Milky Cat 2D — Privacy Policy

1. Which features this policy covers

This policy explains local gameplay, mobile advertising, cloud saves and support, plus optional usage analytics and planned optional purchases where those features are actually offered. A section marked “when available” applies only when that feature is enabled. It is not permission to collect information in advance.

Cloud Save is offered only where Profile → Cloud Save shows it. Mobile advertising uses Google Mobile Ads and Google's User Messaging Platform (UMP) to check applicable advertising privacy requirements and present required messages. Advertising is unavailable in the browser version. Purchases are not enabled. Optional GameAnalytics and Firebase Analytics are offered only to adults after setup and stay off until their measurement choices in the consent manager allow them. There is no player chat, online multiplayer, social sharing or push-notification service. Adding another service requires an updated notice, any legally required choices, and corresponding store disclosures before collection begins.

2. Gameplay and device storage

The game stores a local profile, progression, Coins, upgrades, inventory, match results and reward-claim identifiers, together with sound, vibration, age-group, Terms, ad-personalization, analytics and cloud-backup preferences. Ad spacing and reward-claim records prevent excessive interruptions and duplicate rewards. Google's consent service stores its own privacy-choice records; the game also keeps a local age-context marker for that consent flow. Planned quests, achievements and daily rewards may also need progress and claim records. These records let the game remember progress and prevent duplicate rewards. They are not a cash balance.

We store your age-group answer and whether you have seen the current privacy notice locally. If you select AGREE & CONTINUE on the welcome screen, we also store the Terms version, the device-reported UTC time, the age group used for that step and whether the screen asked for a parent/guardian declaration. This remembers the agreement and avoids unnecessary repeat prompts. A changed age group or Terms version can require a new agreement. These local records are not verified identity, proof of age, verified parental authorization or consent to optional services.

Local records remain on your device or in backups controlled by your operating system. Eligible gameplay records can also be backed up through the Cloud Save service described in section 6; age, privacy and Terms records are not part of that gameplay snapshot. We cannot retrieve a local save using an email address. The game does not ask for contacts, precise location, microphone, camera, identity documents or a full date of birth.

3. Age groups and younger players

The intended audience is teens and adults, not a service deliberately directed to young children. Nevertheless, younger players and people who do not share an age group receive protective treatment. “Prefer not to say” leaves core play available. Review your answer in Settings → Privacy & legal → Age group.

Cloud backup does not start for players who select under 13 or prefer not to share an age group. Changing to one of those answers stops future uploads, but an earlier backup remains until removed. If this device still remembers that backup, Profile → Cloud Save offers removal; Google Play Games data controls or our support route are available otherwise. Players who select 13–15 or 16–17 can use Cloud Save where available; their Terms step asks a parent or guardian to review use of the game. This declaration is not verified parental authorization for data processing.

Additional account features and analytics for younger players need appropriate safeguards before being offered. Where verified parental authorization is legally required, an age button or simple declaration is not a substitute. We do not ask children to send personal information to unlock the game. A parent or guardian can contact us about information a child may have supplied.

4. Advertising

Google AdMob supplies mobile ads through the Google Mobile Ads SDK. No additional mediation-network SDKs are included. A completed optional post-match ad adds a bonus equal to the repeatable Coins earned in that match, once; the one-time first-clear reward is excluded; the normal reward is granted first. Occasional interstitial ads may appear after a win when continuing to the next level, with an introductory grace period and spacing between full-screen ads. Ads do not appear during a match. An unavailable or incomplete rewarded ad does not remove the normal reward or block progression.

After age setup and the current notices, UMP checks whether advertising is permitted and whether a privacy message is required. It may process device, connection, app and consent information to provide this service. The ads SDK initializes and requests ads only when this check permits it. An age answer or Terms agreement is not consent. Core play remains available if permission is refused or a privacy check cannot establish permission.

Under-13 and undisclosed-age players do not contact advertising or advertising-consent services. For ages 13–15, the game uses Google's protected under-consent-age treatment rather than asking the player for adult consent. Ages 16–17 use teen treatment and the applicable UMP choices. Personalization is disabled for both teen groups; ad creatives are restricted to Google's G content ceiling for every eligible age. Changing age can require restarting the game before ads resume.

