DRILL Privacy Policy
Version of October 26, 2026
This policy explains what personal data the game DRILL processes, why, how long we keep it and what rights you have. We follow the EU General Data Protection Regulation (GDPR).
1. Who is responsible for the data
The data controller is RGGame. Contact for data matters: our Discord.
2. What data we process
| Data | Source | Purpose |
|---|---|---|
| Your Google account's permanent identifier, email address and a flag that it is verified | Google, at sign-in | Signing in to the game, one game account per Google account |
| Name from your Google profile | Google, at first sign-in | Only a nickname suggestion and the email address risk assessment; not stored separately |
| Nickname, portrait, faction, game progress, resources, Gems, season history, market deals | You and the game | Providing the game, the Leaderboard and the market (other players see your nickname) |
| Sign-in sessions: a random token (the database holds only its hash), IP address, a random device identifier, browser | Your browser | Secure sign-in, "Sign out on all devices", detecting multiple accounts |
| Log of game actions with IP address | The game server | Fair play, investigating bugs and fraud, balance |
| Aggregated activity data: how many taps, clicks and key presses per minute, whether the tab is visible, time to decision. No coordinates and no record of which keys were pressed | Your browser | Protection against bots |
| Email address risk assessment (a number from 0 to 100 and the reasons) | Calculated by the server | Protection against bots; the assessment is shown to no one |
| Cloudflare Turnstile check result | Cloudflare | Protection against bots |
| Text of the account review form | You | Manual review of restrictions applied by the protection system |
Genesis registration (play.drillgame.fun before the game launches):
| Data | Source | Purpose |
|---|---|---|
| X username, Robinhood Chain wallet address (if you add it), your invite code and the code you registered with | You | Genesis access, the Genesis SFT and invite rewards; the top inviters list shows the X username with all but the first and last letter hidden, and the wallet with all but the first and last 5 characters hidden |
| A one-way hash of your IP address (the address itself is not stored), network operator, country, browser type | Your browser and Cloudflare | Protection against bots and fake invites |
We do not receive Google passwords and do not collect geolocation, contacts or payment cards. For now, the USDC balance in the game is a test balance with no real value.
3. Legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): account, sign-in, game progress, market, Leaderboard.
- Legitimate interest (Art. 6(1)(f) GDPR): security, protection against bots and multiple accounts, fraud prevention, logs for investigating bugs.
- Legal obligation (Art. 6(1)(c) GDPR): where the law requires us to keep or disclose data.
4. Automated decisions
The anti-bot system assesses signs such as playing without breaks, actions without input, or several accounts on one device. When several signs match, the game shows a monitoring warning in the Trust Rating and asks you to confirm you are present with the "I'm here" button. If checks are often failed, 5 or more accounts play from one network, or accounts from the same network or device make market deals with each other, market selling may be closed and the Trust Rating lowered; the rest of the game keeps working. You can appeal such a decision with the review form in the game ("Season" → "Rating") or on our Discord — a human will review it.
5. Who we share data with
- Google — sign-in with a Google account (Google Identity Services).
- Cloudflare — the Turnstile anti-bot check; hosting of the Genesis registration page and its data.
- Hosting — the game's server and database.
These services may process data outside the EU; such transfers rely on the EU Standard Contractual Clauses or adequacy decisions. We do not sell personal data and do not share it with advertising networks. Other players see only your nickname, portrait, faction, rating and Leaderboard results.
6. How long we keep data
- Account data and game progress — while the account exists; after the account is deleted, we delete them within 30 days.
- Sign-in sessions — up to 30 days or until you sign out.
- Log of game actions — 90 days.
- Genesis registration — until the Genesis rewards are delivered, then for as long as the bound rewards exist on your account.
- Account security events (sign-ins, checks, anti-bot decisions, review forms) — while the account exists.
- Data the law requires us to keep longer — for as long as the law requires.
7. Cookies and browser storage
The game uses one cookie — drill_sid: the sign-in session identifier, strictly necessary for the game to work (httpOnly, for the game's addresses only, up to 30 days). In browser storage (localStorage), the game keeps sound settings, the language choice, a random device identifier and interface service data. There are no advertising or analytics cookies. Cloudflare Turnstile may use its own technical data for the check.
8. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing and data portability, to object to processing based on legitimate interest, and the right not to be subject to a decision based solely on automated processing. Message us on our Discord and include your player ID (Account window → "Profile"). We reply within one month. You may also lodge a complaint with the data protection supervisory authority in the EU country where you live or work.
9. Age
The game is intended for persons aged 18 or older. We do not knowingly collect children's data; if we learn of an account belonging to a person under 18, we will delete it.
10. Security
The connection to the game is encrypted (HTTPS). Session tokens are stored in the database only as hashes. Only the game's administrators have access to the data.
11. Changes
We will announce material changes to this policy in the game. The current version is always available at this address.