Back to Tangram Game Studio

Privacy Policy

Last updated:

1. Data Controller Information

The controller responsible for the processing described in this policy is:

Data Controller: Javier Campaña Pulido
NIF (Tax ID): 40456156F
Address: Cul de sac, 7, Palafrugell (Girona)
Contact Email: hello@tangramgamestudio.com

This policy explains our processing of personal data and your rights, including under the General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 on Personal Data Protection and guarantee of digital rights (LOPDGDD), where applicable.

2. Applications Covered

This privacy policy applies to all mobile games developed and published by Tangram Game Studio, including Block Logic and Clue Flip, distributed through the App Store and Google Play. It describes our common data practices across our games. References to “our games”, “the game” or “the app” mean the Tangram Game Studio game you are using. The purchases and gameplay features available depend on the game; the relevant parts of this policy apply when you use those features.

Our games do not require you to create an account or sign in. They still process personal data: our service providers use persistent identifiers, and information you voluntarily send to support can identify you. A pseudonymous identifier can distinguish a user or installation without containing their name; it is not irreversibly anonymous data.

3. Personal Data We Process

3.1. Device, Identifier and Technical Data

Depending on the service, platform, permissions and privacy choices, the app and its providers may process:

  • Advertising identifiers, such as IDFA on iOS and the Android advertising ID, and app installation or service-specific identifiers.
  • Device model, operating system and version, app version, language and connection information.
  • Usage and interaction data, including gameplay, advertising and purchase activity.
  • IP addresses, approximate location derived from them, and crash, performance and diagnostic information.

Our games do not use precise GPS location for the activities described here. Technical data and identifiers may be personal data. We do not describe all provider-processed IP addresses as anonymized.

3.2. Google Analytics for Firebase and Firebase Crashlytics

Google Analytics for Firebase processes gameplay and interaction events to produce statistics and improve the product. These include levels played, session and level duration, mistakes, hints, streaks, achievements, advertising interactions, purchases, and reminder settings and activity. Analytics can also process installation identifiers, device and app information and properties such as game language, progress and purchase status.

Each game starts Analytics after resolving the advertising privacy flow and, on iOS, the applicable tracking-permission flow. It applies Google’s Consent Mode settings for analytics storage, advertising storage, use of data for advertising and ad personalization. The SDK remains enabled after that flow, with its behavior adjusted by these settings. Refusing personalized advertising is not a general switch that stops all Analytics or other SDK communications.

Analytics data is also exported to Google BigQuery and used to create statistics for our internal dashboard, including gameplay, revenue and reminder reports. Exported event data can contain pseudonymous identifiers. Analytics retention settings do not delete these separate exports or dashboard tables; see section 7.

Firebase Crashlytics separately processes crash reports, error traces, installation identifiers, and device, app and diagnostic information to help us investigate failures and improve stability. Crash reporting is enabled in distribution builds separately from UMP advertising preferences. Those preferences do not operate as a Crashlytics opt-out.

Further information: Google’s Privacy Policy and Privacy and Security in Firebase.

3.3. Advertising and Google AdMob

Our games use Google AdMob to display ads. Its SDK may process IP addresses and approximate location derived from them, advertising and other device identifiers, ad impressions and interactions, device information, performance information and diagnostics. These are used for advertising, measurement, security and fraud prevention, with personalization depending on the applicable choices and permissions. Where permitted, advertising identifiers may be used for tracking across other companies’ apps and websites.

Google’s User Messaging Platform (UMP) manages advertising consent and privacy messages according to your region and circumstances. When available, open Settings → Manage advertising privacy to review or change the choices offered by that flow. The option is labelled “Gestionar privacidad publicitaria” in Spanish and may appear within the legal options in Settings. Availability and the choices shown can vary.

On iOS, Apple’s App Tracking Transparency (ATT) permission is separate from consent for other processing purposes. Refusing tracking or personalized ads does not necessarily stop contextual ads, diagnostics, purchase processing or all SDK communications.

