Last updated: November 4, 2026

Privacy Policy

This policy explains how Biverlid OOO (“we”, “us”) handles information in Ready, Aim, Candy! (the “Game”) and when you contact us. It covers the Android release in India and the configured iOS integrations. The iOS version is not publicly distributed.

Release and measurement. Progress and manually exported gameplay reports remain on the device. There is no game account or cross-device cloud save. Firebase measurement starts when the Game opens, independently of the advertising form. Until regional consent is resolved, or when analytics storage is denied in that form, Firebase uses restricted Consent Mode signals rather than a stored app-instance identifier. Complete user-level attribution is not available for every installation. Meta and Branch start only under their applicable provider permissions. Existing explicit in-game opt-outs are retained. Android supports optional purchases and rewarded ads, interstitials at gameplay breaks, and banners in menus. Unity Ads participates through AdMob mediation. Development profiles and explicit SDK tests are excluded from our production event accounting.

1. Information kept on your device

The Game saves completed levels, attempts, earned and spent virtual currency and tools, selected room appearance, language preference, and sound and vibration settings. A randomly generated local installation identifier and session identifiers help connect local gameplay events. These are not your name or Google account.

Local diagnostic events can include level and attempt identifiers, shots and tool use, outcomes, active playing time, interruptions, navigation and advertising events. We use these records to investigate technical issues and difficulty. The local report file is not automatically uploaded. Subject to the measurement settings described below, selected events and counts are sent separately through Firebase Analytics; restricted signals may be available without analytics storage. The Game does not request your contacts, microphone, photos or precise location.

2. Optional reports and support

“Save test report” in Settings creates JSON and CSV files on your device. This action does not send them. The summary separates ordinary attempts from developer-selected tests and includes level results and resource use. Only share files if you choose to do so.

If you email support, we receive the address you use, your message and any attachments. We use them to answer your request and investigate the issue. Review reports and screenshots before sharing; never send passwords, verification codes or full payment-card details.

3. Advertising and third-party SDKs

The Game integrates Google Mobile Ads (AdMob), Google's User Messaging Platform (UMP), and the Unity Ads mediation adapter. An advertising SDK may process information during its operation even when an ad is not shown. Available processing depends on the SDK, configuration, region and privacy choices; declining personalized ads does not mean that all technical processing stops.

Rewarded videos are optional. If an ad cannot load or you decline it, you can keep playing under the normal game rules. A reward is granted only when the ad SDK confirms that its reward condition was met. Android offers optional purchases of tools, sugar and permanent forced-ad removal. There are no subscriptions. The store shows the final local price before confirmation.

Purchases and transaction verification

The Game integrates Unity In-App Purchasing for Google Play and Apple App Store. Native checkout is enabled in the Android release and orders are checked by the cloud transaction verification service. Any explicitly labelled local purchase preview uses a separate test wallet, does not charge money and does not grant real paid ownership.

When native purchasing is enabled, the store handles billing and payment details; we do not receive your full payment-card information. To verify and deliver an order, a verification service may receive the store, app identifier, product identifiers, quantities and the store purchase token, receipt or Apple-signed transaction. This data is used for fulfilment, restoration, refunds, fraud prevention and the operation of purchases. The service must validate it with the relevant store before issuing the purchased content.

Local progress stores granted products, virtual balances, pending product identifiers and one-way transaction fingerprints used to prevent duplicate grants. Raw purchase tokens, signed transactions and full receipts are not added to gameplay reports. Purchase verification is separate from optional gameplay analytics and does not provide a cross-device cloud save. When enabled, it uses a technical anonymous Firebase Authentication identity and Firebase App Check (Play Integrity on Android / App Attest on iOS) to protect the service and bind orders to the purchasing installation. No registration, email or password is required. The technical identity and app-attestation tokens are sent to the verification service; they are not advertising identifiers. The private transaction ledger is hosted in the EU on Firebase/Google Cloud. Raw receipts and purchase tokens are checked in memory and are not retained in its ledger or logs.

Optional analytics and attribution

The Game applies regional choices from Google UMP, including the Google consent purposes, applicable IAB TCF vendor permissions and US opt-out signals. Firebase uses Advanced Consent Mode: storage and advertising permissions are separate from whether its SDK can send limited measurement signals. These limited signals do not provide a complete identifiable player funnel. Where regional consent is not required, measurement can operate without an extra mandatory in-game opt-in. Settings → Privacy → Statistics and attribution provides additional independent controls for Firebase statistics and Meta / Branch attribution. Turning these in-game controls off stops collection by the corresponding integration; any prior explicit in-game refusal remains respected after an update. The Game works with both controls off. Withdrawal does not automatically erase data already processed.

Depending on the applicable permissions, these SDKs may process app-instance or device identifiers, IP address and derived approximate location, device and operating-system details, app version, timestamps and event information. Advertising identifiers are used only where available and permitted; iOS asks separately through App Tracking Transparency. We do not provide names, emails, contacts, precise location, passwords, full payment details or raw Google purchase tokens to the optional event trackers. An SDK's own automatic installation/open event is separate from our locally generated installation identifier, which is not attached to our custom event parameters.

Firebase receives level number, chapter, planned difficulty, attempt count and active time, shots and outcomes, whether tools were used, tutorial and menu interactions, gifts and progression, plus permitted store/ad monetization events. Test profiles and developer play are excluded from our custom cloud measurements. During an explicitly enabled mobile SDK-ad test, optional Firebase collection and our custom cloud events are suspended; test advertisement revenue is not sent through our paid-event callbacks. AdMob is linked to Firebase and Google Play for automatic revenue measurement; manual audit events are separated from canonical revenue events.

