Ardesia mobile privacy

Updated 15 October 2026. This notice covers iOS and Android; features depend on the installed version. Version 1.1 (including build 100) offers separate, optional usage statistics and crash reporting, first introduced in preview build 78. This notice describes version 1.1 in advance of its store availability and does not mean the update is already available. The choices below apply when you install version 1.1 with the new Privacy card. Older builds are described separately below. Account, purchase and online game services operate independently of optional measurement.

Choosing Report an issue on a Together connection error sends a manual technical report to Ardesia, separately from optional crash reporting. It requires a signed-in session and includes a reference ID, app build/platform and bounded connection-status counters. It excludes peer addresses, credentials, account names and gameplay contents. Reports use the separate diagnostic archive with 24-hour retention; a failed send is shown and is not retried automatically.

Who is responsible

Tommaso Galli, Via Giano della Bella 22/1, 50124 Firenze, Italy, is the controller. Contact tommy@ardesia.world for privacy, support or requests concerning your data.

Playing, accounts and saves

Campaign and Rush support local offline play. Progress, preferences and downloaded or packaged resources are kept in the app's private storage. An optional Ardesia account supports cloud saves, unlocks, purchases and online features; Together requires an account. Registration and account management process your name, surname, email, display name, language, password hash, account identifier, accepted terms and session information. Credentials are sent over HTTPS to the Ardesia account service, not to Firebase. Recovery and verification use operational email.

Signed-in play synchronizes progress, achievements, memories, rewards and eligible results. Changes can remain on the device while offline and synchronize later. Current builds with Stay signed in retain a session credential in platform secure storage where supported; signing out or disabling this option removes that saved session. Older iOS builds may retain a remembered login in Keychain. Passwords are not saved in ordinary app files.

Online play and leaderboards

Arena and Together exchange lobby membership, player identifiers or guest identifiers, nicknames, gameplay state and results with the game service and participating players. Direct WebRTC connections may expose network addresses to the other participant; relay servers process connection information when used. No player text chat, voice recording or uploaded media is offered. Leaderboards show nicknames and game results, including relevant scores, times and achievements. Choose a nickname you are comfortable sharing; your account email and surname are not published in rankings.

Purchases

Native purchases use Apple StoreKit or Google Play Billing. The store handles payment details. Ardesia receives transaction references, signed receipts or purchase tokens, product identifiers and entitlement information to verify purchases, restore eligible access, credit shards and prevent duplicate claims. These records are linked to your Ardesia account. Ardesia does not receive your full card number. Providing purchased access is part of the purchase contract; records may also be retained for fraud prevention, legal obligations and disputes. Apple and Google process their own store data under their respective privacy notices. Optional analytics may measure purchase events after consent, including product and price; payment credentials are not sent through gameplay events.

Version 1.1: your optional choices

Optional usage statistics and crash reporting are off by default. The home screen offers equally prominent Allow all and No thanks actions. Customize lets you choose usage statistics and diagnostics separately. Refusing does not prevent playing, signing in or purchasing. Advertising tracking is not available in this release.

Return to the home screen and open Privacy to change or withdraw your choices. Your choice is saved on the device for this version of the consent purposes; an earlier combined acceptance does not enable the new choices automatically. If the available purposes materially change, the app asks again. Website cookie choices are separate and do not enable native collection. Firebase is not initialized before you grant at least one of the two optional purposes.

If you enable crash reporting after a Firebase session began without diagnostic consent, it starts from the next launch. Reports from a previous session without diagnostic consent are deleted before crash reporting is enabled. When usage statistics alone initialize Firebase, Crashlytics may create a local report in private app storage, but the app does not authorize its upload. Turning diagnostics off disables further report delivery and requests deletion of pending reports; withdrawing consent cannot recall data already delivered or requests already in flight.

What optional measurement processes

Usage measurement covers the selected mode (Campaign, Rush, Arena or Together), starts, endings, measured active time, room/world/type where available, deaths and connection states. Detail depends on the mode and build; unknown values are not invented. Firebase also measures app lifecycle and session information and may measure in-app purchase events. Its SDKs use app-instance, installation and session identifiers, app and operating-system versions and device characteristics. Google Analytics derives approximate location from network information; the game does not request GPS or precise location. These records are pseudonymous, not anonymous. Ardesia does not attach the game account ID, email, name, password, raw save or lobby code to its Firebase events.

