| Processor Entity | Purpose & Processing Scope | Data Categories Processed | Hosting Jurisdiction | Transfer Safeguard & Policy |
|---|---|---|---|---|
| Supabase Inc. (AWS) | Backend relational database (PostgreSQL 17), authentication, storage, and serverless edge functions | Player profile (email, username, avatar), hashed credentials, gameplay stats, reward requests, audit logs, 2FA challenge hashes | Frankfurt, Germany (eu-central-1 region) | EU DPA · Privacy Policy |
| Google LLC (Play Billing) | In-app purchase processing and receipt validation | Order ID, purchase token, product ID, timestamp (No financial or card data received) | United States | EU-U.S. DPF / SCCs |
| Google LLC (AdMob) | Rewarded video advertising, ad mediation, and Server-Side Verification (SSV) | Google Advertising ID (GAID), IP address, coarse location, ad interaction events | United States | EU-U.S. DPF / SCCs |
| Google LLC (Firebase FCM) | Background push notification dispatch (streak reminders, reward delivery alerts) | FCM push token, message receipt telemetry, device OS version | United States | EU-U.S. DPF / SCCs |
| Google LLC (Crashlytics) | Real-time crash diagnosis and stack trace analysis (release builds only) | Anonymous crash logs, device hardware model, Android OS version, crash timestamps | United States | EU-U.S. DPF / SCCs |
| Google LLC (Play Integrity API) | Anti-cheat verification, root detection, and device genuineness attestation | App licensing state, device integrity verdict tokens, device hardware fingerprint | United States | Integrity Terms |
| Unity Technologies (Unity Ads) | Rewarded video ad mediation via Google AdMob | GAID, IP address, device hardware specs, ad viewing completion events | United States | Standard Contractual Clauses |
| Pangle (ByteDance Pte. Ltd.) | Rewarded video ad mediation via Google AdMob | Advertising identifier (GAID), device brand/model, approximate location, ad performance metrics | Singapore / People's Republic of China | Standard Contractual Clauses |
| proxycheck.io | Server-side IP risk scoring, proxy, VPN, and botnet fraud detection | Client connection IP address (analyzed server-side at login and reward redemption) | United Kingdom | UK GDPR Adequacy / SCCs |
▸ Advance Subprocessor Change Notification
We provide at least thirty (30) calendar days advance notice before engaging any new subprocessor or transferring existing processing activities to a replacement entity. Notices are communicated via in-app alerts and updates to this directory.
If you object to a new subprocessor, you may terminate your account and export your data before the change takes effect. For inquiries, contact metic.apps@gmail.com.