Zip Zop

Privacy policy — Zip Zop

Last updated: October 30, 2026.

This is an English translation of the French privacy policy (https://wub-lab.com/zip-zop/confidentialite/). If the two versions differ, the French version prevails.

Zip Zop is a rhythm game for Android published by Wub Lab (contact: contact@wub-lab.com). This document describes what the app does with your data, and what the community Jukebox on the wub-lab.com website does. It matches the current version of the app; sections marked “coming soon” will only apply from the version that introduces them, and this page will be updated before then.

In short

Without an account, your game stays on your phone. You play, you create beatmaps, you import and export them: neither your beatmaps, nor your games, nor your music are sent anywhere. A few technical exchanges with Google still take place: advertising (Google AdMob), Google Play for purchases, and the reading of two public game documents, as described in “Without an account, what is still sent”, “Advertising” and “Purchases”; and, for covers, a song’s artist and title sent to MusicBrainz (see “Covers”). None of it contains your game.
The account is optional. It is created with an email address and a password, or with a Google account, and is used for the community Jukebox, leaderboards, friends, challenges, online play, progression and the shop. With an account, what you publish, your drafts, your scores, your friends list and a few other pieces of data described below are stored with Google (Firebase), and you can erase all of it by deleting the account.
Your music stays on your phone. The app reads your music folder in read-only mode; a beatmap never contains audio. The one exception, in a local duel when the sound only plays on the host’s phone: a guest’s song is lent to the host’s phone, over the local link, for the round (see “Local duel, without internet”).
Covers. To show the cover of a song whose file has none, the app sends the song’s artist and title, and nothing else, to MusicBrainz and the Cover Art Archive; the setting can be turned off in Profile → Menu → “Covers from the internet”.
An ad between songs, never during a game, served by Google AdMob, with or without an account: the AdMob kit receives the device’s advertising ID, its IP address and technical information. In Europe, and wherever the law requires it, you first choose whether ads may be personalized; elsewhere, the game does not offer you this choice. A one-time purchase removes the ads between songs; a video that earns wubs only plays if you ask for it. No tracker and no player profile: the game only counts, anonymously, what happens to the songs of the Line-up artists, to report it to them (see “Artist statistics”), and we sell your data to no one.
Progression, wubs and shop, with an account only. Your experience, your levels, your achievements, your wubs (the game’s virtual currency, earned by playing), your VIP tokens (the bought currency, which only pays for shop items and gifts) and your cosmetic items are kept by the game’s server. VIP tokens are bought through Google Play, which processes the payment: we never see your bank details. Without an account, none of this.

What the app reads on your phone

Your music folder. Once and for all, using Android’s folder picker (Storage Access Framework), you choose the folder where your music is. The app receives read-only access to this folder and its subfolders (up to 5,000 files and eight levels deep), which persists from one launch to the next. Choosing another folder in the game’s settings gives up the permission on the old one; clearing the app’s data or uninstalling it removes it too. That is where the app looks for your songs. Outside this folder, it only opens an audio file if you pick it yourself with Android’s file picker (“Browse…”, new beatmap, linking a file), and then keeps read permission on that one file only. It reads audio files to play them and to analyze them on the phone (tempo, attacks, waveform), and reads their metadata (title, artist, duration, and the cover image they carry) to name your beatmaps, to show them and to find, in your folder, the file that matches a downloaded beatmap. No file is copied, modified or sent.

Finding beatmaps for your music. To suggest the community beatmaps that match the songs you own, the app downloads a compact index of published beatmaps (title, artist, author’s username, level, lanes, duration) and compares it locally with the metadata (title, artist, duration) and names of your files. The list of your files does not leave the phone; only the index is downloaded, in the server → phone direction. A file’s attack fingerprint is only compared the first time a beatmap is launched, on the phone.

What the app stores on your phone

In its private storage, which other apps cannot access:

Your year of birth, if you gave it: it never leaves the phone (see “Children”).
Your beatmaps: the beat grid, the notes, the author, the title, the artist, a reference to the linked audio file with its name, and, for those created in express mode, the passages already done. For your drafts, with an account, what keeps them in step with your account’s drafts (see “Your drafts” below): the version number of each one, the date of your last edit, the offset kept when a draft was aligned to your file, and the other version of a draft changed in two places at once, until you decide whether to recover it.
The index of your music folder: the title, artist, duration, address and date of each audio file in the folder, so their metadata does not have to be read again every time.
A fingerprint of each song: a series of values describing the strength of the attacks, about twenty per second. It is used to find your file and to align a beatmap to it when two versions of the same song differ. It cannot be used to rebuild the sound, or to listen to it. For each file matched to a beatmap, it comes with a checksum of the file (SHA-256) and the chosen offset, calculated or set by you.
Your settings: music folder, author username, touch latency calibration, number of lanes, note scrolling speed, sound and graphics settings, and your choice to tone down flashes or not (asked once, at the first launch; Profile → “Dim flashing lights”).
Your best scores and statistics, with an account: best score, accuracy, combo and score curve (the “ghost”) for each beatmap and the totals of all your games. On a shared phone, each account has its own. A game played without an account is not saved. The phone no longer sends a score to the leaderboard itself: see “Your scores” below.
Your progression, with an account: the figures that unlock achievements (zops completed, beatmaps on which you got an S, longest fever, duel win streak, identifiers of the friends you have challenged, and a few feats, such as a game played between 2 a.m. and 5 a.m. or a draw in a duel), the cosmetics you wear, the achievements you chose for your showcase, and a copy of the latest figures received from the server (wubs, VIP tokens, experience, items, achievements), to show them offline. On a shared phone, each account has its own.
Covers: the image embedded in your audio files, scaled down (in a cache Android may clear), and the ones found on the internet (see “Covers”), with the date of a search that found nothing.
An error log: the app’s last serious errors (crash, freeze), twenty at most — the date, the version, the phone model, the kind of error and where in the code it happened, never the error text, nor your files, your beatmaps or your account. It stays on the phone; nothing leaves it unless you use Profile → “Error log” → “Send by e-mail”, which opens your mail app with this text, addressed to contact@wub-lab.com: the studio then receives it, like any e-mail, and keeps it while it fixes the error. You erase it from the same screen.
Local logs: the challenges and friend requests you have already seen, the challenges and requests you have sent, the record of your duels and challenges against each opponent (username and results), the number of your games not yet added to your play history (it goes with the next one), and caches: the Jukebox index, the list of players you have blocked and of your published beatmaps, and the emblem, frame, username effect, banner and level of the players shown in your leaderboards and friends list (twelve hours at most), so as not to ask the server for them every time.

