Who we are
Samartinc publishes Bad Beach game, Android package com.samartinc.badbeach, the browser game at badbeachgame.com, and the existing support and account-deletion website at bad-beach.web.app. For support, privacy, access, correction or deletion requests, email legend@xlunaverse.com. Never send a password, payment-card details or identity documents by email.
What the game and websites use
| Feature | Data and purpose | Service |
|---|---|---|
| Optional sign-in | Email, password, account ID and session tokens provide account access, recovery and purchase restoration. | Google Firebase Authentication. Passwords and tokens stay in app/page memory rather than our local preferences, browser storage or URLs. |
| Optional purchases in the Android game | Product and order references, receipt tokens, purchase status and a pseudonymous account link verify ownership, restore purchases and address cancellation, refund or fraud. | Google Play and Samartinc's verification service on Google Cloud Functions and Firestore. Payment-card details are handled by Google Play; our verification service does not store them or your account email. |
| Optional purchases in the browser game | Product, checkout, payment and transaction references, payment/refund status and an account link verify ownership and restore paid access. Stripe may collect your payment, billing and contact information during checkout. | Stripe-hosted Checkout handles payment details. Samartinc's verification service stores account-linked transaction references and ownership status, not your full card number or card security code. |
| Friend rooms | An installation-generated guest ID, selected ready-made callsign with a short distinguishing suffix, room membership and match events operate multiplayer. | Photon and room participants, who see the callsign and game actions. This release has no custom names, text chat or voice chat. Guest identity is separate from Firebase sign-in. |
| Local game progress | Rep, contracts, weapon mastery, local scores, guest identity and settings remember this installation or browser. | Local game files and preferences in the Android version, or browser-supported storage for the web game. Device backup settings may also affect application data. |
| Optional reminders in the Android game | Your opt-in choice and local schedule display comeback reminders. | Your device and Android notifications. These are local reminders, not remote push messages. |
| Score sharing | A screenshot, scorecard and caption are prepared when you choose to share. The Android menu checks supported installed destinations; the browser offers supported sharing or image download. You can copy a caption to the clipboard. | The app or browser destination you select. You decide whether to post. That service, downloaded files and your device clipboard have their own controls. |
| Home-screen installation and offline download | A game shortcut, small site files and a complete game download attempted automatically after you choose Play let the browser reopen the game and support offline solo play. | Your browser's service worker and Cache Storage. These game files are separate from local progress and account records. |
| Support and service operation | Your support email and information you send help answer requests. Connection, access, error and security records help operate services and prevent abuse. | Samartinc's support mailbox and email provider; our Hostinger-hosted VPS for badbeachgame.com; Google/Firebase and Photon for their respective services. |
Browser game, home screen and local storage
The browser game runs on your device using Unity WebGL. Guest identity, settings, local scores, Rep, contracts and weapon mastery are saved using browser-supported local storage when it is available. This state belongs to the website origin and browser you use; it is separate from another browser, the Android installation and Firebase account records. The game attempts to persist local progress, but private browsing, unavailable storage, full storage or browser cleanup can prevent saving or remove it.
The site uses a service worker to keep its small launch-page files available. Choosing Play automatically attempts to save the listed game files in the browser's Cache Storage for supported offline solo play. If storage is unavailable, the game loads for online play. The game reuses a complete saved release on later launches. You can check or save the files from the browser game's Menu. No complete game download begins merely because you visit the landing page. Choosing Remove download removes the saved game download, while local progress remains separate. Installing an icon on your home screen adds a browser app shortcut; it does not by itself download the full game.
Use your browser's site-data controls to erase Bad Beach's stored guest identity, preferences, local progress and cached files. This can permanently erase local progress. A browser or operating system may evict downloads when space is low. Account, purchase-verification, private-room and external sharing services still need internet. The home-screen version uses the same browser-game data rather than an App Store account.
When you prepare a browser scorecard, the image and caption are held in memory for the sharing preview. Choosing Save image asks your browser to download the PNG; choosing Share image hands it to a supported sharing destination. Receiving apps can ignore captions. You control whether a post is sent. Remove saved images through your Files, Downloads or Photos controls and remove posts through the destination service. Account deletion does not erase those copies.
The browser game and account-deletion page do not put account passwords or session tokens in browser storage, cookies or URLs. Credentials and account tokens remain in page/game memory while the session is active. Local game progress and offline files are functional storage, separate from sign-in secrets.
Purchases and account ownership
The starter weapon is free. Optional upgrades in the Android game are permanent one-time products, not subscriptions or consumable currency. Google Play shows your local price before confirmation. The browser game uses Stripe-hosted Checkout for its available offers; the checkout displays the price before you confirm. Buy and restore while signed into the same Bad Beach account. Android purchases also use the relevant Google Play account. Verified paid access is linked to your Bad Beach account so supported game versions can restore it across platforms. Local scores and progress are separate from purchase ownership.
Our server checks receipts with Google or verifies payment status with Stripe before granting paid access. Google Play purchase tokens are encrypted in our database and linked to a pseudonymous account identifier. Stripe checkout and payment references are associated with the purchasing account for verification, restoration and support. A pending, cancelled or unverified checkout does not grant access. Opening a return link does not prove payment. Refunds, disputes or revocations can remove the corresponding paid access after verification. Online verification is required to validate and refresh paid access; an offline device can use only its short existing authorization window.
Payment information is entered on Google Play or Stripe's hosted checkout, not into the Bad Beach game or our own card form. Our game and verification service do not store your full card number or card security code. Payment providers handle their own payment, billing, fraud-prevention and financial records. Stripe's checkout has its own privacy and cookie controls; see Stripe's privacy policy. The browser game does not initialize Android's Google Play Billing Library.
