Privacy Policy

Effective date: 24 August 2026 Last updated: 24 August 2026

This Privacy Policy explains how Robert Aneszko, a sole trader based in Poland (“we”, “us”, “our”), processes personal data in connection with the Word Popping mobile game (“the App”).

We are the data controller for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). You can reach us at robert.aneszko@gmail.com for any privacy-related question.

1. Summary

You never create an account. We never ask for your name, email address, or anything else that identifies you directly.
On first launch the App generates a random player id. It says nothing about who you are, but it is stored on your device and used to back up your progress and to group your gameplay statistics.
Your progress is stored on your device and backed up to our server, so that deleting and reinstalling the App does not lose it. The backup is stored in the European Union.
We collect gameplay analytics and crash reports through Google Firebase, so we can see where the game breaks, where it is too hard, and which features are used.
The App shows ads. At first launch iOS asks whether the App may track you. If you say no, or never answer, ads are contextual — not based on a profile of you.
In the EEA and the UK you are also shown a consent dialog for advertising, and you can change that answer at any time in the App under Settings → Privacy.
The App contains in-app purchases (coin packs). Apple processes the payment; we never see your payment details.

2. Identifiers we and our partners use

Player id — a random identifier created by Firebase Authentication (“anonymous sign-in”) the first time you open the App. It is not connected to an Apple ID, an email address, or any account. It is kept in the device keychain, which means it survives deleting the App — that is what lets your progress backup be found again after a reinstall.
App and device identifiers — the vendor identifier (IDFV) and the Firebase app instance id, assigned to this App on this device.
Advertising identifier (IDFA) — available to us and our advertising partners only if you allow tracking (section 6).
IP address — seen by every service the App contacts. It is used to route traffic, to derive coarse (city-level) location for ad delivery, and to determine whether EU/UK rules apply to you.

3. Data stored on your device

Your game progress: current level, coins, boosters, which tutorials you have seen
Your settings
Your advertising consent choices, in the standard IAB TCF format

Deleting the App removes this data from your device. The player id in the keychain is the exception — see section 2 — and so is the backup described next.

4. Your progress backup

Your progress is copied to Google Cloud Firestore, a database we operate, under a record named after your player id. The record contains your level, coin balance, boosters, and a timestamp. It contains no other information about you.

The backup is hosted in the European Union (Google’s europe-central2 region, Warsaw) and is read back only when the App finds no local progress — the reinstall case. Local progress otherwise always wins.

5. Analytics and crash reports

We use Google Firebase Analytics and Firebase Crashlytics.

Analytics events describe how the game is played — for example a level started or completed, a booster used, an ad shown (including what it earned), a purchase started or granted, a settings change. Each event carries your player id, the app version, your device model and iOS version, your language, a country derived from your IP address, and, where it applies, the ad campaign that led to your install (section 8).

Crash reports contain the technical state of the App when it stopped working: stack traces, device model, iOS version, and the sequence of events leading up to the crash.

Analytics events are exported daily into our own analysis database (Google BigQuery, also in the EU, europe-central2).

We use all of this to fix bugs, balance difficulty, understand which features are used, and measure whether our advertising pays for itself.

6. Advertising and App Tracking Transparency

Ads in the App are delivered by Unity LevelPlay (the ironSource mediation platform, operated by Unity Technologies), serving ads from the ironSource and Unity Ads networks.

At first launch, iOS shows you Apple’s App Tracking Transparency prompt:

If you allow tracking, your device’s advertising identifier (IDFA) is made available to our advertising partners. Ads may then be personalized, and ad performance can be measured across apps.
If you decline, or never answer, the IDFA is not available. Ads are contextual — chosen from the situation, not from a profile of you.

You can change this at any time in iOS Settings → Privacy & Security → Tracking.

To deliver ads, cap how often you see the same ad, prevent fraud, and measure that an ad was shown, our advertising partners may process your IP address (and coarse, city-level location derived from it), device information (model, operating system version, language, app version), the IDFV, the IDFA where available, ad interaction events (impressions, clicks, video completions), and technical diagnostics related to ad delivery.

Unity’s practices are described in the Unity Player and App User Privacy Policy.

If you are in the European Economic Area or the United Kingdom, the App shows you a consent dialog at first launch, provided by Google’s User Messaging Platform. Your choices are recorded on your device as an IAB TCF consent string, which our advertising partners read before serving any ad.

