Privacy policy

1. Information used by the game

• Local play: your device stores completed and unlocked levels, an unfinished game, local scores, purchase-access information, and preferences such as artwork mode, difficulty, sound, and haptics.
• Age choice: the first-run screen uses the age you enter to choose a local age band. New age choices store only under 13, 13–15, 16–17, 18 or older, or local-only/unknown. Earlier releases may retain a broader under-16 band, which remains restricted because the game cannot infer a narrower age from it. The game does not save or upload your exact age or date of birth. Choosing not to answer keeps online features restricted.
• Optional sign-in: eligible players aged 16 or older can open Options → Login to connect Google or Apple; the entry changes to Signed In when connected. When you connect, we receive a provider account identifier and any verified account information supplied for display, such as an email address or display name. We do not receive your Google or Apple password.
• Cloud progress: completed levels and the furthest level you have earned are associated with your connected game profile. The current ball position, lives, and unfinished game remain on the device.
• App updates: after the initial age choice, Android can check for a required game update, including during local play. Google Play handles this in its own process and uses device metadata, app version, and installed module and asset-pack information to determine availability and update size. Google states that this data is encrypted, not sent to third parties, and deleted after a fixed retention period. See Google’s update data-handling information.
• Security and operation: online requests involve information such as IP address, request time, app version, technical identifiers, and verification or error results. We use these to deliver the service, limit abusive requests, and investigate problems.

Bust Em does not request access to your contacts, camera, microphone, or precise device location. Local play does not require a cloud account. During ordinary under-16 or local-only/unknown play, cloud sign-in, synchronization, public scores, and background purchase-verification checks are disabled. The separate required-update check can still contact Google Play after the age choice. An explicit parent-confirmed purchase or restore action contacts the store and purchase-verification service as described below. Eligible older players can choose online features.

2. What other players can see

In releases that support account-owned nicknames, eligible signed-in players choose one permanent, unique nickname for their game profile before sharing a score. Capitalization does not make names different, and the first saved spelling is kept. Signing in to the same Google or Apple game profile on another device restores that nickname. Google and Apple profiles remain separate even when their email addresses match.

When you explicitly choose Submit for a new eligible high score, your nickname, score, and difficulty can be displayed publicly. The game does not automatically upload historical local scores in the background. The service receives a submission identifier and technical game details such as start and end level, rules version, and app version to handle retries and ranking eligibility. For account-owned submissions, it also keeps a private, opaque game-profile ownership reference to prevent another profile from reusing a submission.

Your cloud-account email, Google or Apple account identifier, private ownership reference, private progress, and purchase details are not shown on the leaderboard. Choose a nickname that does not reveal personal information.

Public score sharing is optional and unavailable in the under-16 and local-only/unknown modes. Before uploading, the game asks you to accept nickname rules and explains that the entry will be public. Hiding an entry saves that choice on your device. Reporting sends the entry identifier, difficulty, and a fixed reason to a private moderation queue; it does not ask for reporter email or free-text comments. The request still involves ordinary connection and abuse-prevention information.

The permanent-nickname registry starts with new account claims; older anonymous leaderboard entries remain historical and do not establish nickname ownership. Older installed releases may continue to use the earlier anonymous submission flow during compatibility support. Account-owned submissions in supported releases use a separate authenticated score endpoint; an old entry is not automatically transferred to a newly connected profile.

Deleting a cloud profile removes its nickname claim, so the name can be claimed again. It does not automatically remove submitted public scores or their limited private anti-replay ownership references. To request a score’s removal, use reporting or the deletion request instructions.

3. Full-game purchases and restoration

The full-game unlock is processed by Google Play or Apple’s App Store. The store handles payment and may collect billing information under its own terms. We do not receive payment-card details.

A parent-initiated Android local purchase can unlock the game without creating a Google or Apple cloud profile. Purchase and restore actions for players under 18, or without a confirmed age choice, first show a reading/arithmetic challenge and adult confirmation. These are practical safeguards, not identity verification or a claim of legally verified parental consent.

To verify ownership, our service processes purchase tokens or transaction identifiers, the product and platform, verification status and times, and pseudonymous purchase-account and installation identifiers. Account-independent purchases use a random credential held in device secure storage; derived identifiers bind the store purchase to that credential. The service checks store ownership before issuing time-limited access. This local purchase flow does not send an email address or cloud-progress profile.

Android restoration: in supported releases, Restore purchases can recover access on a new installation or migrate an earlier account-linked purchase without signing into a game profile. Google Play must report that the current Play account owns the unlock. Our service checks that purchase with Google and verifies a fresh Play Integrity result before associating a new protected local credential with it. A copied transaction identifier alone cannot restore access. Earlier releases may still require their original game account or secure credential.

Android recovery security: an explicit restore request uses Google Play Integrity. Google processes a request hash and one-use challenge, app package/version and signing-certificate information, Google Play licensing status, and device attestation certificates and tokens. Our verifier checks the resulting app, license, and device-integrity verdicts. We do not request optional environment-risk, device-recall, or recent-device-activity signals. Raw integrity tokens are not retained in our purchase database. One-use recovery challenges expire after 180 seconds and are removed when used or during a later challenge request; pseudonymous purchase bindings and recovery-alias records remain with the purchase-verification records described below. See Google’s Play Integrity data-handling information.

iOS restoration: purchases linked to a game profile currently retain their original account binding; use the same provider and game account. Account-independent iOS recovery and migration are not enabled in this Android release. Google and Apple game profiles are separate even if their email addresses match. Contact us if you cannot restore access.

Cloud progress and store purchases serve different purposes. Restoring access to the paid game does not restore completed levels; cloud progress requires the same eligible connected game profile. Local progress remains on the original device. Deleting a game profile does not delete your Apple or Google account, refund a purchase, or erase the store’s purchase history.

