Privacy Policy

This privacy policy explains which personal data is processed when you play YORU, our endless runner game for Android and iOS, and when you visit this website. It describes why this happens, who receives the data, how long it is kept and which rights you have.

1. Controller and contact

The controller responsible for processing personal data under the EU General Data Protection Regulation (GDPR) is:

Please send all privacy questions and requests to this email address.

2. Scope

This privacy policy applies to:

• the game YORU for Android (package name com.slash.yoru), distributed through Google Play,
• the game YORU for iPhone and iPad (bundle ID com.slash.yoru), distributed through Apple's App Store, and
• this website (yoru.sb-techworks.de, also available at yoru-d5a01.web.app). The website itself does not use cookies, scripts, analytics tools or content from other servers. When you visit it, our hosting provider processes request data such as your IP address (see section 5.11).

Both versions of the game process data in the same way unless this policy says otherwise. Where they differ, the text names the platform (“on Android”, “on iOS”); “iOS” also covers iPadOS.

Links to other websites, for example to the privacy policies of our service providers, lead to content for which the respective provider is responsible.

3. Summary

• YORU has no user accounts. You do not register or sign in, and the game never asks for your name, email address or other contact details. There are no text input fields in the game.
• We do not operate our own servers. Data leaves your device only through the services of Google and Unity and, on iOS, of Apple (App Store purchases and Game Center) described in section 5.
• In the European Economic Area (EEA), the United Kingdom and Switzerland, the game asks for your consent on first start. Google Analytics for Firebase and Firebase Crashlytics only send data if you have consented (details in section 4), and ads are only requested after the consent process has been completed. Outside these regions, these services are active without a consent prompt. On iOS, the advertising identifier (IDFA) is only used if you allow tracking in Apple's App Tracking Transparency prompt (section 4).
• Payments for in-app purchases are handled by Google Play on Android and by Apple's App Store on iOS. The Unity In-App Purchasing library used by the game also sends purchase data to Unity, independently of your consent choices.
• The data from Google Analytics, Crashlytics and AdMob that is available to us is pseudonymous (for example crash reports linked to a random installation ID) or aggregated.
• You are not legally or contractually obliged to provide personal data. When you play YORU, however, your IP address and device information are transmitted to Google to run the consent tool (section 4) and to request ads (at least limited ads, section 5.1). In-app purchases are only possible through Google Play with a Google account (Android) or through the App Store with an Apple Account (iOS) and involve the transfers described in sections 5.4, 5.5 and 5.6. If you decline consent in the consent dialog, all game features remain available; you then see non-personalized or limited ads.
• You can object to processing based on legitimate interests at any time (right to object).

4. Consent and your privacy choices

When you start YORU for the first time, the game (on Android and on iOS) uses Google's User Messaging Platform (UMP), a consent management platform registered with IAB Europe's Transparency & Consent Framework (TCF). Based on your location, Google's consent tool determines whether consent is required. In the EEA, the UK and Switzerland it shows a consent dialog in which you can accept or decline individual purposes and advertising partners. The dialog appears again if Google's consent tool requires a new decision. Your choices are stored on your device in the standardized TCF format. How Google uses data from apps that use its services is explained at policies.google.com/technologies/partner-sites.

Data processed by the consent tool

Data

Each time the game starts, in all regions and before any consent, Google's consent tool contacts Google's servers to check whether consent is required and to load the dialog. This transmits your IP address, which Google uses to determine your region, and technical information such as the app ID. Your choices are stored on your device.

Purposes

Determining whether consent is required, showing the dialog, and storing and documenting your choices.

Legal basis

Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (we must be able to demonstrate consent) and Art. 6(1)(f) GDPR (our legitimate interest in asking for consent only where it is required). Storing your choices on your device is strictly necessary for this (§ 25(2) No. 2 TDDDG, Art. 5(3) sentence 2 ePrivacy Directive).

Recipient

Google. Google lists its consent management service (“Funding Choices”, now “Privacy & messaging”) as a service for which it acts as an independent controller (Google's list of controller services).

Storage period

On your device until you delete the app's data or uninstall the game. For data on Google's servers, see Google's retention policy.

