SoundDrop
1. Data controller
The controller of personal data collected by the SoundDrop game is:
- Company
- ARKODIN LLC, a limited liability company registered in the State of New Mexico (USA), Entity ID 0008121708
- Address
- 304 S Jones Blvd, Las Vegas, NV 89107, USA
- Phone
- +1 (505) 369-4704
- Contact for your data
- contact@arkodinstudio.com
ARKODIN LLC is established in the United States. As the game is aimed at players in the European Union, the GDPR fully applies to our processing (article 3(2) GDPR) and you have all the rights described below.
Representative in the European Union (article 27 GDPR): [EU REPRESENTATIVE — to be appointed]. You can contact them, as well as us, with any question about your data; they can also be contacted by the CNIL and other data protection authorities.
2. Data collected
| Category | Details |
|---|---|
| Account identifier | A random technical identifier created on first launch (guest account). |
| Email address | Only if you choose to save your account: it is used to send you the sign-in link. |
| Profile | Username, avatar, chosen title and frame, favorite music styles and artists, friend code. |
| Game data | Card collection, virtual currencies, level, progress, answers and scores, games played, streaks, badges, season pass, rankings. |
| Social data | Friends list, gifts, trade offers, market listings, auctions, wishlist. |
| Purchases | Product bought, date, status, Apple and RevenueCat transaction identifiers, SoundDrop+ expiry date. No bank data: payment is processed by Apple. |
| Messages | What you send us via “A bug, an idea?” or by email to support. |
| Technical and diagnostic data | Device model, iOS and app version, language, crash and error reports, performance metrics. IP address and time of requests in the server’s technical logs. |
| Usage statistics | Game events (app opened, pack opened, game finished, tutorial step, purchase started or completed, trade proposed, theme chosen), linked to the account identifier, never to the email or username. |
We do not collect your location, contacts, photos, microphone, browsing history or your device’s advertising identifier.
3. Purposes and legal bases
| Why | Legal basis (GDPR) |
|---|---|
| Create and manage your account, save and sync your progress, sign you in by email | Performance of the contract (SoundDrop Terms and Arkodin General Terms) — art. 6(1)(b) |
| Run the game: games, rewards, collection, pass, rankings, friends, trades, market, auctions | Performance of the contract — art. 6(1)(b) |
| Deliver in-app purchases, manage SoundDrop+, process refunds | Performance of the contract — art. 6(1)(b) |
| Keep records of sales | Legitimate interest (meeting our accounting and tax obligations) — art. 6(1)(f) |
| Fight cheating, fraud, multi-accounting and abuse; secure the service | Legitimate interest (a fair and safe game) — art. 6(1)(f) |
| Detect and fix crashes and bugs | Legitimate interest (a game that works) — art. 6(1)(f) |
| Measure game usage to improve it (statistics) | Legitimate interest (improving the game) — art. 6(1)(f); you can object (section 12) |
| Answer your messages and support requests | Legitimate interest and performance of the contract — art. 6(1)(f) and 6(1)(b) |
| Send you reminders (free pack ready, streak) as notifications | Your consent, given through the iOS permission and changeable in Profile → Settings |
Cheat detection is partly automated (for example, an answer given in a humanly impossible time is counted as wrong). Any measure on an account (suspension, deletion) is decided by a person and can be appealed (section 12 of the Arkodin General Terms).
4. What we don’t do
- No advertising in the game and no ad targeting.
- No tracking within Apple’s meaning: we do not link your data with data from other apps or websites, and we do not ask for tracking permission (ATT).
- We do not sell, rent or share your data for commercial purposes.
- No free-text messaging between players.
5. What other players see
Your username, avatar, title and frame, level, league, card showcase, scores and rankings (daily challenge, weekly league, an artist’s Top Fan), as well as the cards you offer for trade, sale or auction, may be visible to other players. Your friend code lets other players add you. Your email address is never visible to other players. Choose a username that doesn’t reveal your identity if you prefer.
6. Recipients and processors
Your data is processed by the publisher and by the following providers, who act only on our instructions under a contract compliant with article 28 GDPR:
| Provider | Role | Data location |
|---|---|---|
| Supabase (Supabase, Inc.) | Database, authentication, server functions, storage | European Union |
| RevenueCat (RevenueCat, Inc.) | App Store purchase validation and subscription tracking | United States |
| Sentry (Functional Software, Inc.) | Crash and error reports (no IP address or email) | United States |
| PostHog (PostHog, Inc.) | Usage statistics (IP address not stored) | European Union |
| Resend (Resend, Inc.) | Sending sign-in emails | United States |
| Vercel (Vercel Inc.) | Hosting of the arkodinstudio.com website | Global network, headquartered in the United States |
Apple distributes the app and processes in-app purchase payments as an independent controller, under its own privacy policy. We only receive from Apple the information needed to deliver your purchases, never your bank data.
