Privacy Policy

A-Squad is free because it carries advertising. Here is the whole thing, and then the detail.

Playing as a guest: a randomly generated player ID stored on your device, and your gameplay — spins, picks, projected records, challenge results. No email, no name, unless you choose to sign a name onto a scoreboard.

With an account: your email address (handled by Clerk, our sign-in provider), the first name or nickname you choose at sign-up (this is the name that appears on scoreboards — pick whatever you want shown), an age range (13–17 or 18+ — never your birth date), and the same gameplay data, linked to your account so it follows you across devices.

Automatically, from any visit: your IP address, your browser and device type, which pages you open, and the rough location your IP implies — country and region, not a street and not GPS. Your IP address is how the internet delivers a page at all. We use it to serve the site, to block abuse and bots, and to work out which privacy laws apply to you so you get the right choices.

A cookie is a small file a website asks your browser to keep. Local storage is the same idea with more room and no expiry date. In a phone app the equivalent is a device identifier — the resettable advertising ID your phone hands to apps. We use all three, in four buckets.

Strictly necessary. Your sign-in session, your consent choices themselves, and the security and rate-limiting that keeps bots off the scoreboards. These run without asking, because there is no version of the site that works without them.

Gameplay and preferences. Your random player ID and your in-progress squad, kept in your browser’s local storage. This is what lets you close the tab mid-run and come back to the same six spins. In the iOS and Android apps it lives in the device’s secure storage instead.

Analytics. PostHog, which counts events like “challenge created” and “run submitted” so we can see which parts of the game people actually use. In the EEA, the UK and Switzerland this waits for your consent; elsewhere it runs by default and you can switch it off (section 9).

Advertising. Google AdSense, and the vendors it works with, set cookies and read advertising identifiers to pick an ad, cap how often you see it, and measure whether anyone looked at it. Section 4 is the full account.

Where the law requires consent — the EEA, the UK and Switzerland — nothing outside “strictly necessary” is written to your device until you allow it on the banner. Everywhere, you can clear the lot from your browser settings, and on iOS and Android you can reset or switch off your advertising ID in the system settings. Fair warning: clearing them signs you out and resets a guest’s history, because that history is what’s stored.

A-Squad is free. Advertising is what pays for the servers, the data pipeline and the domain. There’s no subscription, no in-app purchase, and nothing to buy.

We don’t sell ads ourselves. We work with advertising technology companies — an ad server, supply-side and demand-side platforms, exchanges, and measurement and anti-fraud vendors — that fill the ad slots programmatically, in the fraction of a second it takes the page to load. When a slot loads, those companies may receive your IP address, your user agent, the approximate location your IP implies, the page you’re on, the size and position of the slot, any cookie or advertising identifier they’ve previously set, and your consent signal.

They use it for four things.

Personalized versus non-personalized. A personalized ad is picked using a profile of you, assembled across many sites and apps and keyed to a cookie or an advertising ID. A non-personalized ad is picked using only what’s true right now: what this page is about, roughly where you are, what kind of device you’re on. Non-personalized ads still involve a request to an ad server and still get counted. They are not “no data” — they are “no profile.” We’d rather say that plainly than let the phrase do more work than it can carry.

What we never do. We don’t give advertisers your email address, your display name, or your account. We don’t use the age you told us, or anything you typed, to target an ad. We don’t put ads in the sign-in flow. And we don’t let ad partners write into your A-Squad account or read your gameplay from our servers.

One thing we won’t soften. Under US state privacy laws, sharing data with advertising partners for personalized advertising counts as a “sale” and a “share” of personal information, even though nobody pays us for your data specifically. We disclose it as one rather than hunting for a reading where it isn’t. Section 6 is the switch.

Google. Our advertising partner is Google AdSense. Google and other third-party vendors use cookies, and on phones the advertising identifier, to serve ads based on your prior visits to A-Squad and to other websites. Google’s advertising cookie is what lets Google and its partners choose ads for you based on your visits to this site and to other sites on the internet. You can switch off personalized advertising from Google in Google’s Ads Settings, and from many vendors at once at aboutads.info/choices (or youronlinechoices.eu in Europe). How Google uses information from sites that use its services is described at policies.google.com/technologies/partner-sites. None of that replaces the consent banner or “Your Privacy Choices”: those still govern what we pass on in the first place.

We use a Consent Management Platform — InMobi Choice — to ask for your choices, record them, and pass them to every company involved in loading an ad.

In the EEA, the UK and Switzerland, a banner appears the first time you visit. Until you answer it, no advertising or analytics cookies are set and nothing goes to ad partners. You can accept everything, reject everything, or open the detail view and decide purpose by purpose and vendor by vendor. Rejecting is one tap on the first screen, with the same prominence as accepting — if it ever isn’t, that’s a bug, and we’d like to hear about it.

How the signal travels. Your answer is encoded as a TC string under the IAB Europe Transparency & Consent Framework, version 2.3. It’s a compact record of which purposes you allowed, which vendors you allowed, and which you objected to. It’s stored in your browser and attached to every ad request. The framework’s own policies require participating vendors to honour it. The same string limits us, too — we don’t get to do more than you allowed.

