Poo-doku Privacy Policy

This policy explains what information the Poo-doku puzzle game (Android package com.poodoku.game) collects, why, who we share it with, and the choices and rights you have. Poo-doku is made by ZERF Studios (“we”, “us”). If anything here is unclear, email us at privacy@zerfstudios.com.

1. Who we are

ZERF Studios, a game studio based in India, is responsible for your personal data processed through Poo-doku. Under the EU and UK General Data Protection Regulation (GDPR) we are the “controller”, and under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we are the “Data Fiduciary”.

Contact: privacy@zerfstudios.com. Details of our Grievance Officer are in section 13.

2. What we collect and why

2.1 Game data stored on your device

Your progress (completed stalls, stars and best times), current stall, achievements, Daily Drop streak, sound and control settings, your leaderboard name, your age group (under 13, 13–17 or 18 and over, from the year of birth you enter on first launch; the year itself is not kept), your privacy choices, and a record of which upgrades you own are stored locally on your phone. This data is not sent to us except as described below. Settings → Reset Data clears your progress, stars and streaks (purchases are kept). Uninstalling the game, or clearing its storage in Android settings, removes everything stored on your device.

2.2 Global leaderboards

When you complete a stall or the Daily Drop, the game posts a leaderboard entry to Google Firebase Cloud Firestore. An entry contains:

• your leaderboard name (a random name such as “Sparkle Queen #82” unless you change it),
• the stall number, or the date for a Daily Drop,
• your completion time and stars earned, and
• the time the entry was created.

Leaderboards are public: other players can see your leaderboard name, times and stars. Please don’t use your real name or other personal information as your leaderboard name. We use these entries only to run the leaderboards and to keep them fair.

2.3 Advertising (Google AdMob)

Poo-doku shows banner, full-screen (interstitial) and optional rewarded video ads through Google AdMob. To serve and measure ads, prevent fraud and limit how often you see them, Google receives information such as your device’s advertising ID, IP address (from which an approximate location is derived), device and app information, and how you interact with ads. Where the law requires it, ads are personalised only if you agree; otherwise Google shows non-personalised ads. For players under 18, the game tells Google to treat ad requests as coming from a child (under 13) or from a user under the age of consent (13–17): ads are not personalised and are limited to content rated suitable for that age. Google’s use of this data is described at policies.google.com/technologies/ads.

2.4 Purchases (Google Play Billing and the App Store)

Upgrades such as Standard No-Ads and the Royal Club subscription are sold through Google Play or Apple’s App Store. Google or Apple processes the payment and handles your payment details under the Google Payments Privacy Notice or Apple’s Privacy Policy. We receive only what’s needed to unlock the upgrade: the product purchased, its status and a purchase token (on the App Store, the signed transaction Apple gives the app). We never receive your card or bank details, your name or your email address.

To stop upgrades being unlocked without paying, the game sends the purchase token to our server (Google Firebase Cloud Functions), which asks Google Play or Apple whether the purchase is real and still active. Our server keeps a record of each purchase it checks: the product, its status, when it ends, the store’s order or transaction number, whether it was a test purchase and when it was last checked. This record isn’t linked to your leaderboard name, advertising ID or game progress. Subscription terms are in our Terms of Use.

2.5 Google Play Games Services (optional)

If you are signed in to Google Play Games, the game can save your progress to your Play Games cloud storage and unlock Play Games achievements. This uses your Play Games player ID and profile name and is governed by Google’s Privacy Policy. You can manage or delete Play Games data in the Google Play Games app.

2.6 Game analytics (Google Firebase Analytics), with your permission

To understand how players progress and stay engaged, so we can improve the game, we use Google Firebase Analytics (Google Analytics for Firebase). It collects:

• an app instance ID (a random identifier for your install of the game), device model, operating system, language, app version, and country or region derived from your IP address;
• app opens, sessions and in-app purchases, and, where you have agreed to it, ad impressions;
• a small number of gameplay milestones: finishing or skipping the tutorial, reaching certain numbers of completed stalls, completing a chapter, completing the Daily Drop (with your streak), and watching a rewarded video;
• how each stall is played, so we can tune how hard the stalls get: when you start, finish, fail or leave a stall, its number and difficulty, how long it took, how many hearts were left, whether you used hints or revives, and when the game showed a full-screen ad, a hint offer or an offer to remove ads, or offered and you used a way to keep a Daily Drop streak;
• which screen of the game you are on (such as the home screen, a stall, the leaderboard or the shop) and how long you spend there;
• your first steps and your sticking points: starting the tutorial and each step of it you complete, starting a Daily Drop, a Daily Drop streak ending (with its length), the game pausing because your phone is offline and for how long, and what you choose on the Game Over screen (revive, the shop or leaving);
• your visits to the shop: opening it and what led you there, starting a purchase, and a purchase being cancelled or not going through (completed purchases are covered above);
• how the ads in the game went: when you ask for a rewarded video and whether it played, and when an ad could not be loaded or shown;
• markers of how far and how often you play: reaching 5, 10, 25 and 50 completed stalls, coming back to the game 1, 3 and 7 days or more after you first played, and the first rewarded video you watch;
• a band for how much advertising revenue the ads shown in your game have earned in total (the total itself is kept on your device and is not sent);
• your membership type (free, Standard or Royal Club), a range for how many stalls you have completed, a range for your Daily Drop streak, whether reminders are turned on, and how much visual effect the game shows on your phone (high, medium or low), including when the game lowers it because the phone runs it slowly.

We use this data only in aggregated reports, for example to see how many new players come back after a week. We do not use it to identify you. Analytics is turned on only for players aged 18 or older who agree, where agreement is required (see section 4).

2.7 Crash reports (Google Firebase Crashlytics), with your permission

To find and fix crashes, freezes and errors, we use Google Firebase Crashlytics. When the game crashes, stops responding or hits an error, it sends a report containing the technical details of the problem (such as the error message and where in the game’s code it happened), your device model, operating system version, app version, free memory and storage, whether the phone is rooted, a random installation ID, and your membership type and range of completed stalls from 2.6. Reports don’t include your leaderboard name or your progress details. Crash reporting follows the same permission as game analytics: it is only turned on for players aged 18 or older who agree, where agreement is required. Otherwise reports are deleted on your device without being sent.

2.8 Remote game settings and trials (Google Firebase Remote Config and A/B Testing)

The game downloads a few settings from Google Firebase Remote Config, such as how often full-screen ads may appear or how much visual effect the game shows, so we can adjust them without releasing an update. To do this it sends a random installation ID, the app version, and your device’s operating system version, language, country setting and time zone. This is needed for the game to work as intended, so it applies to all players, but it is not used to track you or build a profile.

Sometimes we try a setting on part of the players before changing it for everyone (Google Firebase A/B Testing). Which group an install falls into is decided at random from its installation ID. To see which version works better, Firebase compares the groups using the game analytics in 2.6. So only players who have game analytics turned on are counted: for them, Firebase also records which group they are in, and can use the details in 2.6 (such as your membership type) to decide which settings your game gets. Players under 18, and players who have not agreed to analytics, may still get one version of a setting, but nothing about how they play is collected.

2.9 Advertising measurement (Meta and Google Ads), with your permission

We advertise Poo-doku on Facebook and Instagram. To learn which of our ads lead to installs and engaged players, the game uses Meta’s App Events software (the Meta SDK). With your permission, it sends Meta Platforms, Inc. and Meta Platforms Ireland Ltd. your advertising ID, device and app information, IP address, the fact that you installed and opened the game, the gameplay milestones listed in 2.6 (not the stall-by-stall details), and purchases (product, price and currency). Meta may combine this with information it already has about you, in line with the Meta Privacy Policy. This is turned on only for players aged 18 or older who agree, where agreement is required, and is turned off if you opt out of the “sale” or “sharing” of your data under US state laws. It never includes your leaderboard name or game progress details beyond those milestones.

We also advertise Poo-doku through Google Ads. To learn which of our ads lead to installs and engaged players, and to show our ads to people likely to enjoy the game, Google Analytics for Firebase passes Google Ads the fact that you installed the game after one of our ads, together with the markers in 2.6 (such as reaching 10 completed stalls or coming back after a day) and the revenue of the ads shown in your game. Google links these to your advertising ID. This happens only for players aged 18 or older who agree, where agreement is required, and stops if you opt out of the “sale” or “sharing” of your data under US state laws.

2.10 In-app ratings (Google Play In-App Review)

From time to time the game may show Google Play’s rating window. Your rating and review go directly to Google Play; we do not see whether you rated the game or what you wrote until your review is published on Google Play.

2.11 Daily Drop reminders

If you turn on Daily Drop reminders, the game schedules at most one notification a day on your phone, never between 9 pm and 9 am: when you haven’t played that day’s Daily Drop yet, a few hours before your streak would end, or after a few days away. To pick a good time and the right words, it keeps on your phone the hours you recently opened the game, the last day you played, your Daily Drop streak and your next stall. They are scheduled and shown by your phone alone: none of this is sent to us or anyone else, and we don’t use push notifications. You can turn them off in Settings, on the Daily Drop screen, or in your phone’s notification settings.

2.12 Technical requests

Like any app that uses the internet, the game’s requests reveal your IP address and basic device information to the servers it contacts. Besides the services above, the game checks your connection by contacting google.com and loads its typefaces from Google Fonts.

App integrity checks. To keep the leaderboards fair and stop modified copies of the game from unlocking upgrades, the game uses Google Firebase App Check. On Android it asks Google Play’s Play Integrity service, and on iOS Apple’s App Attest service, to confirm that the request comes from the genuine Poo-doku app on a real device. Google or Apple receives information about the app and device needed for that check, under their own privacy policies; we receive only a yes-or-no token, not your identity. It applies to every player, as a security measure.

2.13 What we do not collect

We do not collect your name, email address, phone number, contacts, precise location, photos, camera or microphone input, or any account details. The game has no chat or messaging.

3. Legal bases (EEA, UK and Switzerland)

Under India’s DPDP Act we process personal data on the basis of your consent or for legitimate uses permitted by the Act, such as providing a service you asked for.

4. Your choices and consent

• Age screen: on first launch the game asks for your year of birth. If you are under 18, analytics, crash reports and Meta measurement stay off and ads are limited as described in 2.3; there is nothing further to choose.
• Consent prompt: for players aged 18 or older, where the law requires it (for example in the EEA, the UK and Switzerland), the game shows Google’s consent form before any ads are requested or analytics, crash reporting or Meta measurement starts.
• Change your mind at any time: open Settings → Privacy choices in the game. There you can switch analytics, crash reports and ad measurement off (or back on), and, where it applies, reopen Google’s consent form with Manage ad consent. In US states with privacy laws, that is also where you choose “Don’t sell or share my data”. Withdrawing consent stops future collection; it does not affect what was lawfully collected before.
• Advertising ID: you can reset or delete your advertising ID in Android settings (usually Settings → Privacy → Ads or Settings → Google → Ads). Once it is deleted, apps can no longer use it for ads or measurement.
• Leaderboard name: change it at any time with the pencil next to your name on the home screen, or from the leaderboard screen. Entries you already posted keep the name they were posted with; email us if you want those removed.
• Stop all collection: uninstalling the game stops all data collection from your device.

5. Who we share it with

We share information only with the service providers that run parts of the game, and only for the purposes above:

We may also disclose information if required by law or a valid legal request, to protect players or the game from fraud and abuse, or as part of a merger or sale of our business, in which case this policy continues to apply.

Selling and sharing (US state laws): we do not sell personal information for money. Some US state laws (such as California’s CCPA/CPRA) treat giving advertising identifiers to ad partners for personalised advertising as “selling” or “sharing”. You can opt out by declining or withdrawing consent in Settings → Privacy choices, by deleting your advertising ID, or by emailing us. We do not collect sensitive personal information.

6. International transfers

Google and Meta process data on servers in the United States and other countries. Where data from the EEA, UK or Switzerland is transferred, these providers rely on safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

7. How long we keep it

• Game data on your device: until you reset your progress, clear the game’s storage or uninstall it.
• Leaderboard entries: for as long as the leaderboard exists, unless you ask us to delete them.
• Analytics data: detailed event data is kept for up to 14 months, after which only aggregated reports remain.
• Crash reports: kept for 90 days.
• Advertising and Meta data: kept by Google and Meta under their own retention policies.
• Purchase records: kept by Google Play or Apple as required by law. Our own record of a purchase check (2.4) is deleted 3 years after the purchase was last checked.

8. Your rights

Depending on where you live, you have some or all of these rights:

• EEA, UK and Switzerland (GDPR): to access, correct or delete your data, to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to your local data protection authority.
• India (DPDP Act): to obtain a summary of your personal data and how it is processed, to correct, complete, update or erase it, to have your grievances addressed, and to nominate another person to exercise your rights if you die or become unable to do so.
• California and other US states: to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of “sale” or “sharing” for personalised advertising. We will not discriminate against you for using these rights.

How to make a request: email privacy@zerfstudios.com. Because the game has no accounts, please include your leaderboard name and roughly when you played, so we can find your entries. We will reply within 30 days (45 days where US state law allows). Data kept only on your device can be removed by you at any time by resetting progress or uninstalling the game. Analytics data is linked only to a random app instance ID, not to you, so we may be unable to identify which analytics data is yours; withdrawing consent stops it being collected.

9. Leaderboard names

Leaderboard names are shown publicly, so they must follow the rules in our Terms of Use: nothing offensive, hateful, sexual, impersonating or containing personal information. Names are checked against a word filter when you set them. To report a name, tap the flag next to it on the leaderboard; this sends us the name and the leaderboard it appeared on, and hides it for you straight away. You can also email privacy@zerfstudios.com with the name, the stall or Daily Drop date where you saw it, and why you are reporting it. We review reports and remove names that break the rules.

10. Children

Poo-doku is intended for players aged 13 and older and is not directed at children. Because younger players may still use it, the game asks every player for their year of birth on first launch and treats everyone under 18 as a minor, which covers the age limits in the US (COPPA, under 13), the EU and UK (13 to 16 depending on the country) and India (under 18 under the DPDP Act). For minors:

• no analytics, no crash reports and no Meta or Google Ads advertising measurement are collected;
• ads are never personalised, Google is told the player is a child or under the age of consent, and only age-appropriate ads are shown;
• leaderboards show a randomly generated name only, which the player can’t change.

We do not knowingly collect personal information from children beyond what is needed to run the game as described here. If you believe a child has shared personal information with us, contact us and we will delete it.

11. Security

Information is sent over encrypted connections (HTTPS). Leaderboard data is protected by access rules that allow the game only to add entries in a fixed format, and not to change or delete other players’ entries. Because the game has no accounts, there are no passwords that could be stolen. No system is completely secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

12. Changes to this policy

We may update this policy as the game changes or the law requires. We will change the “Last updated” date above and, for significant changes, tell you in the game or on its Google Play listing before the changes take effect.

13. Contact and grievances

For privacy questions, requests or complaints, including grievances under India’s Information Technology Act, 2000 and the DPDP Act, contact our Grievance Officer:

Grievance Officer, ZERF Studios
Email: privacy@zerfstudios.com
Location: India

We acknowledge grievances promptly and aim to resolve them within 30 days. If you are in the EEA, UK or Switzerland, you can also contact your local data protection authority. In India, you may escalate an unresolved complaint to the Data Protection Board of India.