Privacy Policy

1. Who we are

Big2 Royale is provided by mad (“we”, “us”, or “our”). This policy covers our game, the website at big2.mad.gg, and the services we use to run player accounts and gameplay. Contact us at big2@mad.gg about this policy or your information.

2. Information we collect

Accounts and sign-in

A guest account has a generated identifier and game profile. If you sign in by email or a supported provider, we process your email address when supplied, provider account identifier, name, authentication tokens, and session information. We do not receive your Facebook, Google, or Apple password.

Profile and social features

Your display name, avatar, country flag, friend code, friends, friend requests, groups, and invitations. A supported sign-in provider may supply a profile picture; we store a copy for use in the game. We may suggest a country using the approximate country associated with your internet connection. We do not request GPS location for this feature.

Gameplay and purchases

Game participation, results, rankings, scores, coins, XP, missions, spin rewards, inventory, and equipped cosmetics. Purchases can involve store receipts, transaction identifiers, product details, purchase status, and a game-account identifier. Apple or Google processes store payments; our game does not collect your full payment-card details.

Technical and support information

The game stores a random installation credential separately from your account login. Our server stores its one-way hash, associated game-account identifiers, and limited welcome-gold and daily-reward eligibility records to prevent repeated free rewards through account deletion. These records do not contain your name, email, profile picture, or wallet balance.

Our infrastructure processes connection information such as IP addresses and request or error logs to deliver and protect the service. If you contact us, we receive the details you choose to send.

Optional usage analytics

When Usage analytics is enabled, Big 2 Royale uses PostHog to understand how players find and use the game. Events include app visits, tutorial progress, completed rounds, shop and starter-offer views, checkout results, and invitation sharing. These include a generated analytics identifier, game-account identifier when available, app and device information, and campaign labels supplied by a download link. On Android, Google Play may provide the install referrer and click/install timestamps. Signed-in activity can be linked to earlier guest activity. We do not send account passwords, authentication tokens, store receipts, names, email addresses, or payment-card details to analytics. Diagnostics include error types, code method names, source filenames and line numbers, and connection or sign-in failure categories. Raw error messages and full file paths are omitted. Diagnostic reporting follows the Usage analytics setting. Session recording is disabled.

3. Why we use it

• Create accounts, sign you in, and carry eligible guest progress into a signed-in account.
• Run matches, rankings, rewards, purchases, inventory, friends, and invitations.
• Deliver sign-in emails, respond to support requests, and communicate service matters.
• Verify purchases, prevent duplicate credits and abuse, troubleshoot errors, and keep accounts secure.
• Meet applicable legal requirements and resolve disputes.

Where applicable law requires a legal basis, we process information to provide the service you request, for legitimate service and security purposes, to meet legal obligations, or with your consent where required. Optional information can be withheld, although the related feature may then be unavailable.

4. What other players can see

Other players may see your display name, avatar, country flag, rank, equipped cosmetics, and information about a shared table or match. Friends can see relevant availability and group information. Leaderboards show public competitive results. Your sign-in email and authentication tokens are not displayed as part of your player profile.

Choose a display name and picture you are comfortable showing to other players. Information another person has already viewed, saved, or captured cannot be remotely removed from their device.

5. Service providers and Facebook Login

We use Cloudflare for authentication, storage, and network services; SpacetimeDB for online game data; Vercel for web hosting; and Resend for sign-in emails. Enabled sign-in providers and app stores process information needed for their respective login and purchase services. These providers may process information in countries outside your own.

If you choose Facebook Login, we request basic public-profile information and email when available. We use these to identify your account and provide its name and picture. Our in-game friends feature does not import your Facebook friends list, and we do not post to Facebook on your behalf.

We do not sell your personal information or use your social-login profile for targeted advertising. We may disclose information where reasonably necessary to comply with law, address fraud or security incidents, protect rights, or transfer operation of the service with appropriate protections.

Usage analytics is processed by PostHog in its US Cloud project. IP-based location enrichment is disabled; a signed-in player's selected country may be included. Third-party services also have their own privacy policies, including PostHog, Meta, Cloudflare, and Vercel.

6. Cookies, storage, and security

Sign-in uses necessary cookies or similar session storage. The game stores authentication credentials and preferences on your device so you can stay signed in and keep your settings. Web builds may cache game files. These legal-information pages do not load the game or include advertising or analytics scripts.

We use access controls, authenticated requests, and encrypted connections for production services. No system can guarantee absolute security. Keep your device and sign-in account secure, and contact us if you suspect unauthorized access.

7. Retention and deletion

We retain active account and gameplay information while needed to provide the service. Successful account deletion removes your active game profile and associated progress, social and inventory records, sign-in account, sessions and tokens, and our stored copy of your social profile picture.

Minimal reward-eligibility records and the separate installation credential remain after account deletion to prevent repeat reward claims. Deletion does not renew welcome gold, daily spins, or already-claimed mission rewards. Contact support if you believe a reward limit has been applied incorrectly.

Shared table or round records may remain until that room or record expires. Technical logs, backups, support correspondence, or records needed for legal obligations, security, or disputes may remain for the period necessary for those purposes. App stores and sign-in providers independently control their own records. Previously downloaded or cached profile pictures may remain on other devices; deleting the stored picture prevents new retrieval from our storage.

Deleting the app, clearing browser data, signing out, or removing Facebook access does not by itself delete your Big2 Royale account. Follow the account and data-deletion instructions instead.

8. Your choices and requests

You can use available account settings to update your profile, manage friends, or delete your account. You can also contact big2@mad.gg to request access, correction, deletion, or other rights available under applicable law, including objections, restrictions, or portability where those rights apply.

Turn off Usage analytics under Settings → Privacy to stop future analytics capture on that installation and clear unsent queued events. This does not remove earlier analytics records. Analytics records are managed separately from the game database; contact support to request their removal.

We may need to verify account ownership before acting. We will explain any information we must retain or any request we cannot fulfill, and respond within the time required by applicable law. You may also raise a concern with your local data-protection authority.

9. Younger players

Players must meet the age requirements of applicable law and the platforms they use. Where parental or guardian permission is required, it must be obtained before using the service. We do not knowingly collect a child’s personal information where doing so would require consent we have not obtained. A parent or guardian can contact us to request review or deletion of a child’s information.

10. Changes to this policy

We may update this policy as the game or our practices change. The date above identifies the latest version. We will provide additional notice or obtain consent when required by applicable law.