1. Who we are
This Privacy Policy applies to the mobile and web game Hotseat (package / bundle ID com.santrina.hotseat), operated by Santrina (“we”, “us”, “our”).
Gameplay services are provided through our API on hotseat.website. Account authentication and related cloud profile storage are provided via Google Firebase.
Account deletion: request page · fmanagerapp@gmail.com
2. Scope
This Policy covers:
- the Hotseat application on Android, iOS, and supported web clients;
- our game backend and infrastructure used to run careers, matches, and club data on hotseat.website;
- Firebase services we use for sign-in, profile storage, and app integrity checks.
It does not cover third-party websites or stores (for example Google Play or the App Store) that have their own policies.
3. Data we process
We process only what is needed to run an online career game with an account.
3.1 Account & authentication
- Email address and password (password is handled by Firebase Auth; we do not store your plaintext password).
- Google account identifiers if you choose Google Sign-In (name/email as provided by Google for authentication).
- Firebase user ID (UID), email verification status, and authentication tokens used to access the game.
3.2 Manager & club profile
- Manager display name, selected country, and avatar identifier.
- Club name, city, country, stadium name, colours, and emblem identifier.
- Onboarding status, rating / division metadata, and profile timestamps.
This profile is stored in Firebase (Cloud Firestore) and linked to your career on our game servers.
3.3 Gameplay & cloud save data
To operate the game we store career state on our servers (PostgreSQL and related infrastructure), including for example: squad and player data, tactics and line-ups, finances and transfers, matches and results, board / sponsor / infrastructure state, and in-app club notifications. This is gameplay data required to provide the service — not advertising profiles.
3.4 Security & integrity
- Firebase App Check attestation signals (for example Play Integrity on Android, App Attest / DeviceCheck on iOS, and reCAPTCHA-based checks on web) to reduce abuse and unauthorised API use.
3.5 Device & local preferences
- Language preference and certain UI preferences stored locally on your device.
3.6 Technical / server logs
- When your device talks to our API on hotseat.website, our reverse proxy and servers may process standard request metadata such as IP address, timestamps, user-agent, and request paths, used for security, reliability, and debugging.
3.7 What we do not currently use in the app
The current Hotseat client does not integrate advertising SDKs, crash-reporting SDKs (such as Crashlytics), push-notification delivery services (FCM), or in-app purchase / subscription SDKs. If that changes, we will update this Policy and, where required, ask for additional consent.
4. Why we process data
- Provide the game: create and maintain your account, sync career progress, run matches and seasons.
- Authenticate & secure: verify identity, protect accounts, prevent cheating and automated abuse (App Check).
- Communicate service messages: account verification emails (via Firebase) and in-game club notifications.
- Improve reliability: diagnose outages and API errors using technical logs.
- Comply with law: respond to lawful requests and enforce our terms where applicable.
We do not sell your personal data.
5. Legal bases (EEA / UK and similar)
Where GDPR or equivalent rules apply, we rely on:
- Contract: processing needed to provide Hotseat when you create an account and play.
- Legitimate interests: securing the service, preventing fraud/abuse, and keeping logs for reliability — balanced against your rights.
- Legal obligation: where we must retain or disclose information to comply with law.
- Consent: where we expressly ask for it (for example for optional features we may add later).
7. Retention
- Account & career data are kept while your account remains active so you can continue your save.
- After deletion (or a verified deletion request), we remove or anonymise personal account data from active systems within a reasonable period, except where we must keep limited records for security, dispute resolution, or legal compliance.
- Server logs are retained for a limited operational period and then deleted or aggregated.
8. Security
We use industry-standard measures appropriate to an online game: encrypted transport (HTTPS/TLS), token-based API access, Firebase security rules limiting profile access to the owning account, and App Check to reduce unauthorised clients. No method of transmission or storage is 100% secure; please use a strong unique password and protect your device.
9. Your rights
Depending on your location, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- request deletion of your account and associated personal data;
- restrict or object to certain processing;
- receive a portable copy of data you provided;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local data protection authority.
To exercise these rights, email fmanagerapp@gmail.com from the address linked to your Hotseat account and describe your request. We may need to verify that you own the account before acting.
Account deletion: use the Delete account page or email fmanagerapp@gmail.com. We aim to complete verified deletion requests within 30 days.
10. Children
Hotseat is intended for a general audience of football fans and managers. We do not knowingly collect personal data from children under 13 (or under 16 where local law sets a higher digital-consent age) without appropriate parental authority. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.
11. International transfers
Firebase / Google and our hosting providers may process data in countries other than where you live. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses or the provider’s equivalent transfer mechanisms) described in those providers’ documentation.
12. Changes to this Policy
We may update this Privacy Policy as Hotseat evolves (for example if we add optional analytics, purchases, or push notifications). We will change the “Effective” date above and, for material changes, provide additional notice in the app or by email when appropriate. Continued use after an update means you acknowledge the revised Policy.
13. Contact
Controller: Santrina — for the Hotseat game (com.santrina.hotseat).
Email: fmanagerapp@gmail.com
Delete account: hotseat.website/delete-account
Service: hotseat.website