Operator: VIVEKRAO GOVINDARAO ANNA
Contact: shubhamvivekrao315@gmail.com
Effective date: 19 October 2026
This policy explains what Caramel Crushers ("the Game") collects, why, and what you can do about it. It applies to the Game on both Google Play and the Apple App Store.
• You can play the whole Game without signing in and without giving us your name or email.
• Signing in is optional. It exists so your progress and coins survive changing or losing your phone.
• The Game shows rewarded ads only — short videos you choose to watch in exchange for a reward. There are no forced ads, no banners, and no ads between levels.
• We do not sell your personal information for money, and you can control personalised ads (section 4).
• You can delete your account and the data stored with it at any time. A few records that stop rewards being claimed twice are kept, as explained in section 14.
Whether or not you sign in, the Game and the services it uses collect:
• A device identifier generated by your operating system, used to recognise the device your save belongs to and to prevent duplicate coin awards.
• The advertising ID on your device (the Android advertising ID), used by Google, Unity and Meta as described in sections 4 to 6. On iPhone and iPad the Game does not ask for permission to track you, so Apple's advertising identifier (IDFA) is not available to the Game or its partners.
• App activity — which levels you play and complete, your scores and stars, boosters and lives used, coins earned and spent, and when you last played.
• Technical and diagnostic information — app version, operating system, device model, crash and performance data, and your IP address, from which an approximate (city-level) location may be estimated.
Signing in is optional and can be skipped. On Android you can sign in with Google Play Games or with Google. On iPhone and iPad you can use Sign in with Apple or Google. If you choose to sign in:
• With Google Play Games (Android): we receive an account identifier and your Play Games display name (for example, "TemperedVideo93"). Google Play Games does not give us your email address.
• With Google (Android, iPhone and iPad): we receive an account identifier, your name and your email address, and a link to your profile picture if your Google account has one.
• With Sign in with Apple (iPhone and iPad): we receive an account identifier, your name, and an email address. If you use Apple's "Hide My Email", we only ever see the relay address Apple generates — never your real one.
You can add more than one sign-in method to the same account with "Add a login" — for example, so you can also play on a different kind of phone. We then receive the information above for each method you add.
We do not ask for, and cannot see, your password for any of these methods.
When you first open the Game, it creates an anonymous player account for you with Google Firebase. It has a random identifier and no name or email. Your progress is kept on your device and saved in the cloud under that identifier, using Google Firebase (Cloud Firestore). If you sign in, the same progress is linked to your sign-in, so you can restore it on another device.
The saved record contains:
• the level you have reached, and the highest level unlocked to you
• your stars and scores for each level
• your coin balance, boosters, lives and their refill timer
• your chosen avatar, daily bonus day, spin-wheel counters and last-spin times, and similar counters for the Game's daily rewards
• a record of coin transactions (amount, reason, and time), which prevents a purchase or reward from being granted twice
• the identifier of the device that last saved, the platforms you have played on, and when the record was last updated
• technical values used to combine progress saved on different devices
The Game shows rewarded video ads only. You only ever see one after choosing to watch it.
The ads are served by Google AdMob. Through AdMob's mediation, Unity Ads (operated by Unity Technologies) can also compete to supply the ad you choose to watch.
Google's advertising SDK collects, and shares with Google's advertising network:
• your device's advertising ID and app set ID
• ad interactions — that an ad was requested, shown, watched or closed
• diagnostic information — such as load times and performance metrics
• your IP address, from which an approximate location may be estimated
Google uses this to select and measure ads, to limit how often you see the same ad, and to detect invalid traffic and fraud. Google's own description of what its advertising SDK collects is at https://developers.google.com/admob/android/privacy/play-data-disclosure and how Google uses data from partner apps is at https://policies.google.com/technologies/partner-sites
Unity Ads collects similar information — device identifiers including the advertising ID, device information, your IP address and the approximate location estimated from it, and how you interact with its ads. Unity uses it to show and measure ads, to personalise them where you allow it, and to detect fraud. Unity describes this in its Game Player and App User Privacy Policy: https://unity.com/legal/game-player-and-app-user-privacy-policy
Your choice. If you are in the European Economic Area, the United Kingdom or Switzerland, the Game shows you a consent screen the first time it runs. It lists our advertising partners, including Google and Unity Ads, and you decide whether ads may be personalised. If you live in a US state whose privacy law lets you opt out of the "sale" or "sharing" of personal information or of targeted advertising, you can opt out in the Game, and the Game passes your choice on to Google and Unity Ads. To review or change your choice, open the Game's Settings, tap the "i" button, then "Ad privacy" (this option appears where these laws apply), or email us at shubhamvivekrao315@gmail.com.