What depends on your choices

• Google Analytics for Firebase and Firebase Crashlytics (5.2, 5.3) are switched off by default. The game only switches them on if you consent to “Store and/or access information on a device” (TCF purpose 1) and to at least one of “Measure content performance” (purpose 8), “Understand audiences through statistics or combinations of data from different sources” (purpose 9) or “Develop and improve services” (purpose 10). This consent also covers making Analytics data available to Google AdMob as described in 5.2.
• Game events that occur while analytics is switched off (before your decision, while the privacy dialog is open, or after you declined or withdrew consent) are kept in the game's memory, at most 64 events, until the game is closed. They are only sent to Google if you consent during the same session; otherwise they are discarded when the game is closed. For crash reports, see 5.3.
• The same choices control the advertising-related consent signals the game passes to Google Analytics: storage of advertising identifiers (purpose 1), sending user data to Google for advertising (purposes 1 and 7, “Measure advertising performance”) and ad personalization (purposes 1, 3 “Create profiles for personalised advertising” and 4 “Use profiles to select personalised advertising”).
• Advertising (5.1): the game only requests ads after the consent process has been completed. Google then reads your choices and decides whether to show personalized, non-personalized or limited ads. As long as the consent process has never been completed, for example because you were offline on first start, the game shows no ads.
• The following does not depend on your choices: purchase data that the Unity In-App Purchasing library sends to Unity (5.6), the automatic analytics and diagnostic data of the Google Play Games Services library on Android (5.9), Apple Game Center on iOS if you are signed in to it (5.10) and the request of the consent tool itself (see above).

On iOS: App Tracking Transparency

On iPhone and iPad, an app needs your permission through Apple's App Tracking Transparency (ATT) before it may track your activity across apps and websites of other companies and before it can access your device's advertising identifier (IDFA). YORU asks for this permission with Apple's system prompt after the consent process described above and before the first ad is requested, and only if personalized ads are allowed: in the EEA, the UK and Switzerland only if you consented in the consent dialog to TCF purposes 1, 3 and 4 (see above), elsewhere always. If you did not consent to personalized ads, the game does not show the prompt. Google's consent tool can also show a short explanation followed by Apple's prompt as part of its own dialog; the game then does not ask again.

• If you tap “Allow”, Google AdMob and Google Analytics for Firebase can use the IDFA as described in 5.1 and 5.2.
• If you tap “Ask App Not to Track”, if you were not asked, or if tracking is restricted on your device, the game and the libraries it contains cannot access the IDFA. According to Apple, the app is then also not permitted to track your activity using other information that identifies you or your device. You can still use every feature of the game.
• You can give or withdraw this permission at any time in iOS under Settings → Privacy & Security → Tracking. In the EEA, the UK and Switzerland, your choices in the consent dialog apply in addition.

Outside the EEA, the UK and Switzerland

Outside these regions the game does not show a consent dialog. Google Analytics for Firebase, Firebase Crashlytics and personalized advertising (on iOS only if you allow tracking, see above) are active from the first start. You can object to this at any time (right to object). To stop personalized ads, delete your advertising ID in your device settings on Android, or do not allow tracking or turn it off on iOS (section 8.2). The game currently has no switch for analytics and crash reporting outside these regions; uninstalling the game ends all processing, and you can send us your objection by email (section 1).

Changing or withdrawing your consent

In the EEA, the UK and Switzerland you can change your choices or withdraw your consent at any time in the game under SETTINGS → PRIVACY OPTIONS. While the dialog is open, analytics is paused. Afterwards the game applies your new choices. If you withdraw consent, analytics stops immediately and crash reporting stops from the next start of the game. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

SETTINGS → PRIVACY POLICY in the game opens this page.

5. Data processing in detail

For each service, this section lists the data concerned, the purposes, the legal basis, the recipients and the storage period. Legal bases refer to Art. 6(1) GDPR: (a) consent, (b) performance of a contract, (c) legal obligation, (f) legitimate interests. Where consent is the legal basis, storing and reading information on your device is additionally based on your consent under the national rules implementing Art. 5(3) of the ePrivacy Directive (2002/58/EC), in Germany § 25(1) TDDDG. Where we do not rely on your consent, the game itself stores on your device only what is strictly necessary to provide the game you have requested (§ 25(2) No. 2 TDDDG, Art. 5(3) sentence 2 ePrivacy Directive): your save file and the hashed transaction identifiers of delivered purchases (5.7) and your consent choices (section 4). The Google and Unity libraries described in 5.1, 5.6 and 5.9 also read or store information on your device, as described there.

