Cube Candy Privacy Policy

1. Who we are

Andrija Rotter Kobasić, a sole indie developer based in Croatia (operating as Kobasic), is the data controller for Cube Candy (Android package com.kobasic.cubecandy; the "Game").

For any privacy-related question, including requests to exercise your rights below, contact us at kobasic@gmail.com. We respond within 30 days.

2. What data we collect

Core gameplay progress stays on your device. We do not receive your name or account profile while you play as a guest; limited service data may still be processed as described below.

Adventure mode and daily challenge progress
High scores, statistics, and combo history
Audio, haptic, notification, and gameplay preferences

Data sent off your device through analytics, crash reporting, advertising, and optional Google services is described in section 2c.

If you choose to sign in, Google sends us a one-time ID token from which we read:

Your Google account's display name
Your Google account's email address
Your Google account's avatar URL
A stable account identifier (Google "sub" claim)

We never receive your password, OAuth refresh token, or full Google account data. We only keep what is needed to recognise you as the same user across sessions.

2c. Automatic data (every install)

Anonymous analytics & crash reports — aggregated, non-identifying metrics (screen views, session counts, ANR / crash stack traces) used to fix bugs and improve gameplay. Processed by AppMetrica.
Google advertising data — when ads are shown, AdMob receives device-level signals such as approximate location (IP-based country), ad identifier, and language. In the EEA / UK, this is gated by your consent choice (see section 5).
Unity mediated advertising data — when the mediation stack selects Unity Ads, Unity may process device information, IP address and approximate location, advertising and app-install identifiers, play-session information, ad impressions, clicks, campaign interactions, and monetisation events. This is used to deliver and measure ads, report performance, prevent fraud, and personalise ads where your consent permits.
Purchase entitlements — Google handles the transaction; we only see whether an entitlement (e.g. Premium) is active for your account. We never receive payment card or billing-address data.

Performance of a contract — to provide the Game and the features you ask for (e.g. saving progress, handling purchases).
Legitimate interests — for anonymous analytics and crash reports, fraud prevention, and securing the service. We weigh these against your privacy and use the minimum data needed.
Consent — for personalised advertising in the EEA / UK, as collected via Google's User Messaging Platform consent prompt and communicated to integrated advertising partners where supported.
Legal obligation — when applicable law requires us to retain or disclose data (e.g. tax records for purchases).

4. Third-party services we rely on

These services act as independent data controllers or processors under their own privacy terms:

AppMetrica (Yandex) — Anonymous analytics and crash reporting. Privacy policy
Google AdMob (Google) — Serves ads (banner, interstitial, rewarded). Subject to your consent choice in the EEA / UK. Privacy policy
Unity Ads (mediated ad network) (Unity Technologies) — May serve ads when selected by the mediation stack and process device, ad-interaction and monetisation data for delivery, measurement, reporting, fraud prevention and permitted personalisation. Privacy policy
User Messaging Platform (UMP) (Google) — Collects and stores your ads consent choice (GDPR / EEA / UK). Privacy policy
Google Identity Services (Google) — Verifies your Google account during sign-in via a one-time ID token. Privacy policy
Google Play Billing (Google) — Handles in-app purchases and subscriptions. Privacy policy

The Game uses an advertising mediation setup that includes Google AdMob and Unity Ads. The mediation layer selects an available ad source for each request. If you are in the EEA or the UK, the first time you launch the Game (and any time you change it from in-app settings) you see a Google UMP consent dialog, where you can choose:

Accept personalised advertising;
Use only non-personalised advertising;
Manage individual partners.

Your consent choice can be changed any time from in-app Settings → Privacy. That choice is used to configure ad requests and is communicated to integrated advertising partners where supported. Unity ad units may also provide their own privacy control for Unity's advertising services. Withdrawing consent doesn't affect the lawfulness of processing done before you withdrew.

6. International transfers

Some of the third-party services listed in section 4 (notably Google and Unity services) may transfer or process data outside of the EEA, including in the United States. These transfers rely on the EU–US Data Privacy Framework and on Standard Contractual Clauses where applicable. We rely on the third party's own safeguards as published in their privacy policies.

7. How long we keep data

Local game data — until you uninstall the Game or clear app data.
Anonymous analytics & crash reports — retained for the duration set by AppMetrica defaults (typically up to 2 years), aggregated and not tied to your real identity.
Advertising and mediation data — retained by Google, Unity, and any selected advertising partners under their own privacy policies and retention schedules. We do not receive your raw advertising profile or control those providers' retention periods.
Account-linked data (signed-in users) — retained until you sign out or request deletion.
Purchase records — kept for as long as legal and tax obligations require (typically 10 years under Croatian law).

If you are in the EEA, the UK, or another jurisdiction with equivalent data-protection law, you have the following rights with respect to your personal data:

Right of access — to know what data we hold about you and to receive a copy.
Right to rectification — to correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — to have your data deleted, where there is no overriding legal reason to keep it.
Right to restrict processing — to ask us to pause processing in certain cases.
Right to data portability — to receive your data in a structured, machine-readable format and have it sent to another controller.
Right to object — to object to processing based on legitimate interests, including for direct marketing.
Right to withdraw consent — at any time, where processing is based on your consent (e.g. personalised ads).
Right to lodge a complaint — with the Croatian Personal Data Protection Agency (AZOP) or your local supervisory authority.

9. How to exercise your rights

Email kobasic@gmail.com with a clear description of your request. To help us locate your data and verify it's actually you, please include:

The Game name (Cube Candy) and the email used to sign in (if any);
Your in-app User ID, found in Profile → User ID → Copy;
The right you wish to exercise.

We respond within 30 days (extendable by up to 60 days for complex requests, in which case we will explain why).

10. Children's privacy

Cube Candy is not directed at children under 13 years of age (or the equivalent age in your country). We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Security

We follow industry-standard practices to protect data in transit (TLS) and at rest. No system is perfectly secure; if you suspect a breach, please tell us at kobasic@gmail.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be highlighted in-app or on the Cube Candy Play Store listing. Continued use of the Game after a change means you accept the updated policy.

Last updated: July 28, 2026 · Data controller: Andrija Rotter Kobasić, Croatia. · Contact: kobasic@gmail.com

1. Who we are

2. What data we collect

2a. When you play as a guest (no sign-in)

2b. When you sign in with Google