You can review and change these choices at any time: open the App’s Settings and tap Privacy.

If you do not consent to personalized advertising, you still see ads, but they are contextual.

8. Install attribution

Apple SKAdNetwork. The App participates in Apple’s SKAdNetwork framework, which tells advertisers that an install happened without identifying you. Attribution is aggregated and delayed by the operating system.
Apple Ads attribution. If you installed the App after tapping one of our ads on the App Store, iOS gives the App a token that we exchange with Apple for the campaign and ad group that brought you in. We store that campaign information alongside your analytics data. It identifies a campaign, not a person.

9. In-app purchases

The App sells coin packs through the App Store. Apple processes the payment. We never receive your card details, your Apple ID, or your billing address — only Apple’s confirmation that a purchase completed.

We record that a purchase was started and that coins were granted, together with the product bought and your coin balance, against your player id. We use this to make sure purchases are delivered correctly and to understand what players buy.

10. Remote configuration

The App downloads a small set of settings from Firebase Remote Config (for example how often ads appear), so we can adjust the game without shipping an update. The request carries standard app and device information.

11. Data processed by Apple

App Store analytics. If you have opted in to sharing analytics with developers in iOS Settings, Apple provides us with aggregated usage statistics such as install counts and retention. These are anonymous aggregates; we cannot identify you from them.
Crash diagnostics. Apple may share crash reports with us under the same opt-in.

12. Legal basis for processing

Processing activity	Legal basis (GDPR Art. 6)
Running the game, storing and restoring your progress	Performance of the service you request (Art. 6(1)(b))
Selling and delivering in-app purchases	Performance of the service you request (Art. 6(1)(b))
Personalized advertising in the EEA/UK	Your consent (Art. 6(1)(a)), given through the dialog in section 7 and withdrawable at any time
Contextual advertising, frequency capping, fraud prevention, and ad measurement	Legitimate interest in funding a free game (Art. 6(1)(f))
Analytics and crash reporting, to keep the App working and improve it	Legitimate interest in maintaining and improving our product (Art. 6(1)(f))

Where we rely on a legitimate interest, you have the right to object — see section 15.

13. US state privacy rights

If you allow tracking, identifiers about your device are shared with our advertising partners so that ads can be personalized. Some US state privacy laws, including California’s, treat that kind of sharing as a “sale” or “sharing” of personal information.

To opt out, either:

turn tracking off for Word Popping in iOS Settings → Privacy & Security → Tracking — this removes the advertising identifier and stops personalized advertising; or
email us at robert.aneszko@gmail.com and we will record your opt-out and pass it to our advertising partners.

We do not knowingly sell or share the personal information of anyone under 16.

14. How long we keep data

Your progress backup — kept while you play (each session overwrites it) and until you ask us to delete it.
Analytics events — kept for a limited period under Google Analytics’ retention settings and then deleted automatically. Aggregated statistics that no longer identify a device may be kept longer.
Crash reports — kept for the limited period applied by Firebase Crashlytics.
Data held by our advertising partners — kept according to their own retention schedules, described in their privacy notices.

You have the right to access, rectify, and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time where processing is based on consent.

A practical note: we hold no name, email, or account for you. Everything described here is keyed to the random player id on your device. If you write to us, we will do our best to find and act on your record, and we may need details that let us locate it — roughly when you installed the App and the level you had reached. If we cannot identify your data, we will tell you.

To delete local data, delete the App.
To delete your backup and analytics data, email robert.aneszko@gmail.com.
To withdraw advertising consent, use Settings → Privacy in the App (EEA/UK) or turn off tracking in iOS Settings.

You can lodge a complaint with the Polish data protection authority:

Urząd Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa, Poland https://uodo.gov.pl

16. International transfers

Your progress backup and our analysis database are hosted in the European Union. Firebase Analytics and Crashlytics are operated by Google and may process data on servers outside the EEA, including in the United States. Our advertising partner (Unity Technologies, including its ironSource platform) and Apple operate globally.

Where personal data is transferred outside the EEA, these transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses, as required by GDPR Articles 45-46.

17. Children

The App is not directed at children under 13, and we do not knowingly collect personal data from children. If you believe a child has used the App and you would like the associated data removed, contact us and we will delete it.

18. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated through the App where reasonably possible.

19. Contact

Robert Aneszko (sole trader) Poland Email: robert.aneszko@gmail.com