You can also reset or disable your advertising ID at the operating-system level:
• Android: Settings → Google → Ads
• iOS: Settings → Privacy & Security → Tracking
The Game uses Google Firebase Analytics to understand how the Game is used in aggregate — for example, how many players a feature reaches, or how often a cloud save conflict occurs. The events the Game sends are short event names, sometimes with one simple detail such as which sign-in button was used; we never attach your name, email, or account identifier to them.
Firebase Analytics also collects some information automatically: an identifier for your installation of the Game, the Android advertising ID, device and app information, your approximate location (estimated from your IP address), when you first open the Game, in-app purchases, and the rewarded ads you are shown and rewarded for.
We link Firebase Analytics to Google Ads so that we can measure our own advertising for the Game — for example, how many people installed the Game after seeing one of our ads. On iPhone and iPad, where the Game does not use Apple's advertising identifier, this measurement relies on Apple's SKAdNetwork and Google's on-device conversion measurement.
We sometimes advertise the Game on Facebook and Instagram. To measure those ads, the Game includes Meta's software development kit (SDK), from Meta Platforms. It is used for measurement only: there is no Facebook Login and there are no Meta ads in the Game.
Where it is switched on, the SDK sends Meta: that the Game was installed and opened; on iPhone and iPad, in-app purchases (the item, price and currency — never your payment details); the advertising ID (Android only); an identifier the SDK creates for your installation of the Game; and device and app information such as device model, operating system, language, time zone and app version, together with your IP address. Meta uses this to tell us how many people installed or used the Game after seeing our ads. Meta's own use of this data is described in its privacy policy: https://www.facebook.com/privacy/policy/
Where it is switched off. The Game keeps Meta's measurement switched off — no installs, app opens or purchases are reported, and no advertising ID is shared — on devices where the consent screen in section 4 applies (the European Economic Area, the United Kingdom and Switzerland), and on devices where you have opted out under a US state privacy law (section 4). Once it is switched off on a device, it stays off on that device.
You can invite friends with your own 8-character invite code. When a new player joins with your code and finishes Level 1, you receive 200 coins. To run this, and to stop the reward being claimed more than once, the Game stores in Cloud Firestore:
• your invite code, the account it belongs to, the hashed device key of the phone it was created on, and when it was created
• each use of a code: the code, the inviting and the joining account, the joining phone's hashed device key, and whether the new player has finished Level 1
• for each device, its hashed device key, the account that first played on it, when, and whether the device was new to the Game
A hashed device key is a one-way code made from an identifier of your device — on Android, the Android ID; on iPhone and iPad, a random identifier the Game keeps in your device's keychain. It cannot be turned back into that identifier.
On Android, if you install the Game from a friend's invite link, the Game reads the link's referral details from Google Play (the Google Play Install Referrer service) to find the code, so you don't have to type it.
When you share an invite, the Game opens your phone's own share menu. We don't see who you share it with.
If you allow notifications, the Game schedules reminders on your device — for example, when your lives are full or a free spin is ready. They are created on your device, and no personal information is sent to us or anyone else to deliver them. You can turn them off at any time in your device's settings.
Coin packs and other in-app purchases are processed by Google Play Billing or the Apple App Store. We never see or store your payment card, billing address, or any other payment detail — those go to Google or Apple, under their own privacy policies.
We do keep a record of the coins a purchase awarded, so that the coins can be restored if you change device and so that a purchase is never credited twice. Firebase Analytics records that a purchase was made (section 5), and on iPhone and iPad so does Meta, where its measurement is switched on (section 6).
