Privacy Policy

1. Who we are

The operator of the game Portfolio Tycoon (the “Game”) and the controller of personal data within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) is Peter Hucel, a sole trader (self-employed natural person), with place of business at Fedinová 22, 851 01 Bratislava, Slovak Republic, company ID no. (IČO): (the “Operator”). Contact for exercising data subjects’ rights and for communication on personal data protection matters: .

This policy applies to the Portfolio Tycoon mobile app for Android and the related website portfolio-tycoon.pages.dev, as well as to the processing of personal data when providing related services, handling user requests and communicating with users. It explains what data we process in connection with the Game, why, to whom we provide it and what rights you have.

2. In short

• The Game is a simulation. Money, assets and prices are fictional. We do not ask for any bank details or card numbers.
• Game progress (wealth, settings) is stored on your device. You can play without linking a Google account and without internet; however, on the first internet connection an anonymous Firebase account is created automatically, unless you previously turned off cloud backup.
• If a connection is available, the Game creates an anonymous Firebase account and stores a backup of the game (cloud save). You can optionally link it to a Google account. The cloud backup is created and updated automatically in the background. In the app you can delete the cloud backup and the relevant Firebase account and turn off further automatic backup. You can turn it on again later.
• Rewarded ads (Google AdMob) are shown only when you choose them yourself (e.g. the daily bonus). We manage consents and ad privacy settings through Google UMP.
• We use no analytics or crash-reporting tools of our own (the AdMob ad SDK processes data to the extent described in section 3.3 and according to its technical operation), we do not collect location from the device via GPS, contacts, photos or microphone, and we do not sell personal data. Technical and advertising data may be processed by the service providers named in this policy.
• You can request deletion of data under the conditions set by the applicable legal regulations – see Data deletion.

3. What data we process

3.1 Data stored only on your device

The Game keeps in the app storage the game state (cash, portfolio, transaction history, in-game messages, badges, goals and other progress), settings (language, theme, accent colour, display currency, notifications, advisor on/off), an optional player name and the chosen avatar, a game Bank PIN (a purely in-game feature stored only on the device – do not use a real PIN) and technical markers that protect against cheating (an integrity signature of the saved game). This data is not transferred to us unless it is transferred through the cloud backup under section 3.2 or through another transfer expressly described in this policy.

3.2 Cloud backup (Firebase Authentication and Cloud Firestore – Google)

When the device is online, on the first connection the Game automatically signs in to Firebase Authentication as an anonymous user (a random ID, no e-mail or name) and creates and updates a cloud backup in the background, unless the user has turned this function off. “Anonymous” refers to a way of signing in without providing a name and e-mail address; it is not anonymisation of data within the meaning of the GDPR. A document tied to this ID is stored in the game backups, containing the game state (compressed), the save time, an expiry date (24 months after the last save; inactive backups are deleted automatically on that date), a schema version, the player name (if you entered one), the player level and a shortened user-agent string (device type/OS version – used for support and abuse detection). Firebase may also create a technical installation identifier (Firebase Installation ID) on the device, which is needed for Firebase services to work.

If you decide to link the account to a Google account (optional), Google provides us through Firebase with an account identifier and the data that Google normally passes on at sign-in (e-mail address, name). We use them only to identify your account and restore the backup on a new device. Under the Firestore security rules, only its owner (the signed-in user with that ID) has access to the backup document through ordinary user access; this does not affect legitimate administrative and technical access necessary for managing and securing the service. You can turn off cloud backup by using the “Delete cloud backup and account” function, which removes the cloud backup and the relevant Firebase account and prevents the automatic creation of a new Firebase account and further backup until you turn the function on again. If the Firebase account was linked to a Google account, the relevant Firebase account is removed, but not the Google account itself. Deleting the cloud backup does not affect any copies of data managed separately by Android or Google services.

3.3 Ads (Google AdMob)

The app contains rewarded ads served through Google AdMob (Google Ireland Ltd. / Google LLC). An ad starts only after you tap (e.g. the daily bonus, a TradeBot bonus or an extension of the daily limit). When it is shown, and possibly also when advertising technologies are initialised, AdMob may process the device advertising identifier (Advertising ID), IP address, approximate location derived from the IP, the app set ID, device and app information (including diagnostic data, e.g. app launch time, hangs and energy use) and information about ad impressions and interactions. Google is a controller of this data to the extent that it independently determines the purposes and means of processing, see policies.google.com/privacy and How AdMob uses data. We use Google User Messaging Platform (Google UMP) to manage consents and ad privacy settings. If a particular processing requires consent, we ask for it before such processing begins. Consent is voluntary and you can withdraw or change it at any time through Settings → Help & Support → Legal information → Ad privacy settings. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. Refusing consent to ad personalisation does not necessarily rule out showing non-personalised ads, if showing them complies with the applicable legal regulations. You can turn ad personalisation off in Android settings (Google → Ads) and reset or delete the advertising ID. Android system settings do not replace consent management through Google UMP.

