Privacy Policy

This Privacy Policy describes how IdleArc ("we", "us", or "our") collects, uses, and shares information about you when you use the IdleArc website (idlearc.com) and our mobile and web application (together, the "Services").

IdleArc is operated by Mikhael Studio. For the purposes of the EU and UK General Data Protection Regulation (GDPR), Mikhael Studio is the "data controller" responsible for your personal data. See "Contact Us" below for how to reach us.

We collect the following types of information:

• Account Information: When you create an account, we collect your email address and username.
• Gameplay Data: We collect information about your in-game progress, including character stats, items, achievements, and game settings.
• User Content: Content you create in the game, such as chat messages, your username, and guild names and descriptions.
• Purchase Information: When you make an in-app purchase, we receive a confirmation and entitlement details from the app store so we can grant your purchase. We do not receive or store your payment card details.
• Device & Log Information: We may collect your device type, operating system, unique device identifiers, IP address, and technical log data (such as timestamps and error reports) needed to run and secure the Services.
• Advertising Identifier (with your consent): If you agree to ad attribution, we collect your device's advertising identifier (Apple IDFA / Google advertising ID) to measure which of our ad campaigns bring new players — see "Advertising Attribution" below.
• Communications: If you contact us (e.g., by email), we keep your messages and contact details to respond.

We use the information we collect to:

• Provide, maintain, and improve the Services
• Create and manage your account
• Save and sync your game progress across devices
• Process and grant your in-app purchases
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities to improve the Services
• Measure the performance of our own ad campaigns (with your consent — see "Advertising Attribution")
• Detect, investigate, and prevent cheating, fraud, abuse, and other illegal activities
• Comply with our legal obligations

If you are in the European Economic Area (EEA) or the UK, we process your personal data on the following legal bases:

• Performance of a contract: to create your account, provide the Services, save your progress, and grant your purchases.
• Legitimate interests: to secure the Services, prevent cheating and fraud, monitor for errors, and improve the game — balanced against your rights.
• Consent: for ad-campaign attribution (sharing your advertising identifier with our partner Tenjin — see "Advertising Attribution"), and for any optional cookies or communications that require it. You can withdraw consent at any time, as easily as you gave it (see "Advertising Attribution", "Cookies", and "Your Rights").
• Legal obligation: to keep records required by law (for example, tax and accounting records for purchases).

We do not sell your personal data, and we do not share it so that other companies can advertise to you. The only advertising-related sharing we do concerns our own ads: with your consent, we share limited device data with our attribution partner Tenjin solely to measure ad campaigns we run for IdleArc (see "Advertising Attribution" below). Beyond that, we share information only with service providers ("processors") who help us run the Services, and only as needed:

• App stores (Apple App Store, Google Play): in-app purchases are processed by Apple or Google; their respective privacy policies apply. We do not directly collect or store payment information.
• Purchase management (RevenueCat): we use RevenueCat to validate in-app purchases and keep them in sync across your devices. RevenueCat receives your app account ID and purchase receipt data from the app stores and acts as our processor, storing data on Amazon Web Services in the United States. If you have consented to ad attribution, RevenueCat also receives your device's advertising identifier so it can forward purchase events to Tenjin (see "Advertising Attribution" below).
• Hosting & infrastructure (OVH): our servers and databases are hosted on OVH infrastructure.
• Error & performance monitoring (Better Stack): we send technical error and diagnostic data to help us find and fix problems.
• Push notifications (Google Firebase Cloud Messaging): to deliver push notifications, Google processes a per-install push token for your device (and, transiently, your IP address when delivering messages) as our processor.
• Website & traffic protection (Cloudflare): traffic to our Services passes through Cloudflare's network for security and DDoS protection; Cloudflare processes IP addresses and connection metadata in transit as our processor.
• Email delivery (OVH): account and support emails (such as password resets) are sent through OVH's email service, which processes your email address and the message content as our processor within the EU.
• Ad-campaign measurement (Tenjin): only with your consent — see "Advertising Attribution" below.

We may also disclose information if required by law, or to protect the rights, safety, and security of our players and the Services.

To help new players find the game, we sometimes run ads for IdleArc on other platforms. So we can tell which of our ad campaigns actually bring new players, the mobile app includes an attribution tool from Tenjin, Inc., a US company that acts as our processor under a data processing agreement — Tenjin uses this data only to provide the attribution service to us, never for its own purposes.

If you consent, the following is shared with Tenjin:

• Advertising identifier: your device's advertising ID (Apple IDFA / Google advertising ID).
• IP address: used to derive an approximate location, such as your country.
• Device information: device model, operating system and version, language and region.
• App events: install, app opens, and the app version you use.
• Purchase events: the product and price of in-app purchases (never your payment details), forwarded to Tenjin server-to-server by RevenueCat, our purchase-management provider.

