Privacy Policy

Version 1.2 · Last updated 8 October 2026

1. Who is responsible for your data

Arrows In! (the “Game”) is developed and published by Dariia Tieriekhova, an independent developer based in Ukraine (“we”, “us”). Depending on which law applies to you, we are the data controller, business, personal information handler or responsible party for the processing described here.

Contact for any privacy question or request: tieriekhova.dariia@gmail.com. A postal address is available on request. Please write in English or Ukrainian.

This policy covers the Arrows In! mobile app for iOS and Android (bundle and package identifier com.arrowsin.game). It does not cover the app stores themselves, or any website you reach by leaving the Game.

2. One standard, everywhere

Privacy laws differ by country, and a game sold worldwide could try to give each player only the minimum its local law demands. We do the opposite: the protections in this policy apply to every player, in every country, whichever law you happen to live under. Where a specific law gives you more than this policy does, that law wins; section 11 lists what it adds in the largest regions. Where your country is not mentioned at all, the rest of this policy still applies to you in full, and the same contact address works.

In practice this is easier for us than for most apps, because the Game holds almost nothing about you: there is no account to breach, no password to leak and no profile to sell.

3. Data that stays on your device

The Game keeps one save record in the app’s private storage on your device. It contains:

• which levels you have completed, your best number of moves, and which gold marks and crowns you have earned;
• any unfinished level, so you can leave the Game and come back to it;
• your settings: vibration, light or dark appearance, and the board theme you selected;
• what you own and how much of it: the “No ads” purchase, purchased themes, your crown balance, levels unlocked with crowns or by watching an ad, and your stock of hints and undo refills;
• whether you have finished the tutorial.

This record never leaves your device: we do not upload it, we cannot read it, and there is no cloud save in the Game. It is deleted when you uninstall the Game or, on Android, clear the Game’s storage in your device settings. On Android, the system’s own backup feature may include app data in your Google account backup; that copy is governed by Google’s privacy policy and controlled by your device settings, not by us.

4. Data collected by the services we use

We have no servers. Everything the Game sends out goes to one of the providers below, each acting under its own privacy policy. We receive only aggregated reports, never a list of identifiable players.

4.1 Advertising — Google AdMob

The Game shows rewarded video ads, which you choose to watch in exchange for a hint, an undo refill, early access to a hard level or replaying a level you have already completed. It also shows interstitial ads: occasionally after you tap Next on the victory screen, from level 20 onwards, and after you restart a level. Interstitials are never shown during your first session, never more often than once every two minutes, and never in the Extreme section.

To serve and measure those ads, Google AdMob may process: your device’s advertising identifier (IDFA on iOS, Advertising ID on Android), IP address, from which an approximate location such as country or city is derived, device and operating system details, language and region, and interaction data about the ads shown, such as impressions, clicks and whether a video was watched to the end. AdMob also stores how recently an ad was shown so we can limit their frequency.

Whether ads are personalised depends on your choice:

• Where consent is required by law — the European Economic Area, the United Kingdom, Switzerland, and other countries whose rules Google’s consent framework covers — the Game asks on first launch, through Google’s consent dialog, before any advertising or statistics begin. If you decline, ads are limited to non-personalised ads, which still need basic data such as IP address and device information in order to be delivered and to prevent fraud.
• On iOS, personalised advertising additionally requires your permission in the system’s App Tracking Transparency prompt. If you decline, the advertising identifier is not used for tracking, whatever else you have agreed to.
• Everywhere else, you can turn off ad personalisation at any time in your device settings, and where local law gives you an opt-out from the sharing of your data for advertising, exercising it instructs Google to restrict how it processes data from your device.

See Google’s Privacy Policy and how Google uses data from AdMob apps.

4.2 Usage statistics — Google Firebase Analytics

We use Firebase Analytics to understand how the Game is played, so we can fix what is too hard, too slow or too confusing. It works with a randomly generated app instance identifier, not with your identity. The events we record are, typically: the tutorial being started and finished; a level being opened, completed or abandoned, together with a summary of that attempt such as the number of moves, the time taken, how many hints and undos were used and whether a crown was earned; hints and undo refills being used; ads being offered, shown, skipped or blocked; screens of the collection and the shop being opened; purchases succeeding, being cancelled or failing; and settings being changed. Alongside events we store coarse properties of the player: which stage of the campaign you have reached, as a range rather than an exact number, whether you own “No ads”, whether you have ever purchased, your selected theme and appearance, and your consent status.

We do not send your name, email address, phone number, contacts, precise location, or the content of anything you type — the Game has no text input at all.