5.1 Advertising: Google AdMob

YORU is free to play and financed by advertising. It shows full-screen ads between runs (interstitials) and optional rewarded video ads that you can choose to watch to continue a run or to double your coins. The “Remove Ads” purchase turns off interstitials only. Rewarded ads remain available and optional.

Provider

Google, through the Google Mobile Ads SDK (AdMob). For AdMob, Google acts as an independent controller (Google's list of controller services).

Data

According to Google's disclosures for Android and iOS, the SDK collects:

• your device's IP address, which may be used to estimate the general location of the device;
• interactions with the app and ads, such as app launches, taps and video views;
• diagnostic information, such as app launch time, hang rate and energy usage, and on iOS also crash logs of the SDK;
• on iOS also advertising data, such as the ads you have seen;
• device identifiers: on Android the Android advertising ID, the app set ID and, if applicable, other identifiers related to accounts signed in on the device; on iOS the advertising identifier (IDFA, only if you allow tracking, see section 4) and other app- or developer-bound device identifiers.

Purposes

Selecting, delivering and measuring ads, analytics and fraud prevention. How Google uses data from apps that use its services: policies.google.com/technologies/partner-sites. Which kind of ads you see depends on your choices:

• Personalized ads are based on a profile of your interests.
• Non-personalized ads are based on context, such as the app and your coarse location (for example the city). According to Google, they still use the advertising ID for frequency capping and aggregated ad reporting.
• Limited ads can be shown if you do not consent to storing and accessing information on your device (TCF purpose 1). According to Google, they do not use personal data for personalization. Your IP address is still used to deliver them, and, according to Google, Google may store information on your device solely to detect invalid traffic and fraud.

Legal basis

In the EEA, the UK and Switzerland: your consent (Art. 6(1)(a) GDPR) for the purposes you accept in the consent dialog. For some purposes, Google and other advertising partners rely on their legitimate interests instead (Art. 6(1)(f) GDPR). For Google, these are, according to its entry in the IAB Europe Global Vendor List, “Use limited data to select advertising”, “Measure advertising performance”, “Understand audiences through statistics or combinations of data from different sources” and “Develop and improve services”. You can object to this in the consent dialog. If you do not consent, the game still requests non-personalized or limited ads. Transmitting the data needed for this, in particular your IP address and the ad request, is based on our legitimate interest in financing the free game through advertising (Art. 6(1)(f) GDPR). If you do not consent to purpose 1, any storage on your device is carried out by Google solely to detect invalid traffic (see “Limited ads” above). Outside these regions: Art. 6(1)(f) GDPR, for the same interest, including for personalized ads. On iOS, the IDFA is only used if you allow tracking (section 4).

Recipients

Google. Google may share data with other ad technology providers, such as advertisers and ad networks that buy ad space through Google. In the EEA, the UK and Switzerland, the consent dialog lists these partners together with their purposes (see also Google: ad technology providers).

Storage period

According to Google, Google anonymizes advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months. In the IAB Europe Global Vendor List (vendor 755, “Google Advertising Products”), Google declares a standard retention period of 548 days, 180 days for creating and using profiles for personalized advertising, and 1,096 days for security, fraud prevention and fixing errors. Other partners' storage periods are described in their own privacy policies, which the consent dialog links to.

5.2 Google Analytics for Firebase

Provider

Google, as our processor (Google Analytics for Firebase is a processor service).

Data

• Game events we record, including: app start; start and end of a run (score, best score, whether it was a new record, average frame rate); tutorial progress; purchases in the in-game shop (cars, customizations, upgrades, exchanging gems for coins); in-app purchases (product, type, gems and coins granted) and restored purchases; daily rewards, missions and achievements; whether an interstitial ad was shown or suppressed, and the ad revenue per ad; the result of the consent dialog.
• User properties: whether you have made a purchase, whether you own “Remove Ads”, your number of runs, your high score and the graphics quality level of your device.
• Performance data: graphics quality level, device memory (RAM) and frame rate.
• Data that Google Analytics collects automatically, such as first start, sessions, engagement time, screen views and in-app purchases (product ID, product name, price), as well as app version, device model, operating system version and language.
• Approximate location (country, region, city), derived from your IP address. According to Google, Google Analytics does not log or store IP addresses of users in the EU, Switzerland and the UK; the IP address is only used to derive the location and is then discarded.
• Identifiers: the app instance ID and the Firebase installation ID. If storage of advertising identifiers is allowed (in the EEA, the UK and Switzerland: TCF purpose 1; elsewhere: by default), Google Analytics also collects the advertising ID of your device: on Android the Android advertising ID, on iOS the IDFA, which iOS only makes available if you allow tracking (section 4).