None of this leaves the device: the app is excluded from Android’s automatic backup, and nothing from it is copied to your Google account. Uninstalling the app erases all of it.

Without an account, what is still sent

Without an account, the app does not identify you, but it reads two public Firebase (Google) documents, located in the European Union, without writing anything to them:

The game’s configuration document, read when you reach the menu, at most once every six hours: the dates of the shop’s seasonal events, the stakes switches (challenges, rooms) and the game’s version numbers (the latest published version and the oldest one that still works, to offer you an update). It is read the same way with an account.
The genre table, when you tag a beatmap in the editor: one small document of the “artist → genre” table (drawn from Discogs’s public data), whose number, from 0 to 511, depends on the artist’s name without revealing it; it is then kept on the phone for thirty days.

Like any network request, these reads leave technical traces with Google: the phone’s IP address, the app’s verification token (Firebase App Check, issued by Google Play Integrity: see “The account, optional”) and Firebase’s installation ID, a number drawn by Firebase, specific to this installation, which is linked neither to an account nor to your name. We do not consult these logs. No game data is in them. Apart from this, without an account, only advertising (Google AdMob) and Google Play, for purchases, receive device data (see “Advertising” and “Purchases”), and the cover search a song’s artist and title (see “Covers”).

Included songs (coming)

Zip Zop’s included songs (under a free license, or offered by their artists) download from our storage, with or without an account:

the app asks the game’s functions (Firebase, European Union) for the catalog of songs, then, for each song, for a download link valid for ten minutes; the request carries the app’s verification token (Firebase App Check) and, if you are signed in, your account’s token;
the file comes from Cloudflare R2 (Cloudflare’s storage, which also hosts the website), which receives the phone’s IP address for that;
to prevent mass downloads (sixty links per hour per account, a hundred and fifty per address without an account), the server keeps a counter for the current hour, attached to your account or, without an account, to an encrypted fingerprint of the IP address, computed with a secret key that does not allow the address to be recovered. These counters are erased every night.

On the phone, the downloaded songs, their catalog (titles, artists, licenses) and the time each was last played (to free the space of the least played ones first when the limit chosen in the Profile is reached) stay in the app’s private space, outside Google’s backup. These files never leave the phone: no sharing, no export, no sending to another player (a nearby room does not lend them).

Artist statistics

Every month we report to the artists whose songs are in the game what happens to their songs (we commit to it with them). For this, the app keeps, with or without an account, anonymous counters:

it counts the games played on an included song, the plays of an excerpt in the artists’ showcase (Line-up), the openings of an artist’s page (their website, social networks, listening platforms) and the follows of an artist, given or removed;
these counters are grouped on the phone and sent at most once a day to the game’s functions (Firebase, European Union), in a request that carries neither your account, nor your username, nor any device identifier: only numbers, per artist, per song and per month;
to count an artist’s players without knowing who they are, the phone only remembers that it has already been counted this month;
the server keeps only the totals per artist and per month. To prevent mass sending, it keeps, as for the songs, a counter for the current hour tied to an encrypted fingerprint of the IP address, erased every night.

Artists receive these totals, never anything that could identify a player. A link to a website carries the mention utm_source=zipzop, which only tells that website the visit comes from Zip Zop.

Covers

On the Play screen, each beatmap has its cover. The app first takes the image embedded in your audio file, on the phone. If the file has none, and as long as the setting Profile → Menu → “Covers from the internet” is on (it is by default), with or without an account, it looks for it on the internet:

it sends the song’s artist and title, nothing else (neither the file, nor your account, nor your username), to MusicBrainz, the MetaBrainz Foundation’s open music encyclopedia (United States), one request per second at most;
if MusicBrainz surely recognizes the album (matching title, artist and duration), it downloads its cover from the Cover Art Archive (MetaBrainz Foundation and Internet Archive, United States); otherwise, nothing, and the game draws the cover itself.

Like any network request, these requests reveal the phone’s IP address; they also carry the app’s name and version (“ZipZop/1.0.5”, as MusicBrainz asks). The cover is kept on the phone, in the app’s private storage, and is not requested again; a search that found nothing is only made again after thirty days. Nothing is requested for the songs included with the game, for a beatmap without an artist or a title, or without a network. Turning the setting off stops all requests and erases the downloaded covers: the covers drawn by the game come back.

The account, optional

You create an account from the Profile, at first launch, or when a feature asks for one (Jukebox, publishing, leaderboards, friends, online play). Two ways: an email address and a password, or your Google account. You then choose a username, unique and permanent, which is your identity in the game: it signs your published beatmaps, your scores and your challenges, and it is visible to other players. Your email address, on the other hand, is never visible: no one can find your address from your username, and that is why you cannot sign in with your username.

Sent to Firebase Authentication (Google): your email address and your password (Firebase keeps a hash of it, we never see it), or the token provided by Google if you use your Google account. Firebase gives your account a technical identifier. Firebase may send you an email to reset a forgotten password.

With an email address and a password, the address must be confirmed before you can reserve a username: Firebase sends you an email that contains a link, and the server checks it (this is what stops accounts from being mass-produced). A Google account has no such step: Google confirms the address itself. An account created before this rule, which already has its username, is not affected.

