Privacy Policy | Cat Rules Corp

The Short Version

You do not need to create an account. The Application creates an anonymous player ID and backs your progress up to the cloud under it.
You may, if you wish, link a Google or Apple account in Settings so that your progress can follow you to a new phone.
If the Application crashes, a crash report is sent so the Service Provider can fix the problem. Firebase Crashlytics also records basic app and device information and session times when nothing crashes (see Crash and diagnostic data).
Purchases are handled by Apple or Google and verified by RevenueCat. The ads (optional rewarded videos and, from version 1.0.1, short ads at natural breaks) are provided by Unity Ads. Both of these services process data about you, as listed below. Unity is an independent controller of the advertising data its SDK collects: it acts for itself, not on behalf of the Service Provider.
From version 1.0.1, the Application uses Google Analytics for Firebase to count installs and to see how players move through the game (for example where new players stop in the tutorial). On Android it also reads which store link led to the install (the Google Play install referrer). The Service Provider uses this data to improve the game and to measure its own ad campaigns on Google Ads.
From version 1.0.1, the Application also uses Meta (Facebook) App Events. It tells Meta when the Application is installed and opened, and also when you finish the tutorial, reach a new CEO level or buy something, so that the Service Provider can see which of its own ads on Facebook and Instagram bring players. In the European Economic Area, the United Kingdom and Switzerland this happens only if you allow it (from version 1.0.2). See Ad measurement and Privacy choices.
From version 1.0.2, the Application asks for your consent to game statistics and to personalised ads and ad measurement in the European Economic Area, the United Kingdom and Switzerland, and everyone can change these choices in Settings, Account, Privacy choices. It does not ask your age. See Privacy choices in the Application.
Reminder notifications are optional and are scheduled on your device only. Nothing is sent to a server for them.
The Application does not collect your precise location, contacts, photos, camera or microphone data. It never sends your name, email address or player ID to Google Analytics, Meta or Unity.
If you linked a Google or Apple account, you can delete your account and data in the Application: Settings, Account, Delete account (in app versions that include it). A guest, who has not linked an account, has no such button and uses the email request instead, as does anyone who cannot use the Application; no reinstall is needed. Deleting does not cancel a subscription, and it cannot remove every record (for example the purchase records of Apple, Google and RevenueCat). See Deleting Your Data and the account deletion page.

Information Collection and Use

The Application collects information when you download and use it. This information may include the following.

Player ID and cloud save

An anonymous player ID (a random Firebase Authentication user ID) created the first time you open the Application
Your game save: your office, staff, currencies, settings and purchase entitlement flags
A small summary of the save (CEO level, Branch, a rough coin total and the time you last played), the Application version and a random install identifier

This is used to back your progress up and restore it after a reinstall or on another device. It is stored in Google Cloud Firestore (multi-region location in the United States). Cloud save works only in the mobile apps.

Optional Google or Apple sign-in

In Settings you may link a Google account, or on iPhone an Apple account, to your player ID. If you do, the provider returns your name and email address to the Application through Firebase Authentication (with Apple you may choose to hide your email, in which case Apple provides a private relay address). If the account is new to the game, linking keeps your player ID, so your existing cloud save follows the account. If the account already has a save (for example from an earlier install or phone, which is the normal case on a new phone), the Application asks whether to switch to it and then uses that account's own player ID (if the phone has progress of its own too, the Application also asks which progress stays). The anonymous player ID the new phone had before the switch then stays as a separate anonymous ID that is not linked to your account; see Deleting Your Data. This information is used only to identify your account and restore your progress. It is not used for marketing.

Crash and diagnostic data

The Application uses Firebase Crashlytics. When it crashes or reports an error, Crashlytics receives the stack trace, your device model, operating system and its version, the Application version, free memory, your player ID, a Crashlytics installation identifier, a Firebase installation ID and a random session ID. The Application also attaches a few labels about what was happening: the current screen, your CEO level, the graphics setting, the language, and recent in-game steps such as the start or end of a minigame, a purchase (product ID only) or a level-up. From version 1.0.1 the labels also include the version of the system WebView the game runs in and, on Android, the source of the store link that led to the install (see Install source below), and Crashlytics adds the recent Google Analytics events described below to a crash report to show what led up to it. Crash reports are kept by Firebase for 90 days, after which Firebase starts removing them from its live and backup systems. There is no switch in the Application to turn crash reports off yet. You may object to this processing by contacting the Service Provider (see Your Rights below).

