Levelplay Analytics

Privacy Policy

LevelPlay Analytics ("the app," "we," "our") is an Android application that lets ironSource and LevelPlay publishers connect to the ironSource Publisher API and view their monetization data — revenue, impressions, eCPM, fill rate, and performance breakdowns by app, ad unit, and country.

This policy explains what information the app collects, how it is used and protected, and what choices you have. We are committed to handling your data with minimal footprint: the app does not collect personal information, does not run advertising SDKs, and does not share anything with third-party analytics platforms.

By installing and using LevelPlay Analytics, you agree to the practices described in this policy.

Information We Collect

The following describes every category of data the app handles, where it is stored, and whether it ever leaves your device.

API Credentials — Your ironSource Secret Key and Refresh Token, entered during setup. Stored on-device only (encrypted). Sent to the ironSource API to authenticate requests — never to any other party.

Access Token — A short-lived bearer token exchanged from your credentials by the ironSource API. Stored on-device only. Never shared externally.

Analytics Data — Revenue, impressions, eCPM, fill rate, country and app breakdowns — your own publisher data. Cached on-device only. Never shared externally.

Network IDs / App List — ironSource network and app identifiers returned by the API. Cached on-device only. Never shared externally.

Remote Config — App configuration flags fetched from a Supabase backend. No personal data is included in these requests — config values only, no device or user identifiers are transmitted.

What we do not collect

Your name, email address, phone number, or any personal identifiers

Your device's advertising identifier (GAID / IDFA)

Location data

Camera, microphone, or contacts access

Crash reports or usage analytics sent to third-party platforms

How We Use Your Information

API credentials

Your Secret Key and Refresh Token are used solely to authenticate requests to the ironSource Publisher API on your behalf. They are read from encrypted storage each time the app needs to fetch or refresh data, and are never used for any other purpose.

Analytics data

Revenue and performance metrics fetched from the ironSource API are displayed within the app and cached locally to allow you to view recent data when the device is offline. This data belongs to you — the app renders it and does not transmit it anywhere.

Remote configuration

The app retrieves feature flags from a Supabase backend to control optional in-app features. This request contains no personal information or device identifiers.

Storage & Security

All credentials stored by the app — your Secret Key, Refresh Token, and derived access token — are written to Android Encrypted Shared Preferences via the flutter_secure_storage library. This provides AES-256 encryption backed by the Android Keystore system, meaning the values cannot be read by other apps or extracted without the device's hardware security module.

Cached analytics data is stored locally on your device using the same encrypted storage mechanism. No plaintext credentials or tokens are written to logs, shared preferences, or the external filesystem.

All network requests to the ironSource API are made over HTTPS. We do not implement any certificate pinning bypass or custom trust managers.

Third-Party Services

The app interacts with the following external services. We do not control these services and recommend reviewing their privacy policies separately.

ironSource / LevelPlay Publisher API

All monetization data is fetched from Unity's ironSource Publisher API. Your credentials are sent to this API to authenticate each request. ironSource's data practices are governed by Unity Technologies' Privacy Policy. The app communicates with api.ironsrc.com and related ironSource endpoints.

Supabase

The app fetches remote configuration values from a Supabase database to manage optional feature flags. No personal data, device identifiers, or credentials are included in these requests. Supabase is governed by its own privacy policy available at supabase.com/privacy.

Flag CDN (flagcdn.com)

Country flag images displayed in the country breakdown view are loaded from flagcdn.com, a public image CDN. Requests to this service may include your IP address as part of standard HTTP logging. No personal information is deliberately sent.

What we do not include

The app does not include any of the following: advertising SDKs, social media SDKs, third-party crash reporting tools (e.g., Firebase Crashlytics, Sentry), third-party analytics tools (e.g., Firebase Analytics, Mixpanel, Amplitude), or third-party attribution SDKs (e.g., AppsFlyer, Adjust).

Device Permissions

The app requests only one runtime permission:

INTERNET

Required to connect to the ironSource Publisher API and retrieve your monetization data, and to fetch remote configuration from Supabase. Without this permission the app cannot display any data.

The app does not request ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, READ_CONTACTS, CAMERA, RECORD_AUDIO, READ_EXTERNAL_STORAGE, or any other sensitive permission.

Data Retention

Credentials

Your Secret Key and Refresh Token are retained in encrypted storage until you explicitly log out through the app's settings, or until you uninstall the app. Logging out deletes all stored credentials and cached tokens from the device.

Cached analytics data

Local caches of revenue and performance data are stored on-device for offline access. They are deleted when you log out or uninstall the app. You can also clear the cache by initiating a full refresh from the dashboard.

Remote configuration

Configuration values fetched from Supabase are written to encrypted local storage and refreshed each time you open the app. They are deleted on logout and uninstall.

We do not retain any copy of your data on our servers. The only server-side storage involved is the ironSource API (which is your own data source) and the Supabase configuration database (which contains no personal data).

Changes to This Policy

We may update this privacy policy from time to time. When we do, the effective date at the top of this page will be updated. For significant changes — such as the introduction of new data collection practices — we will post a notice within the app before the change takes effect.

Continued use of the app after a policy update constitutes acceptance of the revised terms. If you do not agree with any change, you should stop using the app and delete your credentials by logging out before uninstalling.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or LevelplayAnalytics, please contact us:

LevelplayAnalytics Support

Email: mixtubeteam@gmail.com

We will make reasonable efforts to respond to inquiries in a timely manner.