Privacy Policy

This policy explains what we collect when you play Pixel Art Heist (the “Game”), why, who we share it with, and the rights you have. It applies worldwide; region-specific rights are in Section 10.

1. The short version

• We collect gameplay events, device information, and pseudonymous identifiers to run the Game, save your progress, fix crashes, and understand how levels are played.
• We do not collect your name, email, contacts, photos, precise location, or payment card details. App-store purchases are processed by Google or Apple; we never see your payment instrument.
• The Game shows ads, served by Google AdMob (Section 6). Google uses your advertising ID and device information to show and measure them. In the EEA, UK and Switzerland we ask for your consent first; in US states whose laws treat this as a “sale” or “sharing” of personal information, you can opt out at any time in Settings → Privacy. We do not sell your personal information for money.
• You can delete your account and data at any time — in the Game (Settings → Delete my data) or at https://pixel-art-heist.web.app/delete-account.

2. Data we collect

We collect no precise location, contacts, photos, microphone, biometrics, or free-text content. The Game has no chat and no user-generated content.

3. Why we collect it (and our legal bases where GDPR-type laws apply)

4. Who processes it (our service providers)

• Google Firebase (Google LLC / Google Ireland): analytics, crash reporting (Crashlytics), authentication, cloud save (Firestore), remote configuration, content hosting. [Privacy: policies.google.com/privacy]
• GameAnalytics (GameAnalytics ApS / Mobvista group): aggregated gameplay analytics. [gameanalytics.com/privacy]
• Google Play / Apple App Store: distribution, payments, platform sign-in (their own policies apply).
• Adjust (Adjust GmbH, Berlin, Germany): mobile measurement and marketing attribution. Adjust receives your advertising ID, an attribution device ID, coarse device and region information, and a small set of gameplay milestones, and tells us which marketing campaign a player arrived from. [adjust.com/terms/privacy-policy]
• Google AdMob (Google LLC / Google Ireland): serves and measures the ads in the Game. Google receives your advertising ID, device and technical information, IP address and ad interactions. For advertising, Google acts as an independent controller and may use this data to personalise ads, subject to your consent (EEA/UK/Switzerland) or opt-out choices (US states). [How Google uses data from apps that use its services: policies.google.com/technologies/partner-sites]
• AdMob can pass an ad request to other ad networks competing to fill it (“mediation”). We will name any additional ad network here before it receives data from the Game.

Except where noted above (Google’s advertising), these providers process data under our instructions per data-processing agreements. We do not sell data for money.

5. International transfers

We operate globally; data is processed on servers that may be outside your country (primarily EU and US data centers operated by our providers). Where required, transfers rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework certifications of our providers.

6. Advertising

The Game shows two kinds of ads, served by Google AdMob:

• Rewarded ads you choose to watch, for example to double the coins from a level. They are always optional.
• Interstitial ads: full-screen ads shown between levels. The Silent Partner purchase turns these off permanently; rewarded ads stay available because they are optional.

Your choices:

• EEA, UK and Switzerland: at first launch, Google’s consent message asks whether ads may use your data. You can consent, manage your options, or decline. You can change your choice at any time in Settings → Privacy. If you decline, you may still see ads that are limited or not personalised.
• US states with privacy laws: Settings → Privacy opens “My data preferences”, where you can opt out of the sale or sharing of your data for targeted advertising.
• iOS: ads are personalised with your device’s advertising identifier (IDFA) only if you allow tracking in the App Tracking Transparency prompt, which you can change in iOS Settings → Privacy & Security → Tracking.
• Any device: you can reset or delete your device’s advertising ID in your device settings.

The Game also includes Adjust, a measurement SDK that tells us which marketing campaign a new player came from (see Section 4). It reads your advertising ID for that purpose and does not select or display ads.

7. Retention

• Analytics events: up to 14 months in identifiable form, aggregated thereafter.
• Crash data: ~90 days.
• Cloud save / account data: for as long as your account exists; deleted within 30 days of a deletion request.
• Purchase validation records: as long as required for fraud/tax/audit obligations.
• Local device data (settings, offline save): stays on your device; removed when you uninstall.

8. Security

Data in transit is encrypted (TLS). Cloud data lives in access-controlled Google Cloud infrastructure. No system is perfectly secure; we will notify you and regulators of breaches where the law requires.

9. Children

Pixel Art Heist is intended for players 13 and older (16 in the EEA where consent age applies, unless a parent consents) and is not directed to children. We do not knowingly collect personal information from children below these ages. If you believe a child has provided personal information, contact support@systemsofplay.com and we will delete it.

10. Your rights (by region)

Everywhere: access, correct, or delete your data via Settings → Delete my data, the deletion page (https://pixel-art-heist.web.app/delete-account), or support@systemsofplay.com. We answer within 30 days.

• EEA / UK (GDPR/UK GDPR): access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), withdrawal of consent at any time (Settings), and complaint to your supervisory authority (e.g. your national DPA / the ICO in the UK).
• United States (California CPRA and other state laws — CO, CT, VA, UT, TX, OR, etc.): right to know, delete, correct, and opt out of “sale”/“sharing” and targeted advertising. The ads in the Game (Section 6) may involve “selling” or “sharing” identifiers, device information and ad interactions with Google for targeted advertising, as those laws define the terms. You can opt out at any time in Settings → Privacy (“My data preferences”). We do not use sensitive personal information as defined by the CPRA. We honor authorized-agent requests and will not discriminate for exercising rights. Categories collected: identifiers, internet/app activity, purchase records, device information (Section 2).
• Brazil (LGPD): the rights above plus confirmation of processing and anonymization; contact us as the controller; you may complain to the ANPD.
• Canada (PIPEDA): access and correction; withdrawal of consent; complaints to the OPC.
• Australia (Privacy Act/APPs): access and correction; complaints to the OAIC.
• Japan (APPI): disclosure, correction, and cessation-of-use requests.
• South Korea (PIPA): access, correction, deletion, suspension; consent applies to personalised ads.

11. Changes

We will post changes here with a new effective date; material changes are announced in-Game before they take effect. Continued play after the effective date means the updated policy applies.

12. Contact

Systems of Play Consulting Inc., 329 Howe Street #1155, Vancouver, BC V6C 3N2, Canada · support@systemsofplay.com
(EU/UK players: if we appoint an EU/UK representative under GDPR Art. 27, their contact will be listed here.)