Privacy Policy

Effective date: 8 October 2026. Applies to the Gravity Shapes mobile game ("the App") published by Bartosz Wróbel ("we").

1. Summary

Gravity Shapes can be played without creating an account. To offer rankings and duels, the App creates an anonymous player identity. You may optionally link it to a Google or Apple account. We show ads and offer optional in-app purchases. We do not sell personal data.

2. Data we process

• Anonymous player identity: a random identifier created on first launch (Supabase Auth). Used to store your nickname, avatar, scores, duel results and rating.
• Linked account (optional): when you sign in with Google or Apple we receive the identifier and e-mail address provided by that service, solely to let you keep your progress across devices. We do not post anything on your behalf. For an Apple account we also keep the token Apple issues at sign-in, only so that we can revoke it with Apple when you delete your account.
• Gameplay data: scores, game mode, duration, number of pieces and lines, and a log of moves ("replay") used to validate results and detect cheating.
• Local data: settings and the game in progress are stored on your device. Coins, purchases and progress are kept on our servers so they follow your account.
• Analytics and crash reports: we use Google Firebase Analytics and Crashlytics to understand how the App is used and to fix errors (device model, OS version, app version, session and event data, crash traces). Firebase may assign a random installation identifier. Collection starts only with your consent where the law requires it, and you can turn it off at any time in Settings → Privacy & account.
• Advertising: the App shows ads through Google AdMob and its mediation partners. Ad providers may process your advertising identifier and IP address to serve and measure ads. On iOS we ask for permission through App Tracking Transparency; in the EU/UK we ask for consent through a consent form and you can change it at any time in Settings → Privacy options. Without consent, ads are non-personalised.
• Rewarded ads: when you watch an ad for a reward, your player identifier is passed to Google AdMob, which confirms to our server that the ad was watched so the reward can be credited to you.
• App integrity: to keep rankings and purchases safe from modified copies of the App, the App obtains a token from Google Firebase App Check, which uses Google Play Integrity (Android) or Apple App Attest (iOS) to confirm that it is a genuine copy on a real device. We record only whether the token was valid, with your player identifier.
• Purchases: in-app purchases are processed by Apple App Store or Google Play. We receive only a confirmation of the purchase, never your payment details.

3. Why we process it (legal bases)

To provide the game and its online features (performance of a contract), to keep leaderboards fair and secure (legitimate interest), to improve the App (legitimate interest), and to show personalised ads only with your consent.

4. Sharing and processors

Data is processed by our service providers: Supabase (database and authentication, EU region), Google Firebase (analytics, crash reporting, remote configuration, App Check), Google AdMob and ad-network partners (advertising), Apple and Google (app distribution and payments). Sign-in providers (Google, Apple) process data under their own policies. We do not sell data to third parties.

5. Retention

Account and gameplay data are kept while your player identity exists. Replays (move logs) are deleted after 30 days, except the top results of each all-time leaderboard and runs a recent or open challenge was made from. Finished duels are deleted after 30 days; unanswered friend invites after 14 days. Anonymous identities that never linked an account are deleted after 12 months of inactivity. App integrity records are deleted after 60 days. Analytics data is retained according to Firebase defaults (up to 14 months). To recover from failures we keep copies of the database for up to 8 weeks; a deleted account disappears from them as they expire. You can delete your account and all associated data at any time in the App under Settings → Privacy & account → Delete account and data; deletion is immediate. You can also ask us by e-mail (see below).

6. Your rights

Depending on where you live (including under GDPR), you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. To exercise these rights, e-mail wrobelbartosz@icloud.com from the device or account concerned. You may also lodge a complaint with your data protection authority.

7. Children

The App is not directed at children under 13 (or the age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

8. Security

Data is transmitted over encrypted connections. Server access is protected by row-level security so that players can only modify their own records.

9. Changes

We may update this policy; the effective date above will change and material changes will be announced in the App.

10. Contact

Bartosz Wróbel, Poland — wrobelbartosz@icloud.com