The short version
- You play as a guest. No email, phone number or password is needed.
- We store your player name, look, progress and safety settings so the game works.
- Online matches use your player ID and your IP address to connect you.
- No ads, no advertising ID, no location tracking, and no access to your contacts, camera, microphone or files.
- Optional analytics is off by default, and only adults can turn it on.
- There are no purchases in this version of the game.
- You can delete your account in the game, or by email without reinstalling.
1. Who is responsible
J M R TECNOLOGIA LTDA (Brazil), operating as Kubimi, decides how your personal data is used for SmashFoot and is the controller under Brazil’s General Data Protection Law (LGPD, Lei 13.709/2018). For anything about your data, including reaching the person in charge of data protection (encarregado), write to hello@kubimi.com.
2. What we collect and why
| Data | What we use it for | Handled by |
|---|---|---|
| Guest account. A random player ID and a sign-in token, created by Unity Authentication the first time you open the game. | Signing you in, keeping your progress, connecting you to matches, protecting the game against cheating. | Unity |
| Player name. The nickname you choose (2–14 characters). Until you change it, the game uses a default such as “PLAYER42”. | Showing you to other players (see section 4). Names are checked against a word filter. | Unity; other players |
| Look and items. Your footballer’s appearance and the cosmetic items you own and wear. | Showing your character and checking that you own what you wear. | Unity; other players |
| Progress. Level, XP, coins and gems earned in the game, items, season pass progress, quests and completed lessons. | Saving your progress and rewards. | Unity |
| Match data. Matches you start and finish, mode, score, goals, assists and similar statistics, match length, your play time today and in total, and a hidden skill rating. | Running matches, giving rewards, finding opponents of similar skill, applying playtime limits and detecting cheating. | Unity; Edgegap (dedicated matches) |
| Age group and parental settings. The age group chosen in the game (under 13, 13–17, 18 or older, or “prefer not to say”). On Android, if Google Play shares an age signal, the game uses whichever is more protective. Also the PARENTS choices and limits. The parent PIN never leaves the device and is stored there only in scrambled (hashed) form. | Applying safer settings for younger players and respecting parents’ choices. Age signals are never used for ads or analytics. | Unity; Google (age signals on Android) |
| Reports. When you report a player: the reported player’s ID, the reason, the name that was shown and the time. Stored under a code that does not show your player ID directly. | Moderation and safety. | Unity |
| Network data. Your IP address and basic technical details of each connection. | Delivering the game, connecting you to matches, choosing a nearby game server and keeping services secure. | Unity; Edgegap; Cloudflare (this website) |
| Optional analytics (adults only, off by default). Game events such as screens opened, matches started and finished, waiting time and lessons, plus device details collected by Unity Analytics, such as device model, operating system, game version and country. | Understanding how the game is used so we can improve it. Never names, looks or payment details. | Unity |
| Support messages. Your email address and what you write to us. | Answering you and keeping a record of requests, such as deletion requests. | Google Workspace (email) |
If you join a test, Google or Apple tell us the email address you used to join when we invite you by email, and they may share crash reports and feedback that you choose to send. They handle this under their own privacy policies.
3. What we don’t collect or do
- No precise location (GPS), contacts, photos, camera, microphone or files on your device.
- No advertising ID and no payment details. There are no ads and no advertising or attribution tools in the game.
- No free-text chat and no voice chat: players communicate only with preset signals and stickers.
- We don’t sell personal data and don’t use it for targeted advertising.
- We don’t make automated decisions about you with legal or similarly significant effects. Matching players by skill is part of the gameplay.
4. What other players can see
- Your player name, your footballer’s look and items, your playstyle, your team and your match statistics (for example goals and assists), during and after matches and in groups.
- On the devices of players under 18 or of unknown age, other players’ names are hidden by default and appear as “PLAYER”.
- Your own name is still visible to players whose settings show names. Please choose a name that doesn’t reveal who you are, such as your full name, school or phone number.
- Nobody can send you messages. Preset signals can be muted, and they start switched off for players under 18.
- Your player ID is sent to the phone or server running a match. It is not shown on screen.
5. How online matches work
- Quick Match uses Unity’s multiplayer services (matchmaking, lobbies, Relay and connection-quality checks).
- A match runs either on a dedicated game server operated by Edgegap, or on one player’s phone, connected through Unity Relay servers. With Relay, players don’t connect directly to each other’s IP addresses.
- On a dedicated server, Edgegap receives your IP address to connect you and may use it to start the server in a location close to you. The server receives your player ID, team and seat, player name, look and items, and sends the match result to our backend.
- Groups with friends use a code that a friend shares with you. Group members see each other’s names (subject to the name settings) and whether they are ready.
- Traffic is encrypted: HTTPS for Unity services and DTLS for match traffic.