Further information: Google’s Privacy Policy and Google Mobile Ads data disclosures.

3.4. Game Progress, Preferences and Local Storage

Our games store progress, preferences, balances of hints or other consumable items, and related purchase-delivery records locally, using app files and secure storage. The data saved depends on the features of the game. Some iOS Keychain data, including saved values or limited progress backups, may survive uninstalling and reinstalling an app.

Our games do not provide game-progress or consumable-balance synchronization through iCloud or Google Play Games. Any device backup or restore provided by your operating system is separate from an in-game synchronization feature and depends on your system settings. Restoring an eligible purchase is also separate from transferring progress or a hint balance.

3.5. In-App Purchases and RevenueCat

Our games offer optional in-app purchases processed by Apple’s App Store or Google Play. We use RevenueCat to validate purchases, manage purchased features, restore eligible purchases and analyze purchase activity. RevenueCat processes purchase and transaction information, including purchase history, product and entitlement information and store receipts or purchase tokens, associated with an automatically generated app user identifier. This is a pseudonymous identifier; we do not configure our own account identifier. Our games do not require you to create an account and do not receive your payment card details. Purchase-related events may also be processed by Firebase Analytics in accordance with the app’s privacy settings.

Depending on the game, purchases may include a permanent Remove Ads entitlement and consumable items such as hint packs. Remove Ads removes the interstitial ads covered by the offer; optional rewarded videos remain available where offered. Restoring a permanent entitlement, where eligible under the store’s rules, does not synchronize game progress or restore or transfer a consumable balance between devices.

Further information: RevenueCat’s Privacy Policy. Its Data Processing Addendum describes processing under its customer service agreement; the public privacy policy does not replace those terms or this description of our use of the service.

3.6. Contact and Support

Settings displays your RevenueCat app user identifier, when available, which you can copy to the clipboard for support. If you choose Contact, the app prepares an email draft containing the app version/build and this identifier. You can review or edit the draft before sending it. The app does not send the email automatically.

We receive your email address, message and any included support details only if you send the email. We use that information to respond to your request and investigate relevant purchase or app issues. Sending your identifier can allow us to associate your support message with the relevant RevenueCat purchase records.

Where GDPR applies, the relevant legal basis depends on the purpose:

  • Providing the game and purchases: performance of a contract (Article 6(1)(b)) for delivering requested features, validating transactions, managing entitlements and restoring eligible purchases.
  • Usage statistics and product improvement: consent (Article 6(1)(a)) where required for analytics or related device storage/access. Where local law permits processing without consent, legitimate interests (Article 6(1)(f)) in understanding and improving the game may apply, subject to your rights and the applicable safeguards. Purchase analytics is distinct from the processing needed to deliver a purchase.
  • Advertising and advertising measurement: consent where required for personalization, tracking and related storage/access. Other advertising, measurement and fraud-prevention processing depends on the activity, jurisdiction and provider’s applicable legal basis; refusing personalization does not by itself prohibit all such processing.
  • Crash diagnostics, stability and security: legitimate interests in maintaining a reliable, secure app and investigating faults (Article 6(1)(f)), subject to applicable local requirements. This basis does not override any requirement for consent to device storage/access. Crashlytics is operated separately from the advertising-consent controls described above.
  • Support: performance of a contract where needed to address a request about the game or a purchase; otherwise legitimate interests in responding to correspondence and resolving problems.
  • Legal obligations and claims: compliance with applicable legal obligations (Article 6(1)(c)), and legitimate interests in establishing, exercising or defending legal claims, where relevant.

UMP does not necessarily show the same consent request to every player or on every launch. ATT is an additional iOS permission, not consent for every purpose in this policy. Analytics applies Consent Mode after these flows have been resolved; this does not make UMP a universal privacy control for diagnostics or purchases. Other territories may apply different legal requirements and rights.

You can change available advertising choices as described in sections 3.3 and 10, and contact us to withdraw consent or exercise your rights. Withdrawal does not affect processing that was lawful before withdrawal.

