Privacy Policy

Velvet Rush: Gem Block Puzzle · version of 31 October 2026

Draft pending legal review This text describes how the game works today. It will be reviewed by a lawyer before the public launch, and the publisher will fill in the details highlighted in yellow.

Velvet Rush is a block puzzle game for Android, made for adults (18+). You don’t need to create an account, sign in or give us your name or email address to play. This policy explains what data is processed when you play, why, and who receives it. If the Polish and English versions differ, the Polish version prevails.

In short

Your progress, settings and purchases are saved on your phone.
The game shows ads from Google AdMob. In the EEA, the UK and Switzerland it asks for your consent first.
Google Firebase helps us count how the game is played, fix crashes and run the daily challenge.
The daily challenge uses an anonymous account and a nickname that the game generates for you. Your results are visible to other players under that nickname.
An age signal from Google Play only decides whether purchases are available. It stays on your phone.
We don’t sell your data. You can ask us to delete it at any time — see Deleting your data.

Data controller

The controller of your personal data is [publisher’s full name or company name], [address], [tax ID, if applicable] — the publisher of the game on Google Play, trading as Wumiko (“we”).

For any privacy matter, email privacy@wumiko.games. For help with the game, write to support@wumiko.games. We have not appointed a data protection officer.

What data we process

Game data on your phone — progress (stars, unlocked amulets, best results, an unfinished run), settings (sound, music, vibration, effects, language), what you bought and the age signal described below. It stays on your phone and is removed when you uninstall the game or clear its data.
Ads — the game shows rewarded ads (you choose to watch one, e.g. for a revive or a second amulet) and full-screen ads between runs; buying “No Ads” turns off the full-screen ones. Ads are served by Google AdMob. The ad library on your phone collects your device’s advertising ID (Android Advertising ID), the App Set ID, your IP address (which can reveal approximate location), device model and operating system, language, ad views and taps, and diagnostic data. It uses this data to show ads, limit how often you see the same ad, measure and pay for ads and prevent fraud — and, where you allow it, to show ads based on your interests. On newer Android versions it may also use the Android Privacy Sandbox (Topics, attribution) for the same purposes.
Consent — in the European Economic Area, the UK and Switzerland the game asks for your consent before the first ad, using Google’s consent platform (User Messaging Platform, IAB TCF v2.3). Your choice is stored on your phone and passed to Google and its ad partners. The game doesn’t load ads until the choice has been made.
Analytics — Google Analytics for Firebase records game events such as starting and ending a run, clearing or failing a stage, using a revive, watching an ad, a purchase and taking part in the daily challenge, together with an app instance ID, device model, operating system and game version, language and country (derived from your IP address). The events contain no names, email addresses or age data. Analytics waits for your consent choice before it stores anything, and it uses advertising signals only where your choice allows it.
Crash reports — Firebase Crashlytics sends a report when the game crashes or hits an error: what went wrong in the code, device model, operating system, game version, free memory and a Crashlytics installation ID. We use it only to fix bugs.
Remote settings — Firebase Remote Config downloads game settings (for example how often ads appear) using a Firebase installation ID.
Daily challenge — when the game first talks to the daily challenge server, it signs in to Firebase Authentication with an anonymous account: a random identifier, with no name, email or phone number. With it our server stores:
- your nickname — two words from a fixed list (e.g. “Velvet Fox”), which you pick from the game’s suggestions or which the server draws for you; you can’t type your own;
- for each day you play: your score, stages and moves, the time you sent them, and the list of moves in that run, which the server replays to check that the result is genuine.
Other players see the top results of the day and your rank, with nicknames — never the anonymous identifier. To protect the leaderboard, Firebase App Check asks Google Play Integrity whether the request comes from a genuine copy of the game on a genuine device.
Purchases — payments go through Google Play; we never see your card details. The game receives the purchase details from Google Play (product, order ID, time, status) to grant what you bought, such as No Ads or a board theme, and to restore it after reinstalling.
Age signal — on Android the game may ask Google Play (Play Age Signals) whether your account is verified as an adult or belongs to someone under 18. The answer stays on your phone, is not sent to us and is not used for ads or analytics. Its only use is to turn off purchases if the signal says the player is under 18. See Adults only.
Sharing a result — if you tap Share, the game hands a short text (date, result and a link) to your phone’s share menu. Where it goes is up to you; we don’t receive it.
Contacting us — if you email us, we process your email address, the message and anything you attach (e.g. phone model, screenshot).

The game doesn’t request access to your location, contacts, photos, camera, microphone or files, has no chat and doesn’t let players send each other messages. It uses the vibration motor for haptic effects, which you can turn off in Settings.

