Portal Pop! · privacy
Privacy policy
This policy explains which data are processed when using Portal Pop! and, in particular, the optional World Ranking service.
Last updated: July 12, 2026
1. Data controller
Controller: Combixa
Trading name: Combixa
Privacy contact: info@combixa.com
This policy applies to the Portal Pop! mobile application, the World Ranking available on this website, and communications concerning privacy, data-subject rights and ranking moderation.
2. Data we process
Internal player ID, technical fingerprint HMAC, session hash, profile status, creation date and last activity date.
The name selected for the ranking, its normalized version used to prevent duplicates, and the alias reservation date.
Score, level, combo, hits, mistakes, duration, app version, completion date and integrity-check results.
The infrastructure may record IP address, date and time, user agent and technical security events in its ordinary logs.
How the ranking's technical fingerprint works
The app locally creates a SHA-256 fingerprint from a technical identifier supplied by the platform. The original identifier is neither stored in the database nor made public. When the ranking is used, the fingerprint is sent over HTTPS and transformed by the server into an HMAC using a server-side secret. The database stores that HMAC, not the original identifier.
This mechanism helps recognize the same technical profile on a compatible device after an update or reinstall, prevent duplicates and protect the ranking from abuse. It is pseudonymisation, not absolute anonymisation, because it can distinguish a profile within the service.
Do not use your real name, email address, phone number, postal address or other personal data as your alias. The alias and submitted score are publicly displayed in the World Ranking.
3. Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the World Ranking requested by the player. | Pseudonymous technical profile, alias, score and game data. | Performance of the online service requested when the player enables, checks or uses the ranking. |
| Prevent duplicates, cheating, replay attacks, manipulation and abuse. | Technical HMAC, session token, one-time challenge, submission history and game-consistency data. | The controller's legitimate interest in the security, integrity and fairness of the ranking. |
| Publish the active season standings. | Alias, score, level, combo and update date. | Performance of the ranking service voluntarily requested by submitting a score. |
| Moderate aliases and handle reports. | Reported alias, reason for the report, minimum technical data and related communications. | Legitimate interest in maintaining a safe environment, preventing unlawful or abusive content and protecting users. |
| Handle enquiries, rights requests and claims. | Data included in the message and data reasonably needed to verify the request. | Handling the request, compliance with legal obligations and legitimate interests in administration and legal defence. |
4. Public information, moderation and reports
When you choose to publish a score, the World Ranking may publicly display your alias, score, level reached, maximum combo, position and last update date.
The alias remains linked to the technical profile between seasons. A new season may reset score and position, but the alias remains reserved for that profile while it exists. This reservation does not prevent you from requesting erasure.
Aliases may be subject to automated filters and manual review. The controller may block, hide or replace aliases that are offensive, unlawful, misleading, discriminatory, impersonate another person or contain personal data. You may report an inappropriate alias by emailing info@combixa.com with the subject “Portal Pop! · Alias report”.
The technical identifier, HMAC, session token, IP address, internal player ID and private validation history are not publicly disclosed.
5. Recipients, hosting and international transfers
Access to the data is limited to the controller and providers supplying technical infrastructure under the controller's instructions:
- Hosting and infrastructure: Proveedor de alojamiento que opera combixa.com, which serves the website, API and database using the infrastructure contracted for the Portal Pop! website and API. The provider acts as a processor where applicable.
- Google Play: distribution and installation are handled through Google Play, which processes the data necessary for that service under its own terms. The ranking API does not send Google Play the HMAC, alias or scores.
International transfers: Combixa currently does not integrate its own advertising, analytics or payment services. If the hosting provider or a future provider involves international data transfers, the legally required safeguards will be applied and this policy will be updated where appropriate.
Data is not disclosed to advertisers, advertising networks, data brokers or third parties for behavioural advertising. The ranking only makes public the standings data described above.
6. Retention and deletion
- Technical profile and alias: while the ranking profile remains active and for no longer than 24 months after the last ranking interaction, unless erasure is requested or a properly justified legal need applies.
- Scores and validation history: for the relevant season and up to 24 months after its closure or the last interaction, followed by review for deletion or anonymisation.
- Session tokens: they become invalid on expiry; their hashes are renewed or replaced when a new session begins.
- Infrastructure logs: for the period configured by the provider and only for as long as reasonably necessary for security, diagnosis, service continuity or incident handling.
Following an erasure request, only the technical HMAC, date and reason for a confirmed block or fraud incident may be retained for up to 24 months where necessary to prevent repeated abuse or defend a claim. In that case, the public alias, scores and ordinary history are removed. A legal obligation or specific dispute may require a different retention period for the applicable limitation period.
The ordinary deletion request must be started from the Portal Pop! app under Settings → Privacy and data → Delete data. The app verifies control of the profile through the authenticated session. The data deletion page explains the procedure and alternatives when access to the app is not possible.
7. Your rights and how to exercise them
You may request access, rectification, erasure, objection, restriction and, where applicable, portability of your data. You may also request review of an automated ranking validation or block.
Email info@combixa.com with the subject “Portal Pop! · Privacy”. To prevent another person from accessing or deleting someone else's profile, we may request additional, relevant and proportionate information to verify that you control the profile concerned.
If you believe your rights have not been properly addressed, you may lodge a complaint with the competent supervisory authority. In Spain, this is the Spanish Data Protection Agency.
8. Automated checks and ranking integrity
The ranking applies automated rules to check sessions, one-time challenges, submission limits and basic consistency between score, duration, level and game statistics. These rules may prevent a score from being published or flag it for review when anomalies are detected.
No solely automated decision is made that produces legal effects or similarly significant effects on a person. If you believe a valid score was rejected by mistake, you may request manual review through the privacy contact.
9. Children, advertising and future purchases
Portal Pop! does not request a date of birth or contact details to take part in the ranking. Children must not use personal data as an alias. A parent or legal guardian may contact us to request information, moderation or deletion of a child's profile.
The current version contains no ads, behavioural advertising, advertising analytics or in-app purchases.
Optional digital purchases may be added through Google Play in the future. Before they are enabled, this policy and the Google Play Data safety disclosures will be updated. The controller will not receive or store card data; only the minimum purchase or validation information supplied by Google Play may be processed to validate, restore or manage purchased content.
10. Security, cookies and policy changes
Reasonable security measures appropriate to the service are used, including HTTPS connections, session tokens, hashes and HMACs, administrative access controls and integrity checks. No Internet-connected system can guarantee absolute security.
The public website does not use analytics, advertising or profiling cookies. Hosting and security infrastructure may use cookies or strictly necessary technical mechanisms to protect the service from abuse, attacks and automated access. The private administration area may use a strictly necessary session cookie.
This policy may be updated if the operation of Portal Pop!, its providers or its data practices change. Material changes will be published on this page before they take effect where required.