5. Recipients and Provider Roles

The relevant recipients for our games include:

  • Google, including Google Ireland Limited and Google LLC as applicable to the service and region: Google Analytics for Firebase, Firebase Crashlytics, AdMob and Google Cloud/BigQuery for the purposes described above. Google’s services have different terms and roles: Analytics, Firebase and cloud services include processing on our behalf, while AdMob generally falls under Google’s controller-to-controller advertising terms, with some features subject to processor terms.
  • RevenueCat, Inc.: purchase validation, entitlements, eligible purchase restoration, transaction history and purchase analytics. Its published DPA describes RevenueCat as a processor of customer personal data within that agreement’s scope.
  • Apple’s App Store and Google Play: purchase processing and store-related operations under their own terms and privacy notices. Apple entities, including Apple Distribution International Limited for relevant EEA processing and Apple Inc., and the applicable Google entities may process information as independent controllers for their store services.
  • Email service providers: handling support correspondence sent by you, under the applicable email service terms.
  • Authorities or professional advisers, where disclosure is necessary to comply with law or establish, exercise or defend legal claims.

Provider roles and obligations depend on the particular service, data and applicable contract. We do not describe all providers as our processors for every purpose.

Provider notices: Google, Apple and RevenueCat.

6. International Data Transfers

Our providers may process personal data outside the European Economic Area, including in the United States. This includes Google services, RevenueCat, store services and providers handling support correspondence. Processing locations depend on the service and its configuration; data is not necessarily processed exclusively in the EU.

For transfers covered by their published terms, Google and RevenueCat provide European Commission Standard Contractual Clauses for relevant restricted transfers. Apple also describes its use of Standard Contractual Clauses for transfers of EEA personal data. The safeguard applicable to a particular transfer depends on the receiving entity, service, contract and territory; a relevant adequacy decision may apply where its conditions are met.

You can contact us for information about the safeguards applicable to your data and how to obtain a copy, subject to any necessary redactions. Further information: Google’s transfer frameworks, RevenueCat’s DPA and Apple’s Privacy Policy.

7. Data Retention

Data from our games is stored in separate systems with different retention rules. We retain personal data for the purposes described in this policy, taking into account the service involved, the relevant app configuration, legal obligations and any need to resolve disputes:

  • Google Analytics for Firebase: user-level and event-level data is retained according to the retention controls configured for the relevant game’s Analytics property. Where renewal on new activity is enabled, later activity can renew the retention period for user data. Those controls do not set a universal deletion deadline for aggregated reports or exported data. Google explains the scope of these controls.
  • BigQuery exports and internal reports: exported events, pseudonymous cohort records and summary reports are stored separately from Analytics. Their retention depends on the expiry settings of each dataset, table or partition; some tables may have no automatic expiry and remain until separately deleted. A dataset’s default expiry does not necessarily apply to older tables. Expired or deleted data may remain temporarily in Google’s recovery systems, subject to its time-travel and fail-safe periods.
  • Firebase Crashlytics: Google’s published policy states that crash traces and associated identifiers are kept for 90 days before removal from live and backup systems begins. This is a provider-described lifecycle, not a guarantee that every diagnostic copy or other log is deleted on day 90. See Firebase’s privacy information.
  • AdMob: advertising data retention depends on Google’s applicable service policies, the data and the processing purpose. We do not apply a single two-year retention period to all AdMob data.
  • RevenueCat and store transactions: purchase, transaction and entitlement records may be retained to validate and restore purchases, maintain purchase history, resolve disputes and meet applicable legal requirements. Provider retention and deletion rules also apply. Uninstalling a game does not delete those records. Apple or Google may lawfully retain records independently, and requests concerning those records are subject to their own obligations and procedures.
  • Support correspondence: retention depends on the request, follow-up needed, purchase disputes and any legal obligations or applicable claim periods. An email is not automatically deleted when you uninstall the app.
  • Local game data and secure storage: app files generally remain until removed by the app or operating system. Some iOS Keychain values and system backups may persist after uninstallation or reinstallation, depending on the platform and settings.

