Privacy Policy

1. Who we are and what this covers

Gully Royale ("we", "us", "our") publishes the Gully Royale mobile game for iOS and Android (the "Game") and operates this website. This Privacy Policy explains what information we collect through the Game and the website, why we collect it, who we share it with, how long we keep it, and the rights and choices you have.

By installing or playing the Game you agree to this policy. If you do not agree, please do not use the Game. This policy does not cover the practices of the Apple App Store, Google Play, or your device operating system, which are governed by their own policies.

2. Information we collect

2.1 Account and sign-in data

The Game can be played without creating a separate username or password. Where account features are offered on your platform, you can sign in through a third-party identity provider (Google or Apple) using Firebase Authentication, operated by Google. When you sign in we receive:

• A unique account identifier created for your sign-in.
• Your email address associated with that provider (or Apple's private relay address if you choose to hide your email).
• A display name, where the provider shares one.

We never see or store your Google or Apple password.

2.2 Game progress and save data

To run the Game we process your gameplay state: your card collection, squads and squad ratings, in-game currencies and balances (such as coins, gems and event tokens), level and experience, objectives, event and pack history, and settings. This data is stored on your device. When cloud backup is available and you are signed in, it is also synced to Cloud Firestore (a Google database service) so your progress can be restored if you change or reset your device.

2.3 Integrity and anti-cheat data

To keep the Game fair for everyone, saved data is protected with cryptographic integrity checks, and the Game periodically performs a lightweight connection to verify server time. As part of this we process technical signals such as save-data checksums, a device clock comparison against server time, and audit records of in-game currency changes. The Game requires an active internet connection, and it may pause play if the connection is unavailable or if the device clock or save data appears to have been tampered with. These signals are used only for fairness, fraud prevention and security.

2.4 Device and diagnostic data

We automatically collect standard technical information: device model, operating system and version, app version and build, language and region, screen characteristics, app instance identifiers, crash logs and performance diagnostics.

2.5 Analytics data

We use Google Analytics for Firebase to understand how the Game is used, through events such as app opens, matches played, packs opened, screens viewed, objectives claimed and feature usage. Analytics data is associated with app-instance identifiers rather than your name. Aggregated analytics data may be exported to Google BigQuery for our own analysis. We use this to fix bugs, balance the game economy and decide what to build next.

2.6 Purchase data

When you make an in-app purchase, the transaction is processed entirely by the Apple App Store or Google Play. We do not receive or store your card number, banking or payment credentials. We receive only a confirmation of the purchase (such as the product, price tier, currency and a transaction identifier) so we can deliver the purchased content, restore it if you reinstall or change device, and provide support.

Purchased entitlements, such as a season pass for the current season or a one-time bundle, are recorded in your game save so the Game knows what you own. Where cloud backup is available and you are signed in, that record syncs with your save.

2.7 Advertising data

The Game shows optional rewarded video ads supplied by Google AdMob. These are always opt-in: an ad only plays if you tap an offer that states its reward first, nothing you already had is lost by skipping one, and the number you can watch per day is capped. The Game does not show banner or interstitial advertising, and no part of the Game is gated behind watching an ad.

To serve and measure these ads, Google AdMob may process limited device and technical data, including an advertising identifier, coarse device and network information, and ad interaction events. This processing is subject to your platform-level choices. On iOS we do not ask for permission to track you across other companies' apps and websites, so ads are served on a non-personalised basis; if that ever changes we will request your permission through Apple's App Tracking Transparency prompt first and update this policy. On Android you can reset or delete your advertising ID, or opt out of ad personalisation, in your system settings. See how Google uses data from partner sites and apps.

2.8 Support communications

If you contact us, we receive the information you choose to send, such as your email address, your message, and any screenshots or details about your device and account that you include.

2.9 What we do not collect

• No precise location. We do not request GPS or location permissions.
• No contacts, photos, camera, microphone or health data.
• No payment card or banking details.
• No biometric data.
• No data purchased from data brokers, and no selling of your data to anyone.

3. How we use your information

• Operating the Game: saving and restoring progress, running matches, packs, objectives and events, and syncing your account across devices.
• Fairness and security: verifying save integrity, detecting tampering, cheating and abuse, protecting the in-game economy, and securing accounts.
• Improvement: analysing aggregate usage, balancing gameplay and the economy, prioritising features and fixing crashes and bugs.
• Support: answering your questions and investigating problems you report.
• Purchases: delivering content you buy, restoring it on a new device, and handling purchase-related support.
• Rewarded ads: showing the optional ad offers you choose to watch, granting the reward, and enforcing the daily caps on how many you can watch.
• Legal: complying with applicable law, enforcing our Terms of Service, and establishing, exercising or defending legal claims.