Verifying the app (Firebase App Check). So that the server only accepts requests from a genuine installation of Zip Zop, the app attaches an attestation token to its requests to Firebase. On Android, this token comes from Google Play Integrity: Google checks that the app is the Play Store one and that the device is a genuine Android device, and receives information about the device and the installation for that, under its own privacy policy. The token contains no data from your account. On the web Jukebox, the same check goes through reCAPTCHA (see “The web Jukebox”).

What is stored on the server, with an account

This data is hosted by Google, in the studio’s Firebase project (Firebase Authentication, Cloud Firestore and Realtime Database; the game server’s calculations run on Cloud Functions), with the databases and these functions located in the European Union. Google acts as a processor; it does not use this data for its own purposes. It is kept as long as your account exists, unless stated otherwise below, and erased when the account is deleted (see “Deleting your account”).

Your profile: technical identifier, username and its lowercase form, sign-up date, your duel record (wins, losses, draws), your total experience (a number written by the server when your level changes, from which the level and the title shown come), the four cosmetics others see (emblem, frame, username effect, banner), the number of your achievements and up to three achievements chosen for your showcase (with no choice, your three finest; written by your phone when they change, and checked against your game state), and, for an account created before 30 September 2026, the date of an old library marker that the app no longer writes or reads. Your profile can be read by any signed-in player who finds you: it is your player card, which opens when someone taps your username (leaderboard, room, challenge, duel results, Jukebox, search) and shows your username, your cosmetics, your level and title, your sign-up date, your duel record, the number of your achievements and your showcase, and your published beatmaps; your cosmetics also go with your username on beatmap leaderboards. The rest of your progression is described in “Progression, wubs and shop”.
The beatmaps you publish: title, artist, genre, keywords, your username, number of lanes, tempo, level, number of notes, song duration, maximum score, your creator score, the beat grid and the notes, and the attack fingerprint (never the audio, never the name of your file). They come with counters kept by other players: stars received, downloads, reports. A published beatmap is visible to anyone signed in, in the game and on the web Jukebox. The server recalculates the maximum score and the number of notes from the published notes. The identifier of each beatmap you publish stays registered to your account (your technical identifier, in a registry), even if you remove it from the Jukebox: nobody else can publish under that identifier. The registry can be read identifier by identifier by signed-in people (it only says what the published beatmap already said); when your account is deleted, your technical identifier is replaced there with “supprimé” (deleted), and these identifiers stay reserved. Wub Lab also studies published beatmaps, without their author's username, to tune the game's beatmap generator (see the terms of use, part 2): their notes are compared with what the generator suggests for the same song, and only settings and statistics are kept. Only the beatmaps of accounts that accepted the terms of October 19, 2026 are used (the date of that acceptance is on your profile).
Your downloads: when you download a beatmap from the Jukebox, your technical identifier is recorded under that beatmap, with the date, only once: this is what lets the download counter count each account only once. No one reads this list.
Your stars and your reports: a rating from 1 to 5 stars per beatmap, linked to your identifier, which you can change (the date of the last change is kept, and the server keeps their sum and count on the beatmap’s listing); or a reason for a report, only once per beatmap, never editable. The phone also keeps the ratings you gave, to show them. No one outside the studio reads the list of reports. An account can only report a beatmap three days after signing up: your profile’s sign-up date is used to check it, nothing more is recorded.
Your scores: only official games (which you choose before playing) enter the leaderboard of a published beatmap: your username, your score, your accuracy and your combo, recorded by the server and never by your phone, and only if they beat your best score. For an official game, the server keeps a ticket for the length of the game (beatmap, version of the notes, start time) and then destroys it; the day of your last free official game is noted in your game state. A practice game never leaves your phone.
Your declared library: for each beatmap you have, its identifier, its title, the version of its notes, whether an audio file is linked to it (yes or no, never which one) and the date — never the audio or the name of your file. This is what tells who can be challenged on what; it can be looked up beatmap by beatmap, by signed-in people, never as a whole.
Your friends: your friends list (private, no one else reads it) and the friend requests you send or receive (username and date). A friendship starts with a request: you look someone up by the first letters of their username — the search only returns ten usernames at a time, never the whole directory —, you send them a request, which they accept or decline. Once accepted, the friendship is recorded on both sides; if declined, nothing is kept.
Your play history: the beatmaps you have played, your best score, your accuracy and your combo on each one, the number of games and the date of the last one. It is visible to your friends only, on your profile; removing someone from your friends hides it from them again.
