DinoGacha is developed and published by Basalt Works. This page explains what information the app and its support website may use, how it is handled, and what choices you have.
Last updated: October 29, 2026
This Privacy Policy explains how Basalt Works collects, uses, discloses, and protects information when you use the DinoGacha mobile apps, the online game service that keeps your progress, or the public DinoGacha websites and support pages.
This policy applies worldwide. Specific rights and obligations may differ depending on where you live.
Basalt Works, Tarragona, Spain, is the data controller for personal data handled directly through DinoGacha and its online service. Cloudflare, Google (sign-in, AdMob and UMP, Google Play), Apple, RevenueCat, Formspree, Vercel, and device backup providers may process information under their own roles and privacy terms. Contact us at contact@basaltworks.com.
From version 1.3, the first time the app opens it creates an anonymous online account for you automatically. No name, email, or password is asked for. The account lets our servers keep your progress, check that game actions follow the rules, and restore your progress on another device if you link a sign-in method.
Our servers run on Cloudflare (Workers, D1, Durable Objects, and R2), and your account data is stored in the United States. For your account they store: an account and player identifier; session tokens; your game state, including the collection, card levels and mutations, packs and DNA, daily rewards and quests, achievements, profile (nickname and avatar), combat deck, battles and expedition progress, season pass progress, titles and frames; the history of game actions the app sends, with their time and your device’s time-zone offset; and the app rules version. To deliver and protect the service, Cloudflare also processes technical request information such as IP address, time, and user agent.
The app keeps a copy of your progress and any actions not yet sent on the device so you can play offline. When you reconnect, the server checks those actions within a limited offline window; actions it cannot accept are discarded and the app adopts the server’s version of your progress.
Preferences such as language, sound, and vibration, page-tip markers, advertising-consent state, purchase-reward markers, notification identifiers, image-cache state, and the session of your online account are stored on the device. Your operating system or backup provider may include this data in a device backup and restore it later.
You can link your account to Google, or to Apple on iOS, to keep your progress if you change or lose your device. Linking is optional. When you link, we receive and store the name, email address, and account identifier of that Google or Apple account, and the sign-in tokens the provider issues. We use them only to sign you in, restore your progress, resolve which progress to keep when an account was already linked elsewhere, and process deletion. We do not use them for marketing.
If you have not chosen a nickname, the app uses the first name of the linked account as your nickname, never your full name or email address. You can change it at any time in your profile.
Rankings and ranked PvP are available only to accounts linked to Google or Apple; anonymous accounts never appear in them. They show other players your nickname, avatar, equipped title and frame, and your scores, rank, and rating. During a PvP match your opponent sees your deck and the moves you make.
When no live opponent is found, the game can match players against a ghost built from another linked player’s most recent battle deck, nickname, avatar, and frame, or against a computer-controlled opponent. Choose a nickname that does not reveal personal information about you.
If you played version 1.2 or earlier, which saved progress only on the device, the app offers to import that save once into your online account for a limited time after the update. The save is uploaded to our server, checked against the game’s rules and limits, and an exact copy is kept in Cloudflare R2 to audit imports and prevent abuse. We also keep a one-time marker of the save’s identifier and digest so the same save cannot be imported twice.
DinoGacha uses Google AdMob only for optional rewarded ads. Ads may be personalized using permitted identifiers when you allow it, and are otherwise served without interest-based personalization. The app does not show banner or interstitial ads.
When you finish a rewarded ad, Google sends our server a signed confirmation that includes your player identifier, so the reward is added to your account.
Google UMP privacy checks gate ad requests, and you can reopen available privacy choices in the app. On iOS the app requests Apple’s App Tracking Transparency permission before requesting the first rewarded ad: if you allow tracking, the advertising identifier and ad-related data may be used to personalize ads; if you decline, ads are still shown without that identifier. The app does not request precise-location permission.
AdMob may process data needed to request, personalize, prevent fraud, and measure ads, including IP address and derived approximate location, permitted advertising or app-scoped identifiers, Privacy Sandbox signals, ad interactions, and diagnostics, subject to your choices, platform settings, and Google policies.
RevenueCat manages optional in-app purchases and the monthly season pass subscription, using your player identifier as the customer identifier. When you buy, renew, cancel, or are refunded, Google Play or the App Store informs RevenueCat, which notifies our server so the purchase or pass is added to, or removed from, your account.
RevenueCat and the store may process product identifiers, transaction information, receipts or purchase tokens, purchase history, and diagnostics. Billing, renewals, cancellations, and refunds are handled by Google Play or the App Store under their rules. Basalt Works does not collect or store payment-card details.