When ads are permitted, Google may collect or share the device IP address (which can indicate approximate location), advertising or app/device identifiers where allowed, ad impressions and interactions, app launches, and diagnostic or performance information. These support advertising delivery, measurement, SDK operation and fraud prevention. We do not send your nickname, cloud-save identity, email, gameplay save or exact age to AdMob. Turning personalization off does not make advertising data-free. Google handles information under its privacy policy at https://policies.google.com/privacy and its advertising information at https://policies.google.com/technologies/ads.

Settings → Privacy & legal → Manage consent opens Google's privacy options when available in your region, where advertising and optional analytics choices can be reviewed or withdrawn. Ad personalization follows those choices, platform permissions and age restrictions. Earlier local personalization opt-outs remain honored. These privacy choices remain on this device and are not copied with Cloud Save. On iPhone, Apple's tracking permission separately controls access to the advertising identifier and tracking; refusing it keeps core play available. Device advertising-ID controls remain available through Android or iOS settings. Changing privacy choices does not delete information already processed by Google; use Google's controls or contact us about applicable rights.

5. Purchases and entitlements — when available

Optional digital purchases are not enabled. If introduced, they will use the store's payment system. Apple or Google handles payment credentials; do not send card information to us. To deliver, verify, restore and support a purchase, the game may need product identifiers, transaction or receipt information, purchase status and time, and the resulting entitlement. Account-linked purchases may also need the relevant game-account identifier.

Purchase records may be used for fraud prevention, refunds, revoked purchases and legal or accounting duties. Store purchase history is separate from a local save. Deleting game data does not cancel or refund a store purchase. The applicable offer and Terms will describe restore and refund details before purchases are enabled.

6. Cloud saves and account sign-in

After the current notice and Terms steps, eligible players can use Cloud Save where it is enabled. Local play continues if connection fails or you choose not to connect. The game never asks for a Milky Cat password or receives your Google or Apple password. A platform account prompt may appear. Cloud Save availability and status are shown in Profile → Cloud Save.

On Android, Google may use the selected Play Games profile or show its own account prompt. The game requests a short-lived server authorization code and sends it to our server, which exchanges it with Google and asks the Google Play Games API for the verified player ID. On iPhone, Game Center provides the game player ID and a short-lived signed verification package; our server validates Apple's signature and this app's bundle identifier. The game does not treat an unverified player ID supplied by the device as proof of identity.

When Cloud Save is turned on, Firebase Authentication first creates an anonymous Milky Cat 2D authentication session; this does not ask for an email address or Firebase login. After our server verifies Google Play Games or Game Center, it binds that platform player identity to the existing Firebase game-account ID and returns a Firebase session for that same account. On a reinstall, a new anonymous session can therefore recover the previously bound game account after the same platform player is verified. The game sends short-lived Firebase ID tokens to our Milky Cat 2D server to authenticate save requests. Our server stores a one-way-hashed platform-binding key, the Firebase game-account ID, provider name, binding and last-verification times, one versioned gameplay snapshot and the time it was last updated in a separate Milky Cat 2D database. The raw Play Games or Game Center player ID is used during verification but is not retained in the binding record. Optional Google or Apple Firebase sign-in can be linked to the same game account for cross-platform access; Firebase may then hold the identity details that provider shares, such as provider user ID, display name, email or Apple private relay address. We do not store provider passwords or payment credentials. The original Milky Cat game's account and database are separate. Google and Apple may process account, device, connection and service information under their own policies. The backend uses Google Firebase for authenticated sessions and our own server for gameplay backup, not iCloud or Google Drive.

The gameplay snapshot can include your in-game nickname, completed and unlocked levels, rival progress, Coins, masteries, upgrades, supplies, inventory, match and reward-claim records, and other gameplay state needed to restore the complete profile. Your age answer, Terms record and privacy choices are not in the snapshot. A sync marker with the Firebase user ID and last exchanged save ID remains on each device. The game checks for a cloud save before replacing it. If device and cloud progress differ, you choose which complete save to keep; the other version is kept as a recovery copy on that device. Balances are not added together, and uploads may be delayed while offline.