Purposes and legal bases

Purpose	Legal basis (GDPR)
Running the game, the daily challenge and its leaderboard, granting and restoring purchases	performance of a contract — Art. 6(1)(b)
Personalized ads, storing and reading information on your device for advertising, advertising signals in Analytics	consent — Art. 6(1)(a); access to the device — Art. 399 of the Polish Electronic Communications Law
Non-personalized ads that keep the game free; ad measurement and fraud prevention	legitimate interests — Art. 6(1)(f), as described in Google’s consent form
Analytics without advertising, remote settings, crash reports	legitimate interests — Art. 6(1)(f) (improving the game and fixing bugs) [lawyer to confirm: consent or legitimate interests]
Checking daily challenge results and protecting the leaderboard (replay, App Check)	legitimate interests — Art. 6(1)(f) (a fair leaderboard)
Turning off purchases when Google Play signals a player under 18	legitimate interests — Art. 6(1)(f) (keeping an adult game for adults) and the conditions of Google Play
Answering messages, handling requests and complaints	legitimate interests — Art. 6(1)(f)
Keeping purchase records for tax and accounting	legal obligation — Art. 6(1)(c)

We don’t sell personal data for money. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. The server’s check of a daily challenge result only decides whether that result appears on the leaderboard.

In the game (EEA, UK, Switzerland): Settings → “Privacy and ads” reopens Google’s consent form. You can withdraw consent at any time; this doesn’t affect processing before withdrawal.
Android, everywhere: Settings → Google → All services → Ads — delete or reset your advertising ID. Without it, ads are not based on your interests.

Without consent you will still see ads, but they will not be personalized.

Recipients

Google Ireland Ltd. and Google LLC — Firebase (Analytics, Crashlytics, Remote Config, Authentication, Cloud Firestore, Cloud Functions, App Check) as our processor; Google AdMob, Google’s consent platform, Google Play (including Play Integrity and Play Age Signals) as independent controllers. Google Privacy Policy, how Google uses data from partner apps, Privacy and security in Firebase.
Ad partners in Google’s network — AdMob may let other ad buyers bid for ads in the game; in the EEA, the UK and Switzerland, only those you allow in the consent form. The list is shown in the consent form and on Google’s list of ad technology providers.
Other players — see your nickname, score, stages and rank on the daily leaderboard.
Google Workspace — our email is hosted by Google, which processes messages you send us as our processor.

We disclose data to public authorities only where the law requires it.

Where data is processed

Our daily challenge server and database run in Google Cloud in the European Union (Belgium, region europe-west1). Google’s other services and some ad partners process data in the United States and other countries outside the European Economic Area. Transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework, for participating companies) or the Commission’s Standard Contractual Clauses. Email us for a copy of these safeguards.

How long data is kept

Game data on your phone: until you uninstall the game or clear its data.
Daily challenge (anonymous account, nickname, results and move lists): while the daily challenge is available in the game, unless you ask us to delete them sooner. [set a retention period with the lawyer]
Google Analytics for Firebase: event data for no longer than 14 months.
Crashlytics: crash reports for up to 90 days.
Purchase records: as long as tax and accounting laws require (usually 5 years from the end of the year of purchase).
Correspondence: until the matter is resolved and for one year after, so we can show how it was handled.
Data held by Google and ad partners as independent controllers: according to their policies.

Deleting your data

On your phone: uninstall the game, or go to Android Settings → Apps → Velvet Rush → Storage → Clear data. This removes progress, settings, your consent choice and the age signal. Purchases come back from Google Play when you reinstall.
Daily challenge: email privacy@wumiko.games with your nickname and the days you played (with a score, if you remember it). We will delete your entries, move lists, nickname and anonymous account within one month and confirm by email. Uninstalling the game alone doesn’t delete them from the server: it only breaks the link between your phone and that anonymous account.
Analytics and crash reports: these are not linked to your name. Email us and we will help you find the identifier your request relates to.
Advertising ID: delete or reset it in Android Settings → Google → All services → Ads.

Your rights

You have the right to access your data (Art. 15 GDPR), rectify it (Art. 16), erase it (Art. 17), restrict processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time.

Because the game has no accounts with names or emails, we can’t link data to a specific person on our own. To exercise your rights, email privacy@wumiko.games — your nickname and the days you played are enough to find the daily challenge data. We reply within one month.

You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in the country where you live or work.

Canada, Australia and New Zealand

If you live in Canada, Australia or New Zealand, you have the right to ask what personal information we hold about you and to have it corrected or deleted; write to privacy@wumiko.games and we will reply within 30 days. The game doesn’t show a consent form in these countries; you can turn off interest-based ads at any time by deleting your advertising ID (see How to change your ad choices). Your data may be processed outside your country as described in Where data is processed. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Office of the Australian Information Commissioner (oaic.gov.au) or the Office of the Privacy Commissioner in New Zealand (privacy.org.nz).

Notice for US residents

Sharing data with ad partners for interest-based advertising may count as a “sale” or “sharing” of personal information under some state laws (e.g. California). You can opt out by deleting your phone’s advertising ID or by emailing us. We will not treat you differently for exercising these rights.

Adults only

Velvet Rush is made for adults (18+) and is not part of the Google Play Families program. We don’t knowingly collect data from children. If Google Play’s age signal says the player is under 18, purchases in the game are turned off; the signal stays on the phone and is not used for ads or analytics. If you believe a child has sent us personal data, let us know and we will delete it.

Do you have to provide data?

You don’t need to give us any data to play. The technical data collected by the ad, analytics and crash libraries is needed for the game to work and to stay free. Consent to personalized ads is optional — the game plays the same without it. The daily challenge is optional too: no result goes to the leaderboard unless you play it.

Changes

We publish the current version and its date on this page. If the game starts processing more data (for example other ad networks or cloud saves), we will update this policy before that version is released and tell you about significant changes in the game.