On supported Android builds, you may optionally enable local reminders when a free pack is ready. They are off by default, require notification permission, are scheduled on the device, and do not register or use an Expo remote push token. The app stores the local scheduled-notification identifier so it can replace or cancel the reminder.
DinoGacha has no separate analytics or crash-reporting SDK and does not use advertising trackers of its own. Cloudflare keeps operational logs of requests to our servers for a limited time so we can diagnose and secure the service; the log entries we write ourselves do not include player identifiers. The app does not request precise-location, microphone, or audio-recording permission and does not use Expo over-the-air updates. App delivery and updates are handled by Apple App Store or Google Play.
The DinoGacha legal website stores your selected language in browser localStorage under dino-gacha-lang. If no choice is stored, it reads the browser language to choose an initial language.
If you use the support form, it sends your email, issue type and message, optional device model, operating-system version and app version, plus the app name and source page. Formspree processes these fields so Basalt Works can receive and answer your request.
The product, privacy, terms, and support pages are delivered using Vercel infrastructure. Vercel may process request metadata needed to serve and protect the site, such as IP address, date and time, requested URL, request headers, and browser or device information.
Information is used only for the purposes described in this policy:
We process account and game data to provide the game you asked to use (performance of a contract). We process security, anti-cheat, and fraud-prevention data, keep import and transaction markers, and run rankings and PvP on the basis of our legitimate interest in a fair and secure game. Where the law requires consent for advertising, including personalized ads and the device storage AdMob uses, we rely on the choices you make in the privacy options, which you can change at any time. We keep records needed for legal and tax obligations.
We keep your account and progress while the account exists. Accounts that were never linked to Google or Apple are deleted automatically after 12 months without activity. Weekly ranking entries are removed after eight weeks. Copies of imported saves are kept until the account is deleted.
You can delete your account and all its progress at any time from the app’s Settings with “Delete progress and account”. Deletion is immediate and permanent: it erases the account, progress, rankings, PvP rating and ghost, season pass records, imported saves, linked sign-in, and your customer record at RevenueCat, revokes a linked Apple sign-in where required, and starts the app again from scratch. Transaction and rewarded-ad identifiers and one-time import markers without personal data are kept so the same purchase, reward, or save is never granted twice. Instructions, including how to request deletion by email, are at https://basaltworks.com/dino-gacha/delete-account.
Device records remain until an in-app control replaces them, you clear app data, or you uninstall the app, subject to backup and restore behavior. Support and privacy messages are kept only as long as needed to answer them and keep appropriate records. Cloudflare, Formspree, Vercel, Google, Apple, RevenueCat, and the app stores keep information under their own policies.
Basalt Works does not sell personal information for money. DinoGacha requests personalized, interest-based advertising only where your consent, your Google UMP choices, and iOS tracking permission allow it; otherwise ads are served without interest-based personalization.
Advertising-related disclosures can still be treated as sharing, targeted advertising, or a sale under some privacy laws. Use the Google UMP privacy options available in DinoGacha, applicable iOS or Android controls, or contact us about a legally available opt-out request.
Our servers run on Cloudflare, and your account data is stored in the United States. Cloudflare, Google (sign-in, AdMob, and Google Play), Apple, RevenueCat, Formspree, Vercel, and backup providers may also process information in countries other than where you live. Where required, transfers from the European Economic Area, the United Kingdom, or Switzerland rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on standard contractual clauses.
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, to receive a copy of it, to withdraw consent, and to opt out of eligible advertising disclosures. You can delete your account directly in the app. For other requests write to contact@basaltworks.com; to find an account by email, send the request from the email of the Google or Apple account linked to it. We answer within 30 days. You can also complain to a data protection authority; in Spain, the Agencia Española de Protección de Datos (www.aepd.es).
Never send passwords, sign-in codes or tokens, payment details, identity documents, or other unnecessary sensitive data. For information controlled by Apple, Google, RevenueCat, AdMob, Formspree, Vercel, or your backup provider, you may also need to use that provider’s privacy controls.
DinoGacha is intended for a general audience aged 13 and older. It is not directed at children under 13 and does not collect age. If you believe a child under 13 has given us personal information, for example by linking a Google account or contacting support, contact us so we can review and delete it where required.
Connections between the app and our servers are encrypted, and access to account data is limited to what is needed to run the service. We use reasonable measures appropriate to the information we handle. No device, transmission, or storage method is completely secure, so we cannot guarantee absolute security.
We may update this Privacy Policy from time to time. Changes will be published on this page with a revised last-updated date and announced in the app when they affect how your account data is used, or with additional notice where required by law.
Privacy, data-rights, and deletion questions: contact@basaltworks.com. Account deletion instructions: https://basaltworks.com/dino-gacha/delete-account. App support: support@basaltworks.com or the DinoGacha support form.