Villain's Crew Privacy Policy

Effective 24 October 2026

Villain's Crew is a 3D action game for Android in which you play a villain, published by ST Projects ("we", "us"), an independent developer based in the United States. This policy explains what information the game collects, why, and what happens to it. It applies to the Android app published under the package name com.stprojects.thebadguys.

In short: you don't create an account with us. Your progress is saved on your phone. The game shows no ads, and purchases go through Google Play. If you are signed in to Google Play Games, your progress and your chosen looks are also saved on our server so you can get them back on a new phone. You can delete that cloud data from the game at any time. You can open this policy from the game with the Privacy policy button on the Account screen.

Information stored on your device

The game saves the following in the app's own storage on your phone:

• Game progress: your current run (villain, difficulty, jobs done, upgrades, crew) and the villain looks you have unlocked and chosen.
• Settings, such as your language choice and your acceptance of the Terms of Service and this policy.
• Purchase information: what you bought and when (the purchase history shown on the Account screen), your monthly spending total, the order IDs of delivered purchases (so a purchase is never granted twice), and your answer to the "18 or older" question asked before a first purchase.
• If you use cloud save: your Google Play Games player ID and display name (shown as "signed in as"), and a session token that keeps you connected to our server.

This data stays on your phone unless you use cloud save (below). The app allows Android's Auto Backup, so Android may include it in your device backup to your Google account, or copy it to a new phone during device transfer, depending on your phone's settings. That backup is handled by Google, and we cannot see it.

The game never asks you for a permission and cannot access your location, contacts, photos, camera, microphone or files. It uses internet and network-state access, Google Play Billing and Google Play Games. Google's libraries also include wake-lock and foreground-service permissions for background tasks. The game contains no ads, no advertising SDK, and no analytics or crash-reporting libraries of our own, and it does not use your device's advertising ID.

Purchases (Google Play Billing)

In-app purchases are handled by Google Play Billing. You pay Google, and Google's payment terms and privacy policy apply to the payment. We never see or store your card number, bank details, billing address or Google account email.

The game sells three "Feed the Starving Dev" look packs. Each one unlocks a new look for one villain, can be bought once per Google account, and never expires.

When you buy something, the app sends the purchase details from Google Play (the product ID, the purchase token and the order ID) to our verification server. The server checks with Google Play that the purchase is genuine, has not been used before and has not been refunded, and only then is the item granted. We keep a record of each purchase (product, order ID, purchase time and status, such as refunded) so we can confirm purchases, prevent fraud, handle refunds and meet tax and legal obligations. The record is filed under a one-way hash of the purchase token. The token itself is not kept: we would keep it only for subscriptions, and the game sells none. Google also tells our server when a purchase is refunded or cancelled.

If you are signed in to Google Play Games when you buy, the game tags the purchase with your player account ID: a one-way hash of the app's package name and your Play Games player ID, not the ID itself. The tag goes to Google Play with the order (as Google's "obfuscated account ID") and to our server with the purchase check. Look packs are also tied to your Google Play account, so you can restore them without signing in to Play Games: tap Restore purchases on the Account screen. If the game asks you to choose between the progress on your phone and your cloud save, your look packs are restored whichever you pick.

Real-money purchases are for players 18 or older. The game asks before your first purchase and turns purchases off for players who say they are younger. The game also limits real-money purchases to US$100 per calendar month. It keeps the running total on your phone, as part of your game save, and the limit resets on the 1st of each month (UTC).

Cloud save (optional, through Google Play Games)

You don't need to sign in to play. If your phone is signed in to Google Play Games, the game connects to it automatically and saves your progress on our server, so you can restore it after reinstalling or on a new phone. If you are not signed in, none of the information in this section is sent.

When cloud save is on, our server stores:

Our server does not store your Play Games display name, your email address, or your Google sign-in tokens. The game asks Google for no extra permissions beyond Play Games sign-in. Google's handling of your Play Games account is covered by the Google Privacy Policy.

While you are signed in, the Account screen shows your Player code, for example 3FA9-0C21-7B4E. It is the first 12 characters of your player account ID. Quote it if you email us about your data, so we can find it without asking you for anything else.

To stop cloud save, use Delete cloud data (see below). After that, cloud save stays off on that phone until you tap Sign in on the Account screen.

Information shared with third parties

Google Play handles payments and Play Games sign-in, and receives the player account ID tag on orders you place while signed in. Our server contacts Google Play to verify purchases and your sign-in.

Google Cloud hosts our server (Cloud Run) and database (Firestore). Google processes this data on our behalf.

We do not sell your information, and we do not share it with anyone else, except where the law requires it.

Where your information is stored

Our server and database run on Google Cloud in the us-central1 region, in the United States. The game is offered through Google Play in many countries. Wherever you use it, the information described under "Purchases" and "Cloud save" is sent to and processed in the United States, where data protection laws may differ from those where you are. Wherever you live, this policy applies to you, and the section "Your rights" explains extra rights that people in some places have under local law.

