Elephant Pop! Privacy Policy

1. Who we are, and what this covers

This Privacy Policy (the "Policy") is issued by Cygnus Works LLC ("Cygnus Works", "we", "us" or "our"), which is the controller of the personal data described below.

It applies to the game Elephant Pop! (the "Game") in every form we publish it: the Android application (com.cygnusworks.elephantpop), the browser version, and this website (together, the "Services"). "You" means the person using them.

Anything you reach by following a link away from the Services is somebody else's site, run under somebody else's policy. This one stops at our boundary.

2. Data stored on your own device

Your progress, meaning level completion, coins, upgrades, unlocked skins, charms, records, daily challenge state and settings, is written to storage on the device you are playing on. On Android that is the application's private storage; in a browser it is local storage. It is held under the key elephantpop.save.v1.

That data stays there. It is not transmitted to us. We do not receive it, hold it, back it up, or have any means of reading it. Deleting it is entirely within your control: clear the site data in your browser, or uninstall the application. Once it is gone we cannot restore it, for the simple reason that we never had a copy.

3. Permissions the Android application declares

The Game does not request, and cannot obtain, access to your location, contacts, camera, microphone, photos or files.

4. Advertising

The Game shows advertisements supplied by Google AdMob, a Google service. There are two kinds: a full-screen advertisement shown between levels, and an optional advertisement you choose to watch in exchange for an in-game reward. The second kind only ever runs because you asked for it.

To select and measure those advertisements, Google receives and processes information from your device. That includes your device's advertising identifier, your IP address, general device and operating system information, and data about how you interacted with an advertisement, such as whether it was shown, viewed or clicked. Google acts as an independent controller of that data and processes it under Google's own privacy policy, which we do not control and cannot vary. Google describes how it uses data in advertising products at policies.google.com/technologies/partner-sites.

We do not receive any of it. We are not given your advertising identifier, your IP address, or any per-person record of what you were shown. What reaches us from Google is aggregate reporting: totals and revenue, with no individual identified.

Your controls. The advertising identifier is designed to be under your control, and resetting it breaks the link between past and future advertising data:

• Reset or delete it in Android under Settings, then Privacy, then Ads. Deleting it causes apps to receive a string of zeros instead.
• Opt out of personalized advertising in the same place. Advertisements still appear; they are simply chosen without a profile.
• Remove advertising entirely by making the purchase described in section 5.

If you are in the European Economic Area, the United Kingdom or Switzerland, advertisements are limited to non-personalized advertising unless you have given consent through the consent prompt presented by the Game. Non-personalized advertisements still require limited data, including your IP address and coarse location derived from it, to serve an advertisement at all and to guard against fraud. You may change or withdraw your choice at any time from the Game's settings screen.

5. The in-app purchase

The Game offers one purchase, a one-off payment that permanently removes advertising. It is processed entirely by Google Play under Google's own terms and privacy policy.

We never receive your payment card details, your billing address, or your Google account credentials. The Game asks Google Play whether this device's Google account holds the purchase and shows the price Google Play reports for your country. That is the whole of the exchange.

Because the entitlement is held by your Google account rather than by us, it survives a reinstall or a new phone. The Restore option in the Game's settings asks Google Play to confirm it again. We could not restore it ourselves, because we have no record that you bought it.

6. Fonts and hosting

The Game loads its typeface from Google Fonts. As with any request made over the internet, Google receives your IP address and user-agent string in the ordinary course of serving that request. If the font cannot be fetched the Game falls back to a typeface already on your device and plays normally.

This website is served by our hosting provider and the content delivery network in front of it, which receive and may log requests, including your IP address, the file requested, the time and your user-agent string, to keep the site running and secure. We do not analyze those logs, build profiles from them, or combine them with anything else.

7. What we do not do

• No accounts, no sign-in, no email collection, no newsletter.
• No analytics, crash reporting, telemetry or session recording of our own.
• No advertising trackers besides the Google AdMob integration described in section 4.
• No cookies set by us, and no third-party tracking scripts on this website.
• No access to location, contacts, camera, microphone, photos or files.
• No server holding your progress, your scores or any record of your play.
• No sale of personal information, and no sharing of it for cross-context behavioral advertising, as those terms are defined under California law.

8. Retention

We operate no system that stores personal data from which you could be identified, so on our side there is nothing to retain. Google retains advertising and purchase data under its own retention schedules, which we do not control. Our hosting and content delivery providers keep their own request logs under their own schedules.

9. Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases. For personalized advertising: your consent, under Article 6(1)(a), given through the consent prompt and withdrawable at any time. For non-personalized advertising and for fraud prevention: our legitimate interests, under Article 6(1)(f), in funding a game distributed at no charge and in preventing advertising fraud. For processing the purchase: performance of a contract with you, under Article 6(1)(b). For operational logging: our legitimate interests in keeping the Services available and secure.

10. International transfers

Google processes advertising and purchase data on infrastructure that may sit outside the country you are playing from, under the transfer mechanisms set out in Google's own policy. We store no personal data ourselves, so no international transfer of stored personal data takes place on our side.

11. Security

This website and the Game's network requests are served over HTTPS. No system is perfectly secure, but the surface here is deliberately small: there is no database to breach, no credential store to steal, and no archive of player data to lose.

12. Children

The Game is not directed to children under 13, and we do not knowingly collect personal information from any person under 13, or under 16 where local law sets that threshold. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age, and we do not do so.

If you believe a child has provided personal information to us, contact us at section 15. In practice we hold nothing to delete, but we will act on any request concerning data held by Google on our behalf.

13. Your rights

Depending on where you live, you may hold rights under the EU or UK GDPR, the California Consumer Privacy Act as amended by the CPRA, or comparable legislation. These typically include the right to know what personal data is held about you, and to obtain access to it, correct it, delete it, receive it in a portable form, restrict or object to its processing, withdraw consent, and not to be treated worse for having asked.

We can act on those rights directly only to the extent that we hold data about you, and we hold none. There is no account to access, no profile to correct and no record to export. Data the Game creates lives on your device and is under your sole control at all times, as set out in section 2. For data held by Google in connection with advertising, the controls in section 4 are the effective route, and Google's own policy sets out how to exercise your rights against it.

You may nonetheless write to us at the address in section 15 to exercise any right, and we will respond within thirty (30) days. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority.

14. Changes to this Policy

We may revise this Policy from time to time. The effective date at the top of the page changes when we do, and the current version is always published at this address. Continuing to use the Services after a revision takes effect means you accept the revised Policy.

15. Contact

Questions, requests and complaints about this Policy go to [email protected], addressed to Cygnus Works LLC.