Privacy Policy
For the Mosquito Kingdom mobile game.
Last updated: 10 August 2026Mosquito Kingdom is free, shows adverts, and offers optional in-app purchases.
Your game progress stays on your device unless you choose to create an account for cloud save. We do not run analytics or trackers, and we never sell your data. Our advertising partner, Google AdMob, does collect device and advert data in order to show you adverts — section 3 explains exactly what, and section 5 explains how to control it.
You can remove adverts entirely with a one-off purchase, and you can delete your account and everything in it at any time, instantly.
1. Who we are
Mosquito Kingdom is made and operated by ONEUP TECH S.R.L., a company registered in Romania, European Union. For the purposes of the General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.
You can reach us at any time at contact@oneuptech.ro.
2. Playing offline and without an account
You never have to create an account. The complete game is playable as a guest.
- Your save — progress, currency, upgrades, unlocked lore cards, purchased items and settings — is written to your device's private app storage.
- That save is not sent to us unless you turn on cloud save by creating an account.
- Uninstalling the game removes it. If you never used cloud save, we cannot recover it, because we never had it.
Two honest caveats, so this section is not misleading:
- The game does need an internet connection to load adverts, and loading an advert involves your device talking to Google. That happens whether or not you have an account. See section 3.
- If you play with no connection at all, no adverts load and nothing leaves your device.
3. Advertising
Mosquito Kingdom is free to play and is funded by adverts. We use Google AdMob, operated by Google Ireland Limited, to select and deliver them. There are two kinds:
- Banner adverts — a small strip displayed during play.
- Rewarded adverts — entirely optional. You choose to watch a short video in exchange for an in-game bonus, such as doubling your offline earnings or a temporary boost. Nothing in the game is locked behind watching one; you can finish the entire game without ever doing so.
What the advertising SDK collects
To serve, cap and measure adverts, Google's advertising SDK collects the following from your device. We do not receive this data ourselves — it goes to Google, who act as an independent controller for it. We only see aggregated revenue and performance figures that cannot identify you.
| Data | Why |
|---|---|
| Advertising ID (Android Advertising ID) | A resettable identifier provided by your operating system, used to select adverts, cap how often you see the same one, and detect fraud. You can reset or delete it — see section 5. |
| IP address | Used to work out your approximate region so adverts are in a sensible language and legal for your country. This is coarse, country or city level, not precise location. |
| Device and app information | Device model, operating system version, screen size, language, network type, and the fact that the advert was requested by Mosquito Kingdom. |
| Advert interaction | Whether an advert was shown, how long it was visible, whether you tapped it, and whether a rewarded video was watched to the end so the reward can be granted. |
Google's handling of this data is governed by the Google Privacy Policy and its advertising terms, not by this policy. You can review the partners Google works with at business.safety.google/adspartners.
Mosquito Kingdom offers a one-off Remove Ads purchase. Buying it stops banner adverts from being displayed. Optional rewarded adverts remain available if you still want the bonuses, but you never have to watch one.
4. In-app purchases
The game offers optional one-off purchases — removing adverts, cosmetic sweeper skins, extra tools, a starter bundle, an increased offline earnings cap, and a "support the developers" option. None of them are required to finish the game.
How payment works
- Purchases are processed entirely by Google Play Billing. You are transacting with Google, not with us.
- We never see your card number, bank details, billing address or full name. Those go to Google and never reach our servers.
- What we receive from Google is a confirmation that a specific product was purchased successfully, so the game can unlock it.
What we store about a purchase
| Data | Where it lives |
|---|---|
| Your entitlements — which items you own | On your device. If you use cloud save, they are also part of the save stored on our servers so your purchases follow you to a new device. |
| Purchase verification token | Used to confirm with Google that a purchase is genuine and not forged. It identifies the transaction, not you personally. |
| Payment details | Never collected, never stored, never seen by us. |
Google keeps its own record of your purchase, visible in your Google Play order history, under Google's privacy policy. Refunds are handled through Google Play.
5. Your advertising choices and consent
If you are in the EEA, the UK or Switzerland
Before any personalised advert is shown, the game presents a consent form using Google's User Messaging Platform. You can:
- consent to personalised adverts, which are selected based on your advertising profile; or
- refuse, in which case you see only non-personalised adverts. These are chosen from general context rather than your profile, and still require limited data for frequency capping and fraud prevention.
Refusing does not reduce your access to the game in any way. You get the same content either way.
You can change your mind at any time from the in-game Settings → Privacy options screen, which reopens the same form. Consent is the legal basis for personalised advertising, and you may withdraw it as easily as you gave it.
Everyone, on any device
- Reset your advertising ID — on Android, Settings → Privacy → Ads. This breaks the link to any profile built against the old one.
- Delete your advertising ID — the same screen offers this on recent Android versions. Apps then receive no advertising ID at all.