There is no single retention period or uninstall action that deletes all these systems. Contact us to request deletion or information about the retention applicable to your data. Legal exceptions, provider deletion processes and recovery periods may affect what can be deleted and when.

8. Your Privacy Rights

Where GDPR and LOPDGDD apply, and subject to their conditions, you may request:

  • Access to your personal data (Article 15 GDPR).
  • Rectification of inaccurate or incomplete data (Article 16).
  • Erasure of personal data (Article 17).
  • Restriction of processing (Article 18).
  • Data portability, where applicable (Article 20).
  • Objection to processing based on legitimate interests, and to direct marketing (Article 21).
  • Withdrawal of consent, without affecting the lawfulness of earlier processing.

To exercise your rights, including to request deletion, email hello@tangramgamestudio.com, stating the game and your request. You do not need an account with any of our games. Your RevenueCat support identifier can help us locate relevant purchase records. We may ask for information reasonably necessary to identify the relevant data and verify that you are entitled to make the request. Avoid sending payment card details or unnecessary personal information.

Where a provider processes data on our behalf, we will address applicable requests through the available provider procedures. Apple, Google and other independent controllers may need to handle requests about data they control themselves; legal retention duties and other exceptions may limit erasure. Our games do not offer a single in-app control that erases all local and provider-held records.

You may also complain to the Spanish Data Protection Agency (AEPD) or your competent supervisory authority. Other privacy rights may apply under the law of your place of residence.

9. Children’s Privacy

The intended audience and content age rating for each game are described in its store listing. Target audience, store content age ratings and the legal age for consenting to personal-data processing are different matters; a store rating does not itself establish valid consent.

For processing based on a minor’s consent in Spain, Article 7 LOPDGDD sets the threshold at 14, subject to its exceptions. For a child under 14, consent-based processing requires the consent of the holder of parental responsibility or guardianship, within the scope determined by law. Other countries may set different thresholds. Being 14 or older does not automatically authorize every processing activity involving an adolescent. See Article 7 LOPDGDD.

Our games do not implement automatic age detection or a parental-consent verification system. If you are a parent or guardian with a concern about a child’s personal data, contact hello@tangramgamestudio.com so we can investigate and address the request under the applicable law. This policy does not establish an age gate or a parental-consent mechanism, and does not promise immediate or automatic deletion.

10. SDKs, Device Storage and Your Choices

Our games use SDKs, persistent identifiers, app files and secure storage for gameplay, privacy preferences, analytics, advertising, diagnostics and purchases.

When available, use Settings → Manage advertising privacy (“Ajustes → Gestionar privacidad publicitaria” in Spanish, within the legal options where shown) to revisit UMP choices. The app applies the resulting privacy state to Analytics Consent Mode. This option is not a general analytics or diagnostics on/off switch. Purchase processing and the separate crash-reporting behavior described above are not disabled simply by refusing personalized ads.

System settings may provide additional controls for tracking permissions, advertising identifiers and notifications. Their names and availability depend on the operating system and version, and they do not replace the in-app choices or erase information already retained by providers. Contact us to exercise the rights described in section 8.

11. Data Security

We use technical and organizational measures appropriate to the processing, including encrypted transport for SDK communications and access controls for internal systems. No storage or transmission method can guarantee absolute security.

12. Changes to This Policy

We may update this policy to reflect changes in our practices or applicable requirements. When a revised policy is published, we update the “Last updated” date on this page. Where required, we will provide additional notice or obtain any necessary consent. The privacy-policy address remains https://tangramgamestudio.com/privacy-policy/.

13. Contact

For questions, privacy requests or concerns, contact:

Email: hello@tangramgamestudio.com
Suggested subject: “Data Protection - [Game Name]”.

Where GDPR applies, we respond without undue delay and normally within one month of receiving a request. If a permitted extension is necessary because of its complexity or the number of requests, we will inform you within that month and explain the reason.