We do not use your personal information for automated decisions that produce legal or similarly significant effects about you.

4. Legal bases (where they apply)

Where laws such as the EU/UK GDPR or India's Digital Personal Data Protection Act apply, we rely on:

• Performance of a contract: providing the Game, accounts, cloud backup and purchases you request.
• Legitimate interests: keeping the Game fair and secure, preventing fraud, understanding usage and improving the Game, balanced against your rights.
• Consent: where required, for example for optional marketing, and for advertising identifiers and personalised advertising in regions where consent is required before an ad is served. Choosing to watch a rewarded ad is itself an opt-in step, and you can withdraw consent at any time through your device settings or by not watching them.
• Legal obligation: where processing is required to comply with law.

5. Who we share information with

We do not sell personal information for money. We do not share your account, save or support data for advertising of any kind.

The one exception you should know about is the advertising described in section 2.7: when you choose to watch a rewarded ad, Google AdMob receives device and ad-interaction data, and on Android it may use that data to personalise advertising unless you opt out in your system settings. Under some privacy laws, including in California, that use can count as "sharing" for cross-context behavioural advertising. On iOS we do not ask for tracking permission, so this does not apply there. You can stop it entirely by not watching rewarded ads, and by using your device's ad-personalisation controls.

We share data only with:

• Google (Firebase and Google Cloud): authentication, the Firestore database that stores cloud saves, Firebase Analytics, and BigQuery for our analytics exports. Google processes this data as our service provider. See Firebase's privacy documentation.
• Google AdMob: serving and measuring the optional rewarded video ads described in section 2.7, including fraud prevention and frequency capping. For advertising, Google acts as an independent controller of the data it collects rather than purely as our service provider.
• Apple and Google as platforms: app distribution, in-app purchases, and platform crash reporting operate under Apple's and Google's own terms and privacy policies.
• Professional advisers and authorities: where required by law, legal process, or to protect the rights, property or safety of our players, the public or us.
• A successor business: if we are involved in a merger, acquisition or asset sale, data may transfer as part of that transaction, and this policy will continue to apply to it.

6. Security

All traffic between the Game and our servers uses HTTPS/TLS encryption. Cloud data is stored on Google infrastructure with access controls, and save data carries cryptographic integrity seals to prevent tampering. Access to production data is limited to what is needed to operate the Game. No system is perfectly secure, so we cannot promise absolute security, but we work to protect your data with measures appropriate to the risk.

7. How long we keep data

• Account and save data: kept while your account exists, deleted or anonymised when you delete your account.
• Analytics events: retained under Google Analytics for Firebase retention controls, and in aggregate form in our own analysis exports.
• Integrity and audit records: kept only as long as needed for fraud prevention and dispute resolution.
• Support emails: kept as long as needed to resolve the issue and for a reasonable period afterwards.
• Legal holds: we may retain specific data longer where the law requires it or where it is needed for legal claims.

8. Deleting your account and data

You can delete your account directly inside the Game: open Settings and choose Delete account. For your protection you will be asked to re-authenticate first. Deletion permanently removes your account and your cloud-saved progress, including your collection, currencies and purchase entitlements, and cannot be undone.

You can also request deletion by emailing master.taherm@gmail.com from the address linked to your account. We honour verified requests within the time required by applicable law.

9. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data.
• Delete your data (see section 8).
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Data portability, where it applies.
• Complain to your data protection authority.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. We will not discriminate against you for exercising any right.

You can also limit analytics and advertising identifiers through your device settings (for example "Reset advertising identifier" or Apple's tracking controls).

10. Children

The Game is designed for a general audience of teen and adult cricket fans and is not directed at children under 13, or the higher minimum age your country sets for consenting to data processing. We do not knowingly collect personal data from children below that age. If you believe a child has provided us personal data, contact us at master.taherm@gmail.com and we will delete it promptly.

Because the Game is not directed at children, it is not registered as a child-directed app with the advertising and analytics services it uses, and the age rating we submit to the app stores reflects the presence of in-app purchases and advertising. Parents and guardians can use platform controls, such as Ask to Buy, Screen Time and Google Family Link, to restrict purchases and manage what their child can access.

11. International transfers

Our service providers, including Google, may process data on servers outside your country. Where data moves across borders from regions that restrict transfers, we rely on safeguards such as the provider's standard contractual clauses and equivalent mechanisms so your data remains protected.

12. Changes to this policy

We may update this policy as the Game evolves, for example if we add rewarded ads or new features. We will change the effective date above and, for material changes, give you notice in the Game or on this site before the change takes effect. Continued use after the effective date means the updated policy applies.

13. Contact us

For any privacy question, request or complaint:

Email: master.taherm@gmail.com
Website: gullyroyale.com