and contact route | Countries and scope | Data, purpose, and timing |
|---|---|---|
| Supabase (Supabase DPA; privacy@supabase.io) | Primary database: Ireland. The published DPA names Supabase Pte. Ltd. (Singapore); Supabase, Inc. is listed as a support subprocessor. Global support and subprocessor processing are separate. | Guest identifiers, game state, in-game reports, and first-party analytics. Encrypted network transmission/storage when the game runs, authenticates, synchronizes, or records gameplay. |
| Google services (Google) | United States and Google’s published global facilities. Google LLC, Google Ireland Limited, or other applicable affiliates process data depending on the service and user’s residence; storage is not Germany-only. | Redacted support and report summaries, sent when a report or support message is processed. On the web version, after your consent: Google Analytics for Firebase usage statistics (Section 8). |
| CrazyGames (CrazyGames Privacy Policy) | As described in CrazyGames’ own policy; CrazyGames is responsible for its platform processing. | Delivery of the game on its platform, and its own accounts, ads and analytics. |
See Supabase subprocessors for the Supabase subprocessor list and section 6 for retention. A primary database location or legal entity’s address is not an exhaustive list of that provider’s processing countries.
Transfers outside the EU/EEA require an applicable adequacy decision, Standard Contractual Clauses (SCCs), or another valid safeguard. Supabase’s published DPA contains SCCs; Google describes its transfer mechanisms in its official policy. Contact support@houseduck.in for the countries, recipients, basis, and a copy of safeguards applicable to particular processing. Reading this notice or playing the game is not separate consent to international transfers.
You can object to the service analytics under Section 9. Server-based game services cannot readily be provided without the required Supabase account/synchronization processing. Contact support to object or request deletion; we will explain affected features and available actions in your case. Making a rights request is not itself grounds for adverse treatment.
6. Retention
- Detailed play, season and weekly records and account-separated first-party analytics events: normally 28 days from the record-specific time explained below.
- Account, current synchronized state, best records, progress and fair-play/reward records: until account deletion.
- In-game reports: while needed to handle the report, and no longer than until account deletion.
- Mailbox items: deleted 90 days after they are claimed or expire.
- Support emails: as needed to resolve the request and handle disputes.
- Data in your browser (guest identifier, session token, settings, consent choices): in your browser until you clear it or the browser removes it. Clearing it does not delete the server account (see section 7).
- Information independently held by CrazyGames and other providers: under each provider's retention policy and settings.
How retention is calculated: daily cleanup removes data older than 28 days based on the play time for detailed gameplay, the update/achievement time for season/weekly records, and server receipt time for first-party analytics. The next daily run can normally add up to one day after that threshold. The 28-day window does not apply to CrazyGames’ or other providers’ independent logs.
7. Account Deletion
You can delete your guest account in the game under Settings → Delete Account, follow the account deletion instructions, or email support@houseduck.in. The account profile, synchronized state, progress, mailbox, in-game reports and fair-play records linked to the account are deleted and cannot be recovered. Some detailed play records may remain until the 28-day threshold described in section 6 and the next daily cleanup and are then deleted automatically. Minimal records strictly required for legal obligations, fraud prevention, or legal claims may remain until those purposes end.
Clearing your browser data does not delete the server account; it only removes the identifiers stored in your browser. If you can no longer use the game on that browser, email us. Nicknames and display codes may be visible to other users and are not authentication, so we may ask for the minimum additional information needed to process the request; do not send passwords or payment details.
8. Advertising and Usage Analytics
- Service analytics: The web version has no separate optional analytics choice. After you accept the Terms and this policy, the first-party usage analytics in Section 2 are stored, as part of the service, only on House Duck’s own servers (Supabase) and are not passed to any analytics or advertising provider.
- To object to analytics, contact support@houseduck.in. We will stop further analytics for that guest account and delete analytics already received under Section 6, or earlier on request.
- Google Analytics for Firebase (web version): After you tick the consent box on the start screen (the same box with which you accept the Terms and this Policy), the web version sends usage statistics such as tutorial start and tutorial completion to Google Analytics for Firebase (Google Ireland Limited; Google LLC, USA). A random browser identifier (the _ga cookie), your approximate region derived from your IP address, browser type and time are used; no account ID, nickname or game save is sent. Advertising features, Google signals and ad personalisation are switched off, and nothing is sent to Google before your consent. To withdraw, delete your guest account in the game (Settings → Delete Account; collection stops and the game removes the identifier it stored) or clear this site’s browser data. Google’s processing is described in the Google Privacy Policy; transfers to the USA rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
- Ads: House Duck does not show advertising of its own in the web version. If ads are shown later, they come through the CrazyGames SDK under CrazyGames’ policies, and any consent or ad choices are managed by CrazyGames.
9. Your Rights
Subject to applicable law, you may request access, rectification, erasure, restriction, portability, objection, or withdrawal of consent by contacting support@houseduck.in. For requests to which the GDPR applies, we normally respond within one month. Where necessary because a request is complex or numerous, we may extend that period by up to two further months and will tell you within the first month, including the reasons. The right to lodge a complaint with a supervisory authority is unaffected. The competent authority in Hesse is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit.
You may object to processing based on legitimate interests on grounds relating to your particular situation, and at any time to processing for direct marketing. Objecting to analytics does not automatically erase previously stored server data at once; you can ask support separately to delete historical data. Korean users may also seek help through the personal-information complaint service (118) or the Personal Information Dispute Mediation Committee.
10. Children's Privacy
Quirky Ball is suitable for all ages. The web version does not ask for your birth date or age and does not calculate or store an age band. We do not ask for real names, contact details or precise location, and nicknames can be chosen freely. We do not run personalised advertising or profiling directed at children.
Where local law requires a parent’s or legal guardian’s consent for a child to use the service or for the processing of the child’s data, that consent must be obtained before playing. A parent or guardian who wants to access or delete a child’s data can contact support@houseduck.in; after verification we delete the guest account and its data.
11. Security
House Duck uses reasonable safeguards including TLS, access controls, Supabase Row Level Security and least privilege. No transmission or storage method can be guaranteed completely secure.
12. Required Information and Automated Decisions
A guest identifier, basic game state, and the Supabase-backed operations that store and synchronize them are required to provide the web version. Service analytics are processed as part of the service after you accept the Terms; objections follow Sections 8 and 9. Because the web version has no sign-in, some features (for example friends, invitations or loading your account on another device) are unavailable. Automated fair-play checks may withhold a reward or a ranking entry that fails a plausibility check; you can ask support for a human review. House Duck does not make solely automated decisions producing legal or similarly significant effects.
13. Changes
- Effective October 9, 2026 (v1.0) — First privacy policy for the web version of Quirky Ball (browser version, mainly on CrazyGames): automatic guest accounts stored in the browser, first-party analytics only on House Duck’s own server, no advertising SDK, purchases, sign-in or push notifications on the web, CrazyGames’ own terms and privacy policy for its platform.
- Amended October 9, 2026 (v1.1) — Removed the birth-month check and the optional analytics consent. The web version is an all-ages game that does not ask for age, and service analytics are processed as part of the service after you accept the Terms (legal basis: legitimate interests; you can object).
- Amended October 11, 2026 (v1.2) — Added Google Analytics for Firebase to the web version for usage statistics such as tutorial start and completion, only after consent and without advertising features (Sections 2, 3, 4, 5 and 8).
Material changes will be announced on the website or in the game before they take effect.