Crashlytics comes with a Google component called Firebase Sessions, which the Application cannot switch off separately. Even when the Application does not crash, it records basic information about the app and the device (the app ID, the operating system and its version, the SDK version, the device make and model, the network connection type) and when a session starts and ends. Google processes it on behalf of the Service Provider under the Firebase terms.

Purchases and subscription

Purchases are made through the Apple App Store or Google Play. The Service Provider never sees your payment card details. RevenueCat verifies purchases and keeps your subscription and entitlement status. RevenueCat receives your player ID (used as your RevenueCat app user ID), the product purchased, price and currency, store transaction and receipt data, and device and store information. RevenueCat acts on behalf of the Service Provider and keeps this purchase record under its own retention rules (see its privacy policy). The Application cannot delete that record itself; see Deleting Your Data below. From version 1.0.1, Google Analytics also records store purchases (product, price and currency) and the Application reports real store purchases to Meta (product and its list price in US dollars), as described below. Your payment details are never sent to either of them.

Usage analytics (Google Analytics for Firebase)

From version 1.0.1, the Application uses Google Analytics for Firebase, a Google service. It records the first time the Application is opened and each session, also before the game has finished loading, and game events such as the steps of the start-up and loading screens and how long they take, the steps of the tutorial and whether you finished or skipped it, CEO level-ups, minigames started and their result, screens opened, purchases and ads shown or watched. It also keeps a few properties of your game: the language, the Application and game version, the WebView version, the graphics setting, your CEO level and, on Android, the install source described below.

With these events Google Analytics receives an app-instance ID (a random identifier for this installation), device and system information (such as model, operating system and version, language and screen size), the approximate location (country, region or city) that Google derives from your IP address, and on Android the Google Advertising ID. On iPhone it receives the advertising identifier only if you allow tracking when the system asks. The Application does not send your name, email address, player ID or any text you type. Google processes this data for the Service Provider under the Google Analytics and Firebase terms.

The Service Provider uses it to understand how players use the game and where new players give up, to find problems such as a slow start on older phones, and to measure its own ad campaigns (see Ad measurement below). It has turned off the use of this data for ad personalisation: Google Analytics data from the Application is not used to build advertising audiences or to show you personalised ads. You can turn it off in Settings, Account, Privacy choices (from version 1.0.2); in the European Economic Area, the United Kingdom and Switzerland it is off until you allow it. The Application tells Google Analytics your choices through Google's consent mode (analytics storage, ad storage, ad user data and ad personalisation).

Install source (Android)

From version 1.0.1, the Android app reads the Google Play install referrer once after it is installed. This is information that Google Play keeps about the store link that led to the install. The Application keeps only the campaign values of that link (such as the source, medium and campaign name, for example "facebook", "paid", and the name of an ad), whether the link came from a Google Ads click (yes or no, not the click ID itself) and the time between the click and the install. It sends these to Google Analytics and adds the source to crash reports. The Google Analytics and Meta components may also read the install referrer themselves, to tell Google Ads or Meta whether the install came from one of the Service Provider's ads.

Ad measurement (Google Ads and Meta App Events)

The Service Provider advertises the Application on Google (Google Ads) and on Facebook and Instagram (Meta). To see which of its ads bring players, and to let these ad services show its ads to people who are more likely to play, it uses the following from version 1.0.1.

Google Ads. The Service Provider links its Google Analytics data to its Google Ads account. Google Ads then counts installs and in-game milestones (such as the first open and finishing the tutorial) that followed a click on or a view of one of its ads, using the app-instance ID, the advertising identifier where available and the install referrer. This is used to measure and optimise the Service Provider's own campaigns, not to show you personalised ads based on the game (see above).

Meta App Events. The Application includes the Facebook SDK (App Events) of Meta Platforms. It tells Meta when the Application is installed and each time it is opened or comes back to the screen; on Android this happens before the game has finished loading. From version 1.0.2 this follows your choice for personalised ads and ad measurement: in the European Economic Area, the United Kingdom and Switzerland nothing is sent to Meta (the Facebook SDK is not even started) until you allow it; elsewhere it is sent unless you turn that choice off. It also tells Meta when you finish (or skip) the tutorial, when you reach a new CEO level and when you buy something in the store (the product and its list price in US dollars). With these events Meta receives device information (such as model, operating system, language and mobile carrier), your IP address, Meta's own app and installation identifiers, on Android the Google Advertising ID, and on iPhone the advertising identifier only if you allow tracking when the system asks. The Application never sends Meta your name, email address or player ID.

