Hoop Loop Privacy Policy
Last updated: 16 August 2026
Hoop Loop is a basketball throwing game for iOS and Android (bundle id org.fubl.throwit). It is made and published by an individual developer based in Austria, in the EU, so the GDPR applies.
The data controller is:
Felix Ubl
Grinzinger Allee 42/9
1190 Vienna
Austria
Contact: hi@fubl.org
The short version
Hoop Loop has no user accounts. You never give it an email address, a password, a name or a phone number. Five things leave the device: your daily leaderboard score, a backup of your save file, crash reports, ad requests, and a note that the app was started. A sixth, a bug report, is sent only if you write one. Each one is described below.
The game does not collect your location, your contacts, your photos, your health data or your device's phone number. There is no push notification service.
1. What stays on your device
The game keeps a single save file in the app's own storage. It is used on the device, and it is also backed up as described in section 3. It contains:
- Coins, gems and whether you own the coin doubler.
- Which skins you own and which ball, hoop and court you have equipped.
- Records and totals: best streak, best run points, best hot and swish streaks, total shots, makes and swishes, and your best points and streak per mode.
- Settings: sound on or off, haptics on or off, master volume, the audio mix, the aim guide, the practice backboard, the mirrored court, your chosen language and appearance, and the notification preference.
- Your experience points, from which your level is worked out, and which achievements you have earned and claimed.
- Daily state: daily reward streak, challenge progress, daily bests, and for each ranked mode when your league week runs out and how many of the day's runs you have used.
The game also stores your last run and your best run per mode on the device as replay data, so you can watch them back.
If a score cannot be uploaded straight away (no network, for example), it waits in a small queue on the device (at most six entries) and is sent the next time the game reaches the server. Entries from earlier days are dropped instead of sent.
Uninstalling Hoop Loop deletes all of this.
2. The daily leaderboard (Supabase)
The leaderboard runs on Supabase, which acts as the processor for this data.
Sign-in is anonymous. The game signs in with Supabase anonymous authentication. No email address, no password, no name, no social login. Supabase issues a random account id (a UUID) that identifies the row and nothing else about you.
Your handle is generated, not chosen. On first connection the game picks a name at random by joining one word from a fixed adjective list, one word from a fixed animal list and a two digit number, for example CosmicOtter42. You do not type it in, and it is not built from your device name, your account or anything else about you. It is stored on the device and reused.
What is stored. Two tables hold the data:
players
- the anonymous account id
- the generated handle
- when the row was created
- when you last submitted a score, and a short term submission counter used for rate limiting
daily_scores
- a row id and the anonymous account id
- the ranked mode (
rankedStandard,rankedHardcore,rankedTrialorrankedTrialHardcore) - the UTC day
- points, best streak and run duration
- a run record and its format version
- a verification flag
- when the row was written
There is one row per player, per mode, per day, and it is only overwritten when you beat your own score for that day.
What the run record is. It is the replay of the run: a format version, the mode, the random seed, the list of inputs (shot timings, charge and drag values, makes, saves, declines and quits) and the run summary. It exists so a score can be replayed and checked for cheating. It contains no personal data and no device identifiers.
When it is sent. Only ranked runs that had at least one shot are submitted with a replay. Casual runs upload only their best numbers (streak, points and baskets) with no replay. Practice never leaves the device.
What other players see. The board shows the top 50 handles for the day with their points, best streak and baskets, plus your own rank. Nobody sees your account id or your run record through the app.
Friends. If you use the friends feature, the game also stores your six character friend code (generated, like the handle) and the friendships you add — pairs of anonymous account ids. Friendships are mutual: adding someone by code links both directions, and removing one removes both. Friends see your handle, your code, and your entries on the boards described above.
Profile cards. So friends can open your player card, the game uploads a small stats snapshot: career totals (balls thrown, baskets, swishes), your personal bests per mode and your league tier in each mode. Only you and players you have added as friends can read it — there is no public listing. The card also shows the date your player row was created.
Daily board prizes. Every daily board pays out by rank, and what each place pays is shown on the board itself. Stored per day and per mode: which prize you were owed and whether it has been paid, so the same day is never paid twice. What a prize pays out is held on your device, not on our servers.
Weekly leagues. Each ranked mode runs its own weekly league. Playing a run enrolls you in that mode's league group for the week, up to 30 players of the same tier. Stored per week and per mode: your group assignment and, once the week is settled, your final rank, weekly points and whether you moved up or down a tier. Members of your group see your handle and weekly points, the same way the daily board works.
3. Account recovery and the save backup (Supabase)
Because there is no account to sign in to, losing the device would otherwise mean losing everything in the game. Two things guard against that.
The recovery code. You can ask the game for a recovery code. The server keeps only a hash of it and hands you the one copy that will ever exist, so a lost code can be replaced but never read back. Entering it on another device moves your player row — handle, friend code, friendships and league tiers — to that device. Making a new code cancels the old one. Stored on your player row: the hash and the date the code was made.
The save backup. Whenever you leave the app, your save file is uploaded whole and stored against your anonymous account id. It is the same data listed in section 1. The server stores it and never looks inside: nothing reads it, nothing checks it and no decision is made from its contents. It is downloaded again only onto a device that has no save of its own, which is what makes a recovery code give you back the game and not just the name.
4. Crash reports (Sentry)
If the game crashes or throws an unhandled error, a report is sent to Sentry so the bug can be fixed. A report contains the error, the stack trace and basic technical context such as device model, OS version and app version.