3.4 Time verification (offline earnings and anti-cheat)

So that earnings for the time you are away are calculated correctly and cannot be abused by changing the device clock, the Game reads the current time from a server response (the Date header) at start-up and when it returns from the background, from our website hosting (…pages.dev/time.txt). The hosting provider (Cloudflare) receives your IP address and standard connection data with the request; we send it no personal data or game data. We use no other time services; if the hosting is unavailable, the device clock is used.

3.5 Notifications and vibration

If you allow it, the app schedules local reminders (e.g. the daily bonus, finished offline earnings). They are scheduled and shown on the device itself – we use no push servers and do not store your notification token. You can revoke the permission at any time in Android settings or in the Game. The Game may also use vibration (haptic feedback); this involves no data.

3.6 Sharing

Share buttons (e.g. X, Facebook, WhatsApp, Telegram, Reddit, LinkedIn, Threads) open the chosen service with a prepared text about your result. The Game itself sends nothing – sending happens only in that service and is governed by its policy.

3.7 Purchases

Optional packs of virtual currency and bonuses for real money are processed exclusively by Google Play (Google Play Billing). We do not see or store payment details (card number etc.). When processing a purchase, the app obtains through Google Play Billing the data necessary to verify the result of the transaction and credit the purchased digital content. The Operator does not store purchase tokens or purchase confirmations on its own server or in the cloud backup. The game state keeps the result of the purchase, in particular the credited virtual currency or game bonus. This state is stored locally on the device and, when cloud backup is active, also in the cloud backup under section 3.2. The processing of payment data and the retention of payment records by Google Play is governed by the relevant terms and policies of Google. This does not affect any processing of data by the Operator when handling complaints, communicating with the user or fulfilling legal obligations.

3.8 Data processed by Google Play / Android

When you install and use the app through Google Play, Google collects install statistics, crash and error information (Android vitals) and similar operational data under its own policies. Google makes this data available to us in aggregated form in the developer console. The Game may also show the system Google Play rating dialog (In-App Review); the rating is processed by Google and we cannot see whether or how you rated the Game.

3.9 What we do not collect

We do not collect precise or approximate location from the device (GPS; the location derived from the IP address by AdMob is described in section 3.3), contacts, photos, files, microphone, camera, SMS, phone number or biometric data. The Game has no chat, public profiles or multiplayer; the Leaderboard consists of computer-generated virtual investors, and your name and results are not shown to other players.

3.10 Android backup (Google)

Android may back up the app’s saved state to your Google Drive (Android Auto Backup) and restore it after reinstalling or on a new device. The backup is managed by Google in your Google account under its policies; we have no access to it. You can turn it off in Android settings (Google → Backup) and delete an existing backup there. Deleting the cloud backup in the Game does not affect this copy. Because purchased bonuses are part of the saved progress, they can be restored with this backup too.

3.11 Website (portfolio-tycoon.pages.dev)

The related information website portfolio-tycoon.pages.dev uses no cookies, analytics or advertising tools. Hosting is provided by Cloudflare Pages (Cloudflare, Inc.), which, when a page is displayed, may process technical connection data, in particular the IP address and other data needed to deliver web content and to secure and operate the hosting service. The Operator keeps and manages no server logs of its own and sets no separate retention period for them. The processing of technical data by the hosting provider is governed by the relevant contractual terms and rules of the Cloudflare service. Further information is available at https://www.cloudflare.com/privacypolicy/. Only the choice of page language is stored in the browser’s local storage. If you e-mail us, we process your address and the content of the message to handle the request, for related communication and, in justified cases, to demonstrate that the request was handled or to protect legal claims.

3.12 In-game AI assistant and illustrations

The in-game “AI assistant” (advisor) is a rule-based algorithm running directly on your device – it does not use generative artificial intelligence, sends none of your data or texts anywhere and processes no personal data. The illustrations (e.g. character avatars) were created by the Operator with the help of generative AI tools; no user data was used to create them. The characters are fictional.

4. Purposes and legal bases

Providing personal data is generally not a statutory obligation. The Game can be used without an internet connection and without linking a Google account. However, on the first internet connection an anonymous Firebase account is created automatically and cloud backup begins, unless the user has turned this function off. Processing the relevant identifiers and data on game progress is necessary to use the cloud backup. Without cloud backup, progress cannot be restored on a new device through this service; without consent to personalised ads, rewarded ads are shown without personalisation or are not available, depending on the ad service settings and the availability of the relevant ad content. Not providing data necessary for a specific function may make it impossible to use that function; however, refusing consent to ad personalisation does not in itself mean refusing consent to use of the Game.

The Operator’s legitimate interest in automatic cloud backup is to ensure the retention and restoration of the User’s game progress, reduce the risk of its loss and ensure continuity of use of the Game when changing devices or reinstalling. Cloud backup is activated automatically on the Game’s first connection to the internet. The User may object to processing based on legitimate interest under Art. 21 GDPR and may turn off cloud backup through the “Delete cloud backup and account” function. Using this function removes the relevant cloud backup and Firebase account, and further automatic backup remains off until the User turns it on again.

We make no automated decisions with legal effects and carry out no profiling other than ad personalisation, which Google performs as part of its advertising services under its own policies and the relevant privacy settings.