The vendor list. The full list of advertising companies that can be involved, what each does, how long its cookies last, and a link to each one’s privacy policy is inside the consent tool — open “Your Privacy Choices” and go to the vendor list. We deliberately don’t reprint it here. It changes as vendors are added and dropped, and a hand-copied list on a policy page is wrong the week after it’s written. The one inside the tool is the live one.

Global Privacy Platform. Alongside the TCF string we transmit a GPP signal carrying US choices — the US National section plus the state sections for California, Virginia, Colorado, Utah and Connecticut, and the older US Privacy string for partners that still read that.

Global Privacy Control. If your browser or an extension sends a GPC signal, we treat it as a valid opt-out of sale and sharing for that browser. You don’t have to click anything and we don’t ask you to confirm.

Everywhere else, including Canada and the rest of the world, we don’t show a banner. Ads are personalized where the law allows it, and section 6 is the off switch.

If you’re in the United States, look for Your Privacy Choices in the footer of every page. It re-opens the consent tool.

California’s law (the CCPA, as amended by the CPRA) calls what we do with advertising partners a sale and a share. Virginia, Colorado, Connecticut and Utah call it targeted advertising and sale. Whatever the word is where you live, the same switch turns it off: opt out in that panel and we stop sharing data with advertising partners for personalized advertising, and your ads become non-personalized. You’ll still see ads. They just stop being chosen from a profile of you.

Two honest limitations. The opt-out is stored in your browser, so you need to do it once per browser and per device, and it goes away if you clear your cookies. That’s how the machinery works, not a choice we made — and it’s why we honour GPC, which doesn’t have that problem.

The same panel also switches off product analytics. Analytics is not a “sale” or a “share” — nothing in it goes to an advertising partner and none of it is sold — so opting out of sale and sharing does not by itself stop it. The switch is there anyway, because you should be able to say no to being counted.

We don’t sell personal information for money. We don’t collect sensitive personal information as California defines it — no precise geolocation, no racial or ethnic origin, no health data, no biometrics, no contents of your messages — so there’s nothing for you to limit the use of. And we don’t offer financial incentives for your data: there’s no paid ad-free tier, so there’s no price to discriminate on. Opt out and you get the identical game.

If you have an account and told us you’re 13 to 17, your ads are always non-personalized. That’s a commitment, not a setting:

We know your age band because you gave a birth year at sign-up and we kept only the band — 13–17 or 18+. The birth year itself was never sent to our servers and was never stored.

If you’re playing as a guest, we don’t know how old you are, and we’ve chosen not to ask, because asking would mean collecting a birthday from every anonymous visitor to protect a few of them. Guest sessions follow the ordinary consent rules for wherever they are. If you’re under 18 and want the teen protections, sign in — that’s the only way we can give them to you.

A-Squad is a general-audience game rated 13+, not directed to children. Accounts require you to be 13 or older. Sign-up asks for a birth year, and anyone under 13 gets a polite dead end — no account is created and nothing is kept. We don’t knowingly collect personal information from children under 13, and we don’t knowingly show personalized ads to anyone we know to be under 13.

Guest play doesn’t ask for an age, so we can’t rule out that a younger player has spun the reels anonymously. Here’s what that means in practice: a guest session holds a random ID and gameplay results, no name and no email, and if you’re a parent, clearing the browser’s site data or the app’s storage deletes it. If you believe a child under 13 has created an account or given us personal information, email support@asquadgame.com and we’ll delete it.

We use PostHog to understand how the game is played — which screens get opened, and named events like “challenge created” or “run submitted”. We’ve turned off automatic capture, which means PostHog records the screens you visit and the events we deliberately send, not everything you click. The addresses we record have their identifiers stripped out first: a challenge is counted as “/c/:code”, never the specific challenge you opened. We use Sentry to collect error reports when something breaks; those include the page you were on, your browser and a stack trace, and they can incidentally include your player ID.

Neither is used for advertising, and neither receives your email address, your display name or your age range. When you create an account, analytics is keyed to the same random account ID we use internally, so your play history from before you signed up stays joined to your account afterwards — that ID is not your email and cannot be reversed into it. Signing out unlinks it on that device.

Where it runs, and on what footing. In the EEA, the UK and Switzerland, analytics waits for your consent on the banner and does not run until you give it. Everywhere else — including the United States — it runs by default, on our legitimate interest in knowing which parts of a free game people actually use. We think that is a fair trade for you, and here is what keeps it fair: it is first-party, it is a count of in-game events and not a profile, it is never sold, never shared for advertising, and never handed to an ad partner, and you can turn it off at any time from “Your Privacy Choices”. If you would rather it never started, turn it off — the game plays exactly the same.

A display name you sign is visible to other players on scoreboards you join and in share previews. Don’t sign a name you wouldn’t put on a rink board.