Meta uses this data to provide the Service Provider with measurement and reports on its ads, and, under Meta's own terms and privacy policy, for its own purposes, such as delivering and improving ads; for that use Meta acts as a controller in its own right. Meta may combine it with what it knows from your use of Facebook or Instagram. See Meta's privacy policy. You can stop it in Settings, Account, Privacy choices, and limit the identifiers with the device settings described under Advertising, Tracking and Your Choices.

Ads (Unity Ads)

The ads in the Application are provided by Unity Ads (Unity Technologies). There are two kinds:

Rewarded videos, which you choose to watch in exchange for an in-game reward. They are always optional.
From version 1.0.1, short full-screen ads that can appear at a natural break that you cause, such as when you leave the result screen of a minigame or close a large menu during a long session. They never appear during the tutorial or your first session, before you have played for a while, when the Application opens or comes back to the screen, or right after a rewarded video or a purchase, and only a few can appear per day. Players who have bought anything in the Application (for example Ad-Free Evil, the Black Cat Club or any Catnip pack) never see them. The Application has no banner ads.

The Application starts the Unity Ads SDK shortly after it starts, so that an ad is ready when one is needed. This also applies if you own the Ad-Free Pass (shown as "Ad-Free Evil" in the game and the store) or Black Cat Club. Unity may therefore process the following even if you never watch an ad:

Advertising identifiers (the iOS advertising identifier only if you allow tracking, and the Android Advertising ID) and other device identifiers
Unity user, installation and session identifiers that the Unity SDK uses to run ads and to credit rewards
Your IP address and the approximate location (country or region) derived from it
Device information such as make, model, operating system, language, screen size and connection type
Ads shown and your interactions with them (Unity states that it records taps and page views only inside the ad, not during gameplay)
Other usage data, such as play-session information, and purchase or monetization events, as Unity describes them for its SDK
SDK performance and diagnostic data, such as start-up and initialization speed and errors
Only if you report an ad to Unity: the information you give in that report (customer support), which Unity lists as something it may collect

The Application itself does not send Unity your name, email address, player ID or purchase details. Several of the items above, such as purchase and monetization events, other usage data and diagnostics, are categories that Unity lists in its own data disclosures for its SDK (see Unity's Apple App Privacy disclosure and Unity's Google Play Data safety disclosure).

Unity's role. Unity is an independent controller of this data. It is not a service provider that processes it on behalf of the Service Provider. Unity's privacy policy applies to the personal information that Unity is responsible for as a data controller, and Unity's data protection terms for monetization and advertising treat Unity and the app publisher as separate controllers of the data the SDK sends to Unity. Unity decides what its SDK collects and uses it for advertising, measurement, analytics, fraud prevention and app functionality. The Service Provider chose to include the Unity SDK and tells you about it here, but it does not control what Unity does with the data.

From version 1.0.2 the Application sends Unity your choice for personalised ads: in the European Economic Area, the United Kingdom and Switzerland Unity is told you have not consented until you allow personalised ads (Unity then serves ads that are not personalised); elsewhere, if you turn personalised ads off in Privacy choices, Unity is told not to sell or share your data. The Application sends Unity no age signal. You can also change your choices with the Data Privacy icon shown inside a Unity ad. To make a request to Unity (for example access, deletion or an opt-out from personalised ads), use that icon or the contact routes in Unity's privacy policy.

Up to version 1.0.0 the Application showed rewarded ads only. From version 1.0.1 it can also show the short ads at breaks described above. It does not show banner ads.

Reminder notifications

Reminders are optional and start switched off. They are local notifications scheduled on your device by the Application. They are not push notifications: there is no push token and nothing is sent to or from a server. You choose whether to allow them through the system permission prompt, and you can switch them off in Settings or in your device settings.

Rating prompt

At certain moments the Application may ask the operating system to show its standard rating dialog. That dialog is run by Apple or Google. The Service Provider does not receive your answer or any data from the dialog. A Rate the Game button in Settings opens the store page for the Application.

Technical data

Like any online service, the providers listed below see your IP address and basic technical information when the Application connects to them. When the operating system reports that there is no connection, the Application may also send a tiny empty request to Google servers (firestore.googleapis.com and www.gstatic.com) to check whether the internet is really unreachable.

What is not collected

The Application does not collect your precise location, contacts, photos or videos, camera or microphone data, health data, or payment card details. It has no chat or user-generated content. The usage-related data processed by Google Analytics, Meta, RevenueCat, Unity Ads and Crashlytics is the data described above. Version 1.0.0 of the Application did not include Google Analytics for Firebase, Meta App Events or the install referrer; they were added in version 1.0.1. If another analytics or advertising SDK is added, this policy will be updated before the release that includes it.