Purposes

Understanding how the game is played so that we can improve difficulty, progression, the in-game economy and performance, and measuring purchases and ad revenue.

Legal basis

In the EEA, the UK and Switzerland: your consent (Art. 6(1)(a) GDPR, see section 4). Outside these regions: Art. 6(1)(f) GDPR; our legitimate interest is improving the game.

Recipients

Google as our processor. In addition, our AdMob account is linked to our Firebase project. According to Google, Google Analytics data (including purchase and gameplay events) is therefore available to AdMob independently of our Analytics data-sharing settings, where Google uses it “to enhance product features and improve app monetization”. For AdMob, Google acts as an independent controller (5.1). Legal basis for making the data available to AdMob: in the EEA, the UK and Switzerland, your consent (Art. 6(1)(a) GDPR), because Google Analytics only runs with your consent; outside these regions, Art. 6(1)(f) GDPR (our interest in financing the game through advertising).

Storage period

User-level and event-level data is deleted after at most 14 months (data retention setting of our Google Analytics property; see Google: data retention). Aggregated reports are not affected by this setting.

5.3 Firebase Crashlytics

Crashlytics reports crashes and errors to us, in the Android and in the iOS version of the game. Two related Firebase components are part of it: Firebase Sessions (records when the app comes to the foreground) and Firebase Installations (provides the installation ID).

Provider

Google (Firebase), as our processor (Firebase: privacy and security).

Data

• Crash reports: stack traces of crashes and uncaught errors, including native crashes (on Android with data from native crash dumps, minidumps).
• Non-fatal errors, for example a failure to load or save your game progress.
• A short log of recent game events, for example the start and end of a run with the score, and changes of the consent status.
• Technical context: app version, Unity version, build type, device memory (RAM), graphics API, graphics quality level, selected car, save file version, number of app starts, and device metadata such as device model and operating system version.
• Firebase Sessions: the time a session starts, app and device metadata and the network type.
• Firebase Installations: the Firebase installation ID and a user agent with device, operating system and app information; on Android, it also includes the source from which YORU was installed (for example Google Play).
• Identifiers: the Crashlytics installation UUID and the Firebase installation ID.

Purposes

Detecting, analyzing and fixing crashes and errors.

Legal basis

In the EEA, the UK and Switzerland: your consent (Art. 6(1)(a) GDPR), under the same conditions as Google Analytics (section 4). Crashlytics only sends reports while crash reporting is allowed. While crash reporting is off (before your decision or after you declined), crash information and the related log entries are stored on your device; if you allow crash reporting later, these stored reports are sent. If you withdraw consent, crash reporting stops from the next start of the game. Outside these regions: Art. 6(1)(f) GDPR; our legitimate interest is a stable, error-free game.

Recipients

Google as our processor.

Storage period

According to Firebase, Crashlytics keeps crash stack traces, extracted minidump data and associated identifiers (including Crashlytics installation UUIDs and Firebase installation IDs) for 90 days before starting the process of removing them from live and backup systems.

5.4 Purchases on Android: Google Play Billing

You can buy gems, the “Remove Ads” upgrade and other items with real money. On Android, these purchases are processed by Google Play.

Provider

Google (Google Play). Google processes your payment under its own terms and privacy notices, in particular the Google Payments Privacy Notice.

Data

• We never receive your payment card or bank details.
• To deliver a purchase, the game receives the purchase details from Google Play (product, order number, time of purchase and purchase token).
• Google provides us with sales reports that include, among other things, the order number, product, price, currency and the buyer's country, state or region and postal code.

Purposes

Completing and delivering purchases, restoring purchases, accounting and tax.

Legal basis

Art. 6(1)(b) GDPR (performance of the purchase contract); for sales reports also Art. 6(1)(c) GDPR (accounting and tax obligations).

Recipients

Google; Unity (see 5.6).

Storage period

The game keeps shortened, hashed transaction identifiers (purchase tokens) of the last delivered purchases on your device to prevent double delivery (5.7). We keep sales reports for the statutory retention periods for accounting records and delete them afterwards (in Germany, for example, up to 10 years under § 147 of the German Fiscal Code).