The Game uses these third-party services, each of which has its own privacy policy:
• Google Firebase (Authentication, Firestore, Analytics) — sign-in, cloud save and analytics — https://firebase.google.com/support/privacy
• Google AdMob — rewarded ads — https://policies.google.com/privacy
• Unity Ads (Unity Technologies) — rewarded ads, through AdMob mediation — https://unity.com/legal/game-player-and-app-user-privacy-policy
• Google Ads — measuring our own advertising for the Game — https://policies.google.com/privacy
• Meta SDK (Meta Platforms) — measuring our own Facebook and Instagram ads — https://www.facebook.com/privacy/policy/
• Sign in with Google — sign-in with a Google account on Android, iPhone and iPad — https://policies.google.com/privacy
• Google Play Games and Google Play Services — Android sign-in and store services — https://policies.google.com/privacy
• Google Play Install Referrer — invite codes from invite links on Android — https://policies.google.com/privacy
• Apple (Sign in with Apple, App Store) — iOS sign-in and store services — https://www.apple.com/legal/privacy/
• Unity — the game engine — https://unity.com/legal/privacy-policy
To save and restore your progress across devices; to run the Game's features (lives, coins, boosters, the spin wheel, invites and notifications); to deliver and measure the rewarded ads you choose to watch; to measure how well our own advertising for the Game works; to prevent duplicate or fraudulent coin awards and invite rewards; to understand how the Game is used in aggregate; and to diagnose crashes and errors.
We do not sell your personal information for money.
Firebase processes data on our behalf, under our instructions.
Our advertising partners are different, and we want to be plain about it: the advertising ID and ad-interaction data described in section 4 are shared with Google's advertising network and, when it competes for or shows an ad, with Unity Ads. They use them across apps to select and measure ads. Where Meta's measurement is switched on, the information in section 6 is shared with Meta. Some US state laws treat this kind of sharing as a "sale" or "sharing" of personal information; the consent screen and the Ad privacy option described in section 4 let you control it.
We may also disclose information where the law requires it.
• Play without signing in. Sign-in is optional.
• Change your ad choices in the Game (Settings → "i" → "Ad privacy", where shown), or by emailing us.
• Reset your advertising ID in your device settings, as described in section 4.
• Turn notifications off at any time in your device settings.
• Reset your progress from inside the Game. This is a gameplay feature — it clears your progress but keeps your account.
• Delete your account and the data stored with it: while signed in, tap the @ button, then "Delete account". Instructions are also at https://sites.google.com/view/caramelcrushers-data-deletion
• Request access to, correction of, or deletion of your data by emailing shubhamvivekrao315@gmail.com. We respond within 30 days.
Depending on where you live, you may have further rights under laws such as the GDPR, the UK GDPR, the CCPA/CPRA, or India's Digital Personal Data Protection Act. Contact us and we will honour them.
• Your cloud save and player account, including a guest account: kept while the account exists. Deleted immediately when you delete your account or ask us to, except for the records below that prevent fraud.
• Coin transaction records: up to 90 days, then removed automatically — also after you delete your account, so that a purchase or reward cannot be claimed twice.
• Invite records and hashed device keys (section 7): kept while the invite feature runs, also after you delete your account, because they stop the same account or device claiming a new-player reward twice. They contain no name or email.
• Analytics and diagnostic data: retained by Google under its own retention schedules, up to 24 months.
• Data received by our advertising partners (Google, Unity and Meta): kept under their own retention policies.
• Aggregated statistics that cannot identify you: may be kept indefinitely.
Data is encrypted in transit. Cloud records are protected by Firebase security rules that let an account read and write only its own data, except that the Game can look up an invite code to check it when someone enters it. No system is perfectly secure, and we cannot guarantee absolute security.
The Game's data is stored and processed on servers run by Google and, for advertising and ad measurement, by Unity and Meta. These may be located outside your country, and data protection laws there may differ from those where you live. Where the law requires it, these transfers rely on appropriate safeguards — such as the European Commission's standard contractual clauses — and we obtain any consent required for the transfer.
The Game is intended for players aged 13 and over and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, email shubhamvivekrao315@gmail.com and we will delete it.
In some countries the age at which a young person can consent to data processing is higher than 13. Where that applies, the consent screen described in section 4 is shown and consent is required before personalised ads are served.
We may update this policy. The effective date at the top changes when we do, and material changes will be notified inside the Game or on its store listing. Continuing to play after an update means you accept the revised policy.
VIVEKRAO GOVINDARAO ANNA
shubhamvivekrao315@gmail.com