Privacy policy
Last updated: 24 October 2026
This policy explains what data Lamini, the mobile game by Mocchi's S.r.l., processes, why, how long it keeps it and how you can exercise your rights. It applies to the iPhone and Android app and to this website.
In short. You can play without an account: your progress then stays on your phone. With an account we save your progress on our server so you don't lose it and for the leaderboards. We show no ads, we don't sell data, we don't track you across other apps and websites and we use no third-party analytics. Card details are seen only by Stripe, which handles payments.
1. Data controller
Mocchi's S.r.l., Via Tiziano Vecellio 17/B, 31020 San Pietro di Feletto (TV), Italy. VAT number IT05076170264.
For any privacy question: info@mocchis.com.
2. Who the game is for
Lamini is rated for ages 13 and up. The account is optional. Purchases with real money always go through a parental check inside the app.
3. If you play without an account
Progress, coins, heroes and settings stay only on your phone: we don't receive them. Uninstalling the app deletes them.
Even without an account the phone connects to the internet for two technical reasons:
- game updates: the app downloads new versions from the Expo service (EAS Update), which receives the IP address, the device type and the app version only to deliver the update;
- settings and public leaderboards: the app reads the game settings and the leaderboards from our server. The server records the IP address, the time and the request in technical logs (see section 4.7).
4. If you create an account: the data we process
4.1 Account
- email address and, if the sign-in service provides it, your name;
- the service you sign in with (email and password, Google, Facebook or Apple) and its identifier. If you use email and password, the password is stored by Amazon Cognito in a non-readable form: we never see it;
- the game language.
With Apple you can choose to hide your email: we then receive an address forwarded by Apple.
4.2 Public profile and leaderboards
- a generated player name (for example a title, a hero's name and a number), the avatar you choose and your results: damage, Infinity waves and stars, all-time and by week and month.
Player name, avatar and results are visible to all players on the leaderboards. Your real name and email never appear. You can remove yourself from the leaderboards in your Profile with "Show me on the leaderboard".
4.3 Matches
For each match: level and mode, outcome, stars, waves, duration, enemies defeated, merges, damage (also per hero), team used, the number that generates the match, app version and platform, date and time. The server checks that the numbers are plausible, to keep the leaderboards clean and prevent cheating, and records the result of the check.
4.4 Game state
Coins, upgrades, heroes, blades, stars, team, album cards and daily eggs, with a log of every operation (what changed, when and with what result). If one of our administrators corrects your state (for example to fix an error), the log keeps who did it, when and why.
4.5 Statistics
Totals and records computed from your matches: matches played and won, highest level, play time, first and last match, last app version and platform used.
4.6 Purchases
If you buy something with real money: product, amount, currency, country, platform, your store's country, payment status, any refunds and disputes. Under Apple's and Google's alternative payment rules we also process the codes the stores generate for each purchase and the sales reports we send them.
Card payments are handled by Stripe: you enter your card details in Stripe's screen and we neither see nor store them.
4.7 Technical data
The server records the IP address, the time, the request and its result in technical logs, to run the service, protect it from attacks and find faults.
4.8 On your phone
The app stores your progress, your settings and your sign-in credentials on the phone (the credentials in the system's protected storage). The app uses no cookies. The sign-in page for Google, Facebook or Apple is run by Amazon Cognito and uses technical cookies needed to sign in.
5. Why we process it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the account, saving your progress, syncing it across your devices, delivering what you buy | Performance of a contract (Art. 6(1)(b)) |
| Public leaderboards with the player name | Performance of a contract (Art. 6(1)(b)); you can hide yourself at any time |
| Checking matches against cheating and abuse, service security, technical logs | Legitimate interest in a fair and secure game (Art. 6(1)(f)) |
| Sales reports to Apple and Google for alternative payments | Legitimate interest in complying with our contracts with the stores (Art. 6(1)(f)) |
| Keeping purchase records for accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Service emails (verification code, password recovery) | Performance of a contract (Art. 6(1)(b)) |
We don't use your data for advertising, profiling or automated decisions with legal effects on you, and we don't send promotional emails.
6. Who we entrust it to
The data is stored in Amazon Web Services data centres in Frankfurt (Germany). We rely on these providers, each only for its own part:
- Amazon Web Services EMEA SARL: servers, database, account sign-in (Amazon Cognito) and service emails (Amazon SES);
- Expo (650 Industries, Inc.): delivery of app updates;
- Stripe: card payments, Apple Pay, Google Pay and Link. For some processing (for example fraud prevention and Link) Stripe acts as an independent controller: see its privacy policy;
- Apple and Google: receive reports of purchases made with alternative payments, as their store rules require;
- Google, Meta (Facebook) and Apple, if you use them to sign in: they share your email and name with us according to the choices you make in their screen, and process the sign-in data under their own policies.
We don't sell the data or give it to anyone else.
7. Transfers outside the European Union
Some providers (Expo, Stripe, Apple, Google, Meta) may process data in the United States. In those cases the transfer relies on the EU-U.S. Data Privacy Framework or on the standard contractual clauses approved by the European Commission.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, game state, operation log, statistics, album | As long as the account exists; deleted when you delete it |
| Matches | 24 months, then deleted automatically (earlier if you delete the account) |
| Weekly and monthly leaderboards | 24 months (earlier if you delete the account) |
| Purchases, refunds and store reports | 10 years, for accounting and tax obligations; if you delete the account they remain without the link to your account |
| Server technical logs | 3 months |
9. How to delete your account and data
In the app: Settings → Account → Delete account. Deletion is immediate. You can also request it by email: all the details are on the Data deletion page.
10. Your rights
You can ask us to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. Write to info@mocchis.com from your account's email: we reply within one month.
You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live.
11. Security
Connections between the app and the server are encrypted, access to the data is limited to those who need it for their work, and every administrator action on player state is logged.
12. Changes
If we change this policy we update the date at the top of the page.