Privacy policy

App operator

Lasanha Garage

Information we use

When you register with a password, we process your email address, name, username and password for authentication. Your password is stored as a salted hash. With Google sign-in, we verify your identity, name and email address and store your Google identifier. We do not store your Google password or request access to your Drive. Guests receive a game identity without an email address or password and can upgrade it to an account while keeping their progress. We store submitted cars and photos, answers, progress, XP, specialties, achievements, collections, virtual credits and duels to provide the app’s features.

Visibility and security

Other players can see your name, username, garage, collection and statistics. Your email address, password and authentication token are not public. Android sessions use protected storage. The API requires HTTPS in production, and the app cannot access the database directly.

Activity events and reports

We record our own events for garage, car and collection views and the start of an unlock, linked to your account. Versions with advertising enabled use Google AdMob and UMP. We have not installed Firebase Analytics; the usage events described here are recorded by our own API. Reports and blocks help keep the community safe. IP addresses are processed to establish connections and limit abuse. Log retention will be specified before publication.

Hosting

In production, we use Contabo hosting with our own API and PostgreSQL database. Encrypted backups of the database, photos and configuration are stored in the operator’s Google Drive to allow recovery after a failure.

Account deletion

Confirm your password under Profile → Privacy and security → Delete account, or on the public account deletion page. We remove the account’s personal information, garage, uploads, answers, progress, collection, credits, events and blocks. Shared duel results remain under Deleted account, without your name, photo or profile. Your session is invalidated and the account cannot be recovered. Failed file deletions are logged for retry.

Retention and backups

Account data is kept while the account exists. The operator will specify retention periods for backups, logs and reports before publication. Backups are isolated. After a restoration, account deletions must be reapplied before the service is reopened. This version does not promise a retention period that is not yet operational.

Optional notifications

With your permission, Firebase Cloud Messaging delivers duel, daily challenge and achievement updates. For each installation we store its delivery token, account binding, hashed installation identifier, language, timezone, platform, app version, preferences and activity dates. Invalid tokens can be disabled. On sign-out we attempt to detach the installation and invalidate its token; queued deliveries are checked again before sending. Promotional updates are initially off. Change categories in the app and notification permission in Android settings. Push payloads do not include quiz questions or answers, photos or passwords.

Advertising and consent

When configured and enabled, Google AdMob rewarded ads are voluntary and interstitials appear sparingly at quiz breaks. UMP updates your privacy choices; ads are requested only when the SDK permits. Where required, privacy options can be reopened in the app. The SDK may process device/advertising identifiers, IP addresses, technical information and ad interactions under applicable choices and Google policies. Declining personalization does not necessarily prevent all technical processing. Versions without active configuration do not request ads. Credits are granted only after a signed provider confirmation, recorded in our ledger; device callbacks cannot grant a balance.

Ad and push events

Our API records limited ad request, load, failure, impression and click events, format, placement, language and session duration, plus notification permission, receipt and opening events. Confirmed rewards and transactions are server records. These events do not collect free text, FCM tokens or credentials. Account deletion removes device registrations, preferences, deliveries and ad sessions along with other personal information. Inactive tokens and operational events may be removed by the internal retention task.

Crash diagnostics

Builds with diagnostics enabled use Firebase Crashlytics to investigate crashes and app stability. The service processes crash records, stack traces, app version, device model, operating system and technical Firebase installation identifiers. We do not associate these reports with your account or attach your name, email, answers, passwords or tokens. Dart reports omit the original error message and filter common credential patterns from stack traces. You can disable automatic sending under Profile → Privacy and security → Crash reports. Disabling does not delete reports already received by the provider. This integration does not install Firebase Analytics.

Contact and requests

luccamota22@gmail.com