6. Who helps us run the game
These providers process data on our behalf, under their own terms and data protection commitments:
- Unity Technologies (Unity Gaming Services: Authentication, Cloud Save, Cloud Code, Remote Config, Matchmaker, Lobby, Relay, QoS and Analytics) stores account and game data and runs matchmaking. Servers in the United States and other regions.
- Edgegap runs dedicated game servers in a region close to players. Our tests ran in São Paulo, Brazil.
- Cloudflare hosts this website and stores encrypted backups of the game’s cloud records and game-server logs in Cloudflare R2 (Eastern North America).
- Google distributes the game and its tests on Google Play, provides age signals on Android, and hosts our support email (Google Workspace).
- Apple distributes the game and its tests on the App Store and TestFlight.
Some of these providers process data outside Brazil, including in the United States. We rely on their contractual commitments to protect the data, as permitted by the LGPD. You can ask us for more details about these transfers. We may also disclose information when the law requires it, or to protect players, the game or our rights.
7. Legal bases
- Providing the game you asked for (LGPD Art. 7, V): the guest account, saving progress, matches, rewards and support.
- Legitimate interests (Art. 7, IX): security, preventing cheating, moderation, backups and keeping the service running, always weighed against your rights and the best interests of children and teens.
- Consent (Art. 7, I): optional analytics, only for adults. You can withdraw it at any time in PARENTS.
- Legal obligations and legal claims (Art. 7, II and VI): records we must keep by law or need to defend rights.
Data of children and teens is processed in their best interest (Art. 14), with the protections in section 8.
8. Children and teens
SmashFoot is made for a general audience. Everyone plays the same game, and younger players get safer settings.
- After the first match, the game asks for an age group. It does not ask for a birthday. A store age signal can only make settings stricter, never looser.
- For players under 18 or of unknown age, the game starts with: other players’ names hidden, preset signals off, notifications off, purchases off, analytics unavailable and a daily playtime limit of 60 minutes.
- For players under 13 or of unknown age, names and signals stay off unless a parent’s permission has been verified.
- PARENTS (in SETTINGS → ACCOUNT) is protected by a 4–8 digit PIN. Parents can manage purchases, notifications, names, signals, optional analytics, groups with friends, clubs (not available in this version), playtime and spending limits, and see playtime for today and the last 7 days.
- There are no ads, no free chat and no loot boxes, and nothing random is for sale. This version has no purchases at all.
- If you’re a parent and think your child shared personal information with us, for example in a player name or an email, contact us and we’ll help remove it.
We designed these protections with Brazil’s Statute of Children and Adolescents in the digital environment (ECA Digital, Lei 15.211/2025) and the LGPD in mind.
9. How long we keep data
| Data | How long |
|---|---|
| Account and game data (name, look, progress, items, match rewards, safety settings) | While your account exists. Deleted when you delete your account, except as listed below. |
| Game-server logs (technical logs from dedicated servers) | 14 days. |
| Encrypted backups of the game’s cloud records | Up to 30 days. A deleted account can remain in a backup until that backup expires. |
| Deletion record: your random player ID, the date the account was created and a “deleted” mark | While the online service runs, so that old requests can’t restore deleted progress or rewards. |
| Reports and safety records, stored under a pseudonymous code | While needed for moderation, safety and legal claims. |
| Match records (match ID, player IDs, teams and score) and the hidden skill rating | While needed to check results and keep matchmaking fair. |
| Optional analytics | For the period set in our Unity Analytics project. Ask us and we’ll request deletion from Unity. |
| Support emails | While needed to help you and to keep a record of the requests we handled. |
Our providers also keep their own service logs for limited periods under their terms.
10. Your rights and choices
Under the LGPD you can ask us to confirm whether we process your data, access it, correct it, anonymize, block or delete data that is unnecessary or excessive, receive it in a portable format, delete data processed with your consent, know who we share it with, and withdraw consent. You can also oppose processing that doesn’t comply with the law. If you live elsewhere, you may have similar rights.
- Delete your account in the game, or follow Delete your account.
- Turn optional analytics off at any time in PARENTS.
- For any other request, email hello@kubimi.com. We may ask questions to confirm the account is yours. We will never ask for a password.
We aim to answer within 15 days. You can also complain to Brazil’s data protection authority, the ANPD, or to the authority where you live.
11. Security
Connections are encrypted, access to game records is restricted, server secrets are kept in secret stores, backups are encrypted, and items you wear are protected by signed tickets so they can’t be faked. No system is perfectly secure. If a security incident may put you at risk, we will tell you and the authorities as the law requires.
12. This website
This website is a set of static pages. It uses no cookies, no analytics and no third-party scripts or fonts, and has no forms. Cloudflare processes your IP address and basic request details to deliver and protect the site.
13. Changes to this policy
When we change this policy, we update the effective date at the top. If a change is important, we will also tell you in the game or in the release notes before it applies.
14. Contact
Kubimi (J M R TECNOLOGIA LTDA), Brazil · hello@kubimi.com