Google Play diagnostics and game delivery
In the Android game, when the optional billing connection is initialized after you sign in, Google's Play Billing Library sends Google technical diagnostics about API success or failure and service-connection issues. Google uses these records to support billing and improve its library's performance and reliability. This is diagnostic analytics handled by Google, separate from Unity Engine Diagnostics, which is disabled. You can play as a guest without initializing this billing connection. See Google's Billing Library logging documentation.
Google Play Asset Delivery uses device configuration metadata and the app version to deliver the correct game asset pack and preserve installed packs after updates. Asset delivery is part of installing and updating the Play version of the game. Google documents this information as encrypted, retained for a fixed period and not transferred onward to third parties; it does not publish a specific retention length in that disclosure. See Google's asset-delivery data disclosure. These Google component records are separate from the active account and receipt records that Samartinc can delete. The browser game instead downloads its game files from badbeachgame.com.
Hosting, security and service providers
Badbeachgame.com is served from Samartinc's Hostinger-hosted VPS. The existing bad-beach.web.app support and account-deletion website uses Firebase Hosting. Both use local scripts/images and no advertising tags, analytics scripts or embedded social widgets. Website credentials go directly to Firebase over HTTPS; a confirmed deletion request sends a fresh account token to our receipt/account service over HTTPS. The page does not put passwords or tokens in cookies, browser storage or URLs. Choosing a web purchase opens Stripe's separate hosted checkout, where Stripe's own security and privacy practices apply.
The purchase verification service and its Firestore database are deployed in Google's Frankfurt region. Firebase Authentication, Google Play, Stripe, website hosting, email and Photon have their own processing locations; information may be processed outside your country. See Firebase privacy and security, Stripe's privacy policy and Photon's privacy policy.
Google/Firebase and Stripe process connection, device, service and security information for their respective services. Platform logs may contain IP addresses, request paths, status and pseudonymous record identifiers. Our receipt service does not deliberately log passwords, authorization headers, raw purchase tokens or request bodies.
The VPS web server may record your IP address, access time, requested path, response status, referring page and browser/user-agent information in access and error logs. These records help deliver the website, investigate faults and protect the service from abuse. They are hosting and security records rather than an added player-analytics tracker. Hosting records are retained as needed for those operational and security purposes; contact legend@xlunaverse.com for questions or a related data request.
Deletion and retention
Use Account → Delete account in the game or our external account-deletion page. The external page also offers an email request route without installing the game. We may need to verify ownership.
Confirmed account deletion removes the active purchase/entitlement records associated with that Bad Beach identity, including any complimentary access grant, and deletes the Firebase sign-in account. If an upstream service is unavailable, an encrypted account identifier is kept only in the pending deletion job until completion is confirmed. Pending requests block renewed purchase access and are retried by the service. An accepted or timed-out request is not a completion confirmation; contact legend@xlunaverse.com if it remains unresolved.
Deleting this account removes its purchase access. A newly created account cannot restore purchases bound to the deleted identity. Deletion does not automatically request a refund and does not erase Google Play's or Stripe's legally retained financial/order records. For Android refund requests, use Google Play's refund process. For a web purchase or related data request, contact legend@xlunaverse.com. Short authorizations already on an offline device may remain usable until they expire.
Active account and purchase-access records remain while needed to operate the account and verify its purchases, until deletion. Separate limited transaction or financial records may be retained by payment providers, or where required for accounting, legal obligations, fraud prevention or disputes. Stripe applies its own retention requirements; deleting a Bad Beach account does not delete a Stripe or Link account. We do not promise a fixed Stripe financial-record retention period or immediate erasure of legally required records. See Stripe's privacy policy and rights information.
This deployment has no publisher-managed scheduled Firestore backups or optional point-in-time recovery enabled. Database/provider operational retention still applies; deleting an active record is not a claim of instant physical erasure. Completed deletion jobs do not retain an account tombstone.
The deployed Google Cloud default log bucket retains entries for 30 days; Google's required audit-log bucket retains entries for 400 days. Firebase states that Authentication IP logs remain for a few weeks and other deleted-account authentication data is removed from live and backup systems within 180 days. Firebase Hosting IP data remains for a few months. These records are separate from active purchase ownership. See Google Cloud log storage and the Firebase policy above. These Google retention statements do not specify the separate VPS web-server log retention.
Local guest progress, preferences and saved images are separate. Clear Bad Beach's local storage in Android settings to erase this installation's data, or clear badbeachgame.com's site data in your browser for the web game; that can erase progress. Device/cloud backups and downloaded image files have their own controls. Firebase account deletion does not erase independent Photon guest records or posts already sent to social apps; use those services' controls or contact us for help.
Support correspondence is used to handle your request. You can ask for its deletion when the request is resolved. We may retain limited information for legal obligations, disputes or security issues and will explain any applicable exception when responding.
Your choices and audience
You can play as a guest, decline purchases, sign out, turn Android reminders off, decline sharing, remove offline downloads and clear local game or browser data. Email legend@xlunaverse.com for access, correction or deletion requests, identifying Bad Beach and the relevant account or callsign without sending your password. Depending on your location, you may have additional rights to object or complain to a data-protection authority.
Bad Beach is designed for adults aged 18 and over, not children. If you believe a child provided personal information, contact us so we can investigate. We update this policy when account data or service use changes; the date above identifies this version.
OPEN ACCOUNT DELETION