Privacy policy

1. Information stored by the game

The app saves campaign progress, best scores, coins, owned and selected skins, daily challenge results, reward records and timing, and settings on your device. These records make the game work, preserve rewards, and enforce reward limits. We do not operate a server that receives a copy of your local game save.

The game does not require a separate Spiral Shores account. It does not request your contacts, photos, microphone, or precise location. Device backups may include app data according to your Apple settings. Deleting the app can remove local saves; offloading it may preserve them, and backups or records held by service providers are separate.

2. Gameplay analytics and region check

After you opt in, the app fetches a US eligibility value from Google Firebase Remote Config. Firebase can infer country from the request IP address or, if shared with Firebase, Analytics country information. Remote Config uses a Firebase installation identifier to serve the value. We do not receive or store the IP address or installation identifier in our own database. The app reuses a country result in memory for up to one hour and refreshes it on the next foreground entry after expiry. A full app relaunch starts with a new check. Failed checks keep collection paused and can be retried on a foreground entry after five minutes. An in-progress check is shared across brief foreground transitions. Checks run only while your analytics permission is enabled; an already-started request may finish after you turn it off, but its result cannot restart collection. Before you opt in, or after you turn it off, the app does not make this analytics eligibility request. If that request fails, is throttled, or does not confirm the US, Firebase Analytics stays off. This check does not request precise location permission. Separately, the app fetches a global ad-availability switch from Remote Config on launch, including when Gameplay Analytics is off. This request also uses a Firebase installation identifier. If the switch cannot be fetched or is off, the app does not start ad requests.

When you first open the app without a saved analytics choice, a full-screen prompt asks whether you want to share optional gameplay analytics. You can choose “Share Analytics” or “Don’t Share” and read more through the privacy policy link. The app saves your choice. Analytics stays off unless you choose to share. Later, the Gameplay Analytics switch in Settings > Privacy enables or disables the same collection directly, without repeating the prompt. Google Firebase Analytics starts only after opt-in and a confirmed US result. It helps us understand and improve the game. Choosing not to share does not affect gameplay, coins, or ads. It automatically measures app sessions and engagement and uses an app-instance identifier. Google may process app version, device and operating-system details, language, event timestamps, and approximate location derived from the network IP address. Our events describe level starts and completions, deaths and ring reached, daily completions, play time, result and revive choices, shop opens, skin selections and purchases, coarse coin-balance ranges, and rewarded-ad requests, displays, rewards, failures, and cancellations. We do not send a name, email, account ID, precise location, free-text entry, raw game save, or per-run identifier.

We use these events for internal gameplay and reward analysis. The Firebase integration does not request the advertising identifier, collect the vendor identifier, or use these events for personalized advertising. We do not link the Analytics property to AdMob. Gameplay Analytics is separate from ad privacy choices. In Settings > Privacy, you can turn Gameplay Analytics off at any time; this stops new collection and resets its identifier on your device. Previously uploaded data and aggregate reports are not erased by that switch. Google processes Analytics data under its Privacy Policy and partner-app explanation.

3. Advertising and ad choices

The game integrates Google AdMob for a shop banner, optional rewarded ads such as extra coins or an extra life, and occasional ads between campaign levels. Ad availability varies. Google’s SDK may process IP addresses and approximate location, device or app identifiers, ad impressions and interactions, diagnostic and performance information, and privacy choices to deliver and measure ads, maintain security, and prevent fraud. Test ads can also involve communication with Google.

Our integration requests non-personalized ads, disables publisher first-party ID and publisher personalization, and does not request Apple’s App Tracking Transparency permission. Ads remain non-personalized regardless of your ad privacy choices. Non-personalized ads can still involve data processing for delivery, measurement, and fraud prevention.

We use Google’s consent system to offer regional choices, including US opt-out choices and European consent controls. Google’s ad SDK reads the resulting privacy signals to apply applicable data-processing restrictions, rather than the game forcing restricted processing for every player. AdMob can also send ad requests to third-party advertising partners that compete to provide ads. Even for non-personalized ads, those requests may include contextual information such as approximate location, a truncated IP address, and device or browser information. Google says it removes advertising identifiers and certain other user identifiers from non-personalized bid requests. See Google’s explanation of non-personalized requests to third-party bidders. This does not mean that no data is collected or disclosed, and Google’s restricted processing commitments do not automatically cover those partners’ handling of data.

When ad features are active, Google’s User Messaging Platform checks whether a privacy message is required before ad requests are allowed. Where applicable, you can revisit your choices through Settings > Privacy > Ad Privacy Choices. The game remains playable when ads are unavailable. Read Google’s Privacy Policy and how Google uses information from partner apps.