How and Why Information Is Used

To provide the game, your cloud backup and restore of progress
To deliver, verify and restore purchases and subscriptions
To find and fix crashes and keep the Application stable
To show ads (optional rewarded videos and short ads at breaks), measure them and prevent ad fraud
To understand how players use the game, for example where new players stop in the tutorial or how long loading takes on older phones, and to improve it (Google Analytics)
To measure which of the Service Provider's own ad campaigns on Google, Facebook and Instagram bring players, and to optimise those campaigns (Google Ads and Meta App Events)
To answer your questions and requests

Where the GDPR, the UK GDPR or the Turkish KVKK applies, the legal bases for the Service Provider's own processing are: performance of the contract with you (game, cloud save, purchases); the Service Provider's legitimate interests (a stable and secure game, fraud prevention, offering ads, understanding how the game is used, and measuring and promoting the game with its own ad campaigns); compliance with legal obligations (tax and accounting records); and your consent where consent is required: in the European Economic Area, the United Kingdom and Switzerland, game statistics (Google Analytics), Meta App Events and personalised ads are based on the consent you give in the Application (from version 1.0.2), and access to the advertising identifier on iOS on Apple's tracking prompt. Elsewhere they are based on the Service Provider's legitimate interests, and you can object in Privacy choices (see Privacy choices in the Application). The ads can use advertising identifiers, so the Service Provider does not describe them as contextual only. Unity processes the advertising data its SDK collects as an independent controller, on the legal bases in its own privacy policy, which name consent for personalised ads and legitimate interests for other advertising operations. Meta does the same for the data it uses for its own purposes (see Ad measurement).

Third Party Access

The Application uses third-party services that have their own privacy policies about handling data. The Service Provider does not sell your personal data for money. Google Firebase (Authentication, Cloud Firestore, Crashlytics and, from version 1.0.1, Google Analytics) and RevenueCat process data on behalf of the Service Provider. Unity is different: it is an independent controller of the advertising data its SDK collects, as explained under Ads above. Meta receives App Events for the Service Provider's ad measurement and also uses them for its own purposes as a controller, and Google uses the data it receives through Google Ads under its own terms, as explained under Ad measurement above. Apple and Google also act for themselves in their own services (the App Store, Google Play, and the sign-in you choose to use) under their own privacy policies. Below are the links to the privacy policies of the third-party service providers used by the Application:

The Service Provider may disclose User Provided and Automatically Collected Information:

As required by law, such as to comply with a subpoena, or similar legal process.
When they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
With the service providers that process it on the Service Provider's behalf and on its instructions (Google Firebase, including Google Analytics, and RevenueCat), under data processing terms. This does not describe Unity, which is an independent controller (see Ads), or Meta and Google Ads for their own purposes (see Ad measurement).

Privacy choices in the Application

From version 1.0.2 the Application has two choices of its own:

Game statistics: Google Analytics for Firebase (see Analytics).
Personalised ads and ad measurement: personalised ads from Unity, Meta App Events and the use of Google Analytics data to measure the Service Provider's ads (see Ad measurement and Ads).

If you are in the European Economic Area, the United Kingdom or Switzerland, the Application asks you about both the first time you open it, before it sends anything for them: you can accept both, reject both, or choose each one. Until you have chosen, and if you reject, no Google Analytics data is collected, nothing is sent to Meta, and Unity is told that you have not consented to personalised ads (Unity then shows ads that are not personalised; rewarded and short ads keep working). The Application works the same whatever you choose. To decide whether you are in these regions, the Application looks at the country of your app store account, your SIM card and mobile network (Android), your device time zone and, only if none of these is known, your device language region; it asks if any of them points to one of these regions. It does not use GPS or any other device location.

Everyone, in every country, can change both choices at any time in Settings, Account, Privacy choices. Turning a choice off stops the data for it from then on (Meta's SDK, once started, stops completely the next time you open the Application); it does not affect what was sent before. Outside the regions above both are on until you turn them off; turning off personalised ads there also tells Unity not to sell or share your data for advertising.

Crash reports (Crashlytics), purchases and the anonymous cloud save do not depend on these choices (see the sections on them). Your choice is stored on your device.

