Hoop Loop Privacy Policy

Last updated: 24 September 2026

Hoop Loop is a basketball throwing game for iOS and Android (bundle id org.fubl.throwit). It is made and published by an individual developer based in Austria, in the EU, so the GDPR applies.

The data controller is Felix Ubl, in Vienna, Austria. Contact: hi@fubl.org. The full postal address is in section 16.

The short version

Hoop Loop has no user accounts. You never give it an email address, a password, a name or a phone number. What leaves the device: your scores, statistics about how you play (your runs, how long you play and on which screens, how far you got in the tutorial), a backup of your save file, the purchases the store confirms, crash reports, ad requests, a note that the app was started, and — only if you allow notifications — a push token, so the game can tell you when somebody takes your place on a leaderboard. A bug report or an idea is sent only if you write one. Each one is described below. None of it is sold or used to build an advertising profile.

The game does not collect your location, your contacts, your photos, your health data or your device's phone number.

1. What stays on your device

The game keeps a single save file in the app's own storage. It is used on the device, and it is also backed up as described in section 3. It contains:

• Coins, gems and whether you own the coin doubler.
• Which skins you own and which ball, hoop and court you have equipped.
• Records and totals: best streak, best run points, best hot and swish streaks, total shots, makes and swishes, and your best points and streak per mode.
• Settings: sound on or off, haptics on or off, master volume, the audio mix, the aim guide, the practice backboard, the mirrored court, your chosen language and appearance, and the notification preference.
• Your experience points, from which your level is worked out, and which achievements you have earned and claimed.
• Daily state: daily reward streak, challenge progress, daily bests, and for each ranked mode when your league week runs out and how many of the day's runs you have used.

The game also stores your last run and your best run per mode on the device as replay data, so you can watch them back.

If a score cannot be uploaded straight away (no network, for example), it waits in a small queue on the device (at most six entries) and is sent the next time the game reaches the server. Entries from earlier days are dropped instead of sent.

Uninstalling Hoop Loop deletes all of this.

2. The daily leaderboard (Supabase)

The leaderboard runs on Supabase, which acts as the processor for this data.

Sign-in is anonymous. The game signs in with Supabase anonymous authentication. No email address, no password, no name, no social login. Supabase issues a random account id (a UUID) that identifies the row and nothing else about you.

Your handle is generated, not chosen. On first connection the game picks a name at random by joining one word from a fixed adjective list, one word from a fixed animal list and a two digit number, for example CosmicOtter42. You do not type it in, and it is not built from your device name, your account or anything else about you. It is stored on the device and reused. If you pay to choose your own name, the name you type is stored, read by the developer before it goes up, and your earlier names are kept so one cannot be claimed twice.

What is stored. Two tables hold the data:

players

• the anonymous account id
• the generated handle
• when the row was created
• when you last submitted a score, and a short term submission counter used for rate limiting
• when the app was last opened
• the platform, the app version and build, how the app was installed (App Store, TestFlight or a development build) and the store environment, so test copies can be told apart from real players
• the region your device is set to. This is a setting you chose, not your location: it is never looked up from your IP address
• your phone's model identifier (for example iPhone15,2) and system version, never the name you gave the phone

daily_scores

• a row id and the anonymous account id
• the ranked mode (rankedStandard, rankedHardcore, rankedTrial or rankedTrialHardcore)
• the UTC day
• points, best streak and run duration
• a run record and its format version
• a verification flag
• when the row was written

There is one row per player, per mode, per day, and it is only overwritten when you beat your own score for that day.

What the run record is. It is the replay of the run: a format version, the mode, the random seed, the list of inputs (shot timings, charge and drag values, makes, saves, declines and quits) and the run summary. It exists so a score can be replayed and checked for cheating. It contains no personal data and no device identifiers.

When it is sent. Ranked runs that had at least one shot are submitted with a replay, so they can be checked. For the boards, casual runs upload your best numbers (streak, points and baskets). Every run is also counted in the play statistics described in section 11. Practice never leaves the device.

