Arrow Paths — Privacy Policy

Privacy Policy

1. Scope and current status

This is a draft game privacy policy prepared from the existing Arrow Paths website notice and development project. The existing notice covers the website preview only and does not replace a mobile-app privacy policy. This draft does not represent a public mobile release or claim that development online, advertising or purchase features are active for the public.

Before release, the operator, enabled services and vendors, intended audience, retention periods and international processing arrangements must be confirmed against the actual release. Privacy and support contact details appear below under Contact information.

2. Website preview

The existing Arrow Paths website preview does not create a game account, actively send preview interaction data to a game server, use advertising cookies or run usage analytics. Browser storage retains language and display preferences, which can be removed by clearing site data. Level Studio drawing, validation and play run in the browser.

Accessing a website requires normal network requests. The deployed hosting provider may process technical information such as IP addresses, request paths and browser identifiers. The provider and log-retention rules must be identified for the actual deployment; this page does not promise that web servers never process request information.

3. Game data stored on your device

The project stores levels and completions, stars, virtual coins and hints, streaks and challenges, inbox state, language and theme, notification settings and privacy choices. Anonymous online features also require a random player identifier, access credentials and recovery or deletion state. Such identifiers distinguish players or installations and are not fully anonymous data.

The mobile project protects long-term credentials using facilities such as Android Keystore or iOS Keychain. Clearing data, uninstalling, losing a device or a storage failure can affect local records. Backup and transfer behavior depends on the release and device configuration.

4. Online features and purposes

When configured and enabled in a release, level downloads, cloud saves, leaderboards, wallet validation, recovery codes and anonymous account deletion may process random player identifiers, display names, progress, scores, action proofs, virtual-resource records and service requests. A leaderboard may display a name and score to other players.

Service authentication and platform integrity proofs support online features, validate completions or purchases, protect accounts and prevent duplicate rewards. The project includes Google Play Integrity and Apple App Attest integrations; enabled attestation materials are submitted to the relevant platform. Actual enabled processing and recipients require confirmation in the final policy.

5. Optional analytics and privacy choices

Project analytics requires a separate, valid permission choice for the current policy version. When enabled, it may process gameplay events, app version and platform, service status, limited error fingerprints and event identifiers associated with an anonymous player to improve the game and diagnose faults. Disabling analytics stops future analytics and clears its pending queue, but does not automatically delete records already received by a server.

Processing needed to validate an online account or wallet serves a different purpose from optional analytics. Privacy settings provide controls for applicable choices. The final release must explain how refusal or withdrawal affects each feature.

6. Advertising, purchases and notifications

The project includes an AppLovin MAX advertising adapter and Google UMP consent integration. Production ad units, vendors and configuration still require confirmation. An ad SDK may initialize only after valid current-session privacy and tracking decisions meet its initialization conditions. Declining personalization does not necessarily prevent every form of limited advertising. Ad vendors may process device, ad-interaction and network information, and advertising identifiers where permitted; actual vendor practices and release configuration must be disclosed.

If purchases and restoration are enabled in a release, the app store provides the payment flow while the game and verification service process product identifiers, transaction identifiers and purchase status to fulfill content and prevent duplicate fulfillment. The local development test store does not create real charges.

Local reminders are off by default and request notification permission only when you choose to enable them. Project reminders are scheduled using device time. Notification permission does not grant analytics or advertising-tracking consent.

7. Retention, security and deletion

Local records are generally removed when app data is cleared or the app is uninstalled, subject to backup and restore behavior. Retention for production cloud saves, analytics, operational logs and vendor data, backup deletion periods and exceptions still require operator confirmation. This draft does not invent a fixed period or promise instant deletion.

The project implements anonymous account deletion for cloud saves, wallets, gameplay state, leaderboards, linked telemetry, recovery codes and credentials, with a local reset. Necessary de-identified transaction anti-replay records and deletion ledgers may remain to prevent duplicate fulfillment or the restoration of a deleted account from an old backup. Purposes, retention and access restrictions need to be stated in the final policy.

Protected storage, authenticated services and production transport controls reduce risk but cannot guarantee absolute security. Disabling analytics, closing the game or uninstalling is not the same as completing server-side account deletion.

8. Rights, children and contact

Applicable law may provide rights to access, correction, deletion, restriction, objection or withdrawal of relevant consent. An anonymous system may need installation or player information to verify a request. Do not share credentials or recovery codes with unofficial channels. Send privacy enquiries or data-rights requests to the developer email listed below under Contact information. The release operator still needs confirmation before public release.

Target ages and release territories are pending. This draft does not claim compliance with a particular children’s release or Families policy. Processing involving minors must first satisfy applicable guardian permission, SDK and platform requirements.

9. Final release and updates

The final policy must match in-app disclosures, actual enabled SDKs and services, and store data declarations, and state an effective date. Changes requiring renewed consent must be explained before the affected processing starts. The editing date shown here records draft preparation and is not a final effective date.

10. Email enquiries and rights requests

When you email flowergame@yeah.net, we process the email address, message, attachments and communication information you provide to answer support enquiries, verify identity where necessary, and handle privacy requests or complaints. Mail providers process information necessary to deliver and store communications. Email is not added to game analytics or used for targeted advertising. Do not send passwords, recovery credentials, identity documents or unrelated sensitive information; if additional verification is necessary, we will explain why and limit it to what is needed.

We retain communications only as needed to handle the request. If a legal duty or specific dispute requires further retention, we keep only necessary records, restrict purposes and access, and delete or lawfully anonymize them when that reason ends. We respond within applicable legal time limits. If a request cannot lawfully be fulfilled in full, we explain the reason and available complaint channels. Missing installation information may affect locating historical analytics, but does not automatically remove statutory rights or justify collecting unnecessary personal information.

11. Third-party responsibilities, security incidents and statutory rights

Third-party privacy policies explain their services; they do not transfer our legal data-protection, SDK-configuration, processor-oversight or rights-request duties to those providers. You may still contact the actual game provider at the developer email in this policy. We process or disclose data only for purposes and within limits permitted by applicable law; requests from authorities are handled with legally required and necessary disclosures.

The absence of an absolute-security guarantee is not a blanket release from responsibility for a breach, alteration or loss. When an actual or possible security incident is identified, we take appropriate investigation, corrective and harm-reduction measures and notify affected users and authorities as applicable law requires. Liability limits in the Terms do not reduce statutory privacy rights or liability that cannot legally be excluded.

Permission and withdrawal for optional analytics, and processing requiring separate consent, follow the actual in-app notice and applicable law. Reading this page, accepting Terms or continuing to play does not replace the separate choices and other safeguards legally required for new optional processing, third-party disclosures or international transfers.

12. Reading this document online

This HTML file itself contains no analytics, ads, cookie scripts, external fonts, input forms or login. Online access still sends an IP address, request path and technical information supplied by the browser to the web server. Hosting services may retain access records to deliver and protect the site; this is separate from optional Firebase game analytics. Actual hosting-log practices and retention depend on deployment configuration. You can ask about them or exercise applicable rights using the email above. Services independently provided by linked external websites follow their own notices.