Music previews and images. Previews, covers and artist photos come from Deezer (public API) and Apple (iTunes API). Our servers request them without any data about you. In some cases, your device downloads them directly from these services: they then see, as with any web page, your device’s IP address and technical connection information. We do not send them your identifier, email or game data. “Listen on” links open Apple Music, Spotify or Deezer, whose privacy policies then apply.
Finally, we may disclose data to authorities where required by law.
7. Transfers outside the European Union
Game data is hosted in the European Union (Supabase). The publisher, ARKODIN LLC, is established in the United States and accesses it to run the game and answer your requests, in compliance with the GDPR, which applies to this processing.
Some providers are established in the United States (see the table above). These transfers are covered by the safeguards of articles 44 et seq. GDPR: the European Commission’s adequacy decision of July 10, 2023 (EU–US Data Privacy Framework) for certified providers and, failing that, the standard contractual clauses adopted by the European Commission (decision 2021/914). You can ask us for a copy of these safeguards.
8. Retention periods
- Account and game data: as long as your account exists. When the account is deleted, this data is erased immediately from the database; it may remain for up to 30 days in technical backups before being overwritten.
- Inactive accounts: an account with no sign-in for 3 years is deleted.
- Purchase records: up to 10 years from the purchase, as needed to meet our accounting and tax obligations. After your account is deleted, they are no longer linked to your player profile.
- “A bug, an idea?” messages: deleted with your account, and at the latest 3 years after being sent.
- Emails exchanged with support: 3 years after the last exchange.
- Crash reports: 90 days at most.
- Usage statistics: 25 months at most.
- Server technical logs (including IP address): a few days, 30 days at most.
9. Storage on your device
The app stores on your device what it needs: your sign-in session, a copy of your game state to start faster, your settings (theme, notifications) and an anonymous identifier used for usage statistics. Reminders (free pack, streak) are notifications scheduled locally on your device: no data is sent to a server for them. You can turn them off in Profile → Settings or in iOS settings.
10. Minors
The game is intended for people aged at least 13. In France, if you are under 15, a parent’s consent is required before using the game and registering your email address in it (article 45 of the French Data Protection Act). We collect the minimum data and show no advertising. A parent can exercise their child’s rights and request deletion of their account at contact@arkodinstudio.com. If we learn that an account belongs to a child under 13, we delete it.
11. Security
Communications between the app and our servers are encrypted (HTTPS/TLS). Data access is limited by database-level security rules (each player can only access their own private data), sensitive operations (rewards, purchases, trades) run only on the server, and access to administration is restricted. As no system is infallible, we will inform you without undue delay, and the CNIL within 72 hours, of any data breach likely to pose a risk to you, as required by articles 33 and 34 GDPR.
12. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights over your data:
- access (get a copy of your data) and portability (receive it in a machine-readable format);
- rectification (your username and avatar can be changed directly in the game);
- erasure: delete your account in Profile → Account → Delete my account, or ask us by email;
- objection, in particular to usage statistics, and restriction of processing;
- withdrawal of your consent at any time (notifications);
- setting instructions on what happens to your data after your death.
To exercise these rights, write to contact@arkodinstudio.com from the address linked to your account, or state your username and friend code (Social → Friends screen) if your account has no email. We may ask you to prove that you own the account. We reply within one month, which may be extended by two months for a complex request.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr/en/complaints) or with the data protection authority of your country of residence in the European Union.
13. The arkodinstudio.com website
SoundDrop’s web pages (presentation, terms, support) are hosted on the studio website, arkodinstudio.com. What the website does with your data when you visit it (host’s technical logs, self-hosted fonts, a language-preference cookie — and nothing else: no advertising, no analytics) is described in the website privacy policy.
14. Changes
We may update this policy, for example if we add a feature or change provider. The date of the last update is shown at the top of the page. For any significant change, we will inform you in the game before it takes effect. This policy is written in French; in case of conflict between this translation and the French version, the French version prevails.
End of documentBack to top