Challenges: when you challenge a friend, they receive the beatmap in question, your score, your accuracy and the curve of your game, to play it again against your ghost; when they take up the challenge, you receive their result in the same way. A challenge is left with its recipient, who alone reads and deletes it; a challenge never taken up is deleted by the server after sixty days. A challenge with a stake also carries its stake (10, 25 or 50 wubs); the stake itself is kept by the server (see “Progression, wubs and shop”).
Duel invitations: from the room of an online duel, you can invite a friend: they receive the room code, with your username. The invitation is deleted when they join or ignore it, when the room closes, and, after two hours, as soon as they open their list or at the latest the following night.
The announcement of your new beatmaps: when you publish a beatmap for the first time, the server lets each of your friends know with a notification — your username, the title, the artist, the number of lanes and the level of the beatmap. It only keeps a record that this beatmap was announced (its identifier and the date, under your account), so it is never announced twice.
The players you block: for each one, their technical identifier, their username and the date. Readable by you alone; the blocked player is not told (their requests, challenges and invitations are simply refused). You unblock from Profile → Blocked players.
Player reports: when you report a player, their identifier and username, the reason chosen, your identifier and the date. Only the studio reads them, for moderation (see the terms of use).
Your acceptance of the terms of use: the date, on your profile.
Your phones, for notifications: for each phone where you are signed in, a Firebase Cloud Messaging token — the technical address at which Google delivers notifications to that phone — and the kinds of notifications you have turned off there, filed under the app’s installation identifier (a number drawn by Firebase, specific to that phone). When you send a friend request, the server notes the pair of identifiers (yours, the recipient’s) so as not to notify it more than once an hour; this note is deleted the following night. The token is only requested from Google once an account is signed in on the phone: without an account, the app does not register with Firebase Cloud Messaging. Readable by you alone; deleted when you sign out on that phone and when the account is deleted, forgotten when Google declares it expired (app uninstalled).
Online game rooms: the room code, each player’s username and identifier, the list of the beatmaps they can play (their identifier and note version — never the audio or a file name: this is what lets the room only offer beatmaps everyone has), whether they are ready, the beatmap they suggest, the stake they propose (10, 25 or 50 wubs) and their last reaction; the drawn round (and, when it carries a stake, its stake and escrow), the start time, the live scores during the game, the points of the evening, the identifier of the players the host removed, the game mode and the number of lives chosen by the host, the room protocol version of each player’s app (so that a mode is only offered when everyone knows it), and, during a Survival or Items round, each player’s lives, the moment they were knocked out and the last attack they launched (the target and the item). Any signed-in player who knows the code can read the room. The room lasts as long as someone stays: your spot and your list are deleted when you leave it; when the host leaves, the first guest takes it over; when the last player leaves, it is deleted. An abandoned room is no longer valid after two hours and its code is given to the next room, which overwrites it — the server deletes any that remain every night. When you open a room (or take one over), the room’s code and the time are recorded under your identifier, in the same database: this is what limits each account to one live room at a time — a room you no longer hold can be taken over by another player opening one. Readable by you alone; deleted at night once that room no longer exists or is no longer yours, and when your account is deleted. The reaction packs you own (the paid reactions of the room) are copied by the server, under your identifier, into this same realtime database: this is what lets the room only accept the reactions you have. Nobody can read them, not even you (the server alone); deleted with your account.
Your download queue: when, from the web Jukebox, you ask for a beatmap to be sent to your phone, the website writes a small document under your account (identifier, title, artist and version of the beatmap, date of the request, status). It is written by you alone and read by the app on your phone, which downloads the beatmap and deletes it. A pending request stays until the game is next launched with this account; a failed request is deleted at the latest thirty days later. When you download a beatmap’s file from the website, it records your visit under that beatmap (see “Your downloads” above); the server is what moves the counter forward. The web Jukebox writes nothing else.
Your drafts: each beatmap draft signed with your username, started on your phone or in the website’s editor — the beat grid, the notes, the title, the artist, the genre, the song’s duration and its attack fingerprint (never the audio, never the name or address of your file) —, with its version number, the date of your last edit and the device that wrote it (the phone or the website). That is what makes it appear both on your phone and in the website’s editor. Readable and editable by you alone. A draft you delete, or validate (it then joins My beatmaps on your phone), leaves an empty, dated trace for thirty days, which removes it from your other devices; then the server deletes it. A draft bigger than a published beatmap stays on your phone.