5.5 Purchases on iOS: Apple App Store

On iPhone and iPad, the same items are sold through Apple's App Store. The game uses Apple's StoreKit interface for this; Apple handles the payment.

Provider

Apple. Apple processes your payment and your Apple Account data as an independent controller under its own terms and its privacy policy (see also App Store & Privacy). According to Apple, personal data of individuals in the EEA, the UK and Switzerland is controlled by Apple Distribution International Limited in Ireland.

Data

• We never receive your payment card or bank details or your Apple Account details.
• To deliver a purchase, the game receives the transaction details from the App Store (product, transaction ID and time of purchase, signed by Apple).
• Apple provides us with sales and financial reports, for example per product and country with the number of units, price, proceeds and currency. These reports do not contain your name or contact details.

Purposes

Completing and delivering purchases, restoring purchases (RESTORE PURCHASES in the in-game store), accounting and tax.

Legal basis

Art. 6(1)(b) GDPR (performance of the purchase contract); for sales reports also Art. 6(1)(c) GDPR (accounting and tax obligations).

Recipients

Apple; Unity (see 5.6).

Storage period

The game keeps shortened, hashed transaction IDs of the last delivered purchases on your device to prevent double delivery (5.7). We keep sales reports for the statutory retention periods for accounting records and delete them afterwards (in Germany, for example, up to 10 years under § 147 of the German Fiscal Code).

5.6 Purchases: Unity In-App Purchasing

YORU uses the Unity In-App Purchasing library to communicate with Google Play Billing on Android and with Apple's App Store (StoreKit) on iOS. This library automatically sends purchase event data to Unity over an encrypted connection (HTTPS): when you start a purchase (even if the game cannot connect to the store at that moment), when a payment is completed or fails, and when a purchase is delivered. This includes the automatic delivery of earlier, not yet delivered purchases when you start or return to the game.

Provider

Unity Technologies (USA). According to Unity, Unity processes transaction and in-app purchase data on our behalf as a processor, and uses transaction and billing data as an independent controller for its own purposes, such as financial reporting, auditing, compliance and fraud prevention.

Data

• Purchase data: product ID, product name, description and price as shown in the store, currency, transaction ID, the purchase receipt issued by the store (on Android by Google Play, including order number and purchase token, and its signature; on iOS by the App Store), and the reason and error message for a failed purchase.
• Device information, which the library reads from your device: device model, operating system version, system language and list of preferred languages and regions, total storage capacity of the device, and the time the device was last started.
• App information: app version, Unity version and package name (on iOS: bundle ID).
• A session identifier generated by Unity and the time the game was installed.
• Your IP address, which is transmitted with every request, and your country (which Unity lists as collected data).

The game does not pass your advertising ID to Unity and does not use a Unity player account.

Purposes

Purchase statistics and error analysis for the purchasing library (Unity IAP Insights), and Unity's own purposes named above. The game does not use this transfer to process or verify your purchases; Google Play or the App Store do this (5.4, 5.5).

Legal basis

Art. 6(1)(f) GDPR; our legitimate interest is a reliable purchase system in which errors and fraud can be detected. This transfer does not depend on your choices in the consent dialog, also not in the EEA, the UK and Switzerland: the game currently does not link it to your consent. You can object to this processing (right to object). The transfer only happens when you use in-app purchases, including the automatic delivery of earlier purchases.

Recipients

Unity Technologies.

Storage period

Unity does not state a specific retention period for IAP Insights events. For the In-App Purchasing service, Unity states that stored orders are kept until the controller or the data subject deletes them and that service logs are kept for 90 days.

5.7 Data stored on your device

The game saves your progress in a file in its app-specific storage on your device. It contains: coins, gems, high score and number of runs; owned and selected cars, customizations and upgrades; owned purchases (for example “Remove Ads”) and shortened, hashed transaction identifiers of delivered purchases (on Android purchase tokens, on iOS App Store transaction IDs); daily rewards, missions and achievements; a local high-score list (score, distance and day, no names); your settings (music and sound volume, vibration, graphics quality); whether you have completed the tutorial and the consent dialog, and whether personalized ads are allowed.

Your consent choices themselves are stored on your device by Google's consent tool. The Google and Unity libraries also store their identifiers and temporary data (for example unsent crash reports) on your device.

