Privacy Policy

This policy covers the games and services published by Fourbound Games. It explains what our games collect, why, where it is kept, and how you can have it removed. If anything here is unclear, write to support@fourboundgames.com and a person will answer.

Who is responsible for your data

The data controller is [registered company name — to be filled before launch], [registered address — to be filled before launch]. Questions, requests and complaints all go to support@fourboundgames.com.

Our representative in the European Union for the purposes of Article 27 GDPR is [EU representative, GDPR Art. 27 — to be filled before launch]. Players in the EEA may contact the representative instead of us about anything in this policy.

The short version

We do not ask for your name, your email address, or your phone number to let you play, and we do not sell your data. What we store is your progress, what you have purchased, and technical information about crashes. The one thing that leaves for advertising is what an ad network needs to show you a rewarded ad — and only when you choose to watch one. You can switch personalised ads off and still earn the reward.

What we collect

• An anonymous account identifier. When you first open the game it signs in anonymously through Firebase Authentication and receives a random user ID. That ID is not linked to any personal account and is not derived from your name, email or phone number.
• Game progress. Your save data — depth reached, equipment, resources, settings — stored against that anonymous ID so your progress survives a reinstall or a new device.
• Purchase records and entitlements. If you buy something, we record which product was bought and what it granted you, together with the purchase token the store issues. Payment itself is handled by Apple or Google; we never see or store your card details.
• Crash and stability diagnostics. When the game crashes, Firebase Crashlytics sends us a report containing the error, the device model, the operating system version, the app version and an app-instance identifier that Google generates for the install.
• Your player name. The nickname and tag you choose when you start are stored with your save and, when you appear on the leaderboard, shown to other players. It is whatever you type — it does not have to be your real name.
• Gameplay analytics. Firebase Analytics records a small number of gameplay events — which map node was resolved, how a descent ended — together with the app-instance identifier, device model, operating system version and an approximate location derived from your IP address. We use it to see how the game is played, not to identify you.
• Device integrity signals. Firebase App Check asks Apple’s App Attest or Google’s Play Integrity to confirm the request came from a genuine, unmodified copy of our game. This is an anti-fraud measure and produces a short-lived token, not a profile.
• Advertising data, only when you watch a rewarded ad. Choosing “Watch & Earn” hands the ad network your device’s advertising identifier (Android Advertising ID or Apple IDFA), IP address, coarse device and app details, and whether the ad played through. It is used to select the ad, confirm you watched it so the reward is real, measure the ad and catch fraud. Decline the ad and none of it is sent.

The app-instance and installation identifiers above are device identifiers in the sense the app stores use in their data-safety disclosures, and we declare them there as such. They are reset when you reinstall the game.

What we do not collect

• Your contacts, photos, microphone, camera or precise location — and the ad network is given access to none of them either.
• An advertising profile of our own. We never join the ad network’s data to your save, your purchases or your account.
• Payment card numbers, bank details, or billing addresses.
• Anything you type outside the game.

Why we are allowed to hold it

Under the GDPR our lawful basis is performance of a contract (Art. 6(1)(b)) for save data, entitlements and purchases — without them the game cannot deliver what you asked for or paid for — and legitimate interests (Art. 6(1)(f)) for crash diagnostics and anti-fraud attestation, because a game that crashes or that can be trivially cheated is a worse product for everybody playing it. We have weighed those interests against your rights and use the least data that makes the measure work.

Personalised advertising is the exception: it runs on your consent (Art. 6(1)(a)) and never on legitimate interest. Before the first ad we ask — in the EEA, the UK and Switzerland through a Google-certified consent platform — and you can change or withdraw that answer at any time in Settings → Privacy. Withdrawing it does not take Watch & Earn away: you keep the reward, the ads simply stop being personalised.

Players in Türkiye are additionally covered by KVKK (Law No. 6698); see the Türkiye section below for the corresponding grounds.

Who else processes it

We keep the list short on purpose. Each of these acts as our processor under its own terms, on our instructions:

• Google Ireland Ltd. / Google LLC — Firebase Authentication, Cloud Firestore, Crashlytics and App Check, plus Firebase Hosting for this website. See Firebase privacy and security and the Google Privacy Policy.
• Google (Google Play) — processes your payment and tells us whether a purchase token is genuine. Google is the seller of record for Android purchases.
• Apple Inc. / Apple Distribution International — processes your payment and device attestation on iOS. Apple is the seller of record for App Store purchases. See the Apple Privacy Policy.
• Unity Technologies — the game engine and its in-app purchase module send Unity purchase and diagnostic events (which product, which store, device model, an installation identifier). See the Unity player privacy policy.
• Google AdMob (Google Mobile Ads SDK) — serves rewarded ads and measures them. For advertising the network acts as an independent controller of the data it collects, not merely on our instructions, which is why it is named here with its own policy.

We do not sell personal data, and we do not disclose it to anyone else except where the law requires it or to establish or defend a legal claim.

Advertising — Watch & Earn

Our games carry no banners and no ads that interrupt play. The only advertising is Watch & Earn: a rewarded video you start yourself, in exchange for something in the game. Nothing in the game is gated behind watching one, and declining costs you nothing but the reward.

The ads are served and measured by Google AdMob (Google Mobile Ads SDK). When you start one, the data listed above under “What we collect” goes to that network.

Turning personalised ads off. You keep Watch & Earn either way — the ads just stop being tailored to you:

• In the game: Settings → Privacy → Ad preferences. In the EEA, the UK and Switzerland this reopens the consent form, and withdrawing consent takes effect from that moment.
• Android: Settings → Google → Ads → Delete advertising ID, or Opt out of Ads Personalisation. Deleting the ID stops apps receiving it at all.
• iOS: Settings → Privacy & Security → Tracking, and turn our game off. iOS also asks you directly the first time, through Apple’s App Tracking Transparency prompt; if you decline there, no tracking identifier is ever shared.