- Opt out of ad personalisation at adssettings.google.com.
- Buy Remove Ads to stop banner adverts being displayed.
6. What we collect if you create an account
An account is optional. It exists for exactly two reasons: to carry your save between devices, and to place you on the leaderboards. Here is everything our servers store.
Account and sign-in
| Data | Details |
|---|---|
| Internal account ID | A random identifier we generate. It is not derived from anything about you or your device. |
| Public handle | The short name shown next to your leaderboard score. You choose it and you can change it. |
| Email address | Only if you register with email and password. Used to sign you in and to send password resets. Stored in a normalised form. |
| Password | Never stored. We keep only an Argon2 hash, which cannot be reversed back into your password. |
| Sign-in provider record | Whether the account uses email or Google Play Games. For Google Play Games we store only a hash of the identifier Google gives us, never the raw value. |
Sessions and devices
| Data | Details |
|---|---|
| Device installation ID | A random value the game generates on first run so we can tell your signed-in devices apart and let you sign a lost device out. It is not the advertising ID and not a hardware identifier. |
| Platform and device label | For example "android", plus an optional readable label so a device is recognisable in your session list. |
| Session tokens | Stored as hashes only. Sign-in tokens are short lived; refresh tokens rotate on every use, and reuse of an old one revokes the session. |
| IP address | Stored only as a keyed, irreversible hash, used to rate limit registrations, sign-ins and password resets. We do not keep or display raw IP addresses alongside your account. |
Cloud save and leaderboards
| Data | Details |
|---|---|
| Save snapshot | Your game state: currency, upgrade and device levels, research, zone progress, prestige state, discovered lore cards, owned purchases and settings. |
| Progress summary | Figures pulled out of the snapshot for conflict resolution and leaderboards: highest zone, total clears, lifetime Buzz, bosses defeated, best combo, best streak, clean sweeps, prestige count and infestation rank. |
| Sync metadata | Which device sent the save, when, on what app and rules version, and what triggered the sync. |
| Leaderboard entry | Your public handle and score. This is the only part of your account other players can see. |
| Anti-cheat records | If a submitted save fails validation, the rejected snapshot and the reason are quarantined with a support reference so you can ask us to review it. |
Security and support
- Security audit events — a record that an event happened (registration, sign-in, password reset, logout, deletion), with a hashed IP and a request ID, used to investigate abuse and account takeovers.
- Support messages — if you write to us about your account, we keep the message so we can answer it.
- Outgoing email records — a queue entry for transactional email we send you, such as a password reset.
7. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Creating your account, signing you in, syncing your save, showing you on the leaderboard | Contract — Art. 6(1)(b). |
| Processing a purchase and unlocking what you bought | Contract — Art. 6(1)(b). |
| Personalised advertising | Consent — Art. 6(1)(a). Asked for before any personalised advert is shown, and withdrawable at any time from Privacy options. |
| Non-personalised advertising, frequency capping and ad fraud prevention | Legitimate interests — Art. 6(1)(f), in funding a free game and preventing fraud. Where local law requires consent for the device access involved, that is requested too. |
| Sending password resets and account emails | Contract — Art. 6(1)(b). |
| Rate limiting, abuse prevention, anti-cheat, keeping the service up | Legitimate interests — Art. 6(1)(f). We use hashed identifiers so this is as privacy-preserving as we can make it. |
| Answering your support messages | Legitimate interests — Art. 6(1)(f). |
| Tax and accounting records for purchases | Legal obligation — Art. 6(1)(c). |
8. Google Play Games sign-in
Signing in with Google Play Games is optional and is offered so you do not have to invent another password. If you use it:
- Google confirms to our server that the sign-in is genuine.
- We store only a hash of the player identifier Google returns. We do not receive or store your Google password, and we do not ask Google for your Gmail, contacts, or any other Google data.
- Google's own handling of your data is governed by the Google Privacy Policy.
9. What we never collect
To be explicit, Mosquito Kingdom does not:
- collect your precise or GPS location — advert targeting uses only a coarse region derived from your IP address;
- read your contacts, photos, files, microphone or camera;
- ask for your real name, phone number, date of birth or postal address;
- receive or store your payment card details;
- contain any third-party analytics or crash-reporting SDK — we do not run Firebase Analytics, Google Analytics or any equivalent in this game;
- use cookies or tracking pixels on this website;
- record anything you type, beyond your email address and chosen handle if you make an account;
- sell, rent or trade your personal data to anyone, for any purpose, ever.
The advertising SDK described in section 3 is the only third-party component in the game that collects data, and section 5 explains how to limit it.
10. Who we share data with
We do not use third-party cloud hosting, analytics or storage providers for your account data. Account and cloud-save data lives on servers we rent and administer ourselves, with our own database and our own mail server.
