Data Disclosure
Data & Information Disclosure
Last updated: October 23, 2026
This page discloses all data collection, third-party services, SDK integrations, and advertising practices used in the HaniLab website (hanilab.app) and the HaniLab mobile games. This information is provided to comply with Google Play Data Safety requirements, Apple App Store Privacy Nutrition Labels, Google AdMob policies, and GDPR/CCPA regulations.
1. Data Collected by HaniLab Mobile Games
| Data Type | Purpose | Shared with Third Parties | Storage |
|---|---|---|---|
| Game progress (score, level, settings) | Save game state | No | Device only (PlayerPrefs) |
| Nickname (user-chosen) | In-game profile display | No | Device only |
| Equipped items & inventory | Item management | No | Device only |
| Language preference | Localisation | No | Device only |
| Ad interaction data | Rewarded ad delivery | Google AdMob | Third-party servers |
| Device ID / Advertising ID | Ad targeting (with consent) | Google AdMob | Third-party servers |
| Crash / diagnostic data | Bug detection & quality | No | Device only |
| Anonymous UUID hash (SHA-256) | Active player count tracking | No | HaniLab server; auto-deleted after 90 s inactivity |
| Game score & level | Global ranking percentile calculation | No | HaniLab server (anonymised) |
| 2-letter region code (device locale) | Regional player distribution statistics | No | HaniLab server (anonymised) |
HaniLab's server collects anonymised data for global ranking and active-player features (rows 8–10 above). All other gameplay data stays on-device unless shared with Google AdMob as described above.
2. Data Collected by hanilab.app (Website)
| Data Type | Purpose | Shared with Third Parties | Retention |
|---|---|---|---|
| Contact form (email, subject, message) | Reply to inquiries | No (stored in email inbox) | Up to 2 years |
| IP address | Server security, fraud prevention | Hosting provider | 30 days (server logs) |
| Browser & device info | Analytics & optimisation | Google Analytics | 26 months |
| Page visit data | Traffic analysis | Google Analytics | 26 months |
| Cookie (hl_lang) | Language preference | No | 1 year |
| Ad interaction data | Advertising revenue | Google AdSense | Per Google policy |
3. Third-Party SDKs & Services
| Service | Provider | Purpose | Privacy Policy |
|---|---|---|---|
| Google AdSense | Google LLC | Display advertising on website | Link |
| Google AdMob | Google LLC | In-app advertising (mobile) | Link |
| Google Analytics | Google LLC | Website traffic analytics | Link |
4. Advertising Disclosure
HaniLab monetises through advertising:
- Website: Google AdSense contextual and/or personalised ads
- Mobile game: Optional rewarded video ads (Google AdMob) in exchange for in-game items
Personalised advertising may use your device's advertising ID and browsing behaviour. You can opt out via:
- Android: Settings → Privacy → Ads → Opt out of Ads Personalisation
- iOS: Settings → Privacy & Security → Apple Advertising → Personalised Ads (off)
- Website: Google Ads Settings
All advertisements comply with Google's AdSense Programme Policies and AdMob policies.
5. Google Play Data Safety Summary
For the Google Play Store data safety form, HaniLab games declare:
- Data collected: Advertising ID (for ads, with consent); anonymous UUID hash, game score/level, 2-letter region code (for ranking features, HaniLab server)
- Data shared: Advertising ID shared with Google AdMob for ad purposes
- Security practices: Data encrypted in transit; users can request data deletion via email
- No children: App is not directed at children under 13
- Ranking UUID: an app-generated UUID, not the device advertising ID; hashed with SHA-256 before transmission to HaniLab server
6. Apple App Store Privacy Nutrition Label
- Data used to track you: Advertising ID (for personalised ads, with consent)
- Data linked to you: None (ranking data is linked to anonymous UUID hash only — not personally identifiable)
- Data not linked to you: Usage data (crash reports, analytics, advertising data)
7. GDPR Compliance Summary
- Legal bases used: Consent (advertising, analytics), Legitimate Interests (security), Contract (contact replies)
- Data Protection Officer: Not required (small organisation)
- EU representative: Not appointed (processing is minimal and non-systematic)
- Supervisory authority complaints: You may file a complaint with your national DPA
8. Requests & Contact
For data access, deletion, or portability requests, contact us at:
We will respond within 30 days. All requests are processed free of charge.