Super Bean Boy — Privacy Policy

Version 2.0 · Last updated 21 October 2026

Beananza LTD ("we", "us") makes the game Super Bean Boy. This policy explains what the game collects, why, who else sees it, and what you can do about it. It covers the game on iOS and Android and nothing else.

We are the data controller for everything described here.

Beananza LTD, a company registered in England and Wales, company number 13598201, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. Privacy contact: support@beananza.games

What we mean by a world seed. Every world in the game is made from a world seed: a word or short phrase that you type in, or that the game shuffles for you. The same seed always makes the same world, so a seed is also how a world is known — other players see it beside runs on the leaderboards and on any world somebody holds.

1. The short version

Super Bean Boy is built to need very little about you, and most of what follows is a list of things we do not do.

You do not make an account to play. The game asks our server for a player number and that number is who you are. You never tell us a name.
We do not know who you are. We never ask for your real name, and there is no profile and no photo. On the leaderboards you appear under a handle — a made-up nickname our server picks for you, like silent_parp — which you can change if you want to.
We run no analytics and no attribution SDK, and the game carries no crash reporter. There is no third-party tracking kit inside this game. When our own server fails, it reports the error to an error-monitoring service so that we can fix it — see §5.
We never collect an advertising identifier and we never ask iOS for permission to track you, because we do not.
We do not sell or share your data for anyone else's advertising, and we never will.
What we do collect is how you played — how far you climbed, what you picked up, what you bought — because that is what a save file, a leaderboard and a receipt are made of.

If you only read one more section, read §3 (what we collect) and §7 (what you can do about it).

2. A note on "anonymous"

The game calls your account anonymous, and in ordinary English it is: we have no name, no email and no way to recognise you in the street.

We still treat everything in this policy as personal data. A player number that stays the same for years, carrying your device model, your operating system version, your language and the time of day you tend to play, is information about a person even with no name attached — UK and EU law calls that pseudonymous data and protects it fully. We would rather say so than lean on a word.

3. What we collect

This is everything that leaves your device for our server.

3.1 Who you are to us

Three values, all three generated by our server, none of them taken from your phone:


Player ID	Your account. The same value for as long as the account exists.
Device ID	This particular installation.
Device secret	The password this installation uses to prove it is itself.

And one more that other players can see:


Handle	The name you appear under on the leaderboards and on the worlds you hold. Our server makes one up for you the first time you play; you can change it on the Account page. It is the only thing about you that another player ever reads, so do not make it your real name.

Nothing from your phone goes into making them — no device identifier, no phone number, no advertising ID, no email. The game does not read your device's unique identifier at any point, on any platform.

Why: so that your progress can exist somewhere other than one phone, and so that a purchase can be credited to the player who made it. Legal basis: performance of our contract with you (Art. 6(1)(b) UK/EU GDPR).

3.2 Your device and the app

Sent alongside what the game reports, six values:

app_version · platform (iOS or Android) · os_version · device_model · locale (your language and region) · engine_version

Why: to reproduce bugs on the hardware they happen on, to serve the game in your language, and to protect the game and its leaderboards from cheating. Legal basis: our legitimate interests in a working, fairly-ranked game (Art. 6(1)(f)), and contract for the language.

Your internet address. Our server also sees the internet (IP) address each request comes from. It is kept with the game events it arrived with, and in our server logs, to run the service and protect it from abuse. Legal basis: legitimate interests (Art. 6(1)(f)).

3.3 How you played

When a climb ends, the game reports that climb. Every finished run is reported, whether or not it achieved anything, because the leaderboards rank players by their runs.

A run report contains: the world seed; when it started and ended, and how long it lasted; how far you climbed and how it ended; the hour of your local day it began; what you ate, how much gas you expelled and how much ground you stained; which biomes you passed through; your times at the distance marks you crossed; your player level, skill levels and food digestion levels; the trail and hat you were wearing; and what counts toward the daily challenges.

If you typed in the world seed you climbed, it travels with the report, and other players can see it on the worlds you hold (§3.8).

Why: to save your progress off your phone, to rank you on the leaderboards, and to balance the game. Legal basis: contract for your progress; legitimate interests for ranking and balance.

3.4 What you earned and spent

Everything you earn, spend, unlock and use is recorded, with when it happened — a run banked, a mystery box opened, a machine loaded or collected, a potion drunk, a level bought, a trail unlocked or drawn, a basket paid for.

This is also where a trail you drew yourself is stored. A hand-drawn gradient exists nowhere else, so it is kept on our server as part of your wardrobe; otherwise it would be lost with the phone. So are two small lists that stop a new phone from teaching you the game all over again: which tips you have already read, and how far along the first challenges you are.