Personally identifying information is deliberately switched off. The SDK is initialised with sendDefaultPii: false, so it does not attach things like your IP address to reports. Your handle and your Supabase account id are never attached. Performance tracing is off (tracesSampleRate: 0), so no browsing or usage traces are collected.
5. Counting launches (Expo)
The app includes Expo's insights module. When the game starts, it sends one event to Expo saying that the app was started, with the app version and the platform. It carries no handle, no advertising identifier and nothing about how you play. Expo is the processor for it, and as with any network request Expo's servers see the IP address the request came from.
6. Ads (Google AdMob)
Hoop Loop shows two kinds of ad through Google AdMob: rewarded ads you choose to watch in exchange for something in the game, and occasional interstitials between runs.
To serve an ad, Google receives the advertising identifier of your device (the IDFA on iOS, the Advertising ID on Android) along with the technical data an ad request normally carries, such as device type, OS version, coarse locale and IP address. Google is a separate controller for that data. Its handling is described in the Google Privacy Policy and the AdMob documentation.
The app tells Google that its content rating cap is "Teen", that the app is not directed at children, and that it is not tagged for users under the age of consent.
Consent, for users in the EU, the EEA and the UK. Before ads start, the game runs Google's User Messaging Platform (UMP) consent flow. You are shown Google's consent form and your choice is recorded there.
iOS App Tracking Transparency. On iOS, the system also asks you whether Hoop Loop may track you across other companies' apps and websites. This is Apple's prompt, and your answer applies to the advertising identifier.
Saying no still gives you ads. Declining consent, or declining the tracking prompt, does not remove advertising from the game. It means the ads you see are non-personalized: they are chosen from context rather than from a profile built out of your activity.
Changing your mind.
- iOS: Settings, then Privacy and Security, then Tracking, and turn Hoop Loop off. You can also turn off "Allow Apps to Request to Track" for every app.
- Android: Settings, then Google, then Ads, where you can delete or reset the advertising ID and opt out of ad personalization.
- The UMP choice is stored by the Google SDK inside the app. Removing and reinstalling Hoop Loop clears it, so the form is shown again the next time you start the game. If you want your choice changed and cannot do it yourself, write to hi@fubl.org.
7. Purchases
In-app purchases are processed entirely by Apple on iOS and by Google on Android. Hoop Loop asks the store to start a purchase for a product id and is told back only whether it succeeded, is pending, was cancelled or failed. When you restore purchases, the store tells the app which non-consumable product ids you own.
The app never sees and never stores your card number, your bank details, your billing address or your store account. What you bought is unlocked in the save file on your device. There is no purchase history on any server run by the developer. Apple's and Google's own privacy policies cover the payment itself.
8. Notifications
Reminders are local notifications only. They are scheduled by the app on your own device and fire from your device. There is no push token, no notification server and nothing about them leaves the phone. You can refuse the permission or withdraw it later in the system settings, and you can turn reminders off inside the game.
9. Sharing a score card
If you share a run, the game renders an image file on your device and hands it to the system share sheet. Where it goes from there is your choice and is governed by whichever app you share it with. Nothing is uploaded by Hoop Loop.
10. Bug reports (Supabase)
The settings screen has a "Report a bug" box. Nothing is sent unless you write a message and send it. What is stored with it: your anonymous account id, the text you wrote, the app version and build, the platform and OS version, your language, the name your device reports for itself, which mode you were in and the version of your save file. The device name is whatever you called the phone, so if you would rather it were not attached, rename the phone or write to hi@fubl.org instead.
11. Children
Hoop Loop is not directed at children and is not designed or marketed for them. The ad SDK is configured accordingly (not child directed, not tagged for users under the age of consent, content rating capped at "Teen"). The game does not knowingly collect data from children. If you believe a child has submitted a score, write to hi@fubl.org with the handle and it will be deleted.
12. How long data is kept
- Daily scores. A scheduled job on the database deletes daily score rows older than 30 days. It runs once a day.
- League weeks. Weekly group assignments and results are deleted eight weeks after the week they belong to. Your current tier in each mode stays with your player row.
- The player row. Your handle, anonymous account id, friend code, friendships, league tiers, profile card stats and recovery code hash stay until you ask for deletion.
- The save backup. One copy per player, replaced each time it is uploaded, kept until you ask for deletion or the player row goes.
- Crash reports. Kept for as long as Sentry's retention period for the project allows, then deleted by Sentry.
- Bug reports. Kept until the bug is dealt with, and deleted on request.
- Local data. Stays on your device until you delete the app.
13. Your rights under the GDPR
You have the right to ask for access to your data, to have it corrected, to have it deleted, to have processing restricted, to receive it in a portable form, to object to processing based on legitimate interests, and to withdraw any consent you have given. Withdrawing consent does not affect processing that already happened.
The legal bases are: your consent for personalized advertising, and legitimate interest for running the leaderboard, keeping it free of cheating, and fixing crashes.
How to exercise them. Write to hi@fubl.org. Because there is no account, the only way to find your data is your handle, so please include it. You can read your handle on the leaderboard screen in the game. On request, the player row, your save backup and every daily score attached to it are deleted together. Everything else lives on your device and is yours to delete by removing the app.
To withdraw advertising consent, see the "Changing your mind" steps in section 6.
You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde (Austrian Data Protection Authority).
14. Changes to this policy
If the game starts collecting something new, this file is updated and the date at the top changes with it.
15. Contact
Felix Ubl
Grinzinger Allee 42/9
1190 Vienna
Austria