We use this data for one purpose: measuring which ad campaigns bring new players and whether they are worth their cost. We do not use it to profile you across other companies' apps, we do not sell it, and it has no effect on gameplay.

Your choice (EEA and UK): attribution runs only with your consent, which we ask for on a dedicated screen when you first open the app. If you decline, no data about you or your device is shared with Tenjin. You can withdraw consent at any time in Settings → Ad attribution in the app — withdrawing is as easy as granting was, and it stops any further sharing.

Transfers and retention: Tenjin processes this data in the United States, protected by Standard Contractual Clauses under our data processing agreement with Tenjin (see "International Data Transfers" below). Under Tenjin's documented retention practice, user-level attribution data is kept for no more than 180 days.

On iOS: the app also asks for Apple's App Tracking Transparency permission; if you deny it, your advertising identifier is not available and is not shared. Separately, Apple's SKAdNetwork may send us aggregate, anonymous campaign statistics — these contain no identifiers about you or your device.

On Android: attribution uses the Google advertising ID. You can reset or delete this ID at any time in your device's system settings (Settings → Privacy → Ads).

If you consent and we run ad campaigns through Google, your consent confirmation is passed along to Google, as EU law requires — this signal carries your choice, not additional data about you.

Some of our service providers may process your data in countries outside your own, including outside the EEA or UK. Where this happens, we rely on appropriate safeguards — such as European Commission adequacy decisions or Standard Contractual Clauses — to protect your information in line with applicable data protection law.

We keep your personal data only for as long as we need it:

• Account & gameplay data: for as long as your account is active. When you delete your account, we delete or anonymize this data, except where we must keep it longer (see below). Short-lived encrypted backups may persist for a limited rotation period before being overwritten.
• Ad attribution data: held by our attribution partner Tenjin for no more than 180 days at the individual level (per its documented retention practice), after which it is deleted or only survives in aggregate statistics.
• Consent and acceptance records: we keep a record of your consent choices and Terms acceptances to demonstrate compliance; if you delete your account, these records are de-identified.
• Purchase records: retained for as long as tax and accounting law requires (in Poland, generally five years from the end of the relevant tax year). If you delete your account, your purchase records are anonymized — we keep them for accounting, but they are no longer linked to you.
• Technical & error logs: retained for a limited period and then deleted.
• Support communications: kept for as long as needed to handle your request and our records.

Our website uses cookies — small text files stored on your device — so that it can function. We currently use only strictly necessary, first-party cookies. We do not use analytics, advertising, or third-party tracking cookies on the website.

We load fonts from Bunny Fonts, a privacy-first provider that does not set cookies or track you. Cloudflare, which shields our website from attacks (see "How We Share Your Information"), may also set its own strictly necessary security cookies (such as __cf_bm) to tell real visitors and bots apart. Under the EU ePrivacy Directive, strictly necessary cookies are exempt from prior consent, but you can still block cookies through your browser settings (the website may not work correctly without them).

If we ever introduce analytics or advertising cookies, we will ask for your consent before setting them, and you will be able to accept, reject, or choose individual categories. You can review or change your choices at any time using the Cookie settings link, and withdrawing consent is as easy as giving it.

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using SSL/TLS
• Secure storage of data on protected servers
• Regular security assessments and updates

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

The Services are not directed to children under the age of 13 (or under the minimum age required in your country, such as 16 in parts of the EEA). We do not knowingly collect personal information from children below that age. If we become aware that we have collected such information, we will take steps to delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at the email address below.

Depending on where you live (including the EEA and UK), you have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you.
• Rectification: ask us to correct inaccurate or incomplete information.
• Erasure: delete your account and associated data at any time through the app settings, or ask us to delete your data. Account deletion permanently removes your game progress and personal information from our servers, except the limited records described in "Data Retention".
• Restriction & Objection: ask us to restrict, or object to, certain processing (including processing based on our legitimate interests).
• Data Portability: request a copy of your data in a portable, machine-readable format.
• Withdraw consent: where we rely on consent, you can withdraw it at any time without affecting prior processing. For ad attribution, just switch off the toggle in Settings → Ad attribution in the app.

To exercise any of these rights, contact us using the information below. We will respond within the time required by law (generally one month under the GDPR). You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Polish President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, "UODO") — uodo.gov.pl — and you can also complain to the data protection authority in the country where you live (in the UK, the Information Commissioner's Office, ico.org.uk).

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing; where automated checks flag possible cheating or fraud, a person reviews the case before any significant action (such as an account ban).

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on our website and in the app, and by updating the "Last updated" date above. We encourage you to review this Privacy Policy periodically.

If you have any questions about this Privacy Policy or our privacy practices, or to exercise your rights, please contact the data controller:

Mikhael Studio Michał Stefański
Pod Sosenkę 14, 32-061 Rybna, Poland
NIP: 9442268201
Email: [email protected]