ThrowIt Privacy Policy

Last updated: 7 August 2026

ThrowIt is a basketball throwing game for iOS and Android (bundle id org.fubl.throwit). It is made and published by an individual developer based in Austria, in the EU, so the GDPR applies.

The data controller is:

Felix Ubl
Grinzinger Allee 42/9
1190 Vienna
Austria

Contact: hi@fubl.org

The short version

ThrowIt has no user accounts. You never give it an email address, a password, a name or a phone number. Almost everything the game knows about you stays on your phone. Three things leave the device: your daily leaderboard score, crash reports, and ad requests. Each one is described below.

The game does not collect your location, your contacts, your photos, your health data or your device's phone number. There is no analytics SDK and no push notification service.

1. What stays on your device

The game keeps a single save file in the app's own storage. Nothing in it is uploaded, except where section 2 says otherwise. It contains:

• Coins, gems and whether you own the coin doubler.
• Which skins you own and which ball, hoop and court you have equipped.
• Records and totals: best streak, best run points, best hot and swish streaks, total shots, makes and swishes, and your best points and streak per mode.
• Settings: sound on or off, haptics on or off, master volume, the audio mix, the aim guide, the practice backboard, mirrored handedness and the notification preference.
• Daily state: daily reward streak, challenge progress, daily bests, and the run tickets for each ranked mode.

The game also stores your last run and your best run per mode on the device as replay data, so you can watch them back.

If a score cannot be uploaded straight away (no network, for example), it waits in a small queue on the device (at most six entries) and is sent the next time the game reaches the server. Entries from earlier days are dropped instead of sent.

Uninstalling ThrowIt deletes all of this.

2. The daily leaderboard (Supabase)

The leaderboard runs on Supabase, which acts as the processor for this data.

Sign-in is anonymous. The game signs in with Supabase anonymous authentication. No email address, no password, no name, no social login. Supabase issues a random account id (a UUID) that identifies the row and nothing else about you.

Your handle is generated, not chosen. On first connection the game picks a name at random by joining one word from a fixed adjective list, one word from a fixed animal list and a two digit number, for example CosmicOtter42. You do not type it in, and it is not built from your device name, your account or anything else about you. It is stored on the device and reused.

What is stored. Two tables hold the data:

players

• the anonymous account id
• the generated handle
• when the row was created
• when you last submitted a score, and a short term submission counter used for rate limiting

daily_scores

• a row id and the anonymous account id
• the mode (timeTrial or hardcore)
• the UTC day
• points, best streak and run duration
• a run record and its format version
• a verification flag
• when the row was written

There is one row per player, per mode, per day, and it is only overwritten when you beat your own score for that day.

What the run record is. It is the replay of the run: a format version, the mode, the random seed, the list of inputs (shot timings, charge and drag values, makes, saves, declines and quits) and the run summary. It exists so a score can be replayed and checked for cheating. It contains no personal data and no device identifiers.

When it is sent. Only ranked runs (time trial and hardcore) that had at least one shot are submitted. Practice and standard runs are never uploaded.

What other players see. The board shows the top 50 handles for the day with their points and best streak, plus your own rank. Nobody sees your account id or your run record through the app.

3. Crash reports (Sentry)

If the game crashes or throws an unhandled error, a report is sent to Sentry so the bug can be fixed. A report contains the error, the stack trace and basic technical context such as device model, OS version and app version.

Personally identifying information is deliberately switched off. The SDK is initialised with sendDefaultPii: false, so it does not attach things like your IP address to reports. Your handle and your Supabase account id are never attached. Performance tracing is off (tracesSampleRate: 0), so no browsing or usage traces are collected.

4. Ads (Google AdMob)

ThrowIt shows two kinds of ad through Google AdMob: rewarded ads you choose to watch in exchange for something in the game, and occasional interstitials between runs.

