Privacy Policy

1. Information we handle and why

• Account and sign-in information. We create an account identifier and store protected credentials so you can access your game. If you set a password, we store a password hash. If you link Google, we receive your Google account identifier and verified email information to authenticate you and display your linked identity. We do not receive your Google password. If you add a recovery email, we use it for verification, account recovery, and account-deletion notices.
• Birthday and age restrictions. We ask for your birthday when you create an account to check eligibility and apply age-appropriate advertising restrictions. Accounts created before this check must provide a birthday before using rewarded ads. We store an eligible birthday with your account and calculate age restrictions as you grow older. We do not send your birthday to advertising providers; they receive age-treatment and privacy signals. We do not create an account or retain a birthday when the age check finds you ineligible.
• Game progress and activity. We store your progress, inventory, currencies, equipment, preferences, battle results, reward claims, and account activity. We use this information to save and restore your game, calculate rewards, process your actions consistently, resolve support requests, and prevent cheating or duplicate rewards.
• Purchases and subscriptions. When you buy through Google Play, we handle product identifiers, purchase tokens and transaction references, purchase and subscription status, and their association with your game account. We use these records to verify payments, deliver items and benefits, reconcile renewals or refunds, and prevent fraud. Google Play processes your payment details; we do not receive your full payment-card number.
• Rewarded advertisements. If you use optional rewarded ads, advertising providers process device and advertising identifiers, IP address and approximate location, ad interactions, and diagnostic information. We also handle reward-opportunity identifiers and ad-completion records to credit your account and prevent repeated claims. See the provider and privacy-choice sections below.
• Technical and security information. Our services and hosting providers process connection information such as IP addresses, request times, app or browser information, and error or security events to deliver the service, diagnose faults, and limit abusive requests.
• Support messages. When you contact us, we handle your contact details and the information you choose to send so we can answer your request. Please do not send passwords, recovery codes, or full payment-card details.

You can play without linking Google or adding a recovery email. Features such as purchases, rewarded ads, and email recovery are optional and depend on availability. Information necessary for a requested feature is needed to provide that feature.

2. Grounds for using information

We obtain authorization for processing where required by Colombian data-protection law, unless a legal exception applies. Where European or UK data-protection law applies, we process account information, progress, and purchase records to provide the service you request; security, fraud-prevention, and diagnostic information for our legitimate interests in keeping the service reliable and protecting accounts; and records required to meet legal obligations.

We rely on consent where required for advertising technologies or other optional processing. You can withdraw consent without affecting processing that was lawful before withdrawal. This policy and agreement to our terms do not replace a separate authorization or consent required by law.

3. Service providers and sharing

We share information needed to provide the features you use with these categories of recipients:

• Hosting, database, and email providers process connection data, stored game and account information, and account-related messages on our behalf. Cloudflare delivers and protects our website.
• Google provides optional Google sign-in, Google Play billing, and Google AdMob advertising. See Google’s Privacy Policy.
• Unity LevelPlay (ironSource) and Unity Ads provide optional rewarded advertisements. The game can also use Unity Ads through AdMob mediation. The game uses Unity In-App Purchasing software to handle store product information, purchase status, and receipts when communicating with Google Play. See Unity’s Game Player and App User Privacy Policy and Unity’s purchasing privacy information.

Advertising providers use information to deliver and measure ads, diagnose performance, and detect fraud. Personalization is disabled in the game: accepting the rewarded-ad privacy notice does not authorize interest-based targeting. Non-personalized ads still involve device access and technical information. Google and Unity explain their SDK data practices in their Google Mobile Ads disclosures and Unity Ads disclosures.

We may also disclose information when required by law or necessary to protect people, investigate fraud, or enforce our terms. If the service changes ownership, information may transfer as part of that transaction, subject to applicable law and notice requirements.

4. Website storage and security

The website’s account-deletion flow keeps the account credentials you enter in browser memory rather than browser local storage. Google sign-in uses temporary security cookies to verify the sign-in flow. The game stores credentials and preferences on your device so you can access your account.

We use HTTPS for production connections, hashed passwords and session credentials on our servers, and access restrictions to protect account information. Recovery addresses and purchase evidence receive additional encryption in storage. No system can guarantee absolute security; keep your device, passwords, and recovery information secure.

5. Retention and account deletion

We keep account, progress, and transaction records while your account exists so that we can maintain your progress, honor purchases, and resolve account or billing issues.

You can request deletion at Delete account, including without the game installed. After verification and confirmation, deletion is scheduled with a seven-day grace period. You must explicitly cancel on that page before the deadline to keep your account; signing in or playing does not cancel the request.

