Hotpot Party — Privacy Policy
Hotpot Party ("the game") is a multiplayer game made by iMango Studio ("we"), played on Android and in web browsers. This policy explains what data the game handles and why. We don't sell personal data.
1. Data stored on your device
Your display name, character look (hair, face, shirt), settings (music, sound, vibration, language), tutorial status and a session code to rejoin the table you were at are saved on your phone (web version: in your browser's storage). Uninstalling the game or clearing the site's data removes them.
2. Data on the game's server
When you play online, the game connects to our server. The server stores:
- A guest account, created automatically the first time you connect: a random ID, your display name, when it was created and last used. The server keeps only a hash of your sign-in token, never the token itself.
- If you sign in with Google: your Firebase user ID, and the email address and name of your Google account, so you can get back to the same account on another device. We never receive your password.
- Friends: your friend code, friends list, friend requests and the players you blocked. Your friends can see when you are online and which table you are at.
- Round history: table code, time, and each player's score, rank and title, used for profiles and stats.
- Game save: the cosmetic items you unlocked and wear, your settings, daily gift days and seasonal event progress, so they follow your account.
Players at your table see your display name, character, score, emotes and quick-chat lines. Chat only offers preset lines; there is no free-text input. Your IP address is used to connect and to limit abuse, and is not stored in our database.
3. Data collected by third-party services
The game uses these Google services. They collect data automatically from your device under their own privacy policies:
| Service | Why | Data |
|---|---|---|
| Google AdMob (ads, Android version), with the Google User Messaging Platform (consent) | Show an interstitial ad when leaving the results screen, which keeps the game free; ask for consent where the law requires it | Advertising ID, device and app information, IP address (used to estimate approximate location), ad interactions |
| Google Analytics for Firebase (Android) / Google Analytics (web) | Understand how players join tables, finish rounds and use the tutorial, to improve the game | App instance ID or Analytics cookie, game events (e.g. table joined / left, round finished, tutorial step, ad shown), device or browser model, OS, country derived from IP |
| Firebase Crashlytics (Android version) | Find out when the game crashes or hits an error, so we can fix it | Crash and error reports (where in the code, the screen that was open, the game's latest log lines), device model, OS, game version, Crashlytics installation ID |
| Firebase Authentication | Sign in with Google (only if you choose to) | Google account email, name, profile picture and ID |
| Firebase Hosting | Serve the web version | IP address, browser (access logs) |
Policies: Google Privacy Policy · How Google uses data from apps that use its services · Firebase privacy.
4. Your choices
- No sign-in needed. You can play fully as a guest. Signing in with Google is optional; sign out under Account.
- Ad consent. If you are in the EEA, the UK or Switzerland, the game asks for your consent before showing personalised ads. You can change your choice any time in Settings → Ad privacy.
- Advertising ID. You can reset it or opt out of personalised ads in your Android settings (Settings → Google → Ads, or Settings → Privacy → Ads).
- Blocking. From a player's profile you can block them: they can't add or invite you, and their emotes are hidden.
5. Retention and deletion
- Account, friends, round history and game save data are kept while the account exists.
- Deleting your account in the game: in the Lobby tap the account button (top right) → "Delete account" ("Xoá tài khoản" in Vietnamese) → "Delete for good" ("Xoá vĩnh viễn"). The account, its sign-in identity (email, name), friends, requests, block list and game save are deleted at once; in other players' round history your name is replaced with "Người chơi" (Player) and detached from the account. The sign-in record in Firebase Authentication (Google ID and email) is deleted at the same time on the web version; on Android we delete it within 30 days.
- Or by email: email us (below) from the address of your Google account, or include your friend code. We delete the same, including the sign-in record in Firebase Authentication, within 30 days.
- Analytics data is kept by Google for up to 14 months and is not linked to your name or email.
6. Children
Hotpot Party is not directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has used the game and data was collected, contact us and we will help delete it.
7. Security
Data between the game, our server and the services above is encrypted in transit (HTTPS / WSS).
8. Changes
If this policy changes, we update this page and the effective date above. Significant changes are also mentioned in the game's update notes.
9. Contact
iMango Studio · dangmixxdeveloper@gmail.com