Privacy overview
Understand the personal data collected by Leaderboards and your responsibilities under privacy regulations.
Read time 3 minutesLast updated 7 months ago
The Leaderboards service enables game developers to provide ranking of scores to their players. This includes (or will include) a number of specific applications, such as providing a top scorer list, showing scores around a player and player rank, resetting leaderboards (e.g. weekly leaderboards), or tiered/bucketed leaderboards.
Personal data collected
Personal data collected about app users/game-players.
Personal data which is always collected in order for product to work:
- Unity Player ID
- IP Address
Developer defines
While this product allows for the collection of developer defined data, we require that you not collect personal data through this mechanism. Our systems will not understand that it is personal data and so such would not be treated as such in retention processes or data subject requests.
Relationship under privacy laws
Under GDPR, Unity is the Processor. You, the developer, are an Independent Controller.
Under CCPA (as modified by CPRA), Unity is the Service Provider. You, the developer, are the Business.
Legal basis for processing
As we are a Processor, we do not determine your legal basis for processing. Instead, it is your responsibility as the Controller to determine such a legal basis.
Consent (opt in) vs opt out
This product does not have a consent service. If the Developer determines they need to obtain consent, or provide an opt-out, they should do so within their application.
Data subject requests
Two of the most common data subject requests based in law are the request for access to personal data and the request for deletion of personal data.
Access
This service has no native functionality to support data access requests. You, the developer, are responsible for actioning them.
You can action them by using the documented SDK or REST API functions for the Leaderboards service:
- https://services.docs.unity.com/leaderboards/v1/index.html
- https://services.docs.unity.com/leaderboards-admin/v1/index.html
Deletion
This service has native functionality to support data deletion requests.
This can be done using the Leaderboards Admin API:
https://services.docs.unity.com/leaderboards-admin/v1/index.html#tag/Leaderboards/operation/deleteLeaderboardPlayerScoreAllLeaderboards
Please note: this functionality only applies to this service. If you are using other services which collect app user personal data you will need to review that service's documentation for how it handles data deletion requests. To delete the Player ID created by the Unity Authentication SDK, please use the Authentication API.
Dependencies
This product is dependent on the Unity Authentication service. By using this product, you will also be using the Unity Authentication service and you should refer to the Unity Authentication SDK documentation for more information.
Data retention
By default, personal data is retained indefinitely – or until a Leaderboard is reset, at which point it will be discarded or archived if archives are enabled. If archives are enabled it will be retained indefinitely.
Child privacy
This service is not intended to be used in applications with child users, unless you, the developer, have obtained Verified Parental Consent where required as outlined in the Unity Terms of Service.
Privacy policy requirements
It is never appropriate to use Unity’s privacy policy for your application. You will need to ensure that the personal data practices are reflected in your own privacy policy.
Additionally, you will need to link out to our Privacy Policy from within your own, as required in the Unity Terms of Service.
Data processing agreement (DPA)
The Unity DPA applies to the transfer of data for this product.
Glossary & notable laws
- GDPR - The General Data Protection Regulation (GDPR) took effect in the European Economic Area (EEA). References to GDPR also encompass UK GDPR which is the UK’s version of GDPR which applies post-Brexit.
- CCPA - The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (“CPRA”).
- PIPL - In November of 2021, Personal Information Protection Law (PIPL) took effect in China.
- LGPD - The Brazilian General Data Protection Law
- VCDPA - The Virginia Consumer Data Protection Act
- CPA - The Colorado Privacy Act
- CTDPA - The Connecticut Data Protection Act
- UCPA - The Utah Consumer Privacy Act
- PIPEDA - The Canadian Personal Information Protection and Electronic Documents Act
- COPPA - The Children’s Online Privacy Protection Act (COPPA) imposes restrictions on how data can be collected and used from children under the age of 13.
- CARU - A self-regulatory organization for the promotion of responsible privacy practices to children under the age of 13
- DPA - A Data Processing Addendum (or Data Processing Agreement) forms part of a contract and governs the rights and obligations of each party concerning the processing of personal data.
- ATT - iOS 14 and later requires publishers to obtain permission to track the user's device across applications. This device setting is called App Tracking Transparency, or ATT.