To serve an ad, Google receives the advertising identifier of your device (the IDFA on iOS, the Advertising ID on Android) along with the technical data an ad request normally carries, such as device type, OS version, coarse locale and IP address. Google is a separate controller for that data. Its handling is described in the Google Privacy Policy and the AdMob documentation.

The app tells Google that its content rating cap is "Teen", that the app is not directed at children, and that it is not tagged for users under the age of consent.

Consent, for users in the EU, the EEA and the UK. Before ads start, the game runs Google's User Messaging Platform (UMP) consent flow. You are shown Google's consent form and your choice is recorded there.

iOS App Tracking Transparency. On iOS, the system also asks you whether ThrowIt may track you across other companies' apps and websites. This is Apple's prompt, and your answer applies to the advertising identifier.

Saying no still gives you ads. Declining consent, or declining the tracking prompt, does not remove advertising from the game. It means the ads you see are non-personalized: they are chosen from context rather than from a profile built out of your activity.

Changing your mind.

• iOS: Settings, then Privacy and Security, then Tracking, and turn ThrowIt off. You can also turn off "Allow Apps to Request to Track" for every app.
• Android: Settings, then Google, then Ads, where you can delete or reset the advertising ID and opt out of ad personalization.
• The UMP choice is stored by the Google SDK inside the app. Removing and reinstalling ThrowIt clears it, so the form is shown again the next time you start the game. If you want your choice changed and cannot do it yourself, write to hi@fubl.org.

5. Purchases

In-app purchases are processed entirely by Apple on iOS and by Google on Android. ThrowIt asks the store to start a purchase for a product id and is told back only whether it succeeded, is pending, was cancelled or failed. When you restore purchases, the store tells the app which non-consumable product ids you own.

The app never sees and never stores your card number, your bank details, your billing address or your store account. What you bought is unlocked in the save file on your device. There is no purchase history on any server run by the developer. Apple's and Google's own privacy policies cover the payment itself.

6. Notifications

Reminders are local notifications only. They are scheduled by the app on your own device and fire from your device. There is no push token, no notification server and nothing about them leaves the phone. You can refuse the permission or withdraw it later in the system settings, and you can turn reminders off inside the game.

7. Sharing a score card

If you share a run, the game renders an image file on your device and hands it to the system share sheet. Where it goes from there is your choice and is governed by whichever app you share it with. Nothing is uploaded by ThrowIt.

8. Children

ThrowIt is not directed at children and is not designed or marketed for them. The ad SDK is configured accordingly (not child directed, not tagged for users under the age of consent, content rating capped at "Teen"). The game does not knowingly collect data from children. If you believe a child has submitted a score, write to hi@fubl.org with the handle and it will be deleted.

9. How long data is kept

• Daily scores. A scheduled job on the database deletes daily score rows older than 30 days. It runs once a day.
• The player row. Your handle and anonymous account id stay until you ask for deletion.
• Crash reports. Kept for as long as Sentry's retention period for the project allows, then deleted by Sentry.
• Local data. Stays on your device until you delete the app.

10. Your rights under the GDPR

You have the right to ask for access to your data, to have it corrected, to have it deleted, to have processing restricted, to receive it in a portable form, to object to processing based on legitimate interests, and to withdraw any consent you have given. Withdrawing consent does not affect processing that already happened.

The legal bases are: your consent for personalized advertising, and legitimate interest for running the leaderboard, keeping it free of cheating, and fixing crashes.

How to exercise them. Write to hi@fubl.org. Because there is no account, the only way to find your data is your handle, so please include it. You can read your handle on the leaderboard screen in the game. On request, the player row and every daily score attached to it are deleted together. Everything else lives on your device and is yours to delete by removing the app.

To withdraw advertising consent, see the "Changing your mind" steps in section 4.

You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde (Austrian Data Protection Authority).

11. Changes to this policy

If the game starts collecting something new, this file is updated and the date at the top changes with it.

12. Contact

Felix Ubl
Grinzinger Allee 42/9
1190 Vienna
Austria

hi@fubl.org