What other players see. The board shows the top 50 handles for the day with their points, best streak and baskets, plus your own rank. Nobody sees your account id or your run record through the app.

Friends. If you use the friends feature, the game also stores your six character friend code (generated, like the handle) and the friendships you add — pairs of anonymous account ids. Friendships are mutual: adding someone by code links both directions, and removing one removes both. Friends see your handle, your code, and your entries on the boards described above.

Profile cards. So friends can open your player card, the game uploads a small stats snapshot: career totals (balls thrown, baskets, swishes), your personal bests per mode and your league tier in each mode. Only you and players you have added as friends can read it — there is no public listing. The card also shows the date your player row was created.

Rewards that depend on other players. A friend code you enter within your first two weeks can count as a referral: stored is who referred whom and when, so it pays once. Some items go only to the first players to reach a goal: stored is that you claimed one. A tester code you redeem is stored with your account id so it works once.

Daily board prizes. Every daily board pays out by rank, and what each place pays is shown on the board itself. Stored per day and per mode: which prize you were owed and whether it has been paid, so the same day is never paid twice. What a prize pays out is held on your device, not on our servers.

Weekly leagues. Each ranked mode runs its own weekly league. Playing a run enrolls you in that mode's league group for the week, up to 30 players of the same tier. Stored per week and per mode: your group assignment and, once the week is settled, your final rank, weekly points and whether you moved up or down a tier. Members of your group see your handle and weekly points, the same way the daily board works.

3. Account recovery and the save backup (Supabase)

Because there is no account to sign in to, losing the device would otherwise mean losing everything in the game. Two things guard against that.

The recovery code. You can ask the game for a recovery code. The server keeps only a hash of it and hands you the one copy that will ever exist, so a lost code can be replaced but never read back. Entering it on another device moves your player row — handle, friend code, friendships and league tiers — to that device. Making a new code cancels the old one. Stored on your player row: the hash and the date the code was made.

The save backup. Whenever you leave the app, your save file is uploaded whole and stored against your anonymous account id. It is the same data listed in section 1. No decision about you is made from its contents. For the play statistics in section 11 the developer reads a few named fields from it: coins and gems, which skins you own and wear, your settings, whether you allowed notifications and how far you got in the tutorial. It is downloaded again only onto a device that has no save of its own, which is what makes a recovery code give you back the game and not just the name.

4. Crash reports (Sentry)

If the game crashes or throws an unhandled error, a report is sent to Sentry so the bug can be fixed. A report contains the error, the stack trace and basic technical context such as device model, OS version and app version.

Personally identifying information is deliberately switched off. The SDK is initialised with sendDefaultPii: false, so it does not attach things like your IP address to reports. Your handle and your Supabase account id are never attached. Performance tracing is off (tracesSampleRate: 0), so no browsing or usage traces are collected.

5. Counting launches (Expo)

The app includes Expo's insights module. When the game starts, it sends one event to Expo saying that the app was started, with the app version and the platform. It carries no handle, no advertising identifier and nothing about how you play. Expo is the processor for it, and as with any network request Expo's servers see the IP address the request came from.

6. Ads (Google AdMob)

Hoop Loop shows two kinds of ad through Google AdMob: rewarded ads you choose to watch in exchange for something in the game, and occasional interstitials between runs.

To serve an ad, Google receives the advertising identifier of your device (the IDFA on iOS, the Advertising ID on Android) along with the technical data an ad request normally carries, such as device type, OS version, coarse locale and IP address. Google is a separate controller for that data. Its handling is described in the Google Privacy Policy and the AdMob documentation.

The app tells Google that its content rating cap is "Teen", that the app is not directed at children, and that it is not tagged for users under the age of consent.