For purchases, Meta and Branch receive verified purchase amount, currency, products and a transaction fingerprint. StoreKit 2 measurement additionally sends the confirmed numeric Apple transaction ID to Firebase so it can measure the transaction; this is not a full receipt or payment-card number. Purchase and ad-revenue facts may wait in local delivery queues while SDKs or connectivity are unavailable. A confirmed purchase with an initially missing store price may wait for its actual amount; no catalog estimate is substituted. Withdrawing consent removes the corresponding pending destinations. Restoring existing ownership and local purchase previews are not logged as new purchase revenue.

Branch uses FULL for permitted advertising attribution, MINIMAL for permitted first-party analytics without advertising identifiers or advertising partner postbacks, and NONE when its measurement is not permitted. MINIMAL may still use a device identifier; it is not described as anonymous. Google consent does not substitute for Branch provider permission.

Meta receives app-activation/install measurement and permitted purchase, ad-revenue and selected milestone events. Branch receives its install/open attribution and permitted PURCHASE, VIEW_AD, level and tutorial events. Partner forwarding of purchase and ad revenue is not enabled alongside direct Meta SDK events, to avoid duplicate reporting. Availability of cross-network attribution also depends on the provider plan and platform restrictions.

Providers: Firebase privacy and security; Google Privacy Policy; Meta Privacy Policy; Branch privacy and legal center. Their processing, rights and international-transfer arrangements are described in those policies. This document does not promise that SDK totals cover every installation: choices, connectivity and operating-system restrictions can limit measurement.

Optional Android notifications

If you enable reminders in the Game and allow notifications on Android, the Game can schedule an on-device reminder to resume your puzzle. Its timing and text are stored on your device. The Game also uses Firebase Cloud Messaging to send occasional game news to opted-in installations. Google processes a notification registration token and topic subscription to deliver those messages. We do not upload your puzzle progress to select recipients for these messages. Turn reminders off in Settings or disable the notifications in Android Settings. The Game cancels its local reminder and stops accepting notifications when they are disabled. Turning reminders off in the Game also requests removal of the Firebase topic subscription.

4. Your privacy choices

Before advertising requests, the Game uses UMP to update the consent information and display a privacy message when required. Where available, use Settings → Privacy → Privacy & ad choices to revisit the advertising choices. This is separate from your device advertising settings. Availability of choices depends on region and the advertising service.

Privacy choices do not erase your local progress or automatically delete support correspondence or information already held by a provider. You can ask the relevant provider about its privacy controls using the links above, and contact us about information we hold.

5. Purposes and legal bases

We process local game state to provide the requested gameplay. We use support information to respond to you, maintain the Game and resolve faults. Depending on the applicable law and purpose, processing may rely on performance of a contract, consent, our legitimate interests in maintaining and protecting the Game, or a legal obligation. Where consent is required for advertising processing, you can withhold or withdraw it through the applicable privacy controls.

6. Sharing and international processing

We do not sell your support emails or manually exported gameplay reports. Advertising services may process or share information under their own policies; some advertising uses may be treated as sharing or a sale under regional privacy laws. Use the available regional privacy controls to make a choice.

We may share support information with service providers needed to operate our email and support, or where required by law, to protect legal rights, or in a business transfer subject to applicable protections. Service providers can operate outside your country, including in countries with different privacy laws. Any required transfer safeguards depend on the parties and applicable law; see the providers' policies for their arrangements.

7. Retention and deletion

Game saves and local reports remain on your device until removed by you or the operating system. Uninstalling or clearing app storage may permanently remove local progress and unused tools. Operating-system backups, where enabled, are controlled separately. The current version does not offer our own cloud backup or cross-device restoration.

We retain support correspondence while needed to address the request and related follow-up, and longer only when necessary for a legal obligation, security issue or dispute. Our Google Analytics property is configured to retain user-level and event-level data for 14 months, with no reset of user retention on new activity. This setting does not erase aggregated reports on that schedule. Local delivery queues are bounded to 256 purchase events, 128 pending amounts and 512 ad events, and remove completed or withdrawn destinations. The private EU verification service keeps purchase and refund fingerprints while needed for delivery, fraud prevention and accounting. Rate-limit records expire after 24 hours and notification deduplication records after 90 days. Advertising and attribution providers set their own retention periods. Contact us to request deletion of information we hold; we will explain any legally required retention.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information; restrict or object to processing; withdraw consent; opt out of certain advertising uses; or complain to a supervisory authority. Email info@gitch.xyz with “Ready, Aim, Candy! privacy”. We may request proportionate information to verify and locate your request. We do not require passwords or payment-card details.

9. Children

Ready, Aim, Candy! is intended for a general audience and is not primarily directed to children. Children's privacy requires particular care. Where a child cannot legally provide consent, a parent or guardian must make the relevant decisions. If you believe a child has provided personal information to us inappropriately, contact us so that we can investigate and take the action required by law. Store age ratings do not by themselves determine whether advertising personalization is appropriate for a child.

10. Security, changes and contact

We use reasonable measures appropriate to the information involved, but no device, email service or network is completely secure. This policy may change as the Game develops. Material changes, including new remote analytics or purchases, will be reflected in this policy and the applicable product disclosures before those features are enabled.

Contact the data controller, Biverlid OOO, at info@gitch.xyz or the postal address below.