We do not choose which particular ad you see, and we do not receive a copy of the profile the network holds. Complaints about the content of an ad are best sent to the network, but tell us as well at support@fourboundgames.com — we can stop a category or drop a network entirely.

Where it is stored, and transfers abroad

Save data and entitlements live in Google Cloud Firestore in the europe-west3 (Frankfurt, Germany) region, and the functions that write them run in the same region. Crash reports are processed by Firebase Crashlytics. Purchase verification calls go to Apple’s and Google’s own store APIs.

Some processing by those providers happens outside the EEA, including in the United States. Those transfers rely on the European Commission’s Standard Contractual Clauses, and where applicable on the EU–US Data Privacy Framework, as set out in Google’s and Apple’s own terms.

How long we keep it

• Save data and entitlements — for as long as the account is in use, and erased when you ask us to erase them.
• Crash reports — retained by Crashlytics on Google’s schedule, currently 90 days for an individual crash record.
• Purchase records — our own ledger (which product, which store token, what it granted) lives as long as your account and is erased with it. The transaction itself is recorded by Apple or Google under their rules; that is where refunds and tax records live, and we cannot shorten their retention.

How we protect it

The measures below are the ones actually in place, not a wish list:

• Everything travels over TLS. There is no unencrypted path between the game and the backend.
• Data at rest is encrypted by Google Cloud at the storage layer.
• Firestore security rules restrict every document to the anonymous account that owns it. Entitlements are readable by their owner and writable only by our server-side functions, so a modified client cannot grant itself anything.
• Firebase App Check is enforced at the API layer, so a request that does not come from a genuine, unmodified install of our game is refused — a stolen API key on its own reaches nothing.
• Purchases are verified server-side against the store’s own API before anything is granted.
• Administrative access to the backend is limited to the studio and protected by two-factor authentication.

No system is perfect. If a breach ever puts your rights at risk we will notify the competent supervisory authority within 72 hours as Article 33 GDPR requires, and tell affected players directly where Article 34 requires it.

Deleting your data

The game can delete your data from inside itself: open Settings → Delete Account. That erases your save and your anonymous account. It cannot be undone, and it does not refund purchases — refunds are handled by Apple or Google, not by us.

You can also request deletion from the web, without installing anything: see Delete your data. Because we hold nothing that identifies you personally, we need the player name and tag you chose in the game (shown on the leaderboard as NAME#1234) and, if you bought something, the store order number to find your record — that is a consequence of not collecting your name in the first place, and we would rather keep it that way.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider in a portable form. Write to support@fourboundgames.com. We answer within 30 days and we do not charge for it.

If we get it wrong you can complain to a supervisory authority: the Kişisel Verileri Koruma Kurumu in Türkiye, your national data protection authority in the EEA, the ANPD in Brazil, or the Information Commissioner’s Office in the United Kingdom.

Türkiye — KVKK aydınlatma

For players resident in Türkiye, this section is our notice under Article 10 of Law No. 6698 (KVKK). The data controller is [registered company name — to be filled before launch], [registered address — to be filled before launch].

• Which data. The anonymous account identifier, save data, your chosen player name and gameplay analytics events, entitlement and purchase records, and crash diagnostics described above.
• Purposes. Running the game, keeping your progress across devices, delivering and verifying what you buy, and preventing fraud and abuse.
• Method and legal ground. Collected automatically through the game over an encrypted connection. Processed under Art. 5/2(c) — necessary for the performance of a contract — and Art. 5/2(f) — our legitimate interests, balanced against your fundamental rights.
• Recipients. Our service providers named above, abroad, for hosting, crash reporting, payment verification, advertising (only when you watch a rewarded ad) and game-engine diagnostics. Transfers abroad are made on the grounds permitted by Art. 9 KVKK.
• Your rights. Article 11 gives you the right to learn whether your data is processed, to request information and the purpose, to know the third parties it goes to, to have it corrected or deleted, to object to a result produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing.

United States — state privacy rights

We do not sell personal information for money. We do, however, share it for cross-context behavioural advertising in the sense California gives that word, and personalised ads count as targeted advertising under the Colorado, Connecticut and Virginia laws — because serving you a tailored rewarded ad passes your advertising identifier to the network.

To opt out of sharing / targeted advertising: open Settings → Privacy → Ad preferences in the game, or write to support@fourboundgames.com with “Do not sell or share my personal information” in the subject. Opting out does not remove Watch & Earn and does not reduce your rewards; the ads simply stop being personalised. We honour a browser Global Privacy Control signal on this website as an opt-out too.

If you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you may request access to, correction of, or deletion of your personal information, and you will not be treated differently for asking. Use the same address, support@fourboundgames.com, or the deletion page.

Children

Our games are not directed at children under 13, are not listed in any store’s children or family programme, and we do not knowingly collect data from children. If you believe a child has provided us with data, write to us and we will delete it.

Where we have any reason to believe a player is a child, the ad request is flagged as child-directed, which stops the network serving a personalised ad or using an advertising identifier regardless of any consent it holds.

This website

This site is static. It sets no cookies, runs no analytics, embeds no third-party scripts, fonts or images, and stores nothing about you — there is nothing here to consent to. Firebase Hosting keeps standard server request logs, which include IP addresses, for security and troubleshooting.

Changes

If we change this policy we will update the date at the top, and we will say so in the game’s release notes when the change is material.