For the security of the service, Firebase also keeps technical connection logs (IP address, timestamps), which Google retains according to its own rules and which we do not look at.

Progression, wubs and shop

With an account, the game keeps your progression (experience, levels, prestige, achievements), two virtual currencies — wubs, earned by playing, and VIP tokens, bought —, and what the shop offers: cosmetic items, which only change how things look, and an experience boost — nothing that can be bought affects the score or the beatmap leaderboards. The game’s server calculates and writes all of this; your phone reads it and asks for it. Without an account, none of this: no experience, no wubs, no shop. This data is hosted like the data in the previous section and kept as long as your account exists, unless stated otherwise below.

Your game state, readable by you alone and written by the server alone: your wub and VIP token balances, the chests you have earned and not yet opened, “no ads” if it was given to you by a large VIP token pack, whether the welcome offer has already been used, the end of your experience boost, your total experience, the counters of your game day (the day, the experience and the number of games of the day, whether the first game of the day is done, the identifiers of the beatmaps played today and the number of games on each), your streak of days played, the day you completed the daily challenge, your daily quests (the day, the three quests drawn, your progress, those already paid, the identifiers of the beatmaps played for them, and whether the bonus for all three was taken), your progress in the login calendar, the number of rewarded videos watched today (and the identifiers of Google’s last thirty confirmations), the identifier of your referrer and whether they have been paid, the number of your referred players who have been paid and the latest of them (their identifier, so that the game can tell you), your ranks in the top 10 of leaderboards, the last weekly ranking reward and your experience for the current week and the past week, the number of days you have played (for referrals), the end times and durations of your last hundred games (so that they do not overlap), the number of requests made today (at most 500 a day), the duplicate from a chest waiting for you to give or trade it (the item and the date, one at most), your stakes (see below), your time zone (the offset of your phone’s clock from universal time, in minutes — for example +120 in Paris in summer —, and the next offset with the time it takes effect when it has just changed: your play days, quests, calendar, showcase and daily caps run from midnight to midnight where you are), your achievements and your items (see below), the number of your counted games and your playing time, the identifiers of the published beatmaps you have played and of those you got an S on (sixty at most each, for the “Explorer” and “Star” achievements), and the identifiers and answers of your latest requests (so that a request is never served twice, and so that the app reads its answer).
Your requests to the server: each game finished with an account leaves a request — the beatmap’s identifier, the song’s duration, its difficulty level, your rank (S to D), whether it was a full combo, whether you beat your best score, whether you won, your best combo and the number of zops completed (for the daily quests), the time actually played when a room round stops before the end of the song, the time the game ended (the server’s time as seen from the phone: the game aligns it with the time of the server’s answers) and the identifiers of the achievements the phone saw at the end of the game. The server calculates the experience from it and answers in your game state; a game shorter than thirty seconds does not count. Other actions go the same way: achievement, item purchase (with wubs or VIP tokens), chest (earned, or bought with wubs at the price shown), duplicate, gift, boost, calendar, referrer, Google Play purchase to credit, stake (sent: the friend, the challenge, the beatmap, its version and the amount; taken or declined: the friend and the challenge; the game played for a stake carries its attempt and its score). Each request also carries your phone’s time offset (see “your time zone” above) — never your location, nor the name of your city or time zone. Each request is deleted as soon as the server answers it (the answer stays in your game state, with the last eight); a request never served is deleted at the latest eight days later.
Your achievements and their date, in your game state. Top 10 and No. 1 are calculated by the server from the public leaderboards of the beatmaps (for each one it keeps a copy of its ten best scores, account identifier and score, which no player reads), and are lost when you drop out of them; the long-haul achievements (games, playing time, beatmaps played, beatmaps with an S) are counted by the server from your games; for those about friends, published beatmaps and their downloads, it counts your friends, your published beatmaps and their downloads before recording them.
Your items: the ones you own, where they come from (purchase, chest, bundle, gift, welcome) and, for a gift, the username and identifier of the friend who gave it to you, in your game state.
Gifts: you can give an item to a friend (the friendship must go both ways), with VIP tokens, or a duplicate from a chest for free. Your username is then written in their inventory, and they receive a notification.
Stakes: when you put a stake on a challenge, or take up a friend’s stake, your game state keeps, for the length of the game, the attempt the server opened (the challenge, the friend, the beatmap and its version, the stake, the time, the beatmap’s score ceiling, its duration and number of notes, both usernames, and the score to beat); a stake you sent stays there, with your score, until it is settled (and the time your friend took it up); so does what you staked during the day. When your friend takes up or settles your stake, it is their request that writes your wubs, your pending stakes and their outcome into your game state. The outcome of your last twenty stakes (the challenge, won, lost, tie or returned, the amount, the friend’s username, the date) stays there, so that the game can tell you.
Room stakes: the stake you propose in an online room is written on your spot, with your username, in plain view of the other players (see “Online game rooms”). When the host starts a round with a stake, the server opens an escrow in a document the phone can neither read nor write: the room code, the round number, the stake, the beatmap and its version, its score ceiling, the identifier and game day of each player of the round, the escrow’s state, then each player’s outcome (won, lost, tie or returned, and the amount received). It takes the stake from each player’s game state, reads the scores in the room to pay them out and, once the stake is settled, writes into each player’s game state their wubs, what they staked during the day and the outcome, which stays among the last twenty (like a challenge’s, without a friend’s username).
The weekly ranking: every Monday, the server compares the experience of the past week between mutual friends (the one in your game state); the top three of a group of at least two players receive 50, 30 or 20 wubs and a notification.
Referral: within seven days of creating your account, you can enter your referrer’s username, or the game declares it for you if you followed their invitation link (see below); the server keeps their identifier. To check this deadline, it reads your account’s creation date from Firebase Authentication (without keeping it). When you reach level 5 and have played on three different days, you receive 150 wubs and your referrer 300 (at most ten referred players paid per referrer; if yours has reached that limit in the meantime, you still receive yours); at their third paid referral, your referrer receives the Ambassador emblem, and at the tenth the Headliner emblem. Sharing your link opens Android’s share sheet with a text (your username and your invitation link, https://wub-lab.com/en/zip-zop/invite/ followed by your username): you choose who it goes to.
The invitation link: opened on a phone where the game is installed, it opens the game, which keeps the username of whoever invited you and shows their player card. Otherwise, it leads to the game’s page on wub-lab.com, which shows that username and adds it to the link to Google Play. On its first launch, the game asks the Play Store, on the phone, which link the installation came from (Google Play Install Referrer): it reads only the referrer’s username, keeps it on the phone until you have an account, then declares it as your referrer (you can still choose not to create an account). Nothing else is read or sent.

Rewarded videos are described in “Advertising”, VIP token purchases in “Purchases”.

Your results card. You can share an image of your results (title and artist of the beatmap, your username, your emblem, your rank, your score, your accuracy, your combo, your level) through Android’s share sheet. The image is created on the phone: nothing goes to the server, it only goes where you send it.

The web Jukebox

On wub-lab.com, the community Jukebox lets you, signed in with the same account, search the published beatmaps and send them to your phone or download them. This page of the website connects to Firebase (Google) for your account and for the beatmaps; it uses no tracker and no audience measurement, shows no ads, and writes nothing other than your download queue and the counted record of your downloads. It reads your list of blocked players, to hide their beatmaps as in the game. The “With Google” button loads, when you click it and not before, a script from Google (apis.google.com) and Firebase’s sign-in window. Once you are signed in, the page also loads reCAPTCHA (Google, www.google.com/recaptcha and www.gstatic.com/recaptcha) to check that requests come from a browser and not a bot (Firebase App Check): Google receives information about your browser for that, under its own privacy policy; a visitor who is not signed in loads nothing from Google. Your browser keeps your Firebase session, a copy of the Jukebox index, your username for the length of the session and the chosen tab (the site’s local storage, no cookie); the Firebase SDK also notes there the days it was used, thirty at most, with its version numbers (a firebase-heartbeat-database database), which it attaches at most once a day to a request to Firebase (X-Firebase-Client header) before forgetting them. All of this is erased with the site’s data.

