Privacy Policy
This policy explains exactly what Garden Heist stores, why, and how to get rid of it. It describes the app as it is actually built — not a template. If something here does not match what the app does, the app is wrong and we want to hear about it.
The short version
- You can play without giving us your name, your email, or your location.
- We never sell your data, and we never share it for anyone else's advertising.
- Personalised ads happen only if you say yes when asked.
- Deleting your account inside the app really deletes it, after a 30-day grace period.
What we collect
Account identifier (always)
When you first open the game we create an anonymous account with Firebase Authentication. It is a random identifier. It is not derived from your device, your phone number, or anything about you, and it does not follow you to any other app.
Email address (only if you choose)
If you want to keep your garden across devices you can attach an email address and password, or sign in with Apple or with Google. Then we store that email address, so that you can sign back in and so that we can send a password reset if you ask for one. If you use Sign in with Apple and choose "Hide My Email", we only ever see Apple's relay address. Attaching an account is optional; the game is fully playable without it.
Game progress (always)
Your garden, your crops, your coins and gems, your level, your friends list and your in-game nickname. This is the save file. It lives on our servers so you cannot lose it and so that other players can raid your garden, which is the point of the game.
Notification token (only if you allow notifications)
If you turn on push notifications we store the token the operating system gives us, so we can tell you that your crops are ready or that someone raided you. Turn notifications off — in the game's Settings or in your device settings — and the token is discarded.
Purchases (only if you buy something)
If you buy anything, we store the transaction identifier and the product identifier from Apple or Google, so we can give you what you paid for exactly once and honour refunds. We never see your card number, your billing address, or your name. Payment is handled entirely by Apple or Google; we only receive a receipt to check.
Advertising identifier (only with your consent)
Ads are served by Google AdMob. Before any ad loads we ask for consent through Google's User Messaging Platform, and on iOS also through Apple's App Tracking Transparency prompt. If you decline, ads are non-personalised and your advertising identifier is not used for tracking. If you accept, Google may use your device's advertising identifier to personalise ads. You can change your mind at any time in your device settings, and on Android and iOS you can reset or disable that identifier entirely.
What Google does with it is governed by Google's own policy: How Google uses information from sites or apps that use our services.
Anonymous counters (always)
We keep aggregate daily counters — how many times the shop was opened today, how many purchases succeeded today. These are plain numbers in a shared bucket. They carry no account identifier, no device identifier and no timestamps finer than the day, so they cannot be traced back to you, not even by us. We use them to tell whether a change made the game better or worse.
What we do not collect
- Your real name.
- Your precise or coarse location.
- Your contacts, photos, microphone, camera, calendar, or health data.
- Your browsing history outside the game.
- Card numbers or any other payment details.
Who we share it with
We do not sell personal data and we do not share it for third-party advertising. Data is processed on our behalf by:
- Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud
Messaging) — hosting, accounts, the save file and notifications. Game data is stored in the
europe-west1region. - Google AdMob — ads, under the consent described above.
- Apple and Google Play — purchases and receipt validation.
We may also disclose data if the law actually requires it.
How long we keep it, and how to delete your account
Your account and progress are kept while the account exists. When you delete your account from inside the game (Settings → Account → Delete account), we immediately remove it from play and keep a restore copy for 30 days in case you deleted it by accident or by someone else's hand. After 30 days the copy is deleted automatically and cannot be recovered by anyone, including us.
Purchase records are kept longer where tax and accounting law requires it. Aggregate counters have no expiry because there is nothing personal in them to expire.
Your rights
If you are in the EU, the UK, or anywhere else with comparable law, you have the right to access, correct, export, restrict, object to, and delete your personal data, and to withdraw consent at any time. The fastest route for most of these is in the game itself:
- Access and export — write to us and we will send you everything tied to your account.
- Deletion — Settings → Account → Delete account, which needs no email from you at all.
- Withdrawing ad consent — your device's privacy settings, effective on the next ad request.
You also have the right to complain to your data protection authority.
Children
Garden Heist is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us data, contact us and we will delete it.
Changes
If we change this policy in a way that matters, we will say so in the app before the change takes effect. The date at the top always reflects the current version.
Contact
Questions, requests, or corrections: contact@hashcoreai.com