Privacy policy
Version 1 · Last updated: 1 November 2026
Courtesy translation. The Spanish version is the authoritative text. If you are acting as a consumer, any ambiguity or discrepancy between the two versions will be interpreted in your favour.
Summary in plain language
- You can play without an account. Your progress stays on your phone and never reaches us.
- If you want a cloud copy, you sign in with Google or Apple. We then store your identifier, your email address and your progress.
- For now, the game has no ads, analytics or purchases. If we add them, we will update this policy first and ask for your consent where needed.
- We do not sell your data. This website does not use cookies.
- You can delete your account whenever you like.
1. Who the controller is
Manuel Villanueva, Tax ID (NIF) 28829953M, Avinguda Mas d'en Puig, 08870 Sitges (Barcelona), Spain. Email: manuel.villanueva.dev@gmail.com. We have not appointed a data protection officer, as we are not required to.
2. What data we process
If you play without an account
Your progress and settings are stored only on your device. The game asks our server whether a mandatory update is available; as with any internet connection, the server receives your IP address so that it can reply.
If you create an account (optional)
- Identity: an account identifier and your email address. Google or Apple sends them to us when you sign in, and may also include your profile name and photo, which the game does not use. Apple lets you hide your email address.
- Progress: for each level, your stars, whether you got a Perfect and the date of the last update.
- Technical session data: IP address, type of device or browser and access dates.
If you write to us
Your email address and whatever you tell us.
What we do not collect
Your location, contacts, photos, camera or microphone input, date of birth or payment details.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing your account and the cloud copy of your progress | Identity and progress | Performance of a contract (6(1)(b)) |
| Keeping the game working and secure: sessions, update notices, abuse prevention | Technical data | Legitimate interests (6(1)(f)) |
| Replying to you and dealing with requests to exercise your rights | Email address and message | Legitimate interests (6(1)(f)) and legal obligation (6(1)(c)) |
We do not carry out automated decision-making with legal or similarly significant effects on you, and we do not carry out profiling.
4. Who it is shared with
We do not sell your data. These providers process it to deliver the service:
| Provider | What for | Where |
|---|---|---|
| Supabase Inc. | The game's database and authentication | Ireland (EU) |
| Google LLC / Google Ireland | Signing in with Google, and the email account we reply from | EU and USA |
| Apple Inc. / Apple Distribution International | Signing in with Apple | EU and USA |
| VADAVO SOLUCIONES, S.L. | Hosting this website | Spain |
Google and Apple also process the data in your Google or Apple account under their own policies: Google and Apple. We may also disclose data to the authorities if the law requires it.
5. International transfers
The game's database is in the European Union, but Supabase, Google and Apple are US companies or have a US parent, and may process data outside the European Economic Area, for example to give us technical support. When that happens, the transfer relies on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) if the provider is certified under it, or on the European Commission's standard contractual clauses. You can ask us for more information.
6. How long we keep it
- Account and progress: for as long as you have the account. When you delete it, they are erased.
- What is on your phone: until you uninstall the game.
- Emails: for up to 2 years after the matter is closed.
- Providers' technical logs and backups: for their normal rotation periods.
7. Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. To exercise these rights, write to manuel.villanueva.dev@gmail.com. We reply within one month. To delete your account, follow the steps on this page.
If you think we are not handling your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority in your country.
8. Security
The game's communications are encrypted and each account can only read its own progress. No system is infallible: if a breach affected your data, we would act as the law requires, including telling you if it posed a high risk to you.
9. Minors
Can in One is intended for people aged 16 and over. We do not ask for your date of birth, so we rely on you to meet this requirement. If you are a parent or guardian and believe someone under 16 has given us data, write to us and we will delete it.
10. This website and cookies
This website does not use cookies or store anything in your browser, which is why you won't see a cookie notice. It also has no analytics, advertising or forms, and the typefaces are served from the website itself, without going through third parties.
Like any website, this one runs on a server that logs technical data about each visit (IP address, page requested, date and browser) in order to work and to protect itself from abuse, on the basis of our legitimate interests. These logs are managed by the hosting provider and are deleted within its normal retention periods.
11. Changes to this policy
If something important changes, such as adding ads or analytics, we will tell you in the game before the change takes effect and, if your consent is needed, we will ask for it. The date of the latest version is always shown here.
12. Contact and languages
manuel.villanueva.dev@gmail.com
This policy is available in Spanish and English. The Spanish version is the authoritative text; if you are acting as a consumer, any ambiguity or discrepancy between the versions will be interpreted in your favour.