Why: this record is your save file. It is what lets you change phones without losing anything, and it is how we can tell what you are owed if something goes wrong. Legal basis: contract.

3.5 What you bought

If you buy anything, the purchase is recorded: the store (Apple or Google), the product, the transaction identifiers, the store's own signed receipt, the quantity, the platform, and your player number.

We never see your card, your bank details or your billing address. Payment happens entirely inside Apple's or Google's own purchase sheet. We receive a receipt and verify its signature; we do not receive a means of payment.

Your player number is attached to the purchase at the store as well, so that if Apple or Google later tells us the purchase was refunded, we know whose it was.

Why: to give you what you paid for, to honour refunds, and because tax and consumer law require us to keep records of sales. Legal basis: contract, and our legal obligations.

3.6 If you connect an account

Playing needs no account. If you want your progress to survive losing your phone, you can attach it to something that is not this handset. There are five ways in, and you choose:

Apple, Google, Facebook, Discord. Their sign-in sheet hands the game a token. The game passes that token to our server without reading it — it does not extract, store or transmit your name, your profile picture or your email from any of them. Our server verifies the token with the provider and keeps only the fact that this provider identifies this player.

Email. You type an address, we email a six-digit code, you type the code back. There is no password anywhere in this game. The address is sent to our server to send the mail and to identify you next time. Your language is sent with it, so the email arrives in the language you play in. The address is never written to your device — the game holds it in memory while the page is open and forgets it when the page closes.

We show connected accounts by provider name only. The account page never displays the address or the account name behind them.

Why: so you can get your game back. Legal basis: your consent, given by choosing to connect. You can disconnect at any time on the Account page, and that withdraws it.

3.7 Ads

Unless you have bought Remove Ads, a banner runs along the bottom during a climb. Ads come from Google AdMob.

We give Google nothing about you. The game's ad requests carry no player number, no identifier of ours, no keywords and no targeting of any kind. We do not pass Google your gameplay, your purchases or your account.

Google's own SDK collects what it needs to serve and measure an ad, which is governed by Google's privacy policy rather than this one, and by the consent choice described in §4.

3.8 The worlds you hold

A climb can end with you planting a flag on the world you climbed, which makes that world yours until somebody climbs higher and plants over you. When you plant one:

the map of the ground you painted on that world is uploaded, and anyone who opens that world afterwards sees your paint on it, with your handle;
your flags are recorded — which world each stands on, its level and its shield — so that they survive a change of phone and so that other players can wear them down or take them;
the worlds you hold appear on the Territory page and on the Biggest Stinkprint board, under your handle.

Nothing is uploaded for a climb that plants nothing.

Why: the worlds and their owners are the game. Legal basis: contract.

3.9 Reports, blocks and the name filter

Handles and seeds are filtered. Every handle and every world seed is checked before anybody else sees it. A handle that fails is refused and you are asked for another; a world seed that fails is withheld — nobody else is shown it, and nobody can plant a flag on that world. The climbs made on it are kept, like every other climb.
If you report a handle or a seed, we record who reported it (your player id), the handle or world seed you reported, and when. We look at every report, and may hide a reported handle or seed while we do. The player you report is not told who reported them.
If you report a player for cheating, we record the same, plus which leaderboard you saw them on. We look at every report, and the player is not told who reported them.
If you block a player, we record that you blocked them. From then on our server does not send you their handle or their world seeds — you see "Blocked player" instead — and you can unblock them from the Account page. They are not told.

Why: to keep what players write for each other fit to read, which both app stores require of a game where players name things. Legal basis: legitimate interests (keeping the game safe for its players) and contract.

We do not track you across other companies' apps and websites. On iOS, the game never shows the "Ask App Not to Track" prompt, because it has nothing to ask for: it collects no advertising identifier (IDFA) and shares nothing for cross-app tracking.

In the UK and EU, before any ad is loaded, Google's consent form asks whether ads may be personalised. If you decline, or never answer, ads are non-personalised — still ads, but chosen without a profile of you. On iPhone and iPad, ads are always non-personalised, whatever the form says. You can change your answer later from Settings → Legal → Ad Privacy Choices, which appears wherever the form was asked.

Buying Remove Ads removes the advertising entirely, and with it everything in this section.

5. Who else sees your data

Who	What they get	Why
Apple / Google Play	The purchase, stamped with your player number	They take the payment and handle refunds
Google AdMob	Ad requests carrying nothing we supply	To serve the banner
Our hosting providers	Whatever is in §3, as the place it is stored	To run the server and store its files
Sentry (error monitoring)	When our server hits an error: what went wrong, your player number, the internet address the request came from, and technical details of that request	To find and fix faults in our server
Resend (email delivery)	If you sign in by email: your address and the code we send to it	To deliver that email
Other players	Your handle, your results, level, trail and hat; the worlds you hold, your paint on them, your flags and any world seed you typed	The leaderboards and the worlds are public

That is the complete list. No data broker, no advertising network beyond the banner above, no analytics company, and nobody who wants it for their own purposes.