Advertising, Tracking and Your Choices

Rewarded ads are always optional. Holders of Ad-Free Evil or the Black Cat Club subscription receive the rewards without watching ads. The short ads at breaks are never shown to players who have bought anything in the Application.
On iOS, the Application shows Apple's App Tracking Transparency prompt when the ad service is about to start at launch. The ad service does not wait more than a few seconds for your answer, so it can start while the prompt is still open, but until you allow tracking iOS gives no advertising identifier to Unity, Meta or Google Analytics. If you decline, the advertising identifier is not used and the game works the same, with less relevant ads. You can change this at any time in iOS Settings, Privacy & Security, Tracking.
On Android, you can reset or delete your Advertising ID, or opt out of ads personalisation, in your device settings. If you delete it, Unity, Meta and Google Analytics receive no Advertising ID.
The install and app-open events sent to Meta, and the Google Analytics events, follow your Privacy choices (Settings, Account, Privacy choices; from version 1.0.2). In the European Economic Area, the United Kingdom and Switzerland they are sent only after you allow them. The device settings above also limit the advertising identifiers they can use; uninstalling the Application stops them. You can also object to this processing by email (see Your Rights).
From version 1.0.2 the Application has its own privacy choices (see Privacy choices in the Application) and passes them to Google Analytics, Meta and Unity. It has no age check. In versions before 1.0.2 no choice inside the Application was passed on, and whether ads were personalised depended on the device settings and Unity's own consent request. You can also use the Data Privacy icon inside Unity ads and Unity's own data request options linked in this policy, or contact the Service Provider by email to exercise your rights.

Under some US state laws, letting an ad network use identifiers for advertising, or sending app events to an advertising platform such as Meta to measure ads, can count as "sharing" or "selling" personal information. See Your California Privacy Rights below.

International Data Transfers

The Service Provider's providers store and process data in the United States and other countries, which may be outside your country of residence, including outside the European Economic Area (EEA). Where data from the EEA, the United Kingdom or Turkey is transferred, the Service Provider relies on the following mechanisms where applicable:

Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK addendum
The EU-US Data Privacy Framework, where the provider is certified
For Turkey, the transfer mechanisms of Article 9 of the KVKK
Your consent, where required and legally permitted

Opt-Out Rights

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling alone does not delete your cloud data: information that has already been transmitted, such as your cloud save and player ID, stays until it is deleted. If you linked a Google or Apple account, you can use Delete account in Settings before you uninstall. The Application creates a new anonymous player ID when it restarts after a deletion, so if you want no further collection, uninstall it after the deletion. If you play as a guest, or cannot use the Application, see Deleting Your Data below.

Deleting Your Data

If you linked a Google or Apple account, the fastest and most complete way to delete your account and the data linked to it is inside the Application. If you play as a guest, or cannot use the Application, deletion is requested by email, as explained below; you do not need to reinstall the Application or sign in for that. The email request is open to everyone, also to players who linked an account. In both cases the exceptions listed under "What is not deleted or not cancelled" apply.

In the Application, if you linked a Google or Apple account

In app versions that include Delete account, open Settings, then the Account tab, and tap Delete account at the bottom (in the "Danger zone"). This works in the iOS and Android apps. The button is shown only to players who have linked a Google or Apple account. A guest, that is a player who has not linked an account, does not see it: a guest has no account, only an anonymous player ID that holds no name, email or other personal data, and asks for a guest cloud save to be removed by email (see below). You need an internet connection, because your cloud save is deleted too.

The Application first lists what will and will not be deleted, including that paid consumables are lost. It asks you to cancel an active Black Cat Club subscription before you continue, and it always offers a Manage subscription button (with an active subscription it adds a warning).
A second screen asks you to press and hold a button for 2 seconds. A plain tap does nothing, so nothing is deleted by accident.
After the hold, and before anything is deleted, the Application asks you to sign in again with your Google or Apple account, to confirm that the account is yours. The Google or Apple sheet can appear twice: first to pick the account, then to sign in. If you close a prompt or pick a different account, the Application does not go on: nothing more is deleted, and a deletion that was already under way stays unfinished.
If the cloud save cannot be deleted (for example the connection drops), the Application shows an error message and you can try again. If the server does not answer within about 20 seconds, the Application says that your cloud backup may or may not have been deleted, and asks you to try again when your connection is better.

What is deleted, and when

Deletion starts once you have completed the final confirmation and the sign-in. The Application deletes:

your cloud save, stored in Google Cloud Firestore;
your player ID, which is your Firebase Authentication user (the Google or Apple sign-in linked to it, including the name and email address it stored). With Sign in with Apple, the Application also tries to revoke the app's Apple authorization;
your game progress and settings on the device, and the reminder notifications scheduled on it.

The Application also tries to log out of RevenueCat, so that the game stops using your old RevenueCat record on this device. That does not delete the record; see below.

When it finishes, the Application restarts as a brand-new anonymous player: at that next launch it creates a new anonymous player ID that has nothing to do with the deleted one, and the game starts from the beginning.