4.3 Crash reports — Google Firebase Crashlytics

If the Game crashes or hits a handled error, for example a save file it cannot read, Crashlytics receives a technical report: the error and its stack trace, the device model, operating system version, app version, available memory and storage, and a random installation identifier. We use it only to fix defects.

4.4 Configuration and experiments — Firebase Remote Config and A/B Testing

Some numbers in the Game — the contents and prices of shop packs, the reward ladder, the undo allowance — can be adjusted without releasing a new version, and sometimes we compare two variants to see which works better. This uses the same app instance identifier to keep your assignment stable, and adds no new category of data.

4.5 Payments — Apple App Store and Google Play

All purchases are processed by Apple or Google, depending on where you installed the Game. We never see or handle your payment details. From the store we receive confirmation that a purchase succeeded, the product identifier, and the list of your past non-consumable purchases of this Game, so that the “Restore purchases” button and our returning-player discounts can work. Your purchase history in this Game also determines which price level and offers you are shown; section 11.1 explains what that means and what it does not.

To check that each purchase is genuine and to restore one-time purchases after a reinstall, the Game uses RevenueCat (RevenueCat, Inc.), which acts as our processor. RevenueCat receives a random identifier it creates for this installation of the Game, the store’s purchase token and transaction details (product, price, currency, store country, dates), your device type, operating system and app version, and the request’s IP address. It never receives your payment details, name or email. See the RevenueCat Privacy Policy.

See Apple’s Privacy Policy and Google’s Privacy Policy.

4.6 Over-the-air updates — Expo

The Game may check for small over-the-air updates to its non-native code. When it does, it asks the update service, operated by Expo, whether a newer bundle exists, sending the platform, the app version and the runtime version; the service sees the request’s IP address. No game data is sent. See the Expo Privacy Policy.

5. What we never collect

• No account, sign-in, name, email address, phone number or date of birth.
• No contacts, calendar, photos, files, microphone, camera or precise (GPS) location. The Game requests none of these permissions.
• No health, financial, biometric, genetic, religious, political or sexual-orientation data, and no messages — the Game has no chat, no profiles and no social features. In the language of several privacy laws: we process no sensitive or special-category personal data at all.
• No tracking across other companies’ apps beyond the advertising described in section 4.1, which you control.
• We do not sell personal data for money, and we do not use it to build profiles outside the advertising described above.

6. Why we process data, and on what basis

Under the EU and UK GDPR, the bases above are Art. 6(1)(a) consent, Art. 6(1)(b) contract and Art. 6(1)(f) legitimate interests. The Game stays fully playable if you refuse everything that asks for consent; you will still see non-personalised ads, because they pay for the Game; “No ads” removes the interstitial ones.

7. Your choices

• In the Game: open Settings, the gear icon in the collection, and choose Privacy options to open the consent dialog again and change or withdraw your consent. This entry appears wherever the dialog applies to you.
• iOS: Settings → Privacy & Security → Tracking turns app tracking on or off for the Game.
• Android: Settings → Privacy → Ads lets you delete or reset your advertising ID and opt out of ad personalisation.
• Across your Google account: adssettings.google.com.
• Stop interstitial ads: the one-time “No ads” purchase removes all interstitial ads and opens hard levels and replays without a video. Rewarded videos stay available if you choose to watch one for a hint or an undo refill. Usage statistics and crash reports are unaffected by that purchase and remain governed by your consent.
• Erase what is on your device: uninstall the Game, or on Android clear its storage in Settings → Apps → Arrows In! → Storage. How to ask for the rest to be deleted is explained on our data deletion page.
• Anything else: write to tieriekhova.dariia@gmail.com. We do not charge for requests and we do not make you create an account to make one.

8. How long data is kept

• On your device: until you uninstall the Game or clear its storage.
• Analytics events: retained by Google for the period we configure in Firebase, currently up to 14 months, after which they are deleted or kept only in aggregate form.
• Crash reports: retained by Crashlytics for up to 90 days.
• Advertising data: retained by Google according to its own policies and your ad settings.
• Purchase records: kept by Apple or Google for as long as their terms and tax law require. RevenueCat keeps a copy linked to the random installation identifier, on our behalf, for as long as it is needed to verify and restore purchases and for our accounting; we delete it on request where the law allows.
• Support emails: up to two years, then deleted.