We do not receive this file. Legal basis: Art. 6(1)(b) GDPR (providing the game); storing it on your device is strictly necessary to provide the game you have requested (§ 25(2) No. 2 TDDDG, Art. 5(3) sentence 2 ePrivacy Directive). The data remains until you delete the app's data or uninstall the game.

5.8 Backup of your game progress

On Android: Auto Backup

YORU allows Android's Auto Backup only for the save file described in 5.7. All other data, including the consent choices stored by Google's consent tool, Firebase identifiers and crash reports, is excluded from backup and device-to-device transfer.

• If backup is turned on for your device, Google stores the save file in the backup of your Google account, in a private folder that neither we nor other apps can read. According to Android's documentation, the backup is end-to-end encrypted on Android 9 and later if a screen lock (PIN, pattern or password) is set on your device. On Android 8 or without a screen lock, the backup is not end-to-end encrypted. Only the most recent backup is kept.
• When you set up a new device, the save file can be restored from this backup or transferred directly from your old device.
• You control the backup in your device's settings. We do not receive or have access to it.

On iOS: iCloud Backup and computer backups

YORU does not change how iOS backs up apps. The save file described in 5.7 is stored in the game's documents folder, which iOS includes in device backups. According to Apple, an iCloud backup contains the information and settings stored on your device that are not already synced to iCloud. Unlike on Android, iOS therefore backs up the game's data as a whole: besides the save file, this can include other data the game keeps on your device, such as your settings and your consent choices. The same applies to a backup of your device on a computer.

• iCloud is a service of Apple, which stores the backup in your iCloud account under its own privacy policy. According to Apple, iCloud data is encrypted. With standard data protection, Apple keeps the encryption keys; with Advanced Data Protection for iCloud turned on, iCloud Backup is end-to-end encrypted.
• When you set up a new iPhone or iPad from such a backup, your game progress is restored.
• You control iCloud Backup in your device's settings. According to Apple, you can stop backing up individual apps or delete old backups; if you turn off iCloud Backup for a device, its backups are kept for 180 days before being deleted. We do not receive or have access to the backup.

Legal basis (both platforms): Art. 6(1)(b) GDPR (keeping your progress when you change devices).

5.9 Google Play Games Services (Android)

This section only applies to the Android version. At the time of this update, Google Play Games features (sign-in, achievements, leaderboards) are not active in YORU. The Google Play Games Services library is already part of the Android version of the game. According to Google, it automatically collects analytics and diagnostic data “to improve the stability of our SDKs and make product improvements”. Google uses this data for these purposes of its own under its privacy policy. This does not depend on your choices in the consent dialog. Google does not state a specific storage period for this data (see Google's retention policy).

If Google Play Games features are available in your version of the game and you are signed in to Google Play Games:

• Google provides the game with your Play Games player ID and profile (gamer name and avatar);
• the game sends unlocked achievements and leaderboard scores to Google Play Games, where they are linked to your profile;
• Google processes this data under its own privacy policy. You can delete your Play Games data in your Play Games profile.

Legal basis: Art. 6(1)(b) GDPR for the features you use. For the library's automatic data: Art. 6(1)(f) GDPR; our legitimate interest is keeping the Google Play Games Services library, which these features require, in the game.

5.10 Apple Game Center (iOS)

On iPhone and iPad, YORU supports Apple's Game Center for achievements and leaderboards. If you are signed in to Game Center on your device, the game signs you in when it starts; otherwise iOS may show Apple's sign-in screen once, which you can close. You can play the full game without Game Center.

Provider

Apple. Apple provides Game Center as an independent controller under its own privacy policy and its notice Game Center & Privacy. According to Apple, personal data of individuals in the EEA, the UK and Switzerland is controlled by Apple Distribution International Limited in Ireland.

Data

• If you are signed in, the game sends your unlocked achievements (as progress in percent) and your scores for the leaderboards to Game Center. Apple links them to your Game Center player identity, including your player ID and your nickname (alias), and to your Apple Account.
• According to Apple, your nickname, avatar and scores are visible to all Game Center users, for example in leaderboards, and Apple collects further information about your use of Game Center.
• The game itself only checks whether you are signed in. It does not read, store or send your player ID, nickname, avatar or friends list, and this data does not reach us.

Purposes

Providing achievements and leaderboards in Game Center.

Legal basis

Art. 6(1)(b) GDPR for the Game Center features you use.

Recipients

Apple; other Game Center players see your nickname, avatar and scores according to Apple's rules and your Game Center settings.

