Six of the most-played mobile games in the world, played by more than 100 million people every month, route real-time voice chat through a multimedia SDK owned by Supercell's own majority shareholder, a company legally bound to cooperate with Chinese state authorities, with no safeguard in place for that transfer. The same six games also silently link a player's activity, spending and social connections across all of them into a single behavioral profile that is never disclosed as a distinct purpose. Nine attempts over nearly four months to reach the company's own dedicated privacy, data-protection and legal contacts drew only automated helpdesk replies, twice closing the matter as an already-resolved support ticket, and never a single human response.
com.supercell.clashofclans + Clash Royale + Brawl Stars + Boom Beach + Hay Day + Squad Busters. Supercell Oy (Helsinki, FI), majority-owned by Tencent. 100M+ MAU. 4 findings (2C+1H+1M), case closed and published 2026-10-17, 25 days after the 2026-09-22 embargo (RFI-IRFOS's own R1 and its own 9-minutes-later follow-up stated two different embargo dates, 2026-09-22 and 2026-09-19; the later date governs per RFI-IRFOS's own rule). C1: Tencent GME, the majority shareholder's own voice/multimedia SDK, embedded in all six titles (177-353 classes each), routing real-time voice audio, device identifiers and session metadata to a PRC entity bound by China's state-cooperation law, no Art. 44 safeguard, no SCC identified. C2: Supercell ID, a shared content-provider permission declared identically across all six titles, silently linking play frequency, spending and social-graph data into one cross-game behavioral profile never disclosed as its own processing purpose. H1: Hay Day and Boom Beach, rated Everyone and Teen, carry a disproportionate advertising-mediation SDK stack (IronSource, Facebook SDK, Unity Ads, AppLovin, Vungle) not individually named as recipients in either app's privacy policy. M1: allowBackup=true + hardcoded Firebase credentials across all six titles, local backup extraction via ADB or physical access. Nine messages sent across 116 days to privacy@/dpo@/legal@supercell.com; seven automated Helpshift responses, including two premature auto-closures of the disclosure as a resolved support ticket; one bounce (info@cert.at). No acknowledgment, no denial, no substantive reply ever came from any named person at Supercell.
click to expand