The verified Play Games or Game Center identity normally reopens its bound Firebase game account on the same platform. You may also link Google and Apple Firebase sign-in to that game account. This lets you use a linked Google account on Android and iPhone, or a linked Apple account on iPhone, for cross-platform restore. Linking can associate the identity details the providers share; the game asks before linking. A platform identity cannot be silently moved from one game account to another. Signing in with a different, unlinked identity opens a different game account and can require a save choice. Cross-store purchase rights do not transfer with a gameplay snapshot.

Profile → Cloud Save offers Remove Backup where backup is available. This requests deletion of the gameplay backup, pauses further uploads on that device and leaves its local progress in place. If removal cannot be confirmed, the game shows a retry option. When account-backed backup is active, Delete Game Account also requests deletion of the Firebase game user and its server backup; it does not delete your Apple ID, Google account, Play Games profile or store purchase history. If account deletion cannot be confirmed, the game keeps a pending-deletion record on the device and offers a retry. Turning backup on later may upload local progress again. For help with backup, identity linking, deletion or a privacy request, contact the address above.

7. Optional gameplay analytics

Adults can choose optional GameAnalytics (GameAnalytics ApS) and Google Analytics for Firebase in the same Google consent manager used for advertising. Measurement remains off until the CMP resolves the relevant publisher purposes and provider choices. Firebase additionally requires granted analytics storage. Ads permission, Terms agreement, reading this policy and Apple's tracking permission do not grant analytics consent. Missing, refused or unconfigured analytics choices keep the relevant provider off. Under-18 and undisclosed-age players do not receive optional gameplay analytics. Settings → Privacy & legal → Manage consent lets you review or withdraw the choices where available. Refusal leaves core play available, and switching ads off does not switch analytics on or off.

When allowed, both services receive sessions and screen durations, last known screen and level, tutorial steps, level starts, wins, losses, retries and abandonment, scores and stars, mastery levels, Coins earned and spent, powerup use and remaining supplies, gameplay interruption counts, ad offer/show/reward/failure information and actual impression revenue, cloud-save service states, frame-rate and memory measurements, and sanitized error categories. Firebase's automatic analytics can also measure app launches and sessions. These use fixed game-content identifiers and numeric measurements, not screen recordings or every touch. A local checkpoint helps identify an interrupted session on the next consented launch; an interruption does not itself prove a crash or a decision to stop playing. Actions performed while measurement is off are not replayed.

GameAnalytics associates events with a random installation reference and app/build, device-model, operating-system and connection information. It receives an IP address for the connection and may derive approximate location. Android advertising-ID collection is disabled; on iPhone this SDK can receive Apple's vendor identifier and the advertising identifier only when platform tracking permission allows it. Firebase uses its own app-instance identifier and app/device, operating-system, connection and approximate-region information. Firebase advertising storage, advertising user data and ad personalization remain denied; advertising-ID and iPhone vendor-ID collection are disabled in its configuration. We do not attach nicknames, cloud-account identities, emails, birthdays, age answers, raw error messages or cloud saves to either stream. Analytics choices remain on this device and do not transfer with Cloud Save.

GameAnalytics provides analytics under https://www.gameanalytics.com/trust/privacy-notice. Google's information is at https://policies.google.com/privacy and https://firebase.google.com/support/privacy. Providers may process information outside your country subject to applicable safeguards. Withdrawing a provider's measurement consent stops new game event collection and submission and clears Firebase's local analytics data when Firebase collection stops. It does not delete information already received by either provider. Contact persoftware.srl@gmail.com for access or deletion, including the provider references shown in Privacy help if available. Do not send passwords or your gameplay save.

8. Support and lawful purposes

If you contact us, we receive your email address and what you send, such as a problem description or purchase reference. We use it to respond, resolve delivery problems, handle privacy requests and investigate misuse. Please omit passwords, full payment details and unnecessary sensitive information. Support is handled using email service providers; our contact mailbox is hosted by Google.

Where GDPR or similar laws apply, necessary game, account and purchase processing is based on providing the requested service or performing a contract where appropriate. Security and proportionate support can rely on legitimate interests, balanced against your rights. Required tax, transaction and lawful-request records rely on legal obligations. Optional processing that requires consent uses a separate choice, not this policy. We will explain any new purpose before using information incompatibly with the purpose for which it was collected.