If something interrupts the deletion (for example the app is closed or the connection drops), the Application normally remembers on the device that a deletion is under way and does not upload your save while it is. What happens next depends on how far it got. If your cloud save had not been deleted yet, the Application tries that step again the next time it opens. If that try fails (for example because there is no connection), it cancels the request, says "The account deletion you started could not run. Nothing was deleted." and you have to start again in Settings. If the connection was too slow to tell, it says instead that your cloud backup may or may not have been deleted, and asks you to try again when your connection is better. Once your cloud save is deleted, the rest continues by itself the next time the Application opens, when the connection is back or when you return to it. If a linked account needs a fresh sign-in to finish (for example because your last sign-in is more than about five minutes old), Settings, Account shows a Finish deleting button: tap it and sign in again. Do not uninstall the Application until it says the account is deleted: if you uninstall it before the deletion has finished, the remaining steps cannot run, and if you already did, email the Service Provider. If you are not sure whether a deletion finished, Settings, Account shows whether one is still waiting.

What you lose

Your game progress is stored in the cloud save and on your device, so it is lost with them: Catnip, Recruit Tickets, staff, decor, boosts and everything else, including items that you paid for. Paid consumables (Catnip packs, the Starter Pack, the Piggy Bank and bundles) are lost with the account and are not restored by the store. Only non-consumable purchases (Ad-Free Evil) and an active Black Cat Club subscription can be restored through the store, in a new game with the same store account (Settings, Account, Restore Purchases). This is not guaranteed after a deletion: RevenueCat, which checks purchases for the Application, may keep the purchase with your old player ID, which no longer exists. If Restore Purchases does not bring Ad-Free Evil or your subscription back, email the Service Provider the store order number and it will look into it.

What is not deleted or not cancelled

An active subscription is not cancelled. Deleting your account does not stop the Black Cat Club from renewing. Cancel it in your App Store or Google Play subscription settings before you delete if you do not want to keep being billed (the Application's Manage subscription button opens them).
Your purchases stay in the records of Apple or Google, and the Service Provider keeps the purchase records that tax and accounting law require.
RevenueCat's customer record for your old player ID (which store products were bought and when, and the store receipt data) is not deleted when you use Delete account: the Application cannot delete it, because that needs a server-side key that the app does not carry. The Application only tries to log out of it. The record stays as a purchase record, kept for accounting, fraud prevention and store-record purposes under RevenueCat's own retention rules. After the deletion your old player ID no longer exists in the Application or in Firebase, so the record can no longer be tied to any account or save of yours in the Application. If you use Restore Purchases in a new game, RevenueCat may attach the restored purchases to your new anonymous player ID. To ask for the record itself to be removed, email the Service Provider with a store order number, as described in the email section below.
Crash reports are kept for 90 days, after which Firebase starts removing them. Until then they may contain your old player ID, which no longer identifies any account.
Unity keeps advertising data under its own policy. You can make a request to Unity as described under Ads above.
Google Analytics events are stored under the app-instance ID of the installation, not under your player ID, and Delete account does not remove them. They are deleted when the retention period under Data Retention Policy ends. Events that Meta received are kept under Meta's own policy; Meta offers its own privacy controls and request routes (see Meta's privacy policy).
After data is deleted, Google removes it from its live and backup systems on its own schedule. Google documents that this is completed within about 180 days.
With Sign in with Apple, the Application tries to revoke its Apple authorization, but that attempt can fail. If Cat Rules Corp is still listed after a deletion, you can remove it yourself in your Apple Account settings under Sign in with Apple.
If the same linked account is also signed in on another phone, that phone can still upload its save for up to about an hour after the deletion (the sign-in it holds stays valid that long), which creates the cloud save again. Leaving the game closed on that phone for that hour avoids it. If it happens anyway, use the email request below; as with the anonymous IDs described after this point, the Service Provider can only find that save with a store order number from a purchase made with the account.
If you linked your account on a new phone and the Application switched to your existing account, the anonymous player ID that the new phone used before the switch is a separate ID and stays behind. Delete account does not remove it. It has no name and no email, and it holds the cloud save that the phone backed up under it before you linked (at least the start of a new game). To have it removed, use the email request below; the Service Provider can only find it with a store order number from a purchase made on it.
The new anonymous player ID that the Application creates at the next launch after a deletion is a separate ID. It has no name and no email, and the Application backs the new, empty game up under it. A guest has no Delete account button, so if you want that ID removed too, use the email request below, and uninstall the Application if you do not want it to create another one.