4. Advertising, sign-in SDKs, and service providers

Bust Em has no advertising. We do not sell your personal information or use your game data for targeted advertising. We have not added a separate gameplay-analytics or crash-reporting SDK.

Google sign-in on iOS: the Google Sign-In SDK included in the iOS game declares that Google may collect name, email address, phone-number information, approximate location, account and device identifiers, technical usage information, and other sign-in data. Its privacy manifest lists account/sign-in functionality and, for some identifiers and technical data, analytics as purposes. Google’s sign-in guidance also explains that an IP address may be used to estimate a general location for fraud prevention. These are provider-side practices: the Bust Em account service receives the verified provider identifier and available email or display name, not a phone number or GPS location. Bust Em does not request a phone-number or precise-location permission. Optional Google sign-in is available only in the eligible online experience described above.

The included Google SDK declares that this collection is not used for tracking under Apple’s advertising-tracking definition. This does not mean that sign-in makes no network requests or collects no data. Read Google’s sign-in data disclosure and the app’s App Store privacy label for the applicable data types and purposes.

We use Google and Apple for sign-in and store features, Google Play for Android update checks, and Google Play Integrity for explicit Android purchase recovery. Game progress, rankings, and purchase-verification records are stored on infrastructure operated for MonkeyForge Games. We may disclose information when required by law, to protect people or the service, or in a business transfer with appropriate notice and safeguards.

Read Google’s Privacy Policy and Apple’s Privacy Policy for their processing and choices.

5. Why we use information

We use information to provide requested game and account features, save and restore earned progress, display rankings, verify purchases, respond to support requests, and keep the service reliable and secure.

Where applicable, we rely on providing the service you request, our legitimate interests in operating and protecting the game, your consent where it is required, and compliance with legal obligations. You can withdraw consent for processing based on consent without affecting the lawfulness of earlier processing.

6. Storage, retention, and security

Device-local information stays on your device until removed through applicable game or device controls. Uninstalling or clearing app data may remove local progress; platform backup or secure-storage behavior can also affect what remains. Cloud profile information is kept while needed to provide the connected account.

Confirmed cloud-profile deletion removes the active profile, linked provider mapping, cloud progress, account-display details, permanent nickname claim, and game sessions. The released nickname can then be claimed by another profile. For Sign in with Apple, the service also revokes retained Apple authorizations. These authorization credentials are stored encrypted in a separate private service while needed for account management.

Some records remain separate from a deleted profile: public leaderboard entries until removed separately; limited moderation, report and duplicate-submission records, including opaque ownership references for account-owned submissions; and pseudonymous purchase-verification records needed to verify legitimate access, prevent fraud or duplicate claims, resolve disputes, or meet legal obligations. This includes account-independent purchase bindings. Purchase-verification records currently have no fixed automatic expiry. We review deletion requests and remove those records when the purposes requiring retention no longer apply, subject to applicable legal requirements.

Routine database backups retain the seven most recent copies; deleted information can remain in these protected copies until rotation removes them. Deletion does not rewrite earlier backups.

We use encrypted network connections, authenticated account access, private storage permissions, and store-side purchase verification. No storage or transmission method is completely secure. Google, Apple, and other relevant providers may process information in countries outside your own under their applicable safeguards and policies.

7. Your choices and deletion requests

• You can play locally without connecting Google or Apple. Signing out keeps local progress but stops account synchronization until you sign in again. The age band and hidden-score choices stay on the device.
• To delete a connected game profile, open Options → Signed In → Delete profile and confirm the warning. This affects the game profile, not your Google or Apple account.
• To request deletion without the app, removal of a public score, or access to or correction of your information, follow our account and data deletion page or email contact@monkeyforgegames.com. We may ask for reasonable proof of ownership. Never send passwords or sign-in codes.

Depending on where you live, you may have rights to access, correct, delete, receive a copy of, restrict, or object to processing, and to complain to your local data-protection authority. We handle requests in accordance with applicable law.

8. Children and family play

Local gameplay does not require a name, email address, or online account. Under-16 players and players who do not provide an age use the local experience, with online identity, cloud progress, public scores, and background purchase verification disabled. The Google Play update check is separate and can still run after the age choice. A stored session from an earlier installation or release does not override the online-feature restriction. The age band is a self-reported local preference, not verified identity.

In updated Android releases (version 0.5.43, build 128 and later), the separate Parent area settings entry is shown for under-13 and local-only/unknown choices. It also remains visible for an older, ambiguous under-16 choice until a new age choice is made; it is hidden for known ages 13 or older. Other releases may show Parent area more broadly. This visibility rule does not change the age-16 threshold for online features or the purchase safeguards. A parent or guardian can authorize an Android local purchase without creating a cloud profile. An explicit purchase or restore request transmits the purchase and technical identifiers described above. The parent challenge does not enable child sign-in or public sharing. Parents should supervise purchases and avoid including a child’s personal information in a support message.

If you are a parent or guardian with a concern about a child’s information, contact us to request review, removal, or a stop to further collection. We may need reasonable information to verify the request and locate the relevant profile or score. This statement does not replace any consent or other protections required by applicable law.

9. This website and policy changes

These pages use no advertising, analytics scripts, or cookies of their own. The web server may record ordinary access and security information, such as an IP address, browser information, requested path, and request time.

We may update the policy when features or requirements change. The date at the top identifies the current version; we provide additional notice when required for a material change.

10. Contact MonkeyForge Games

For questions about Bust Em or this policy, contact contact@monkeyforgegames.com. Please identify the game as “Bust Em” in your message.