With diagnostic consent, Crashlytics processes crash traces, relevant device and application state, session/installation identifiers, and limited gameplay context such as mode and, when usage statistics are also enabled, Analytics breadcrumbs, to help diagnose failures. It may retain a report locally for later delivery. Revoking consent disables further optional collection and requests deletion of unsent reports when the SDK is running; it does not recall information already delivered or requests in flight. Account deletion and telemetry deletion are separate because Ardesia does not join Firebase installation records to the account. Contact us for help with a data request; identification of a particular telemetry record may require information from the original installation.

Version 1.1 and the earlier builds described below do not use native Meta or TikTok SDKs, advertising identifiers, advertising personalization or cross-app advertising tracking. They do not request Apple tracking authorization. Ardesia does not send native Firebase events to advertising networks.

Earlier versions

Build 55 and other versions without the optional Firebase module do not provide this Firebase measurement. Preview builds with the earlier October 2026 module and Privacy choices offered Accept all and Deny all for Analytics and Crashlytics together, with a choice lasting up to six months. Refusal left both off and did not prevent playing. That combined acceptance is not reused by the version 1.1 consent module introduced in preview build 78.

The disabled-module configurations 77r5 (iOS) and 77r6 (Android) open this static notice without initializing Firebase Analytics or Crashlytics, including after an earlier acceptance. They do not send optional client analytics or crash reports. They do not initialize Firebase to clear pending local reports, which may remain in private app storage without being transmitted by the disabled module. Updating or disabling measurement does not delete information previously delivered to Google.

Security, recipients and purposes

Network requests expose IP addresses and technical request information to the service for delivery, security and abuse prevention. Accounts, saves, multiplayer and purchase validation are processed to provide the requested service (GDPR Article 6(1)(b)); limited security records and support administration rely on legitimate interests (Article 6(1)(f)). Legal retention relies on Article 6(1)(c). Optional Firebase measurement and diagnostics rely on consent (Article 6(1)(a)). Optional product emails, where separately offered during registration, require their own consent; they are not enabled by native Privacy choices.

Hetzner hosts the Ardesia account service in Helsinki, Finland. Spacemail delivers operational account emails. Google supplies Firebase Analytics and Crashlytics for the optional measurement described above; participating players receive the online game data described above. We do not sell personal data or send native telemetry to advertising networks. Providers use personnel and subprocessors to deliver their services. Google and email providers may process information outside the EEA, including the United States, under applicable transfer safeguards. See Firebase privacy and retention, Google transfer safeguards, and the account privacy notice for provider arrangements and rights.

Retention and deletion

Local progress remains until replaced or removed using app controls or device storage settings. Account records and cloud saves have no automatic inactivity expiry. Deleting the account removes linked account records, cloud saves and leaderboard entries from the live database. Transaction, entitlement, fraud-prevention or dispute records may require separate handling and have no general automatic expiry. We assess retention against the specific purpose and applicable legal obligations.

Access logs rotate daily with 14 rotated archives. Scheduled database backups retain the latest 14 successful generations; failures can extend calendar retention. Separate release backups are reviewed manually. Deletion from the live database does not immediately erase every backup. The account notice explains these limits, including technical diagnostic records. For data received with optional measurement, Google Analytics event-data retention is configured to two months and user-data retention to 14 months, renewed by activity; aggregate reports are governed separately. Firebase states that Crashlytics retains crash records and associated identifiers for 90 days before beginning removal from live and backup systems.

To request deletion, use Account → Delete Account in supported builds, or follow the account and data deletion instructions without installing or signing into the app. You may also request deletion of particular data without deleting the account. Uninstalling alone does not delete your server account. Do not uninstall before synchronizing progress you want to keep.

Permissions, age and your rights

The game does not request camera, microphone, contacts, photo-library or location access. External privacy and support pages open in your browser and follow the website's own notice. Accounts are for people aged 13 or over; under-18s need parent or guardian permission. The account age threshold does not authorize optional tracking. Ardesia has no verified parental-consent flow, so anyone below the applicable digital-consent age (14 in Italy) must leave optional analytics off. Optional account product emails are offered only to adults.

You can request access, correction, deletion, restriction or portability where applicable, object to legitimate-interest processing and withdraw consent. Withdrawal does not affect earlier processing. Contact tommy@ardesia.world; proportionate identity checks may be needed. You may complain to the Italian Garante or your competent supervisory authority. See the Terms for the service relationship. We update this notice before enabling material changes to data practices.