Storage period

According to Apple's privacy policy, as long as necessary for the purposes for which the data was collected. You can sign out of Game Center in your device settings and manage your data with Apple through Apple's Data and Privacy page (privacy.apple.com).

5.11 This website

Provider

Google (Firebase Hosting), as our processor.

Data

When you open a page, your browser transmits your IP address and other technical request data, which is necessary to deliver the page. This website does not set cookies, does not run scripts, does not load fonts or other content from third parties and contains no analytics or tracking tools.

Purposes

Delivering the website. According to Firebase, Firebase Hosting also uses the IP addresses of incoming requests to detect abuse and to provide us with a detailed analysis of usage data.

Legal basis

Art. 6(1)(f) GDPR; our legitimate interests are the secure and reliable operation of this website and understanding how it is used.

Storage period

According to Firebase, Hosting retains IP data for a few months.

6. Transfers to countries outside the EEA

• Google: data may be processed in the USA and other countries. Google LLC is certified under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework (Google: data transfer frameworks; Data Privacy Framework List). Transfers to Google LLC are therefore covered by the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework. Where this does not apply, Google relies on standard contractual clauses. According to Google, Google Analytics collects data from devices in the EU, Switzerland and the UK through servers in these regions before forwarding it to Analytics servers for processing.
• Unity: Unity Technologies is based in the USA. For processing on our behalf, Unity's Data Processing Addendum applies. For the processing Unity carries out as an independent controller, Unity uses standard contractual clauses for transfers of personal data from the EEA and the UK to countries without an adequacy decision, according to its privacy policy.
• Apple (iOS only: App Store purchases, Game Center, iCloud Backup): according to Apple's privacy policy, personal data of individuals in the EEA, the UK and Switzerland is controlled by Apple Distribution International Limited in Ireland, its international transfers of this data are governed by standard contractual clauses, and personal data is generally stored by Apple Inc. in the USA.
• Other advertising partners may be located outside the EEA. Information about them is available through the consent dialog and their privacy policies.

7. Storage periods

We do not run servers of our own and therefore do not store player data ourselves. The providers keep data as follows:

8. Your rights

8.1 Your rights under the GDPR

Subject to the legal requirements, you have the right to:

• access your personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR, see right to object above);
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), in the game under SETTINGS → PRIVACY OPTIONS;
• lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), P.O. Box 1349, 91504 Ansbach, Germany (www.lda.bayern.de).

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Personalized advertising involves profiling by Google and its partners (5.1).

For players in the United Kingdom, the UK GDPR applies accordingly; the supervisory authority there is the Information Commissioner's Office (ICO). For players in Switzerland, the Swiss Federal Act on Data Protection (FADP) applies; the supervisory authority there is the Federal Data Protection and Information Commissioner (FDPIC).

8.2 How to delete data and control its use

• Delete the data on your device: on Android, open the app info for YORU in the settings and clear its storage, or uninstall the game. On iOS, delete the app (“Offload App” keeps its data). This deletes your game progress, your consent choices and the identifiers stored by Firebase and Crashlytics. Data collected afterwards is no longer linked to these identifiers.
• Delete the backup: on Android in your device's backup settings or your Google account; on iOS in your iCloud settings, where you can stop backing up the game or delete old backups (Apple: What does iCloud back up?).
• Reset or delete your advertising ID: in Android settings (on many devices under Settings → Privacy → Ads; the exact path depends on the device). If you delete it, apps receive a string of zeros instead of the ID; resetting only replaces it with a new ID. On devices without the delete option, you can turn on “Opt out of Ads Personalization” instead (Google: advertising ID).
• Tracking permission on iOS: under Settings → Privacy & Security → Tracking. Without this permission, the game and its libraries cannot access the IDFA (section 4).
• Google ad settings: in My Ad Center, if you use a Google account.
• Withdraw consent in the EEA, the UK and Switzerland: SETTINGS → PRIVACY OPTIONS.
• Google Play Games data (if you used it): in your Play Games profile.
• Game Center data (iOS, if you used it): sign out of Game Center in your device settings; your data held by Apple can be managed at privacy.apple.com.