Consent, for users in the EU, the EEA and the UK. Before ads start, the game runs Google's User Messaging Platform (UMP) consent flow. You are shown Google's consent form and your choice is recorded there.

iOS App Tracking Transparency. On iOS, the system also asks you whether Hoop Loop may track you across other companies' apps and websites. This is Apple's prompt, and your answer applies to the advertising identifier.

Saying no still gives you ads. Declining consent, or declining the tracking prompt, does not remove advertising from the game. It means the ads you see are non-personalized: they are chosen from context rather than from a profile built out of your activity.

Changing your mind.

• iOS: Settings, then Privacy and Security, then Tracking, and turn Hoop Loop off. You can also turn off "Allow Apps to Request to Track" for every app.
• Android: Settings, then Google, then Ads, where you can delete or reset the advertising ID and opt out of ad personalization.
• The UMP choice is stored by the Google SDK inside the app. Removing and reinstalling Hoop Loop clears it, so the form is shown again the next time you start the game. If you want your choice changed and cannot do it yourself, write to hi@fubl.org.

7. Purchases

In-app purchases are processed entirely by Apple on iOS and by Google on Android. Hoop Loop asks the store to start a purchase for a product id and is told back only whether it succeeded, is pending, was cancelled or failed. When you restore purchases, the store tells the app which non-consumable product ids you own.

The app never sees and never stores your card number, your bank details, your billing address or your store account. What you bought is unlocked in the save file on your device. So a purchase can be checked and restored, the server keeps a record of each one against your anonymous account id: the product id, the store's transaction id, whether it is valid, pending or refunded, the store environment and when it happened. Apple's and Google's own privacy policies cover the payment itself.

8. Notifications

There are two kinds, and only one of them involves a server.

Reminders about your daily reward are local notifications. They are scheduled by the app on your own device and fire from your device. Nothing about them leaves the phone.

Leaderboard notifications are sent from the server, so that being knocked off the top three of a board is something you find out about. For that to be possible the app registers a push token with the database once you have allowed notifications. A push token is an address for this installation of the app, issued by Apple or Google through Expo. Stored with it: your anonymous account id, whether the device is iOS or Android, and the language the game is in, which is the only way the notification can be written in your language while the phone is asleep. The notification itself carries no handle and nobody else's score, only the place you have dropped to.

Notifications are delivered by Expo's push service, which passes them to Apple's or Google's own notification service. Those services see the token and the text.

You can refuse the permission or withdraw it later in the system settings, and you can turn reminders off inside the game, which also deletes the token from the server.

9. Sharing a score card

If you share a run, the game renders an image file on your device and hands it to the system share sheet. Where it goes from there is your choice and is governed by whichever app you share it with. Nothing is uploaded by Hoop Loop.

10. Bug reports (Supabase)

The settings screen has a "Report a bug" box. Nothing is sent unless you write a message and send it. What is stored with it: your anonymous account id, the text you wrote, the app version and build, the platform and OS version, your language, the name your device reports for itself, which mode you were in and the version of your save file. The device name is whatever you called the phone, so if you would rather it were not attached, rename the phone or write to hi@fubl.org instead.

11. Play statistics (Supabase)

To see whether the game is fun, fair and easy to learn, and to fix what is not, the game records how it is played. None of it is shown to other players.

• Runs. For every run: when it ended, the mode, why it ended, points, streak, shots, baskets, swishes, how far your finger travelled, how long it took, which saves were used, and for each save card that appeared whether you took it and whether an ad was ready. The full replay of each finished run is included (the same kind of record as in section 2).
• Your device. The model, the operating system version, and the region it is set to.
• Sessions. When the app was opened and closed, the time zone, how long each screen was open, and counts of actions such as opening the store, viewing or buying an item, watching an ad or sharing a score.
• The tutorial. Which lessons you reached, how many attempts each took and how long, and whether you finished or skipped it. This is sent while the tutorial is still going, so leaving halfway is counted too.
• Messages from the game. Which in-app messages you have seen, and your answer when a message asks a question.
• The survey. If you answer the short survey the game offers after some play: whether you like the game, which finger you throw with, and anything you choose to write about wishes or problems. Every question can be skipped, and nothing is sent if you decline.

