What the game collects, who else receives it, how long it is kept, and how to get rid of all of it. Written to be read, not to be survived.
Last updated: 10 October 2026 · Applies to the game
Villains: Wreak Havoc on Android (com.tentaculo.villains) and
iOS, and to nothing else.
You can open this page from inside the game too: OPTIONS → PRIVACY POLICY.
The game is made by Tentaculo, an independent game studio (tentaculogames.pt). We decide what the game collects and why, and we answer for it. Every question about this page goes to hellotentaculo@gmail.com.
Everything in this table is sent over an encrypted connection (HTTPS) to Google Firebase, which stores it for us.
| What | Why |
|---|---|
| An account id | A random string, made for every player the first time the game goes online, as a guest account. It is what your save, your ranking row, your problem reports and any name reports are filed under. If you play as a guest, this is all that identifies you. The ACCOUNT window shows its first eight characters as ID: …, so you can quote it when you write to us. |
| Your Google account details Android only, optional |
Only if you tap SIGN IN WITH GOOGLE: your Google email address, your name and profile picture address as Google shows them, and your Google account id. They let you sign in and take your progress to another phone, and the email is shown back to you in the ACCOUNT window so you can tell which account you are using. No other player ever sees them. iPhone has no Google sign-in, so we never get them there. |
| Your save | Your progress: cash, lair upgrades, unlocks, SINS, NEW GAME+ level, records, settings, and the villains you designed, including the villain name you typed. Kept so you do not lose it, and so it comes back on another phone. |
| Your ranking row | For the global RANKING and the player card that opens from it: your villain’s name and look (including its class and super power), your best score, your prestige level, your best survival time, the most superheroes you beat in one run, and how many runs you have played. Every player can see this row, and the game on their phone also receives the account id it is filed under (a random string that says nothing about you). The name is the one you typed for your villain, never your real name. |
| Name reports | Only if you tap REPORT on another player’s card: your account id, their account id, their villain’s name as it is stored on the ranking, the reason you picked (the name or the look) and the time. If another player reports your villain, the same is stored with your account id as the reported one. Used only to review abuse on the ranking and remove what breaks the rules. |
| Problem reports | When something goes wrong: the error message and where in the code it happened, freezes and slow frames, and lost graphics; what the game was doing (which screen, how long into the run, your level, how many enemies were on screen, the screen size, the last few screens you visited); the game’s build number; your device’s user agent (device model, system and web engine version); the name of the graphics chip; and your account id. Used only to find and fix crashes and performance problems. |
| Crash reports Firebase Crashlytics |
If the app itself crashes: the stack trace (where in the code it failed), device model, system version, app version, the time, and a random Crashlytics id for this install. Never your account id, name or email. Used only to find and fix crashes. |
| Gameplay measurement Google Analytics for Firebase |
How the game is played, so we can balance it and see where players give up: sessions and time played; the screens you open; game events (a run starting and ending with its time, level, superheroes beaten, cash, wanted level and what took you down, the villain class and super move you chose, the cards you pick or skip, heists, the sidekick and DOUBLE CASH offers and your answers, videos watched, cash earned and spent, lair upgrades, SINS unlocked, NEW GAME+, signing in or out, reports and blocks); the frame rate during a run and in-game error messages; and the app version, device model, system version, language and approximate country. Filed under a random id for this install of the app (plus the advertising identifier where the ads consent and, on iPhone, tracking allow it), never under your name, email or Google account. Sent only after Google’s consent form has been answered where it applies (see below). |
| Install attribution and measurement AppMetrica, Android only |
That the game was installed and opened, sessions, and which advert (if any) led to the install; a short list of game events (a run starting and how it ended, superheroes beaten, SINS unlocked, NEW GAME+, cash spent, gifts sent, videos watched to the end, signing in, deleting the account); the revenue from ads shown and from a Remove Ads purchase (the price and Google Play’s receipt, not your payment details); and the app version, device model, system version, language, approximate location from the IP address and the advertising identifier. Filed under AppMetrica’s random id for the install, never under your name, email or Google account. In the EEA and the UK it sends nothing at all until you have answered Google’s consent form, and only if you allowed storing and accessing information on your device. |
The ads library inside the game, from our third-party advertising partners (currently Google AdMob, with Google’s consent form), collects these directly from your phone, to show ads, to measure them, to keep fraud out, and for analytics:
| What | Details |
|---|---|
| Device identifiers | The advertising ID on Android. On iPhone, the advertising identifier (IDFA) only if you allow tracking, otherwise an identifier limited to our own apps (IDFV). On Android, also the app set ID. |
| Approximate location | Worked out from your IP address: roughly your country or city, never your precise location. |
| Ad interactions | Which ads were shown, whether you tapped them, and whether you watched a video to the end. |
| Diagnostics | Crash and performance data about the ads library itself. |
On iPhone, if you allow tracking, the advertising partner may link this data with data from other companies’ apps and websites to choose ads for you. The partner uses this data under its own privacy policy; Google explains how in How Google uses information from sites or apps that use our services.