9. Where data goes

Google, Apple, RevenueCat and Expo process data on servers in the United States and other countries, so data about your use of the Game will usually leave your own country. Where data is transferred out of the EEA, the UK or Switzerland, those providers rely on the European Commission’s standard contractual clauses and, where applicable, on the EU-US, UK-US and Swiss-US Data Privacy Frameworks. For transfers governed by other laws — Brazil, Canada, Australia, Japan, Korea, South Africa and others — those providers apply the safeguards their own policies describe. We transfer nothing ourselves, because we receive no personal data to transfer.

10. Rights you have wherever you live

Whatever your country, and without needing to quote a law at us, you may:

• ask what data about your use of the Game exists and receive a copy of it;
• ask for it to be corrected or deleted;
• withdraw a consent you previously gave, and object to processing based on our legitimate interests;
• opt out of personalised advertising, and of the sharing of your data for advertising;
• ask a human to look at your request, and complain to us and to your local privacy regulator if you are unhappy with the answer.

We answer within 30 days, or sooner where your law requires it, and we never charge for a first request or treat you differently for making one.

One honest limitation. Because there are no accounts, the data described in section 4 is pseudonymous, and we normally cannot connect it to you as a person; we will not collect extra identifying data just to search for you. That is a privacy benefit, but it means “show me my data” may have no answer beyond this policy. What always works: uninstalling the Game, or clearing its storage on Android, erases everything on your device, withdrawing consent stops future collection, and resetting the advertising identifier in your device settings breaks the link between past ad data and your device.

11. Regional supplements

11.1 European Economic Area, United Kingdom and Switzerland

You have the rights in Articles 15–22 of the GDPR (and the equivalent provisions of the UK GDPR and the Swiss FADP): access, rectification, erasure, restriction, objection, portability, and withdrawal of consent without affecting the lawfulness of earlier processing. Consent for advertising and statistics is collected through the dialog described in section 4.1, together with the IAB Transparency and Consent Framework signals that Google’s dialog generates, and it is also recorded as a property in our statistics so that we can prove what was agreed.

You may lodge a complaint with the supervisory authority of your country of residence, work or of the alleged infringement. Lists are published by the European Data Protection Board, the UK Information Commissioner’s Office and the Swiss FDPIC. We have not appointed an Article 27 representative in the Union or the UK: as a one-person developer whose processing is occasional, pseudonymous and low-risk, we rely on the exemption in Art. 27(2) GDPR, and we answer requests directly at the address in section 1.

Automated decisions and pricing. The prices and special offers you see in the shop depend on your own purchase history in the Game, and we run experiments comparing price levels, so two players may be shown different prices for the same pack. That is automated, and we tell you plainly because EU consumer law requires it. It is not a decision producing legal or similarly significant effects within the meaning of Art. 22 GDPR: nothing is denied to you, the Game is playable without buying anything, and the exact price is always shown by the store before you confirm. We do not profile you for any other purpose.

11.2 United States

This section applies if you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive consumer privacy law.

We collect no sensitive personal information, and we do not use or disclose any for purposes that would require a right to limit. We do not sell personal information for money. When personalised ads are on, sharing identifiers with Google for cross-context behavioural advertising may count as a “sale” or “sharing” under these laws; you may opt out at any time through the choices in section 7, and we honour an opt-out preference signal such as Global Privacy Control where one reaches us. We do not knowingly sell or share the personal information of anyone under 16. You may also use an authorised agent, and, in California, request the disclosure in Civil Code §1798.83 (“Shine the Light”). We never retaliate against a player who exercises a right, and none of our offers is a financial incentive in exchange for data. Requests go to the address in section 1; if we cannot verify a request, because there is no account to verify it against, we will tell you and explain what you can do instead.

11.3 Other regions

12. Children

Arrows In! is a general-audience puzzle game. It is not directed to children, it is not listed in any store’s children’s category, and we do not knowingly collect personal data from a child under 13, or under the age of consent in your country, which is up to 16 in parts of the EEA and 18 under some other laws. We do not ask your age, because asking would mean collecting more data than we need; instead we keep the Game free of anything that targets children. If you are a parent or guardian and believe a child has provided personal data through the Game, write to us and we will delete what we can, and tell you honestly what is beyond our reach.

13. Security

The save record sits in the app’s private storage, which the operating system protects from other apps. Everything the Game sends to the services above travels over encrypted connections. No method is perfect, but the risk here is limited by design: we hold no accounts, no passwords and no payment data. If a breach ever affects you, we will notify you and the relevant authority as the applicable law requires.

14. Changes to this policy

If we add a service, collect a new category of data or change a purpose, we will update this page and the date at the top and, where the law requires it, ask for your consent again. Material changes will also be noted in the store release notes. The current version always lives at this address.

15. Contact

Dariia Tieriekhova · tieriekhova.dariia@gmail.com