9. Sharing, transfers and security

Information may be handled by providers needed for enabled features, by authorized people providing support, or disclosed to authorities where lawfully required. We may disclose necessary information to establish or defend legal claims. A business transfer involving personal information must maintain applicable protections and provide required notice.

We do not sell local game saves or support messages for money. Google advertising may involve information sharing for personalized or cross-context advertising where the player's consent, age and platform permissions allow it. Applicable regional choices are provided through Google's privacy messages and Manage consent, alongside the game's personalization opt-out.

Providers may process data outside your country, including outside the EEA or UK. Applicable arrangements must provide lawful safeguards, such as an adequacy decision or approved contractual safeguards. Contact us for information about transfers relevant to your data. This is not a claim that every country has identical protections.

We use proportionate access and security controls for the information we handle. No device, transmission or storage system is completely secure. Keep your device and, where offered, account credentials secure.

10. Retention and deletion

Local progress and preferences remain until cleared, overwritten or removed, subject to device backup behaviour. Removing the app or clearing app storage can permanently lose progress that was not backed up. Cloud backups may remain after uninstalling. When Profile → Cloud Save is available, use Remove Backup while signed into the account used for that backup to request deletion and turn off future uploads here. For an account-backed backup, Delete Game Account removes the Firebase game account, its platform recovery bindings and its server save while leaving this device's progress. Our server keeps a snapshot and recovery bindings while its game account exists or until deletion, subject to ordinary operational backups and lawful obligations. If in-app removal cannot be confirmed, retry later or contact us. Apple and Google manage their own account records. Device and store backups are managed through the relevant provider.

Support correspondence is retained only while needed to handle the request, related follow-up or disputes, and applicable legal duties; then it is deleted or anonymized. Retention depends on the nature of the issue and applicable limitation or record-keeping requirements. You can request deletion or ask which retention criteria apply to your correspondence.

GameAnalytics data follows its published retention schedule; detailed event access becomes more limited as data ages, while aggregate statistics can remain available longer. Current details are at https://docs.gameanalytics.com/event-tracking-and-integrations/data-retention-and-limits/data-retention-practices/ and https://www.gameanalytics.com/trust/eu-data-processing-addendum. We use recent detailed data to investigate game issues and longer-term aggregate trends to evaluate improvements. Contact us about the periods applicable to your data or to request deletion. We do not export analytics into a separate indefinite archive. Firebase Analytics retention follows the configured Google Analytics property and its retention controls at https://support.google.com/analytics/answer/7667196. Retention settings and aggregate-report availability differ; contact us about the periods applicable to your data. Purchase retention will be disclosed before purchases become available.

11. Your rights and requests

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests. You may withdraw consent for any consent-based processing. We do not deny core play because you exercise a privacy right.

Email persoftware.srl@gmail.com, naming Milky Cat 2D and the request. We may ask for proportionate verification, but not unnecessary identity documents. We respond within the period required by applicable law and explain any lawful reason a request cannot be fulfilled. Where applicable, an authorized agent may submit a request, and you may challenge our response by replying for review.

You can complain to your local data-protection authority, including Romania's ANSPDCP at www.dataprotection.ro. These rights do not require you to create a game account.

12. Policy changes

The version and date above identify this notice. It remains available offline in Settings → Privacy & legal. Material changes are highlighted in the game and require fresh choices where applicable before new processing begins. Future-feature descriptions do not replace that obligation.

Request account or data deletion

You can request deletion of your Milky Cat 2D game account or personal data without reinstalling the game. Request deletion by email at persoftware.srl@gmail.com. Tell us that the request is for Milky Cat 2D and whether you want your game account, cloud backup or analytics data deleted. Include any game-account or analytics support reference you already have; do not send passwords, identity documents or your gameplay save. We may ask for proportionate verification to identify the correct records.

Game-account deletion removes the Firebase game account, its platform recovery bindings and the server gameplay backup. It leaves local progress on your device and does not delete your Google or Apple account, Play Games profile, Game Center identity or store records. You can also request removal of a cloud backup or analytics data without deleting the game account. Operational backups and records needed for lawful obligations are handled as described in Retention and deletion; we explain any lawful reason or applicable period for retained information when handling your request.