How your information is protected

All communication between the app and our server is encrypted in transit (HTTPS). Your session with our server is tied to this app and your player ID, and it expires after 30 days. The server limits how many requests it accepts, to prevent abuse.

Our server's logs record the time, the type of request and its result, how long it took, and the IP address it came from. Google Cloud's request logs also record your device's user agent (your phone model, Android version and browser-engine version). For purchase checks the logs include the product ID and the order ID, and refund notifications from Google log the order ID. To help us trace problems, some log lines include the first 12 characters of your player account ID (the same as your Player code) or of the purchase token's hash. The logs never contain your save, your full player ID or player account ID, or any tokens. We use them for security, to limit abuse and to fix problems. Google Cloud keeps them for 30 days by default.

How long we keep it

• On your device: game progress and purchase information until you tap Reset progress (which also replaces your cloud save with a fresh start if you are signed in). Your Play Games player ID, display name and session token until you tap Delete cloud data, clear the app's data or uninstall the app. Settings until you clear the app's data or uninstall the app.
• Cloud save and its earlier versions: until you delete them. Each new save replaces the previous one, and at most 2 earlier versions are kept. There is currently no automatic deletion of inactive saves. If we introduce one, we will say so here.
• Purchase and order records: kept for 7 years after the purchase, for tax, refunds and fraud prevention. A daily clean-up job then deletes each record, with its order claim and its refund or cancellation events. If you delete your cloud data, your player account ID is removed from them straight away (see "Deleting your data" for when Google's order tag is written back), and the rest of each record is kept until the same 7-year point.
• Server logs: 30 days by default, then deleted automatically by Google Cloud.
• Database backups: we also keep encrypted copies of our whole database on Google Cloud: a point-in-time recovery history of the last 7 days, daily backups kept for 7 days and weekly backups kept for 14 weeks. We use them only to recover from data loss or to restore a player's progress at their request. Backups can't be edited, so data you delete (including your player account ID removed from purchase records) stays in them until they expire: up to 14 weeks after you delete it.

Deleting your data

In the game: open the Account screen and tap Delete cloud data. This immediately deletes your cloud save, its earlier versions and the record linking your Play Games player ID to your data from our live database, and removes your player account ID from your purchase records. The purchase records themselves are kept until 7 years after each purchase, as described above, without your player account ID (with one exception, explained below). Progress on your phone is kept. Deleted data can remain in our encrypted backups, which we use only to recover from data loss or to restore a player's progress at their request, until they expire: up to 14 weeks.

What this means for purchases: your look packs stay tied to your Google Play account, so you can still restore them with Restore purchases.

After you delete your cloud data, your purchases are no longer linked to you, and they stay that way unless you sign in to Play Games again. Google Play keeps its own copy of the tag on each order, and we cannot remove it. When the game checks a purchase with our server again, the server writes Google's tag (your player account ID) back onto that purchase record, but it does not link the record to you or restore it to you. The game normally checks your look packs this way each time it starts. If you sign in to Play Games again with the same account, purchases that Google still tags with your account and that carry the tag on our record again can be linked to you again. Deleting your cloud data never stops your look packs coming back from Google Play.

By email: you can also ask us to delete your data by emailing battlearenaunlimited@gmail.com. Please say it is about Villain's Crew and include your Player code from the Account screen. If you can't open the game, send the order number (it starts with GPA.) from a Google Play receipt instead. We will reply within 30 days, and we will confirm when your data has been deleted.

To remove your progress and purchase information from your phone, tap Reset progress on the Account screen (if you are signed in, this also replaces your cloud save with a fresh start). To remove everything the game keeps on your phone, including your Play Games player ID, display name, session token and settings, clear the app's data in Android settings or uninstall the app. The full steps are on the data deletion page.

Your rights

If you are in the EEA, the UK or Switzerland, data protection law (GDPR or UK GDPR) gives you the right to access the personal data we hold about you, correct it, have it deleted, restrict or object to how we use it, and receive a copy of it. You can also complain to your local data protection authority. We use your information to provide the game and cloud save you asked for, for our legitimate interests in preventing fraud and keeping the service secure, and to meet legal obligations such as keeping tax records.

If you are in California or another US state with a privacy law, you have the right to know what personal information we collect, to have it deleted or corrected, and to opt out of its sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We will not treat you differently for using these rights.

To use any of these rights, email us at the address below and include the Player code shown on the Account screen, so we can find your data. We will reply within 30 days.

Children

Villain's Crew is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has used cloud save, contact us at the address below and we will delete the data.

Changes to this policy

If this policy changes, the updated version will be published at this address with a new effective date. If the change is significant, we will also mention it in the app or its store listing.

Contact

battlearenaunlimited@gmail.com

Data safety summary

This table summarises the data the app handles, in the terms used by Google Play's Data safety section.

All of this data is encrypted in transit. You can ask for your data to be deleted in the game (Delete cloud data on the Account screen) or by email, as described under "Deleting your data". Purchase records are then kept until 7 years after each purchase, without your player account ID except as described there.