Account data — username, e-mail address, password (stored hashed). Legal basis: performance of contract, Art. 6(1)(b) GDPR.
Game data — match results, scores, game types, dates and the players involved. Legal basis: Art. 6(1)(b) GDPR — it's the entire point of the app.
Social data — friend connections and invite links. Your match results, win rates and rankings are visible to the friends you play with. That's how a leaderboard works; if you don't want a result shared, don't log it.
Technical data — IP address, device type, OS version, crash logs. Legal basis: legitimate interest in a working, secure app, Art. 6(1)(f) GDPR.
Analytics — currently: none. If we ever add usage analytics, we'll ask for consent first (Art. 6(1)(a) GDPR).