Bubble Blast · Societal Private Limited

Privacy Policy

Last updated: 21 October 2026

In short: your game progress stays on your phone. We only receive personal details if you choose to claim a gift, and then only your name, mobile number and delivery address, to post it to you. We delete them 30 days after the gift ships. We never sell them. The ads in the game are served by Google and its partners, who collect device and advertising identifiers as explained below.

1. Who we are

Bubble Blast (Android package com.societal.bubbleblast) is published by Societal Private Limited, a company in India ("we", "us"). We decide why and how your personal data is used, which makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Contact us at nullnftworld@gmail.com.

2. What stays on your phone

The game keeps everything it needs on your device: your levels, stars, coins, boosters, settings, the profile name and avatar you choose, and an identifier the app generates for itself (not your phone's hardware ID). None of this is sent to us. Uninstalling the app, or clearing its data, deletes it.

3. When you claim a gift

Claiming a gift is optional. Nothing below happens unless you reach a reward level and tap Claim.

What we receive

Your delivery details: name, Indian mobile number, address (house and street, area, optional landmark, city, state, PIN code).
Your claim code: a signed code the app makes. It contains the reward level, the level you reached, how many days ago you installed, your total play time, how many rewarded videos you watched, your region as set at install, and a short one-way fingerprint of the app's identifier. It does not contain your name or contact details.
Technical data: your IP address, used briefly to limit abuse of our server and not stored with your claim.

Why

To check the claim is genuine (that the level was reached by real play, once).
To post the gift to you, and to contact you only if there is a problem delivering it.
To stop one person claiming for many installs.

We rely on your consent, which you give when you send a claim. We do not use your details for marketing, and we do not build a profile of you.

Who sees them

The courier or India Post, who receives your name, phone number and address on the parcel so they can deliver it.
Cloudflare, Inc., which hosts our claims server and database as our processor. Your address is encrypted in that database.
Authorities, only where Indian law requires it.

We never sell or rent your personal data, and never share it with advertisers.

How long we keep them

Your name, phone number and address are deleted automatically 30 days after your gift is shipped, or 30 days after a claim is declined.
We keep a one-way, keyed fingerprint of your phone number and of your address, from which neither can be recovered, to stop the same person claiming for many installs.
We keep the claim code and its status (received, approved, shipped or declined), without your contact details, as a record of what was sent.

On your phone

So you do not have to type your address again for a later gift, the app saves it in your phone's encrypted storage (Android Keystore). It leaves your phone only when you send a claim. You can edit or clear it from the app, and uninstalling deletes it.

4. Advertising

Bubble Blast is free because it shows ads. They are served by Google AdMob, which works with these ad networks: AppLovin, Unity Ads, Meta Audience Network, InMobi, Liftoff (Vungle) and Mintegral. To show and measure ads, and to prevent ad fraud, they may collect your device's advertising ID, device and app information (model, operating system, language), IP address and approximate location derived from it, and how you interact with ads.

Where the law requires it, the app asks for your consent to personalised ads before requesting any, using Google's consent tool, and Privacy options in Settings lets you change your choice. You can also reset or delete your advertising ID in your phone's Android settings (Settings → Privacy → Ads). See how Google uses information from apps that use its services.

5. Children

Bubble Blast is not directed at children and is meant for people aged 18 and over. Gifts can only be claimed by people aged 18 or over. If you believe a child has sent us their details, write to us and we will delete them.

6. Your rights

Under the Digital Personal Data Protection Act, 2023, you may:

ask what personal data we hold about you, and how it has been used and shared;
have it corrected or completed, or erased;
withdraw your consent (we will then delete your details; a gift not yet shipped cannot be sent without an address);
nominate someone to exercise these rights for you;
raise a grievance with us, and if you are not satisfied with our reply, with the Data Protection Board of India.

Write to nullnftworld@gmail.com from any email address. To help us find your claim, include the player ID shown at the bottom of the app's Settings, or your claim code. We reply within 30 days.

7. Security

Everything between the app and our server travels over HTTPS. Delivery details are encrypted in our database with AES-256-GCM, and only we can open them, through an admin portal protected by sign-in. On your phone they are kept in Android's encrypted storage. No system is perfectly secure, but we collect as little as we can and delete it as soon as we can.

We will never ask for your OTP, UPI PIN, card or bank details, Aadhaar or PAN, and never ask you to pay for delivery. Anyone who does is not us.

8. Where your data is processed

Cloudflare and the ad networks may process data on servers outside India. Where they do, it is under their own safeguards and only as permitted under Indian law.

9. Changes

If we change this policy we will update the date above and say what changed at the top of this page. A change never applies to details you already sent us without your consent.

10. Contact and grievances

Societal Private Limited
Email: nullnftworld@gmail.com