Data is disclosed only:
- to Google (AdMob) — the advert data in section 3, collected directly from your device by Google's SDK;
- to Google (Play Billing) — to process a purchase you started and to verify it is genuine;
- to Google (Play Games) — only to verify a sign-in you initiated;
- publicly, in a limited way — your chosen public handle and score appear on the leaderboards;
- to you, on request;
- where the law requires it, in response to a valid, binding legal request.
Google is an independent controller for the advertising and payment data it collects, which means it decides how that data is used and is responsible for it under its own policies. Google may transfer that data outside the EEA under its own safeguards.
11. How long we keep things
| Data | Kept for |
|---|---|
| Account, cloud save, leaderboard entry | As long as your account exists. Deleted immediately when you delete the account. |
| Sign-in session | Up to 30 days from last use. Signing out ends it straight away. |
| Access token | 15 minutes. |
| Password reset link | 30 minutes, single use. |
| Your entitlements (what you bought) | On your device until you uninstall. In cloud save, until you delete your account. Google keeps its own permanent order record. |
| Advertising data | Held by Google under Google's retention policy, not ours. We never hold a copy. |
| Your advertising consent choice | Stored on your device by the consent SDK until you change it or clear the app's data. |
| Hashed IP rate-limit counters | Only as long as needed to enforce the limit. |
| Security audit events | Retained for abuse investigation. On account deletion the link to your account is removed and the entry becomes anonymous. |
| Encrypted database backups | Rotated on our backup schedule; deletions propagate as backups roll over. |
12. Deleting your account and data
You can delete your account at any time, and you do not have to email us to do it.
- In the game — open the account screen and choose to delete your account. You will be asked to confirm who you are first.
- On the web — use api.oneuptech.ro/v1/account/delete.
- By email — write to contact@oneuptech.ro from your registered address if you cannot use either of the above.
Deletion is immediate and permanent. It is not a soft delete or a deactivation. Your account row, sign-in identities, email credentials, sessions, cloud saves, save history, leaderboard entries, pending emails and support tickets are removed from the live database in a single transaction. What remains is an anonymous audit record that a deletion occurred, with no link back to you.
Because it is permanent, we cannot restore a deleted save.
Purchases are held against your Google account, not ours. If you delete your Idle Mosquito account but keep the same Google account, you can restore what you bought. To have Google delete its record of a purchase, or to request a refund, you need to contact Google Play.
To remove advertising data held by Google, use the controls in section 5.
13. Your rights under the GDPR
If you are in the European Economic Area or the United Kingdom, you have the right to:
- access the personal data we hold about you;
- rectify it if it is wrong;
- erase it — see section 12, which you can do yourself in seconds;
- restrict or object to processing based on our legitimate interests;
- port your data, receiving it in a machine-readable format;
- withdraw consent for personalised advertising at any time, from Privacy options in the game;
- complain to a supervisory authority.
To exercise any of these against us, email contact@oneuptech.ro. We will respond within one month and we do not charge for it. For data held by Google as an independent controller — advertising and payment data — you will need to exercise those rights with Google directly.
Our supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may also complain to the authority in your own country.
14. How we protect the data
- All traffic between the game and our servers is encrypted with HTTPS.
- Passwords are hashed with Argon2, and new passwords are checked against a large offline list of known-breached passwords.
- IP addresses and third-party sign-in identifiers are stored only as keyed hashes.
- Session tokens are stored as hashes, expire quickly, and rotate on every refresh; replaying an old token revokes the session.
- The application service runs as a locked-down system account with no interactive login, reachable only through a local socket behind our web server, and cannot read our mail credentials.
- The database and cache are reachable only from the local machine, not the internet.
- Backups are encrypted, and the key needed to decrypt them is never stored on the server.
No system is perfectly secure, but we would rather over-engineer this than not.
15. Children
Mosquito Kingdom is a light cartoon game with no violence towards people, no chat and no user-generated content. Players cannot contact each other.
However, because the game shows adverts and offers purchases, it is not directed at children, and the optional account requires you to be at least 16 (or the age of digital consent in your country, where that is lower). We do not knowingly collect personal data from children below that age.
If you are a parent or guardian and believe your child has created an account or made a purchase without permission, email contact@oneuptech.ro. We will delete the account, and we will point you at Google Play's refund process for the purchase, which is the only route that can actually reverse a payment.
We recommend parents enable purchase authentication in the Google Play app so a password is required for every purchase.
16. Changes to this policy
If we change how your data is handled, we will update this page and change the "last updated" date at the top. For changes that meaningfully affect you, we will publish the updated policy before the change takes effect and, where appropriate, tell you inside the game.
17. Contact us
Questions about this policy, requests about your data, or anything else:
ONEUP TECH S.R.L., Romania, European Union.