By email (if you play as a guest or cannot use the Application)

If you play as a guest, or if you uninstalled the Application, lost your device or cannot open it for another reason, email info@sipidikco.com (or use the account deletion page) with the subject "Delete my data". You do not need to reinstall the Application or sign in first. What the Service Provider can do depends on what identifies you, and it only acts on a request it can tie to you, so that nobody can delete somebody else's data or saved game. A description of your progress and the platform (iPhone or Android) help it look but are not proof:

You linked a Google account. Give the full email address of that Google account. The Application shows only a masked version of it in Settings, Account (for example j***@gmail.com). Send the request from that address, or the Service Provider will reply to it to confirm before deleting anything. The Service Provider then deletes your cloud save and your player ID, including the linked sign-in details.
You linked an Apple account. If you chose to hide your email, the Application shows only the label "Hidden Apple email" and never the address. Give the Apple Account email if you chose to share it with the Application, or the private relay address (it ends in @privaterelay.appleid.com), which you can look up in your Apple Account settings under Sign in with Apple, Cat Rules Corp. The Service Provider confirms by email before deleting anything. If it cannot confirm through that address, it may ask for a store order number as well (see the purchase point). It then deletes your cloud save and your player ID, including the linked sign-in details.
You play as a guest (you never linked an account). An anonymous save holds no name or email address, and the Application does not display its ID, so nothing outside the Application identifies it as yours. A description of your progress is not proof, and the Service Provider will not delete a save on that basis. A purchase made with it can identify it: see the next point. If you never linked an account and never bought anything, the Service Provider cannot tell which save is yours, and it will say so.
You made a purchase (this also covers RevenueCat's purchase record after an in-app deletion). Send the store order number from your receipt: the Order ID in Apple's receipt email, or the order number that starts with GPA. in Google Play. The Service Provider tries to match it with the purchase record in RevenueCat, which carries the player ID of the game that made the purchase. If it matches, the Service Provider deletes the cloud save and login that belong to that player ID, if they still exist, and, on request, the RevenueCat record itself. After an in-app deletion this is the only way to reach that record, because the player ID itself no longer exists. Where the law requires a purchase record to be kept (tax and accounting), only that record is kept and you are told.
Requests to Apple, Google and Unity for their own records go to them, not to the Service Provider; see the links above.
Requests are answered within 30 days and confirmed by email. A subscription is not cancelled by any request.

An email request covers the same server-side data as the in-app option, subject to the same exceptions above; progress stored only on your device is removed when you uninstall the Application. On Android, a copy of the game data made by your phone's own backup service may come back if you reinstall the Application and restore from that backup; the Service Provider does not control it. If the Service Provider cannot identify you from your request, it will say so and tell you what further information would help.

Data Retention Policy

Cloud save, player ID and linked sign-in details: kept until you delete your account in the Application or ask for them to be deleted (see above)
An anonymous player ID that a device stopped using (for example after you linked your account on a new phone and switched to your existing account): it has no name and no email, and is kept until it is deleted on request (see above)
Crash reports: 90 days, after which Firebase starts removing them from its live and backup systems
Purchase records (Apple, Google and RevenueCat): kept as long as needed to provide your purchases and to meet tax, accounting and fraud-prevention needs, under each provider's own retention rules
Advertising data held by Unity: kept under Unity's own retention policy
Google Analytics events and the install source: kept for the retention period set in the Service Provider's Google Analytics account, at most 14 months for event-level data, after which Google deletes them; reports made only of totals may be kept longer
App Events data held by Meta: kept under Meta's own retention policy
Deleted cloud data: removed from Google's live and backup systems on Google's own schedule, which Google documents as completed within about 180 days
Data required for legal compliance: kept as long as required by applicable law

Your Rights

Depending on where you live (for example under the GDPR, the UK GDPR or the KVKK), you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to withdraw consent at any time without affecting processing carried out before withdrawal. To exercise these rights, contact the Service Provider at info@sipidikco.com. Requests are answered within 30 days. If the Service Provider needs more time where the law allows it, it will tell you within that period and say why. It may need to confirm that a request comes from you, as described under Deleting Your Data. Where it cannot identify you from a request, it will say so and tell you what further information would help.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with the data protection supervisory authority of the country where you live, where you work or where you believe the infringement took place (in the EEA, see the list of national authorities; in the United Kingdom, the Information Commissioner's Office). In Turkey, you may complain to the Personal Data Protection Authority (KVKK). You are welcome to contact the Service Provider first so that it can try to resolve the matter.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident (other US state privacy laws give similar rights), the following applies to personal information the Application collects.