The website’s editor

On wub-lab.com, the beatmap editor lets you, signed in with the same account, prepare a beatmap’s beat grid and notes on a computer. The audio file you choose is read and analyzed in your browser: it is sent nowhere, neither its sound nor its name. This page of the website connects to Firebase (Google) for your account, reads your username, and reads and writes your drafts (see “Your drafts” above); it publishes nothing (a draft is validated by playing it on your phone, from where it is published), uses no tracker and no audience measurement, and shows no ads. The “With Google” button and reCAPTCHA behave there as on the web Jukebox (see above). Your browser keeps your Firebase session, your username for the length of the session, your editor settings (the snap, the volume of the clicks, the level and what the generator's notes follow), a working copy of your drafts, so that nothing is lost without a network, the other version of a draft changed in two places at once, until you decide whether to recover it, and, in the browsers that allow it (Chrome, Edge), access to the audio file chosen for each draft, which asks for your permission again before reopening it — never the sound itself (the site’s local storage, no cookie); the Firebase SDK notes there the days it was used, as on the Jukebox. These copies stay in your browser after you sign out, filed under your account and shown only to it; all of this is erased with the site’s data.

Local duel, without internet

Two to four nearby phones can play against each other without a connection: they find each other over Bluetooth and Wi-Fi (Nearby Connections, from Google Play Services), directly, without going through a server. Exchanged between the phones: the usernames, a number drawn at random once on each guest phone (unrelated to your account: it lets the host exclude a phone rather than a username, and stays in the room), each player’s account technical identifier (empty without an account: it lets the others open your player card), the room protocol version of the app, the game mode and lives chosen by the host and, during a Survival or Items round, each player’s lives, knock-out time and attacks, the list of the beatmaps each player can play (identifier and note version), the suggested beatmaps and the reactions, the list of players, the sound setting, the identifier, title and note version of each round’s beatmap, the start time, the scores and the points of the evening; and, when the sound only plays on the host’s phone and a guest does not have the beatmap, the beatmap itself (grid, notes, attack fingerprint — never the audio or the name of a file), which is only used for the round: it is stored in their downloaded beatmaps only if they choose to keep it. If the chosen beatmap is a guest’s and the host does not have the song, the guest lends their audio file (40 MB at most) to the host’s phone alone, directly over the local link, without going through a server: the host decodes it for the round in the app’s private space, then deletes it straight away (and, at the latest, at the end of the round, when the room closes or the next time the app starts); it is not kept, cannot be replayed and cannot be exported. A song downloaded from Zip Zop is never lent: each phone downloads it itself. The offset measured by a calibration on the clicks of the host’s phone stays on the guest’s phone, for the time of the room. The result of the game is counted in your local duel record. Nothing else is kept, or sent anywhere else. The app advertises itself from the room screen; the game’s menu listens for nearby rooms, in low-power mode, as long as it is open and if you have already granted the permissions — never when the app is closed.

Notifications

Android notifications can let you know about a friend request, a challenge, the result of a challenge you sent, a duel invitation, a beatmap a friend has just published, a gift received, your weekly ranking or a shop offer. They require your permission (Android 13 and later). They are sent by the game’s server when the thing happens, through Firebase Cloud Messaging, Google’s notification service, which acts on behalf of the studio (see “Your phones, for notifications” above): the message carries the sender’s username and the title of the beatmap — for a gift, the friend’s username and the item given; for the weekly ranking, your place and the wubs earned; for an offer, the item, its price of the day and its usual price —, nothing else. Refusing them takes nothing else away. Shop offers: at 6 p.m. (Paris time), the server announces the item on sale in today’s showcase, at most once every three days — your phone only shows the announcement if your level lets you buy the item (it knows this without asking the server) —, with a single message to a Firebase Cloud Messaging “topic” that phones signed in to an account subscribe to when they have not turned this kind off (the subscription is removed when you turn it off, sign out or delete your account; Google keeps the list of subscribed phones, the game’s server does not see it). Each kind can be turned on or off in the app (Profile → Notifications) — all are on at first, offers included: when it is off, the server no longer sends it to that phone. The kinds are also grouped into channels in the phone’s settings. Signing out stops notifications on that phone; without an account, there are none.

What the app never does

It never uploads any audio file to a server and never shares one, except for lending a song to the host for a round of a local duel (see “Local duel, without internet”). An exported or published beatmap never contains sound: the person who receives it must provide their own file.
It does not read your contacts, your location, your address book, or your files outside the music folder you chose and the files you open yourself.
It uses no audience measurement tool and no tracker (the only counters are the artists’ anonymous ones: see “Artist statistics”) and sells your data to no one. Apart from the host above (Firebase), only Google’s ad network and Google Play receive device data, described in “Advertising” and “Purchases”, and MusicBrainz and the Cover Art Archive a song’s artist and title (see “Covers”).

Android permissions

Advertising. The AdMob kit adds four permissions to the app, granted at installation without asking: AD_ID, access to the device’s advertising ID, and ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION and ACCESS_ADSERVICES_TOPICS, the advertising interfaces of Android’s “Privacy Sandbox” (advertising ID, ad measurement, interests estimated by Android on the phone). The AdMob kit uses them to choose and measure ads; the game itself does not use them. You can reset or delete the advertising ID, and adjust or turn off these interfaces, in Android’s settings (Privacy → Ads, or Ad privacy, depending on the phone).

The music folder goes through the system’s folder picker: you choose the folder, and Android grants the app read-only access, persistent and revocable, to that folder alone. No general permission on your files or your music is requested.

Local play asks, when you open or join a local room, for the “nearby devices” permissions (Bluetooth and Wi-Fi, Android 12 and later) and for “location”, approximate and precise. Precise location is required by Android — and by Nearby Connections — to look for a nearby device over Bluetooth, which could in theory be used to locate you; if you only grant the approximate one, the room says so and does not search. The app never reads your location, nor passes it on to anyone: it only uses it to find the phone across from you. You can refuse: everything else in the app works without it, only local play becomes impossible.

Notifications (Android 13 and later) are requested once, when you open the Friends & challenges screen, or from Profile → Notifications. Internet (and the network state, to know whether you are offline) is only used for the account, the Jukebox, leaderboards, friends, challenges, online play, progression and the shop, advertising, the check of purchases and the cover search. Vibration, granted at installation without asking, is only used for in-game feedback (Profile → Game → Vibration: none, the notes, or the misses).

