Devourling Privacy Policy

1. Introduction

Devourling is an idle game for Android, developed and published by FrostWeb Studios, LLC (“we,” “us,” or “our”), a Florida limited liability company. This policy explains what the app collects, why, who receives it, and the choices you have. It supplements the FrostWeb Studios Privacy Policy; where they differ for Devourling, this policy applies.

Devourling does not use FrostWeb accounts. You can play as a guest, or sign in with your Google account to keep your progress in the cloud.

2. Information We Collect

2.1 Google Sign-In (Optional)

If you sign in, Google confirms your account and our sign-in provider (Firebase Authentication) keeps a user ID for you along with the name and email address of your Google account. We never see your Google password. If you play as a guest, your progress stays only on your phone.

2.2 Your Cloud Save

When you are signed in, your game progress is saved to Cloud Firestore under your user ID: your well’s mass, Dust, Photons, upgrade levels, research, skins, totals such as how much has been eaten, and the times used to calculate progress while you are away. The cloud save does not contain your name or email address.

2.3 Gameplay Analytics

The app sends Firebase Analytics events about what happens in the game: an upgrade bought, research started or finished, a research slot unlocked, Photons traded, a skin bought, a phase reached, the end of a session (its length, mass, and phase), signing in, purchases (started, completed, failed), and a reward earned from an ad. It also records whether you are signed in. Firebase Analytics adds its own automatic information, such as an app instance ID, device model, operating system, app version, approximate location derived from your IP address, and, where available, your device’s advertising ID.

2.4 Crash Reports

If the app crashes, Firebase Crashlytics receives a report with the stack trace, device model, operating system and app version, and device state at the time. When you are signed in, the report also carries your Devourling user ID and the game phase you were in.

2.5 App Integrity

The app uses Firebase App Check with Google Play Integrity, which lets Google confirm that requests to our servers come from a genuine copy of the app on a genuine device.

2.6 Stored Only on Your Phone

The app keeps a copy of your save on your phone (with backup copies), the ID of the last account signed in on it, sync markers, and whether you have bought “ad free.”

2.7 What Devourling Does Not Collect

Devourling does not ask for location, contacts, photos, files, camera, or microphone, and it receives no card details.

3. Ads and the Advertising ID

Devourling shows ads through Google AdMob: a banner at the top of the screen and optional rewarded ads that you choose to watch for an in-game reward. Buying “ad free” removes the banner.

AdMob receives your device’s advertising ID, your IP address, and information about your device and how you interact with ads, and Google and its ad partners may use them to show you personalised ads and to measure ads. Under some US state privacy laws, this may count as “selling” or “sharing” personal information for targeted advertising.

Consent. On launch, the app uses Google’s consent tool, and where Google requires a choice (for example in the European Economic Area and the United Kingdom), it asks for your consent before ads load. Where that tool offers it, a “Privacy settings” button in the app’s Settings lets you change your choice later.

How to opt out (including “Do Not Sell or Share”). The app does not let us switch off personalised ads for an individual player from our side. To stop your advertising ID being used, open your phone’s Settings → Privacy → Ads (on some phones, Settings → Google → Ads) and tap Delete advertising ID. Ads then continue, but without your advertising ID. Buying “ad free” removes the banner, and rewarded ads only play when you choose to watch one. If you have a question about this, email [email protected].

4. In-App Purchases

Devourling sells “ad free” (a one-time unlock) and packs of Photons through Google Play. Google Play processes the payment under its own terms, and we never receive your card or payment details. You must be signed in to buy. To deliver a purchase, the app sends the product and Google Play’s purchase token to our server, which checks it with Google Play and records the Google Play order ID, the product, the purchase time, and the user ID it was granted to. “Ad free” is also recorded against your user ID so that it follows you to a new phone.

5. How We Use Information

• To run the game and keep your progress in the cloud when you sign in.
• To deliver purchases and make sure each is granted once.
• To show ads and give rewards for rewarded ads.
• To improve the game and fix problems, using analytics and crash reports.
• To protect our servers from modified apps and abuse.
• To meet legal obligations, including keeping records of sales.

For people in the EEA and UK, our legal bases are: contract (running the game, your cloud save, and purchases); legitimate interests (analytics, crash reports, and app integrity); consent, collected through Google’s consent tool, for personalised ads where the law requires it; and legal obligation (sales records).

6. Who Receives Your Data

• Google: Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Analytics, Firebase Crashlytics, and App Check (our service providers), AdMob and Google’s ad partners (see section 3), and Google Play for purchases. Google may process this data in the United States and other countries.
• Legal and safety: we may disclose information if the law requires it or to protect the rights and safety of FrostWeb, our players, or the public, and as part of a merger or sale of our business.

Other than the advertising described in section 3, we do not sell your information or share it with data brokers.

7. Data Retention

• Cloud save: until you delete your account.
• Purchase records and the “ad free” record: kept after account deletion, because they prove what was granted and are records of sales. After deletion they are no longer linked to a name or email address.
• Crash reports: deleted by Crashlytics after 90 days.
• Analytics: kept by Google under our Firebase project’s retention settings.
• Data on your phone: until you delete your account in the app or uninstall it.

8. Your Choices and Rights

• Delete your account: in the app, open Settings and tap Delete account, or follow the account deletion page.
• Ads: see section 3.
• Access, correction, or a copy of your data: email [email protected] from the Google account email you sign in with.

You may have further rights where you live, including the EU, UK, and US state rights described in the FrostWeb Studios Privacy Policy, and the right to complain to a data protection authority. We respond within 30 days.

9. Data Security

Traffic between the app and our servers is encrypted with HTTPS. Firestore security rules allow only your own sign-in to read your cloud save, and purchases are granted only by our server after Google Play confirms them. No system is completely secure, and we cannot guarantee absolute security.

10. Children

Devourling is not designed for children and is intended for players aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 is using the app, email [email protected] and we will delete any data we hold.

11. Changes to This Policy

We post changes on this page with a new effective date. If a change is material, for example a new kind of data or a new recipient, we will announce it in the app before it takes effect.