From these, running totals are kept: per day, and by how many runs you have played.

From version 1.1.0 of the app on, a few more things are recorded. Earlier versions do not send them.

• With every run: your device's offset from UTC when it ended (so a day means your day, not the server's), the app build, and a random id for the run so a run sent twice is counted once. A run you leave mid-way and never come back to is sent too, marked as left.
• How smoothly the game ran during the run: how many frames were drawn, how many came late, the longest one, and whether Low Power Mode was on.
• Once per launch: how long the game took to load, your screen's size and pixel density, and its refresh rate.
• The survey described above is offered from version 1.1.0 on.

12. Children

Hoop Loop is not directed at children and is not designed or marketed for them. The ad SDK is configured accordingly (not child directed, not tagged for users under the age of consent, content rating capped at "Teen"). The game does not knowingly collect data from children. If you believe a child has submitted a score, write to hi@fubl.org with the handle and it will be deleted.

13. How long data is kept

• Daily scores. A scheduled job on the database deletes daily score rows older than 30 days. It runs once a day.
• League weeks. Weekly group assignments and results are deleted eight weeks after the week they belong to. Your current tier in each mode stays with your player row.
• The player row. Your handle, anonymous account id, friend code, friendships, league tiers, profile card stats and recovery code hash stay until you ask for deletion.
• The save backup. One copy per player, replaced each time it is uploaded, kept until you ask for deletion or the player row goes.
• Crash reports. Kept for as long as Sentry's retention period for the project allows, then deleted by Sentry.
• Bug reports. Kept in the database until the bug is dealt with, and deleted on request. The analysis copy below keeps the text without the device name.
• Push tokens. One row per device, replaced when the token changes, deleted when you turn notifications off in the game or when the player row goes.
• Queued notifications. The record that one was sent is deleted a week later.
• Runs. Kept in the database for 14 days, and each run's replay only until it has been copied. The copies are compressed files in the same Supabase project, kept without a fixed end, except that a deleted account's runs are removed from them.
• Sessions, tutorial reports, running totals and messages seen. Kept until you ask for deletion or the player row goes.
• Purchase records. Kept as long as the player row, so a purchase can be restored.
• Inactive players. A player row with no activity for 180 days is deleted from the database, with everything attached to it.
• The developer's analysis copy. To see how the game is played over time, the developer keeps a copy of this data on a server the developer runs. It keeps what the database later drops (old runs, old daily scores, players deleted for inactivity) without a fixed end. It never holds recovery codes, push tokens, device names or the whole save file. When you delete your account, everything about it is removed from this copy too.
• Local data. Stays on your device until you delete the app.

14. Your rights under the GDPR

You have the right to ask for access to your data, to have it corrected, to have it deleted, to have processing restricted, to receive it in a portable form, to object to processing based on legitimate interests, and to withdraw any consent you have given. Withdrawing consent does not affect processing that already happened.

The legal bases are: your consent for personalized advertising, and legitimate interest for running the leaderboard, keeping it free of cheating, fixing crashes, and understanding how the game is played so it can be improved.

How to exercise them. Write to hi@fubl.org. Because there is no account, the only way to find your data is your handle, so please include it. You can read your handle on the leaderboard screen in the game. On request, the player row, your save backup and everything attached to it are deleted together. You can also do this yourself with the Delete account button in the game; for 30 days a recovery code can still bring the account back. Deleting an account also removes its runs from the compressed copies and from the developer's analysis copy. Everything else lives on your device and is yours to delete by removing the app.

To withdraw advertising consent, see the "Changing your mind" steps in section 6.

You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde (Austrian Data Protection Authority).

15. Changes to this policy

If the game starts collecting something new, this file is updated and the date at the top changes with it.

16. Contact

Felix Ubl
Grinzinger Allee 42/9
1190 Vienna
Austria

hi@fubl.org