After the grace period, the deletion process permanently removes your live account, including your birthday, progress, inventory, currencies, purchase entitlements, linked sign-in identities, email, password, recovery information, and account history. These cannot be recovered through the game afterward.

We retain one-way purchase-token and billing-account fingerprints indefinitely to prevent a purchase from being rewarded again and to stop delayed billing notifications from recreating deleted records. These retained fingerprints contain no email, password, gameplay data, or readable purchase token.

Backups: Database backups are retained for up to 30 days from creation. Copies made before your live account is deleted may therefore remain in backups for up to 30 days after deletion. This is separate from the seven-day cancellation period. If a backup is restored, completed deletions must be reapplied before the restored service is made available.

Logs and email: We retain support correspondence and security or delivery logs for as long as needed to resolve the relevant request, investigate errors or abuse, handle disputes, or meet applicable legal obligations. Their retention depends on that purpose and the provider’s retention settings; the 30-day backup limit does not apply to these separate records. You can contact us to request deletion or information about a particular record.

The game’s outgoing email queue removes a message after successful delivery or when its delivery window expires. Deleting your account removes its recovery address and associated live account records, but does not automatically erase correspondence or records held separately by email providers.

Google, advertising providers, and other independent providers may retain their own records under their policies. Deleting a game account does not cancel a Google Play subscription or automatically issue a refund. Manage subscriptions in Google Play.

Contact contact@pebbletyrant.com for deletion assistance, a request requiring faster handling, or help identifying the provider responsible for other records.

6. Your choices and privacy rights

You can choose whether to link a Google account, add a recovery email, make a purchase, or use rewarded ads. Where available, open Store → Rewards → Privacy in the game to review or change advertising consent. Android and Google also provide advertising-identifier and ad-personalization controls.

When the game uses LevelPlay, it asks before the first rewarded ad whether you allow Unity LevelPlay (ironSource) and Unity Ads to store and access information on your device and process device and app information, IP address, approximate location, and ad interactions to deliver and measure ads and prevent fraud. We send a reward reference to verify completed videos. Accepting keeps personalization disabled. Declining keeps rewarded ads off; you can continue playing without them.

We save your LevelPlay choices with your account, including acceptances, declines and withdrawals. Each record contains a server timestamp, the notice version and wording, and the app platform and build that submitted it. Your choice applies across devices signed in to the same account; each ad request checks the latest saved choice. A withdrawal that cannot reach the server blocks ads on that device and is queued for retry; other devices receive it after the server saves it. You can withdraw consent through the same Privacy screen; this stops further rewarded-ad requests. Restart the game after withdrawal to stop any ad services already running. We keep your consent history while your account exists and delete it with your account, subject to the backup retention described above. Closing the notice does not change a saved choice. If the game uses AdMob, its separate Google privacy form manages the applicable advertising choices.

Depending on where you live, you may have rights to access or receive a copy of your information, correct it, delete it, restrict or object to its use, receive portable data, withdraw consent, or opt out of certain advertising-related sharing. You may also complain to your local data-protection authority.

Under Colombian law, you can also request proof of an authorization where required, ask how your information has been used, and access your personal information free of charge. You may bring a complaint to Colombia’s Superintendencia de Industria y Comercio (SIC) after completing the applicable inquiry or complaint process with us.

To exercise a right, email contact@pebbletyrant.com. Include your account ID if available and describe your request. We may ask for information needed to verify that the account is yours, and will handle requests within the time required by applicable law. Never email a password or recovery code.

7. International processing

Our service providers may process information in countries other than where you live. The protections available under local law can differ. Where applicable law requires safeguards for an international transfer, those safeguards must apply to the transfer. Contact us for information about where your data is processed and the safeguards applicable to it.

8. Children

Pebble Tyrant is intended for players aged 13 and older. Children under 13 must not use the game or submit personal information to us. Players who have not reached the age of majority where they live need a parent or legal guardian’s permission to use the game, and any parental authorization for data processing required by applicable law.

Rewarded ads for players under 18 use restricted targeting. Players under 16 receive additional age-of-consent restrictions and are not asked to consent to personalized advertising. LevelPlay rewarded ads are unavailable for players marked as under the age of consent because the game does not provide a parental advertising-consent flow. Advertising consent does not remove these age restrictions.

If you believe a child under 13 has provided personal information, or a minor’s information has been processed without required authorization, contact contact@pebbletyrant.com so we can investigate and delete information that should not have been collected.

9. Changes and contact

We will post updates on this page and change the date above. Where required, we will give additional notice of material changes and obtain consent before starting new processing that requires it.

For questions about this policy or your information, contact contact@pebbletyrant.com. The rules for using the game and website are in our Terms of Service.