Privacy Policy - Fortune Smash Gala

Privacy Policy

Fortune Smash Gala · Effective September 4th, 2026

Fortune Smash Gala collects certain data to operate smash events, gala features, and optional rewards. This policy explains what, why, and how — plus your rights under GDPR, CCPA/CPRA, and VCDPA.

What Do These Terms Mean?

Application
Fortune Smash Gala, the mobile smash-and-gala entertainment experience we distribute.
Personal data
Any information relating to an identified or identifiable natural person.
Usage Data
Information recorded automatically from your Device or our systems (session length, smash interactions, crash reports).
Device
A smartphone, tablet, or similar apparatus used to access the Application.
Service Provider
A party that processes data on our behalf to help run the service.

What Data Do We Gather?

We collect two categories of personal data: information generated automatically, and information you provide voluntarily.

Automatic

  • IP address and network metadata
  • Device Info (model, OS, WebView)
  • Identifiers (GAID, ANDROID_ID, equivalents)
  • Usage Data (sessions, smash events)
  • Crash logs and diagnostics

With permission / you provide

  • Advertising IDs (GAID / IDFA)
  • Engagement and event signals
  • PayPal email and name for withdrawals only

Why Do We Need Your Data?

Your personal data powers core functions (gameplay, accounts, payments), communications (updates, support), and improvements (analytics, feature development).

  • Operate and monitor Fortune Smash Gala smash rounds and gala features
  • Manage accounts, authentication, and settings
  • Process PayPal withdrawals and related verification
  • Respond to support requests and send service notices
  • Analyze patterns, improve stability, and measure offers
  • Support mergers, acquisitions, or restructuring when applicable

When Is Data Shared?

Data sharing is limited to operational necessities.

  • Service Providers — analytics, hosting, support, payment processors
  • Business Transfers — merger, acquisition, financing, or asset sale
  • Affiliates & partners — common control or joint offerings
  • Legal — required by law, regulation, or valid process
  • Consent — purposes disclosed at collection or later approved

PayPal protection: We do not sell or rent PayPal account email addresses. Such personal data is disclosed only with your explicit consent or as required by applicable law.

What Can You Do About Your Data?

Local laws give you tools to access, correct, delete, or restrict how we use your personal data.

GDPR (EEA)

  • Access
  • Rectification
  • Erasure
  • Restrict processing
  • Object

CCPA / CPRA (California)

  • Know
  • Delete
  • Opt-Out of sale
  • Non-Discrimination

VCDPA (Virginia): Access, Correct, Delete, Portability, and Opt-Out of targeted advertising, sales, and profiling.

Send requests to oa@quijanoss.com.

How Do You Opt Out?

  • Android: Settings → Google → Ads → “Opt out of Ads Personalization”
  • iOS: Settings → Privacy → Advertising → “Limit Ad Tracking”
  • Do Not Sell: email oa@quijanoss.com with subject Do Not Sell

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. Questions may be sent to the contact email below.

Data Protection Officer

Privacy inquiries and DPO-related requests may be directed to oa@quijanoss.com. We endeavor to respond within 48 hours.

Analytics & Endpoints

Services are reachable at https://xoul.fosmga.com. Analytics payloads are anonymized and are not designed to contain personally identifiable information. The same endpoint supports core smash/gala delivery, progress sync, stability work, and support.

  • TLS 1.2+ for all transmissions
  • Role-based access controls
  • Data minimization and periodic security reviews
  • Data Processing Agreements with third-party handlers

App Permissions

PermissionPurposeData
INTERNETAds, updates, gameplayNetwork status
ACCESS_NETWORK_STATEAdapt to connection typeNetwork type
ACCESS_WIFI_STATEStable Wi-Fi playWi-Fi status
AD_IDAd personalizationResettable ad ID
VIBRATEHaptic feedback on smash hitsNone
ACCESS_ADSERVICES_TOPICSAd topic signalsTopic data
ACCESS_ADSERVICES_ATTRIBUTIONCampaign attributionAttribution data
BIND_GET_INSTALL_REFERRER_SERVICEInstall sourceCampaign parameters
BIND_APPHUB_SERVICEAd delivery optimizationImpression data
ACCESS_ADSERVICES_AD_IDModern ad API complianceAd service IDs
FOREGROUND_SERVICECritical background tasksNone
DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSIONSecure broadcastsNone

Data Security

We apply commercially reasonable safeguards, including TLS 1.2+, access controls, encryption where appropriate, and partner contractual requirements. Absolute security cannot be guaranteed.

Data Retention

Personal data is kept only while needed. After 90 days of inactivity, we permanently delete your personal data. Anonymized Usage Data may remain for internal analysis.

International Transfers

Personal data may be processed outside your country. Transfers use TLS 1.2+ and, where required, Standard Contractual Clauses or equivalent safeguards.

Third-Party Services / Ad Partners

Ads may be served through AppLovin and its mediated network. Categories shared with advertising partners are strictly limited.

May be shared

  • Resettable advertising identifiers
  • Device model, OS, screen size
  • Session frequency and duration
  • Ad impressions and clicks
  • Non-precise demographics

Never shared for ads

  • Email or phone numbers
  • Account credentials
  • Detailed smash progress or balances
  • User-generated content
  • Precise geolocation

Partner privacy policies