5. Who receives data

• Google Ireland Ltd. / Google LLC – Firebase (Authentication, Cloud Firestore), AdMob, Google Play. Whether the relevant Google companies act as processors or as independent controllers of personal data depends on the specific service, the purpose of processing and the applicable contractual terms. For cloud storage of data they may act as processors, and for certain operational, advertising or payment activities as independent controllers.
• Cloudflare, Inc. – hosting of the website and of the time file (technical connection data, including the IP address). Whether Cloudflare acts as a processor or as an independent controller depends on the nature of the processing; further information is available at https://www.cloudflare.com/privacypolicy/.
• E-mail service provider – processes your e-mail address and the content of the message if you write to us (support, deletion requests).
• Public authorities – where the law requires us to, or where providing data is necessary for the lawful establishment, exercise or defence of legal claims.

We do not sell personal data or share it for advertising purposes beyond the AdMob processing described above. When AdMob is used, data may also be processed by other parties involved in delivering the ad, according to the relevant settings and rules of the ad service.

6. Transfers outside the EU

Google may process data on servers in the EU, the USA and other countries. Where personal data is transferred outside the European Economic Area, the relevant protection mechanisms under Chapter V of the GDPR apply, in particular European Commission adequacy decisions or the European Commission’s standard contractual clauses together with other necessary safeguards. The specific mechanism depends on the recipient and the service used. Information about the relevant safeguards can be obtained through the Operator’s contact e-mail.

7. How long we keep data

• On-device data – until you uninstall the app or clear its data. This does not affect any copies of the data in the cloud backup or in the Android backup system.
• Cloud backup – until you delete it using the “Delete cloud backup and account” function or ask for it to be deleted; backups that stay inactive for 24 months are deleted automatically. Deletion also covers the relevant Firebase account, but not the user’s Google account itself. The retention periods for technical data at Firebase may be governed by separate rules of that service.
• Support communication – for as long as needed to handle it, at most 3 years, unless longer retention is required by law or is necessary to protect a specific legal claim.
• Technical data processed by the hosting provider (Cloudflare) – according to the relevant terms and rules of the hosting service; the Operator keeps no server logs of its own.
• Purchase data – the Operator does not store purchase tokens or payment confirmations on its own server or in the cloud backup. The result of a purchase is part of the game state and is kept under the rules applicable to local storage and cloud backup.
• Data processed by Google (ads, Play) – according to Google’s policies, to the extent that Google acts as an independent controller of personal data.
• Exceptions to deletion – data that we must or may legitimately keep (e.g. purchase records under accounting and tax rules, records needed to prevent abuse or to resolve disputes) is kept only for the necessary period and for the purposes for which further retention is legally justified.

8. Your rights

Under the GDPR, under the conditions set by the applicable legal regulations, you have the right of access to personal data and to obtain a copy of it, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interest; where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of the earlier processing. You can change or withdraw consent to the processing of personal data for advertising purposes in the app through Settings → Help & Support → Legal information → Ad privacy settings. You have the right to lodge a complaint with a supervisory authority (in Slovakia the Office for Personal Data Protection of the Slovak Republic, dataprotection.gov.sk, or the authority in your country of residence).

Send your request to or use the procedure in the Data deletion section on the page Data deletion. We will inform you of the measures taken without undue delay, at the latest within one month of receiving the request. In justified cases this period may be extended by a further two months under the conditions set by the GDPR. To verify, we may ask for data that reliably shows that the account is yours (e.g. the Google account e-mail or the player name and level) if we have reasonable doubts about the requester’s identity; we require only data that is appropriate and necessary for verifying it.

9. Children

The Game is intended for persons aged 16 and over and is not intended for children or teenagers below that age. We do not knowingly collect personal data from persons under 16 and we do not configure ads as child-directed. Ad consents are managed through Google UMP, and the Game is not set up as an app directed at children. If you believe a child has provided us with personal data, write to us and, after checking the circumstances, we will delete the data to the extent required by law. A parent or legal guardian can also use the procedure on the page Data deletion.

10. Security

Communication with Firebase and the time services is encrypted (HTTPS/TLS). The Firestore security rules allow only the owner to read and change the backup and limit the shape and size of the document. No method of transmission or storage is absolutely secure, however. If a personal data breach posing a risk to your rights occurs, we will report it in accordance with the law.

11. Links to other services

The Game and the website may link to third-party services (sharing, Google Play, Google). We are not responsible for their content or privacy policies.

12. Changes to this policy

We may update this policy, for example when a new feature or service is added. The current version is always on this page with its effective date. We will notify you of material changes in the app or on the website. If a change in the processing of personal data requires further information to be provided or a new consent to be obtained, we will ensure that the relevant obligations are met before such processing begins. Publication of the updated policy does not in itself replace the data subject’s consent where the law requires it.

13. Contact

On personal data protection matters and when exercising data subjects’ rights, you can contact us at the e-mail address . A request to delete the cloud backup and the relevant Firebase account can also be made directly in the app through the “Delete cloud backup and account” function. More detailed information on the deletion procedure is on the page Data deletion. Deleting a Firebase account linked to a Google account does not delete the user’s Google account itself.