The game does not collect your precise location, contacts, photos or videos, microphone or audio, files, calendar, health or fitness data, financial or payment details, messages, browsing or search history, or the list of apps on your phone. There is nothing to buy in the game, so there is no purchase history either. The game sends no notifications.
Permissions: on Android, internet access, network state and vibration (the buzz when you hit or get hit), plus the permissions the ads library adds: the advertising ID permission and Android’s ad services permissions (advertising ID, ad attribution and ad topics), and two housekeeping permissions Google’s libraries use to finish short background tasks (keeping the phone awake briefly and running a foreground service). The game asks for no location, camera, microphone, contacts, photos or storage permission. On iPhone, only the tracking question, which you can refuse.
We do not sell your data, and we hand it to no one else unless the law requires us to. Google may process it on servers outside your country, including in the United States, under the safeguards Google provides for such transfers, such as the European Commission’s standard contractual clauses.
Villain names are the one thing players write for others to read, so the game keeps an eye on them:
To report something the buttons do not cover, write to hellotentaculo@gmail.com.
The only ad is the DOUBLE CASH video on the end-of-run screen, at most once per run, and only if you tap to watch it. There are no banners and no ads during a run.
If you are in the European Economic Area, the United Kingdom or another place where the law asks for it, Google’s consent form appears before any ad is requested, and what you choose there decides whether ads may be personalised. On iPhone, Apple’s App Tracking Transparency question comes next, and the advertising identifier is read only if you allow it. Where the consent rules apply, a PRIVACY SETTINGS button in OPTIONS lets you change your answer at any time; on iPhone you can also change the tracking answer under Settings → Privacy & Security → Tracking.
The same answer governs gameplay measurement. Until the form has been answered, the game sends no measurement at all; where it applies, measurement keeps an identifier on your phone only if you allowed storing information on your device, and otherwise sends only counts with no identifier attached.
You can reset or delete the advertising ID on your phone at any time: on Android under Settings → Privacy → Ads (the exact path varies between phones), on iPhone by turning tracking off as above. That does not stop the video being offered; it stops it being tied to what you did before.
Inside the game, your save can be read only by your own account; your ranking row is the one thing other players can read. We look at stored data only to run and fix the game, or when you ask us to.
Open the game and tap your villain’s face on the menu’s top bar to open ACCOUNT. At the bottom, tap Delete account if you signed in with Google, or Delete my data if you play as a guest, and confirm. Your save, your ranking row and the account itself are deleted, on the phone and on our servers, and the game starts again as a new guest. There is no undo.
If you would rather we did it, or you have already uninstalled the game, write to hellotentaculo@gmail.com and include the ID: … shown in the ACCOUNT window if you can. The full details are on the delete your data page.
You can also keep your account and ask us to delete only your problem reports, or only the name reports you sent or that were made about your villain. One email does it.
Deleting the app on its own does not delete what is stored in the cloud, only the copy on that phone.
The game is not directed to children under 13, and we do not knowingly collect anything about them. If you believe a child under 13 is playing with an account here, write to the address above and we will delete it.
You can ask us for a copy of what we hold about you (access), ask for it to be corrected or deleted, ask us to stop or limit using it (objection), or ask for it in a form you can take elsewhere. In the EEA and the UK these are your rights under data protection law, and you can also complain to your local data protection authority. One email to hellotentaculo@gmail.com does any of them. We do not charge for it and we do not need a reason.
If what the game collects changes, this page changes with it, before that version ships, and the date at the top moves. There is no other notice, so the date is the thing to look at.