What is collected, from whom and why

Identifiers: your anonymous player ID, a random install identifier, Crashlytics and Firebase installation IDs, the Google Analytics app-instance ID, Meta's app and installation identifiers, advertising identifiers and your IP address; and, if you link an account, your name and email address.
Commercial information: the products you buy (with their price) and your subscription status.
Internet or other electronic network activity: ads shown to you and your interactions with them, the crash-context labels, the game events recorded by Google Analytics and sent to Meta, and on Android the store link that led to the install, all described above.
Approximate geolocation: country or region derived from your IP address.
Device information: model, operating system, language, screen and connection type.
Inferences: advertising interests that Unity and its ad partners, or Meta, may derive under their own privacy policies.

The information comes from you and your device, from Apple or Google when you link an account, and from the service providers named in this policy. It is used for the purposes listed under How and Why Information Is Used and disclosed for a business purpose to the service providers that process it on the Service Provider's behalf (Google Firebase, including Google Analytics, and RevenueCat), and to Apple or Google for purchases and sign-in. Unity and Meta are not among those service providers: they receive advertising and ad-measurement data that they also use for their own purposes, which is covered under Sale and sharing below. It is kept as described under Data Retention Policy. The Application does not collect sensitive personal information such as precise geolocation, government identifiers, passwords, health data or the contents of communications.

Sale and sharing

The Service Provider does not sell personal information for money. However, Unity Ads uses advertising identifiers and device data to show and measure ads and to personalise them, and the Service Provider is paid for ads shown. From version 1.0.1 the Application also sends app events with device data and advertising identifiers to Meta, and Google Analytics data is used to measure the Service Provider's Google Ads campaigns. Under some US state laws this can count as a "sale" or as "sharing" for cross-context behavioural advertising, so the Service Provider treats it as such. You can opt out in these ways: on iOS, decline the tracking prompt or turn tracking off in iOS Settings, Privacy & Security, Tracking; on Android, reset or delete your Advertising ID or opt out of ads personalisation in your device settings; use the Data Privacy icon inside a Unity ad or Unity's request routes described above; use Meta's own privacy controls; or email the Service Provider. The Application does not yet have its own in-app opt-out screen, and the install and app-open events sent to Meta do not depend on these choices (the device settings only limit the advertising identifier they carry).

Your rights

You have the right to know what personal information is collected, used and disclosed, the right to delete personal information, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. To exercise them, email info@sipidikco.com. The Service Provider may ask you to confirm the request as described under Deleting Your Data, and it answers within 30 days (or tells you if the law allows it to take longer and it needs to). You may use an authorised agent, who may be asked for proof of authorisation.

Children

The Application is not directed to children under the age of 13 (or the higher age of digital consent in your country). The Service Provider does not knowingly solicit data from or market to children under that age. This is a statement of who the Application is for: the Application does not currently ask your age, has no age check, and does not send an age signal to Unity, Google or Meta.

The Service Provider does not knowingly collect personally identifiable information from children under 13 years of age. In the case the Service Provider discovers that a child under 13 has provided personal information, the Service Provider will delete it. If you are a parent or guardian and you are aware that your child has provided personal information, please contact the Service Provider at info@sipidikco.com so that they will be able to take the necessary actions.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. Data is encrypted in transit (HTTPS/TLS). Cloud saves can be read and written only by the player they belong to, which the database security rules enforce. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date and, for significant changes, in the Application. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at info@sipidikco.com.

This privacy policy is effective as of 2026-10-22. This version adds the privacy choices of version 1.0.2 of the Application (a consent request in the European Economic Area, the United Kingdom and Switzerland, and Settings, Account, Privacy choices for everyone). The previous version, also effective as of 2026-10-22, added Google Analytics for Firebase, the Google Play install referrer, Google Ads measurement, Meta App Events and the short ads at breaks (version 1.0.1). The version before it was effective as of 2026-09-30.

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action, such as allowing tracking on iOS, allowing notifications, or linking a Google or Apple account. Unity may also ask for your consent itself inside its ads where it says it does (see Ads). From version 1.0.2, in the European Economic Area, the United Kingdom and Switzerland the Application asks for your consent to game statistics and to personalised ads and ad measurement, and you can withdraw it at any time in Settings, Account, Privacy choices. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider (Sipidik OU) via email at info@sipidikco.com. Sipidik OU is the controller of the personal data described in this policy, except where a provider acts as an independent controller (Unity for its advertising data, Meta for the App Events data it uses for its own purposes, and Apple and Google for their own services). See also the Terms and Conditions.