YOUR DATA / PLAIN WORDS
THE SMALL
PRINT.
Privacy policy for Bad Beach by Samartinc.
Last updated: 5 October 2026 · Account and optional purchase services
Who we are
Samartinc publishes Bad Beach, Android package com.samartinc.badbeach, and this support website at bad-beach.web.app. For support, privacy, access, correction or deletion requests, email legend@xlunaverse.com. Never send a password, payment-card details or identity documents by email.
What the game and website use
| Feature | Data and purpose | Service |
|---|---|---|
| Optional sign-in | Email, password, account ID and session tokens provide account access, recovery and purchase restoration. | Google Firebase Authentication. Passwords and tokens stay in app/page memory rather than our local preferences, browser storage or URLs. |
| Optional purchases | Product and order references, receipt tokens, purchase status and a pseudonymous account link verify ownership, restore purchases and address cancellation, refund or fraud. | Google Play and Samartinc's verification service on Google Cloud Functions and Firestore. Payment-card details are handled by Google Play; our verification service does not store them or your account email. |
| Friend rooms | An installation-generated guest ID, selected ready-made callsign with a short distinguishing suffix, room membership and match events operate multiplayer. | Photon and room participants, who see the callsign and game actions. This release has no custom names, text chat or voice chat. Guest identity is separate from Firebase sign-in. |
| Local game progress | Rep, contracts, weapon mastery, local scores, guest identity and settings remember this installation. | Local game files and preferences. Device backup settings may also affect application data. |
| Optional reminders | Your opt-in choice and local schedule display comeback reminders. | Your device and Android notifications. These are local reminders, not remote push messages. |
| Score sharing | A screenshot, scorecard and caption are prepared when you choose to share. The menu checks supported installed destinations; you can copy a caption to the clipboard. | The app you select. You decide whether to post. That service and your device clipboard have their own controls. |
| Support and service operation | Your support email and information you send help answer requests. Connection, access, error and security records help operate services and prevent abuse. | Samartinc's support mailbox and email provider; Google/Firebase and Photon for their respective services. |
Purchases and account ownership
The starter weapon is free. Optional upgrades are permanent one-time products, not subscriptions or consumable currency. Google Play shows your local price before confirmation. Buy and restore while signed into the same Bad Beach account and the relevant Google Play account. Online verification is required to validate and refresh paid access; an offline device can use only its short existing authorization window.
Our server checks receipts with Google before granting paid access. Purchase tokens are encrypted in our database and linked to a pseudonymous account identifier. Google processes payment information and maintains its own order records under its policies. A pending or unverified purchase does not grant access. Refunds or revocations can remove the corresponding entitlement.
Google Play diagnostics and game delivery
When the optional billing connection is initialized after you sign in, Google's Play Billing Library sends Google technical diagnostics about API success or failure and service-connection issues. Google uses these records to support billing and improve its library's performance and reliability. This is diagnostic analytics handled by Google, separate from Unity Engine Diagnostics, which is disabled. You can play as a guest without initializing this billing connection. See Google's Billing Library logging documentation.
Google Play Asset Delivery uses device configuration metadata and the app version to deliver the correct game asset pack and preserve installed packs after updates. Asset delivery is part of installing and updating the Play version of the game. Google documents this information as encrypted, retained for a fixed period and not transferred onward to third parties; it does not publish a specific retention length in that disclosure. See Google's asset-delivery data disclosure. These Google component records are separate from the active account and receipt records that Samartinc can delete.
Hosting, security and service providers
This website uses Firebase Hosting with local scripts/images and no advertising tags, analytics scripts or embedded social widgets. Website credentials go directly to Firebase over HTTPS; a confirmed deletion request sends a fresh account token to our receipt/account service over HTTPS. The page does not put passwords or tokens in cookies, browser storage or URLs.
The purchase verification service and its Firestore database are deployed in Google's Frankfurt region. Firebase Authentication, Google Play, website hosting, email and Photon have their own processing locations; information may be processed outside your country. See Firebase privacy and security and Photon's privacy policy.
Google/Firebase process IP addresses, user-agent information and service/security records. Platform logs may contain IP addresses, request paths, status and pseudonymous record identifiers. Our receipt service does not deliberately log passwords, authorization headers, raw purchase tokens or request bodies.
Deletion and retention
Use Account → Delete account in the game or our external account-deletion page. The external page also offers an email request route without installing the game. We may need to verify ownership.
Confirmed account deletion removes the active purchase/entitlement records associated with that Bad Beach identity, including any complimentary access grant, and deletes the Firebase sign-in account. If an upstream service is unavailable, an encrypted account identifier is kept only in the pending deletion job until completion is confirmed. Pending requests block renewed purchase access and are retried by the service. An accepted or timed-out request is not a completion confirmation; contact legend@xlunaverse.com if it remains unresolved.
Deleting this account removes its purchase access. A newly created account cannot restore purchases bound to the deleted identity. Deletion does not automatically request a refund and does not erase Google's financial/order records. For refund requests, use Google Play's refund process or contact us. Short authorizations already on an offline device may remain usable until they expire.
Active account/purchase records remain while needed to operate the account and verify its purchases, until deletion. This deployment has no publisher-managed scheduled Firestore backups or optional point-in-time recovery enabled. Database/provider operational retention still applies; deleting an active record is not a claim of instant physical erasure. Completed deletion jobs do not retain an account tombstone.
The deployed Google Cloud default log bucket retains entries for 30 days; Google's required audit-log bucket retains entries for 400 days. Firebase states that Authentication IP logs remain for a few weeks and other deleted-account authentication data is removed from live and backup systems within 180 days. Firebase Hosting IP data remains for a few months. These records are separate from active purchase ownership. See Google Cloud log storage and the Firebase policy above.
Local guest progress, preferences and saved images are separate. Clear Bad Beach's local storage in Android settings to erase this installation's data; that can erase progress. Device/cloud backups have their own controls. Firebase account deletion does not erase independent Photon guest records or posts already sent to social apps; use those services' controls or contact us for help.
Support correspondence is used to handle your request. You can ask for its deletion when the request is resolved. We may retain limited information for legal obligations, disputes or security issues and will explain any applicable exception when responding.
Your choices and audience
You can play as a guest, decline purchases, sign out, turn reminders off, decline sharing and clear local game data. Email legend@xlunaverse.com for access, correction or deletion requests, identifying Bad Beach and the relevant account or callsign without sending your password. Depending on your location, you may have additional rights to object or complain to a data-protection authority.
Bad Beach is designed for adults, not children. If you believe a child provided personal information, contact us so we can investigate. We update this policy when account data or service use changes; the date above identifies this version.