Privacy Policy

01Who We Are

Block Slots is a free Android game published by VelaVia, LLC ("we", "us", "our"). This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding your data.

02Data We Collect

Data you provide directly

• Email address — required to deliver redeemed gift cards.
• Phone number — used to verify you are a real human and prevent fraudulent redemption (one-time SMS code; we do not market to your phone).
• Age attestation — a tap to confirm you are 18 or older; stored as a yes/no flag with the timestamp of attestation.

Data we collect automatically

• Anonymous user ID (UID) — assigned by Firebase Auth on first launch so we can save your progress server-side. Not linked to your real identity unless you complete redemption (which requires email + phone).
• Gameplay state — score, level, currencies, themes owned, time played. Stored in Firebase Firestore against your UID.
• Device + crash logs — Android version, model, region, anonymized crash stack traces (Firebase Crashlytics).
• Approximate region — derived from IP address at the network layer. We do not store precise location.

Data we do NOT collect

• We do not access your contacts, photos, or files.
• We do not access your microphone or camera.
• We do not track your precise GPS location.
• We do not collect data from children under 13. Block Slots is not directed at children. If you believe a child has provided us data, contact us and we will delete it.

03How We Use Your Data

• To save and sync your game progress across devices.
• To deliver gift-card rewards you redeem from Loyalty Tokens.
• To prevent fraud, abuse, and bot-driven redemption.
• To diagnose crashes and improve game stability.
• To comply with legal obligations (e.g. tax reporting on prizes > $600/year USD).

We do not sell your data. We do not share your data with advertisers for cross-app targeting. We do show in-game ads (rewarded video, interstitial); ad SDKs may use Android Advertising ID per platform policy and your device-level opt-out settings.

04Loyalty Token Program

Block Slots includes an in-game Loyalty Token system. Tokens are earned through skill and engagement (daily login, completed missions, time played, rewarded video opt-ins, level progression). Tokens are not earned from chance, slot outcomes, or RNG events.

• Tokens have no cash value and cannot be transferred between accounts.
• Tokens may be exchanged for digital gift cards via our reward partner (Tremendous, Inc.) at the published exchange rate inside the app.
• Redemption requires you to be 18 years or older and to verify a working email and phone number.
• We reserve the right to limit, delay, or deny redemptions if we detect abuse, fraud, or violations of these terms.
• If we discontinue the program, you will receive at least 30 days' notice and a final redemption window.

05Third-Party Services

The following third parties process limited data on our behalf:

• Google Firebase (Auth, Firestore, Functions, Crashlytics) — hosting, authentication, gameplay state, crash reports. Firebase privacy.
• Tremendous, Inc. — gift-card fulfilment for redeemed tokens; receives only your email and the redemption amount at the moment of redemption. Tremendous privacy.
• Unity Ads — anonymized ad serving, frequency capping. Unity Ads privacy.
• Google Play — app distribution, in-app purchases (if used). Google privacy.

06Data Retention

• Anonymous gameplay state — kept while your account is active and for 24 months after last activity, then deleted.
• Verified email + phone — kept while your account is active and for 7 years after final redemption (tax records). Then deleted.
• Crash logs — 90 days.
• Tax records (where total annual prizes exceed $600 USD) — 7 years per IRS retention requirements.

07Your Rights

You can request the following at any time by emailing contact@velavia.io:

• Access — a copy of all data we have linked to your account.
• Correction — we will fix any inaccurate data within 30 days.
• Deletion — we will delete your account and all linked data within 30 days, except records we are legally required to retain (tax records).
• Opt out of advertising ID — disable on your device: Android Settings → Privacy → Ads → Reset/Delete advertising ID.

Rights by jurisdiction

• California (CCPA / CPRA) — right to know, delete, correct, opt out of "sale" or "sharing" of personal information, and limit use of sensitive personal information. We do not sell personal information.
• EU / EEA / UK (GDPR / UK GDPR) — right of access, rectification, erasure, portability, restriction, objection, and to withdraw consent. Our lawful basis is contract performance (rewards) and legitimate interest (anti-fraud, analytics). You may lodge a complaint with your local supervisory authority. Our designated EU representative will be appointed before any active EU rollout and disclosed here.
• Canada (PIPEDA / Quebec Law 25) — right of access, correction, withdrawal of consent, and (Quebec) right to data portability and request information on automated decision-making.
• UK — same as EU GDPR; complaints to the ICO.
• Australia (Privacy Act 1988) — right of access and correction; complaints to the OAIC.
• New Zealand (Privacy Act 2020) — right of access and correction; complaints to the Privacy Commissioner.
• Brazil (LGPD) — right of access, correction, deletion, portability, and to confirm processing.
• Mexico (LFPDPPP) — ARCO rights: Access, Rectification, Cancellation, Opposition.
• Japan (APPI) — right of access, correction, and cessation of use.
• All other countries — we will honour reasonable access and deletion requests regardless of jurisdiction.

08International Data Transfers

Block Slots is operated from the United States. When you play from outside the US, the personal data described in Section 02 is transferred to, stored, and processed in the United States and (for some sub-processors) other countries.

For transfers out of the EU/EEA, UK, and Switzerland we rely on the Standard Contractual Clauses (2021 EU SCCs and the UK International Data Transfer Addendum) with each sub-processor, supplemented by additional safeguards including encryption in transit and at rest and purpose limitation. A copy of the SCCs we use is available on request to contact@velavia.io.

For transfers involving Quebec residents we comply with Law 25's cross-border transfer assessment requirements. For Brazil we rely on the standard transfer mechanisms recognised by the ANPD under the LGPD.

09Security

We use industry-standard security measures including HTTPS for all network requests, Firebase server-side security rules, encrypted at-rest storage, and role-based access for VelaVia staff. No system is perfectly secure; if we discover a breach affecting your data, we will notify you within 72 hours per applicable law.

10Children

Block Slots is not intended for children under 13. We do not knowingly collect data from anyone under 13. The Loyalty Token redemption flow is gated behind an 18+ attestation. If you are a parent or guardian and believe your child has used Block Slots, contact us and we will delete their data.

11Changes

We may update this policy. Material changes will be announced in-game and via a notice on this page at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent change.

12Contact