4. Support email and this website

When you email support, we receive your email address, message, and any information or attachments you choose to send. We use these to respond, investigate problems, and handle privacy requests. The dedicated support mailbox is hosted by Google Gmail; Google processes email under its own privacy policy. Please share only what is needed to explain the issue.

The website is hosted using Amazon Web Services, including CloudFront and S3. Requests necessarily involve network information such as your IP address and the page requested so the site can be delivered and secured. We have not enabled visitor access logs or installed website analytics, advertising scripts, tracking pixels, or cookies. See the AWS Privacy Notice for AWS’s own practices.

5. Providers, purposes, sharing, and retention

The third-party services used by the current app and website are:

• Google Firebase Remote Config and Installations: a US eligibility check after analytics opt-in, and an independent ad-availability check even when Gameplay Analytics is off.
• Google Firebase Analytics: optional gameplay and engagement measurement after explicit opt-in for confirmed US connections, with an in-app off switch.
• Google Mobile Ads, User Messaging Platform, and participating ad partners: ad delivery and ad privacy choices when the app is allowed to request ads. Google may pass non-personalized bid requests to third-party buyers. Google’s processing is described in Google’s Privacy Policy and Google’s partner-app explanation.
• Google Gmail: hosting for the developer’s support mailbox.
• Amazon Web Services: CloudFront and S3 hosting and delivery for this website.

We use information to provide the game and requested services, improve the game through optional gameplay analytics with your consent for confirmed US connections, deliver ad features when enabled, respond to support, maintain security, and meet legal obligations. Depending on your location and the processing involved, the applicable legal basis may be providing a requested service, consent, legitimate interests such as support and security, or a legal obligation. Where consent is required, it must be obtained before the relevant optional processing.

Information is handled by the providers described above for those services. We do not sell your support correspondence or local game saves, and we do not use them for cross-context behavioral advertising. Advertising-related processing may have specific legal definitions under regional privacy laws; Google may receive ad-related network, device, impression, interaction, diagnostic, and privacy-choice information when ad features operate. Applicable ad privacy choices are provided when those features operate. We may disclose information when required by law or reasonably necessary to protect users, rights, and security.

Local game records remain until removed from the device or replaced during play. We normally delete support correspondence within 12 months after our last exchange. We may keep a specific message longer when needed for an unresolved request, a legal obligation, or a dispute, then delete it when that need ends. Providers retain information under their own policies and controls. Disabling a feature does not automatically delete information previously received by its provider.

6. Security and international processing

We use reasonable administrative, technical, and organizational safeguards appropriate to the information we handle. The website is delivered over HTTPS from a private, encrypted S3 bucket through CloudFront. Support email is hosted by Gmail. No method of transmission or storage is completely secure, and provider security practices are governed by the providers’ own policies.

Google, Apple, and AWS may process information in countries other than your own, including the United States. Their privacy notices explain their international processing and applicable safeguards.

7. Your choices and privacy requests

Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, restrict or object to certain processing, withdraw consent, or complain to your local data protection authority. Where applicable, you may also have the right to know whether information is sold or shared, opt out of sale, sharing, or targeted advertising, appeal a denied request, or use an authorized agent. Withdrawing consent does not affect processing that lawfully took place beforehand.

Contact zachmarks.support@gmail.com with “Privacy request” in the subject. Describe the request and relevant service without sending passwords or unnecessary sensitive documents. We may need proportionate information to verify that a request concerns you. We will respond within applicable legal time limits and explain any limitation, including where data is controlled by Apple or Google and must be managed through their tools.

You can review, enable, or turn Gameplay Analytics off in Settings > Privacy, revisit ad privacy choices when available in the app, and remove local game data by deleting the app. Turning off Gameplay Analytics does not stop the separate Remote Config check for ad availability. We cannot restore a deleted local save from a developer-operated cloud backup. Your Apple backups and provider-held information need to be managed separately. If you disagree with our response where an appeal process applies, include “Privacy appeal” in a follow-up message and we will review it.

8. Children

Spiral Shores is a general-audience casual game and is not specifically directed to children under 13. The game does not use an age gate. An App Store content rating describes content suitability and does not establish an audience age or change this intended audience. We do not knowingly collect personal information from children under 13 through support. Additional protections may apply to minors under local law. If you believe a child has provided personal information to us, contact us so we can investigate and take appropriate action.

9. Updates and contact

We may update this policy when the game, its services, or legal requirements change. The date above identifies the latest revision. Material changes will be communicated as required, and any newly required consent will be obtained before the affected processing begins.

Developer and privacy contact: Zachary Marks
zachmarks.support@gmail.com