Children

Zip Zop is meant for people aged 13 and over, as its Google Play listing states; it is not designed for children under 13, who must not create an account. The app asks once for your year of birth, before the ad consent message: it stays on your phone, is never sent, and is only used to set up advertising. Under 16 (the highest age at which an EU country lets people consent on their own; 15 in France), ads are never personalized and the consent message is not shown; under 13, they are also treated as directed at a child and limited to content suitable for all audiences. Otherwise, ads are limited to content suitable for all audiences and teenagers (AdMob’s “T” rating). Between 13 and 14, the terms of use ask for a parent’s consent to create an account (in France, people decide on their own about their online data from the age of 15). If you are a parent and learn that a child under 13 has created an account, write to contact@wub-lab.com: the account is deleted.

Why we process this data

The data controller is Wub Lab, a sole trader business (full identity, address and telephone in the legal notice: wub-lab.com/en/legal-notice/; see also “Your rights”). Depending on what the app does:

To provide the service you ask for (performance of a contract, art. 6(1)(b) GDPR): your account and username, your published beatmaps and drafts, your scores and leaderboards, your friends, challenges, duels and rooms, your progression, your wubs, your VIP tokens and the shop, purchases and their verification.
To protect the service and the other players (our legitimate interest, art. 6(1)(f)): the app’s verification (Firebase App Check), the server’s calculation of scores and rewards, the daily caps, the moderation of reports, the reservation of usernames and beatmap IDs, the record of a purchase that prevents crediting it twice, the reading of the configuration document and of the genre table (without an account as with one), the study of published beatmaps, without their author’s username, to tune the game’s generator, the cover search (which you can turn off: see “Covers”), and the anonymous counters used to report to artists (see “Artist statistics”).
With your consent (art. 6(1)(a)): the personalization of ads, where Google’s consent message is shown (you can withdraw it at any time: Profile → Privacy → “Ads: my choices”), Android notifications, and the “nearby devices” and “location” permissions for the local duel (see “Android permissions”).

Advertising is processed by Google, which is responsible for its own processing (see “Advertising”).

Where the data goes

The databases (Cloud Firestore and Realtime Database) and the game’s functions are located in the European Union. Google hosts them as Wub Lab’s processor. Some Google services also process data outside the European Union, notably in the United States: sign-in (Firebase Authentication), the app’s verification (Google Play Integrity, Firebase App Check), notifications (Firebase Cloud Messaging), advertising (Google AdMob) and Google Play. Google LLC participates in the EU–US Data Privacy Framework (recognized as ensuring an adequate level of protection by the European Commission on July 10, 2023), and its contracts include the Commission’s standard contractual clauses where necessary.

The wub-lab.com website and the contact@wub-lab.com address go through Cloudflare (Cloudflare, Inc., United States, which also participates in this framework): it hosts the site’s pages and, coming, the included songs’ files (Cloudflare R2), and receives for that the IP addresses of visitors and of the phones that download them; it also forwards the emails received to the studio’s mailbox. The cover search goes through MusicBrainz and the Cover Art Archive (MetaBrainz Foundation and Internet Archive, United States): they receive the phone’s IP address, the app’s name and version, and a song’s artist and title, nothing else. No other recipient receives your data, which is neither sold nor handed over.

How long we keep it

Your account and what is attached to it (profile, published beatmaps, drafts, friends, history, progression, wubs, VIP tokens, items, scores, notifications): as long as your account exists; erased when it is deleted, except what remains (see “Deleting your account”).
What remains after the account is deleted: published beatmaps (with their username), the reserved username and beatmap IDs, the ratings and reports you gave, download IDs, the sponsor’s ID with the players they sponsored, items you gave and challenges you sent (never taken up: sixty days): as long as the game exists, because they keep leaderboards and counters accurate and prevent a username or a beatmap from being taken over by someone else. The record of a Google Play purchase (without the account’s ID): as long as the game exists, to never credit a purchase twice and to take back the tokens of a refunded purchase.
Requests to the server: erased as soon as the server answers, eight days at most. Rooms: an abandoned room is no longer valid after two hours, and the server erases the remaining ones every night. The website’s download queue: until the next launch of the game with that account, thirty days at most for a failed request. Deleted drafts: a trace for thirty days. A challenge never taken up: sixty days. A room stake’s escrow: seven days after it is settled (an escrow nobody has settled within a day is returned to its players the following night). The notification token: until you sign out of that phone or delete the account. The totals of the artist statistics (with nothing that designates a player): as long as the game exists. The counters limiting song downloads (coming): erased every night.
Google’s technical connection logs (IP address, timestamps) and the data advertising receives: according to Google’s own rules; at MusicBrainz and the Internet Archive, according to theirs.
On your phone: until you erase it or uninstall the app; the app is excluded from Android’s backup.

Your rights

Without an account, nothing you do in the game (beatmaps, games, settings) is sent or kept outside your phone (the technical exchanges that remain are described in “Without an account, what is still sent”): you erase your data by deleting the beatmaps concerned in the app, or by uninstalling it. The device data that advertising receives, with or without an account, is processed by Google: you reset or delete the advertising ID in Android’s settings, you change your choices, where they are offered to you, in Profile → Privacy → “Ads: my choices”, and you exercise your rights over this data with Google (https://policies.google.com/privacy).

With an account, you can view and change from the app what is stored on the server: delete or republish your beatmaps, remove a friend, delete a challenge you received, and delete your account with everything linked to it (see below). To exercise your rights of access, rectification, erasure, objection, restriction or portability in another way, write to contact@wub-lab.com from the account’s email address. You can withdraw a consent you gave at any time (see “Why we process this data”). You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr). The data controller is Wub Lab, reachable at the same address.