We may also disclose data if the law requires it, or to establish or defend a legal claim — and if we are ever bought or merged, to whoever takes over the game, who would be bound by this policy until they gave you notice of a new one.

What the leaderboards show

A board shows your handle — the nickname our server made up for you, or the one you changed it to on the Account page. It is the same name everywhere, so that you are recognisable across the boards and the worlds. A handle is made of letters, numbers, full stops and underscores; a few words that would let somebody pass themselves off as us are reserved, and every handle is checked as §3.9 describes. A player you have blocked is shown to you as "Blocked player".

Beside it a board shows the run behind your score — how far you climbed, how long it took, how many beans you collected, how much ground you stained, and the world seed it happened in — plus your player level and the trail and hat you were wearing. Your own row says "YOU" rather than your handle.

6. Where it is kept, and for how long

Our database is in the United Kingdom. The servers that answer the game run in the United Kingdom and the United States, and files the game uploads — such as the map of the ground you painted on a world you hold — are stored by a provider that keeps copies in several countries. Error reports are kept by Sentry in the EU. Apple, Google and Google AdMob operate globally too, and Sentry and Resend are US companies. So your data may be processed outside the UK and EEA; those transfers rely on the UK International Data Transfer Agreement and the EU Standard Contractual Clauses, or an adequacy decision where one applies.


Your account and progress	While the account exists, then deleted
Runs on the leaderboards	While the account exists
Your flags and the worlds you hold	While the account exists
Reports you made, and the players you blocked	While the account exists
Purchase records	Six years after the purchase — UK tax law, and we cannot shorten it
Internet (IP) addresses	With the game events they arrived with, while the account exists; in server logs, up to 30 days
Error reports	Up to 90 days, then deleted by Sentry
Data on your device	Until you delete the game, which takes all of it

Deleting your account removes your progress, your runs, your leaderboard entries, your flags and your hold on every world. It cannot remove the purchase records, for the reason above; what is left is a receipt with no player attached to it.

7. Your rights

You can ask us to show you what we hold, correct it, delete it, give you a copy in a portable form, restrict what we do with it, or object to anything we do on the basis of legitimate interests. Where we rely on your consent, you can withdraw it, and doing so does not undo what was lawful before.

To delete your account, you do not need to ask us. Settings → Me → Account → Delete my account (it reads Delete my progress if you never connected your account to anything) erases the account and everything attached to it. It is immediate and cannot be undone.

If you no longer have the game, you can still ask us to delete your account: follow the steps at https://superbeanboy.com/legal/data-deletion/, or email support@beananza.games with your handle.

For anything else, email support@beananza.games. We reply within one month. Please include your handle — it is at the top of Settings → Me → Account — because without it we genuinely cannot find you, which is the flip side of not knowing who you are.

We do not charge for any of this, and we will not make the game worse for you for asking.

If you think we have got it wrong, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to your own country's data protection authority. We would rather you told us first, but it is your right either way.

8. Children

Super Bean Boy is not directed at children under 13 and we do not knowingly collect anything from one. If you believe a child under 13 has an account, email support@beananza.games and we will delete it.

That said, a game about farts is obviously going to be played by children, and we have built it accordingly rather than pretending otherwise. Under the UK's Children's Code we treat this as a service likely to be accessed by under-18s, which means:

no profiling, and no advertising personalisation unless it is actively consented to
no behavioural tracking across other apps, at all
the most private settings on by default, with nothing to switch off to be safe
we collect what the game needs to work and nothing kept "just in case"
no dark patterns, no countdown pressure, and no nudging anyone toward giving up more data

If a parent or guardian wants to see or delete a child's data, the address above reaches us.

9. When the game is offline

The game never waits for our server. If it cannot be reached, you keep playing, and what you earn is kept on your device and sent when it can be.

10. Security

Everything between the game and our server travels over HTTPS, and purchases are verified against Apple's and Google's own signatures. We take reasonable steps to protect what we hold, on our server and on your device — but anybody holding your unlocked phone can open the game on it, so keep it locked.

No system is perfectly secure. If we ever suffer a breach that puts you at risk, we will tell the ICO within 72 hours and you as soon as we know what happened.

11. Changes

If we change this policy in a way that affects what we collect, why, or who sees it, the game will show you the new version and ask you to accept it before you play again. Smaller corrections are published here with a new date and no interruption.

The current version is always at https://superbeanboy.com/legal/privacy.

12. Contact


Email	support@beananza.games
Post	Beananza LTD, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom