Privacy Policy

Pixel Art Collect for iPhone and iPad · Effective date: 23 October 2026

This policy explains what information the Pixel Art Collect game (“the game”) processes, why, and what choices you have. The game is developed by Simple Ideas (“we”, “us”). You can reach us at salih@simpleideas.net.

1. Information we process

1.1 Player account (Google Firebase Authentication)

When you first open the game, it signs in anonymously with Google Firebase Authentication. This creates a random player ID that does not contain your name, email address or any device identifier. Firebase stores this ID together with when the account was created and last signed in. To protect the sign-in service, Firebase may also process your IP address and basic information about your device and app version.

Sign in with Apple (optional). Before your first purchase, the game asks you to link your player account with Sign in with Apple, so that your purchases are tied to your account and can be recovered on another device. The game does not request your name or email address from Apple. Apple gives the game a sign-in token that contains a stable identifier for your Apple Account that is specific to our apps; Firebase uses it to link and verify your player account.

If you never link your account, nothing about you is stored in our database (see 1.3). Your random player ID and its sign-in dates still remain in Firebase Authentication until you delete your account (see 6).

1.2 Purchases (Apple In-App Purchase)

All payments are processed by Apple under Apple’s terms and privacy policy. We do not receive your card details, your Apple Account email address or your billing address.

When you buy an item, the game attaches to the purchase a hashed token derived from your player ID. Our server uses the transaction ID to ask Apple for the current state of the purchase (including refunds) and checks that the purchase belongs to your player account before it delivers the item. Apple also sends our server notifications about changes such as refunds.

1.3 Cloud wallet (Google Cloud Firestore, Frankfurt)

For players who link their account, our server keeps the following in Google Cloud Firestore in the europe-west3 region (Frankfurt, Germany), processed by our server functions in the same region:

• your player ID and platform (iOS);
• purchase records: product, Apple transaction ID, quantities granted and still unused, refund status and when it was last checked;
• your balance of purchased boosters and whether you own “Remove between-level ads”;
• a random installation ID created by the game (not a hardware or advertising identifier), used so that paid items are used on one device at a time and can be recovered;
• when you use a paid booster: a backup of that painting in progress, together with your booster inventory (free and purchased counts) and the play state needed to resume it, so the paid result is not lost. This backup is updated while that painting continues;
• a record of each paid item used, so it is never charged twice.

The game cannot read or write this database directly; only our server can.

1.4 Advertising (Google AdMob)

The game shows ads between levels and offers optional rewarded ads (for example, extra moves). These ads are provided by Google through Google AdMob, using the Google Mobile Ads SDK. They may come from Google’s own advertisers or from the third-party ad technology partners that Google works with. Google and these partners may collect and process, for advertising purposes (including interest-based advertising, ad measurement, fraud prevention and improving their advertising services), information such as your IP address (which may be used to estimate your general location), your device type, operating system and settings such as language, the name of the app, crash logs and performance data of the ad software (such as app launch time), how you interact with the app and its ads (such as app launches, taps and video views), identifiers for your device (the Identifier for Vendors, IDFV, and, only if you allow tracking, your Advertising Identifier, IDFA) and information about the ads you see. Third-party measurement partners may also collect and process data to measure ads as part of the IAB Tech Lab Open Measurement framework.

• Tracking permission.iOS asks whether you allow the game to track you. Only if you allow it can the Advertising Identifier be used. You can change this at any time in iOS Settings › Privacy & Security › Tracking.
• EEA, UK and Switzerland. Before personalised ads are shown, the game displays a consent form provided by Google’s User Messaging Platform. If you do not consent, Google may still show non-personalised ads, which are based on context such as the app and your general location rather than on your past activity, or limited ads, which do not use personal data to personalise ads. You can review or change your choices at any time in Settings › Privacy choices, which opens Google’s privacy options form.
• Remove between-level ads. This one-time purchase stops the automatic ads between levels. Rewarded ads remain available if you choose to watch them, so the ad software stays active in the game.

To learn how Google collects and uses your information, see the Google Privacy Policy and How Google uses information from sites or apps that use its services. For the EEA, the UK and Switzerland, Google publishes the list of ad technology partners that may serve and measure ads.

1.5 Information that stays on your device

Your painting progress and stars, settings such as language and theme, the painting in progress, free boosters and the game’s local copy of your account status are stored only on your device. They are not sent to us, with one exception: the paid-booster backup described in 1.3 also contains the painting in progress and your booster counts. They are included in your device backups (iCloud or computer) if you use them, and they are removed when you delete the game.

When you share a painting, the game creates the image on your device and opens the iOS share sheet. Where it goes next is up to you and the app you choose; we do not receive it. The game does not read your photo library or contacts and does not use location services. Google estimates your general (city-level) location from your IP address for ads and consent handling, as described in 1.4.

1.6 Links to other websites

Artwork and artist pages link to their sources, such as Wikimedia Commons and museum websites. These open in your browser and are governed by those websites’ own policies.

1.7 What we do not do

We do not use separate analytics, crash-reporting or attribution SDKs. The Google Mobile Ads SDK described in 1.4 and the purchase SDK (Unity IAP) described in 3 collect their own technical data. We do not ask for your name, email address, phone number, contacts, photos or location. We do not sell your personal information for money. Some laws (for example in certain US states) may treat the advertising described in 1.4 as “sharing” for targeted advertising; you can limit it by not allowing tracking (see 1.4).

2. Why we use information and our legal bases

• Providing the game, player accounts, purchases and the cloud wallet — to perform our agreement with you.
• Security, preventing fraud and double spending, handling refunds — our legitimate interest in protecting the game and its players, and legal obligations for keeping transaction records.
• Advertising — your consent where the law requires it (the consent form and iOS tracking permission); otherwise our legitimate interest in funding a free game with ads.

3. Who receives information

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions) — hosts our player accounts and server as our service provider. See Privacy and Security in Firebase.
• Apple — processes payments and Sign in with Apple under the Apple Privacy Policy.
• Unity Technologies (Unity IAP SDK) — receives technical purchase events to operate and improve its in-app purchase service. These include the product, price, currency, Apple transaction ID and receipt, a hashed player token, device identifier (IDFV), session identifier, device model, operating system, language, and app and SDK versions. See the Unity Privacy Policy and Unity IAP privacy information.
• Google (AdMob and the User Messaging Platform) and the ad technology partners Google works with — as described in 1.4.
• Authorities — when the law requires it.

Google processes our player-account and wallet data on our behalf under its data processing terms. Apple handles payments and Sign in with Apple under its own privacy policy. Google and its advertising partners process advertising data under their own policies. Unity processes purchase data under the Unity Data Processing Addendum and, where it acts as an independent controller, its privacy policy. These terms and policies describe each provider’s data protection obligations.

4. International transfers

Our database and server functions are located in Frankfurt, Germany. Firebase Authentication is operated from the United States. Google, its ad technology partners and Unity may process information in the United States and other countries. These companies use safeguards such as the European Commission’s Standard Contractual Clauses for transfers from the EEA and the UK.

5. How long we keep information

• Player account and cloud wallet: for as long as your account exists. They are not deleted automatically. You can delete your account in the game at any time, whether it is linked or a guest account (see 6).
• Purchase records: when you delete your account, the record of each completed purchase (product, Apple transaction ID, quantities, refund status and dates) is kept without any link to your player account, so that the same purchase can never be claimed again and refunds can be handled. It is kept for as long as these purposes require.
• Server logs: our server logs only the type of error, never your player ID or sign-in tokens. Google Cloud keeps technical request logs (such as IP address and time of the request) for a limited period, normally 30 days. Firebase keeps the IP addresses it logs at sign-in for a few weeks.
• Advertising data: kept by Google and its ad technology partners under their own policies.
• Technical purchase data sent to Unity: retained under Unity’s data processing terms and privacy policy linked in 3. Contact us for requests concerning purchase data processed on our behalf (see 7).
• Data on your device: until you delete the game.

6. Deleting your account

If your player account is linked with Sign in with Apple, open Settings › Player account › Delete account in the game. After you confirm and sign in with Apple once more, we permanently delete your player account and its link to your Apple Account, revoke the game’s Sign in with Apple authorization, and delete your cloud wallet: purchased boosters, “Remove between-level ads” ownership, painting backups, installation and usage records. Purchase records are kept without your account as described in 5. Your painting progress and free boosters stay on your device, and the game continues with a new guest account.

If you never linked your account (guest), our database holds nothing about you; only your anonymous player ID and its sign-in dates remain in Firebase Authentication (see 1.1). You can delete it in the game too: open Settings › Player account › Delete account and confirm; no sign-in is needed. We then delete your anonymous player ID, and the game continues with a new guest account. If you can no longer open the game, email us at salih@simpleideas.net. Because a guest account has no name or email address, we may ask you for information that helps us find it (see 7).

Deleted purchases cannot be restored later, even with the same Apple Account. Deleting your account does not cancel or refund purchases; refunds are handled by Apple at reportaproblem.apple.com. You can also stop using Sign in with Apple with the game in iOS Settings, under your Apple Account › Sign in with Apple. If you can no longer open the game, email us and we will help.

7. Your rights

Depending on where you live (for example under the EU and UK GDPR or Turkey’s Personal Data Protection Law, KVKK), you may have the right to access, correct or delete your information, to restrict or object to its use, to receive it in a portable form, and to withdraw consent at any time. You also have the right to complain to your data protection authority. To use these rights, email salih@simpleideas.net. Because we do not know your name or email address, we may ask you for information that lets us find your player account. We answer within the time limits set by law.

8. Children

The game is not directed at children under 13, or under the minimum age for consenting to data processing in your country. We do not knowingly collect personal information from children. If you believe a child has used the game and we hold their information, contact us and we will delete it.

9. Security

All communication between the game and our server is encrypted (HTTPS). Every request is verified with a Firebase sign-in token, the database cannot be accessed directly from the game, and our logs exclude player IDs, tokens and purchase receipts. No system is perfectly secure, but we work to protect your information.

10. Changes to this policy

If we change this policy, we will publish the new version on this page with a new effective date.

11. Contact

Simple Ideas · salih@simpleideas.net