Deleting your account. From the app (Profile → your account card → “Delete my account…”), after confirming your identity (password, or Google account). The following are then erased on the server: your profile and your displayed username, your level, your duel record, your visible cosmetics, your friends list (and your entry in each friend’s list), the friend requests received and sent, the duel invitations received and left with your friends, the challenges received, the announcements of friends’ beatmaps not yet read, your phones registered for notifications, your blocked players, the record of beatmaps already announced to your friends, your play history, the list of beatmaps in your library, your download queue, your online drafts and your scores on every leaderboard. Then the account itself is deleted from Firebase Authentication, and the server then erases your game state (wubs, VIP tokens, experience, chests, stakes, counters), your achievements, your items and your requests. Your wubs, your VIP tokens (bought ones included), your items and the “no ads” given by a VIP token pack are lost, with no refund. What remains: the beatmaps you published, which stay on the Jukebox — the people who downloaded them keep them — marked as coming from a deleted account, with the username that signed them (in the Jukebox index too); your username, which stays reserved so that no one can take it and sign these beatmaps; the ratings and reports you gave — on beatmaps as on players — and the beatmaps you downloaded (a simple technical identifier, now with no account behind it, which keeps the counters accurate), as well as your identifier with the players you referred; the record of your purchases on Google Play, without your account’s identifier (replaced by “supprimé”, French for “deleted”), so that a purchase is never credited twice; the items you gave to friends, which stay with them with your username; and the challenges you had sent, with the friends who received them, until they delete them (or, if never taken up, sixty days). On your phone, your beatmaps, your drafts and your best scores are not touched; the copy of your progression (wubs, experience, items, achievements), the figures behind your achievements, the cosmetics you wear and the log of your challenges and duels are erased. If you no longer have access to the app, write to contact@wub-lab.com from the account’s address: the same deletion is done by hand.

Advertising

The free version shows a full-screen ad between songs: when you return to the menu after a game, at most one game in two and never less than three minutes after the previous one — never during a game, in the editor, during loading or in a duel, nor during your first two games. It is served by Google AdMob (Google Ireland Limited), which is the controller of its own processing: to choose, display and measure the ad, and to fight fraud, the AdMob kit collects device data — the Android advertising ID, the IP address (from which an approximate location is inferred), information about the device and the app, your interactions with the ad, and diagnostics. This applies with or without an account: the kit starts as soon as you reach the game’s menu (after the consent message, where it is shown) and prepares an ad in advance, so these exchanges take place even before your first ad. Google’s rules: https://policies.google.com/technologies/ads.

In Europe (European Economic Area, United Kingdom and Switzerland), and wherever a local law requires it, a consent message (Google UMP) is shown before any ad: you choose whether ads may be personalized based on this data; without your consent, they are not. Under 16, it is not shown and they never are (see “Children”). You can change your mind at any time: Profile → Privacy → “Ads: my choices”. Elsewhere, this message is not shown and the game does not offer this choice: ads may be personalized according to Google’s rules. You can then limit personalization by deleting or resetting the advertising ID in Android’s settings (see “Android permissions”).

Rewarded videos. In “Daily rewards”, and only if you ask for it, you can watch an advertising video (AdMob, “rewarded” ad unit): watched to the end, it earns 5 wubs, up to ten times a day. The AdMob kit then receives the same data as for the ads between songs, under the same consent choice, and the identifier of your Zip Zop account (a string of letters and digits, not your username or your address) with a random tag specific to the video: this is what lets Google confirm directly to the game’s server that the video was watched (“server-side verification”), without the phone being able to claim it instead. The game’s server receives this identifier, the transaction identifier and the time from Google, credits the wubs, and only keeps the number of videos of the day and the identifiers of the last thirty confirmations, so that the same one is never paid twice (see “Progression, wubs and shop”).

Apart from rewarded videos, Zip Zop does not pass your account to AdMob; never your username, your beatmaps or your music. The pacing of ads is counted on your phone only (the number of games, the time of the last ad). After the “no ads” purchase (or when a VIP token pack has given it to you), the game no longer starts the ad network: no more ads between songs, and no more ad requests — unless you ask for a rewarded video yourself.

Purchases

The “no ads” purchase and VIP token packs are made through Google Play Billing: Google processes the payment, and we neither see nor keep any bank details. The price of a purchase, in euros or in your currency, is the one Google Play shows; in the game, shop items are shown in wubs and in VIP tokens. Wubs cannot be bought.

“No ads”. The game receives proof of purchase from Google Play and keeps it on your phone; it checks it again with Google Play at each launch, which brings it back on another phone with the same Google Play account (and removes it after a refund). The two largest VIP token packs also give “no ads”: it is then recorded in your game state, on the server (see “Progression, wubs and shop”), and follows your Zip Zop account.

VIP token packs (from 1 to 28 tokens, and a one-time welcome offer: 3 tokens and an emblem) require an account. The purchase carries a masked account identifier — the SHA-256 hash of your account’s identifier —, so that it cannot be credited to another account. The purchase token that Google Play hands over is sent to our server (Cloud Functions, europe-west1 region), which checks it with the Google Play Developer API, credits the VIP tokens only once and keeps a record of the purchase: the SHA-256 hash of the purchase token, the purchase token itself, your account’s identifier, the product, the number of VIP tokens credited, the Google order number and the date. This record stays so that a purchase is never credited twice, so that the purchase can be completed with Google Play (“consumed”) if that could not be done right away, and so that the tokens of a refunded or cancelled purchase can be taken back: every night, the server checks the list of cancelled purchases kept by Google Play (Voided Purchases API); the VIP tokens of such a purchase are removed from your token balance, which may then go below zero. When the account is deleted, the account identifier in it is replaced by “supprimé” (“deleted”).

Changes

If anything changes, the date at the top of this page is updated; the version in force is the one published on wub-lab.com, which the app opens from its Profile.