Shared scoreboards, challenge pages and squad pages are public URLs — anyone with the link can open them without an account. That’s the point of a shareable scoreboard, but it’s worth knowing before you type your full legal name into one.

This section uses the categories California’s law asks us to use. “Shared for advertising” means shared with advertising partners for personalized advertising — which is off if you’ve opted out, if you’re in the EEA/UK/CH and didn’t consent, or if you’re a signed-in 13–17 player.

Identifiers — a random player ID, your email address (accounts only), device and advertising identifiers, your IP address. Used to run your account, keep your history across devices, sign you in, serve and cap ads, and stop abuse. Shared with Clerk, our hosting provider and advertising partners. Shared for advertising: the advertising identifier and IP address, yes.

Internet and network activity — pages you open, in-game events, browser and device type, ad impressions and clicks. Used to make the game work, see which parts get used, and serve and measure ads. Shared with PostHog, Sentry and advertising partners. Shared for advertising: the ad-related portion, yes.

Approximate location — country and region, derived from your IP. Used to decide which privacy rules apply to you and to keep ads in the right country. Shared for advertising: yes. We never collect precise or GPS location.

Characteristics — your age band, 13–17 or 18+, and nothing else. Used to enforce the 13+ rule and the teen advertising commitment in section 7. Shared for advertising: never. It’s used to withhold data, not to target it.

User content — the first name or nickname you sign onto a scoreboard. Public by design. Checked on save against a filter for slurs, profanity and anything that isn’t a plain name, and removable if it slips through. Shared for advertising: never.

Inferences — A-Squad draws none about you. Our advertising partners may build interest profiles under their own policies, and that’s precisely what the consent choices in section 5 control.

Commercial information — none. We don’t take payments, so there’s nothing to record.

We don’t collect biometrics, precise geolocation, government IDs, financial account details, health information, race or ethnicity, religion, sexual orientation, union membership, or the contents of your messages. We don’t want them and we don’t ask. And we don’t make automated decisions about you that produce legal or similarly significant effects — the season projection is a statistical model applied to hockey box scores. It decides things about Gretzky, not about you.

Where the basis is consent, you can withdraw it at any time and it must be as easy as giving it: open “Your Privacy Choices”. Withdrawing doesn’t undo what already happened, and it doesn’t stop you playing.

A-Squad runs on Amazon Web Services in the United States (Northern Virginia). Sign-in is Clerk, product analytics is PostHog, error reporting is Sentry, DNS is Cloudflare, consent management is InMobi Choice, and our advertising partners operate globally.

If you’re in the EEA, the UK or Switzerland, that means your personal data is transferred to the United States and to wherever individual advertising partners operate. We rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914); the UK International Data Transfer Addendum; the Swiss addendum recognised by the FDPIC; and, where a provider is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions. Ask us which mechanism applies to a specific provider and we’ll tell you: support@asquadgame.com.

Everything is encrypted in transit (HTTPS throughout) and at rest. The game is server-authoritative: the seed for your session never leaves our servers in raw form, and every run is replayed and scored server-side. That’s primarily an anti-cheat measure, but it has the happy side effect that the app on your device holds very little worth stealing. Sign-in credentials are handled by Clerk — we never see your password, and if you use a passkey there often isn’t one. Access to production data is limited to the people who run A-Squad, over accounts with multi-factor authentication.

No system is perfect, and we’d rather write that than pretend otherwise. If we discover a breach affecting your personal data we’ll notify you and the relevant regulator within the time the law requires — for the GDPR that’s 72 hours to the supervisory authority.

The first six are service providers, bound by a data processing agreement that limits them to processing data on our instructions. Google and the other advertising partners are a different animal: most of them act as independent controllers, or as “third parties” under US law, for the data they receive, under their own privacy policies. We’re saying that plainly because it’s the whole reason the consent tool exists and the reason the vendor list lives there rather than here.

Rights are only worth what they cost you to use. Here is each one and where it actually is.

We answer within 30 days (45 in California, extendable once where the law allows). We verify a request by confirming you control the account email. Playing as a guest? Your data is on your device — clearing your browser or app storage deletes it, and there’s no email address on our side for us to match a request against.

Version 1.1, September 3, 2026: we named Google AdSense as our advertising partner, added Google’s cookie disclosures and the opt-out links to section 4, and listed Google in sections 3 and 16. Nothing else changed. Version 1.0 (September 1, 2026) was the first published version and is available on request.

We’ll post new versions here with a new effective date and a short note like the one above saying what changed. For material changes — new categories of data, new purposes, a new kind of partner — we’ll give notice in the app before it takes effect rather than after, and where the law requires consent we’ll ask again instead of assuming the old answer still stands.

support@asquadgame.com. It’s a real mailbox and it’s read by the person who built A-Squad. If you’re writing about a privacy right, say so in the subject line and we’ll treat the clock as starting the day it arrives.

By post, to the controller:

A-Squad Gaming LLC 117 S Lexington St, Suite 100 Harrisonville, MO 64701 United States