8.3 Requests to us

You can send any request to the contact in section 1. Please note: YORU has no accounts and the game does not show any identifier. Apart from Google Play order data and data that Google links to your Google account (for example in AdMob or Google Play Games), and App Store and Game Center data that Apple links to your Apple Account, the data held by Google and Unity is linked only to random installation, device or advertising identifiers. Without such an identifier we are usually unable to find data relating to you (Art. 11 GDPR). If you made a purchase, the order number allows us to find the related purchase records and, where applicable, to instruct Unity to delete them: on Android the Google Play order number (in your Google Play order history and in the purchase confirmation email from Google), on iOS the order ID in the receipt email from Apple. For data that Google, Unity or Apple process as independent controllers, you can also contact them directly (section 13).

9. Children

YORU is intended for players aged 13 and over. It is not directed at children under 13, and we do not knowingly collect personal data from children under 13. The consent dialog does not ask for your age. If you are a parent and believe that your child under 13 has used YORU, you can delete the data as described in section 8.2 and contact us.

In the EEA and the UK, if you are younger than the age at which you can give consent yourself in your country (16 in Germany and several other EU countries, between 13 and 15 in others, 13 in the UK), you may only accept optional purposes in the consent dialog with the permission of a parent or guardian (Art. 8 GDPR). Otherwise, please decline them in the dialog. You can still play the full game.

10. Security

• According to the providers, all data that the game sends to Google and Unity is encrypted in transit (TLS/HTTPS). The game has no network code of its own and does not use unencrypted connections.
• Payments are handled by Google Play Billing within the Google Play Store app on Android and by Apple's App Store on iOS. The game never processes payment details.
• This website is only available over HTTPS and does not load content from other servers.

11. Information for residents of US states

Privacy laws in some US states, for example California, give residents rights such as the right to know and access, to delete and to correct personal information, and to opt out of the “sale” or “sharing” of personal information or of targeted advertising. You also have the right not to be discriminated against for exercising these rights.

• Categories of personal information processed through the game (section 5): identifiers (on Android the advertising ID and app set ID, on iOS the IDFA if you allow tracking and other app- or developer-bound device identifiers; installation and app instance IDs), commercial information (purchase history), internet or other electronic network activity (interactions with the game and ads), approximate location derived from the IP address, and diagnostic data.
• The use of the advertising ID and related data by Google AdMob for personalized advertising may count as “sharing” or “targeted advertising” under these laws. The game does not show a separate opt-out dialog for US states. On Android, you can opt out of personalized ads by deleting your advertising ID in your device settings (resetting only replaces it with a new ID); on devices without this option, turn on “Opt out of Ads Personalization”. On iOS, do not allow tracking or turn it off under Settings → Privacy & Security → Tracking (section 8.2).
• For other requests, contact us (section 1). The limits described in section 8.3 also apply here.

12. Changes to this privacy policy

We update this privacy policy when the game, the services it uses or the legal requirements change. The date at the top shows the latest version. If a change requires new consent, the game asks for it again.

13. Privacy information of our service providers

• Google Privacy Policy: policies.google.com/privacy
• How Google uses information from apps that use its services: policies.google.com/technologies/partner-sites
• Firebase privacy and security: firebase.google.com/support/privacy
• Google Mobile Ads SDK data disclosure (Android): developers.google.com/admob/android/privacy/play-data-disclosure
• Google Mobile Ads SDK data disclosure (iOS): developers.google.com/admob/ios/privacy/data-disclosure
• Firebase data collection on Apple platforms: firebase.google.com/docs/ios/app-store-data-collection
• AdMob advertising partners (ad technology providers): support.google.com/admob/answer/9012903
• IAB Europe Transparency & Consent Framework: iabeurope.eu/transparency-consent-framework
• Google Payments Privacy Notice: payments.google.com
• Google Play Games Services data collection: developer.android.com/games/pgs/data-collection
• Unity Game Player and App User Privacy Policy: unity.com/legal/game-player-and-app-user-privacy-policy
• Unity Data Processing Addendum: unity.com/legal/unity-data-processing-addendum-dpa
• Unity In-App Purchasing privacy overview: docs.unity.com/en-us/iap/privacy-and-consent/overview
• Apple Privacy Policy: apple.com/legal/privacy
• Apple Game Center & Privacy: apple.com/legal/privacy/data/en/game-center
• Apple App Store & Privacy: apple.com/legal/privacy/data/en/app-store
• Apple App Tracking Transparency (“If an app asks to track your activity”): support.apple.com/en-us/102420
• Apple iCloud Backup (“What does iCloud back up?”): support.apple.com/en-us/108770
• Apple iCloud data security overview: support.apple.com/en-us/102651