Privacy Policy

Rillroot (app ID com.dangasama.garden) · Effective 20 October 2026

This policy explains what data the mobile game Rillroot (“the game”) uses, why, and the choices you have. The game is a puzzle game for Android and iOS. You can play it without creating an account; signing in with Google, to keep your progress in the cloud, is optional.

Who is responsible

The data controller is Luis-Fernando Scripcaru, Romania. Contact: hello@luisscripcaru.com.

Data kept on your device

Your settings (language, sound, vibration, the daily reminder time) and the downloaded levels are stored only on your phone. Your progress (levels, streak, coins, power-ups, daily race history, your player name and avatar) is stored on your phone too, and is copied to the cloud only if you sign in with Google (see below). Uninstalling the game deletes what is on the phone.

The daily reminder is optional and off by default. It is a notification scheduled on your phone; no data is sent anywhere to show it.

Data processed by service providers

The game uses the following services. They receive the data described below, under their own privacy policies.

Level downloads and app protection: Google Firebase

New levels and the daily puzzle are downloaded from Google Cloud Firestore. To deliver them, Google processes technical data such as your IP address and device type. Firebase App Check (with Google Play Integrity on Android and Apple App Attest on iOS) verifies that requests come from the real game. Firebase Remote Config delivers game settings (for example prices in coins) and uses an installation identifier.

Legal basis: our legitimate interest in delivering the game's content and protecting it from abuse (GDPR Art. 6(1)(f)).

Player ID: Firebase Authentication

On first launch the game creates an anonymous player account with Google Firebase Authentication: a random identifier, with no name or email attached. It lets the leaderboards know which entry is yours and stops others from changing it. Firebase processes technical data such as your IP address to provide this.

Legal basis: performing the service you use (GDPR Art. 6(1)(b)) and our legitimate interest in protecting the leaderboards from abuse (Art. 6(1)(f)).

Leaderboards: the daily board and the daily race

Once you reach the leaderboards (after the first levels), the game shows you on them under a player name and an avatar. The name is made up for you (a garden name such as “Mossy Fern”) and you can change it; please don't use your real name. Stored in Google Cloud Firestore and visible to other players: your player name, avatar and avatar frame, how many daily races you have won, your solve time on each day's daily puzzle, your score in each day's race, and when they were set, all linked to your player ID.

Legal basis: performing the service you use (GDPR Art. 6(1)(b)). Entries are removed when you delete your account, or on request.

Sign in with Google and cloud save (optional)

If you sign in with Google (Settings → Account), Google shares your name, email address and Google account ID with the game through Firebase Authentication, and your player account is tied to your Google account. Your saved game (levels finished, coins, power-ups, daily streak, race history, player name, avatar and frames, and items bought with coins) is then stored in Google Cloud Firestore under your account, so you can continue on another phone. Only you can read it. Your purchases are tied to your player ID at RevenueCat, so they follow your account.

Legal basis: performing the service you asked for (GDPR Art. 6(1)(b)). Signing out leaves the cloud save in your account; deleting your account removes it.

Usage statistics and crash reports: Google Analytics for Firebase, Firebase Crashlytics

Only with your consent. If you agree, the game sends gameplay events (for example a level started or finished, time taken, power-ups used, ads watched, purchases started), an app instance identifier, device and app information and approximate location (country, derived from the IP address). If the game crashes, a crash report with technical details is sent. We use this to fix bugs and balance difficulty. We do not use it to identify you.

Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time (see “Your choices”).

Advertising: Google AdMob

The game shows ads (banners, ads between levels, and ads you choose to watch for a reward). Google AdMob receives your device's advertising identifier, IP address, device and app information and ad interactions, to show ads, limit how often they show, measure them and prevent fraud.

In the EEA, the UK and Switzerland, a consent form (Google's User Messaging Platform, using the IAB Transparency & Consent Framework) asks before personalised ads are shown. Without consent, Google shows non-personalised or limited ads. On iOS, the game asks for permission to track (App Tracking Transparency) before the advertising identifier is used. Ads in the game are limited to content suitable for a general audience (rating PG), and categories such as gambling, dating and alcohol are blocked.

Legal basis: your consent for personalised ads and for storing information on your device (GDPR Art. 6(1)(a), ePrivacy); our legitimate interest in funding the free game with non-personalised ads (Art. 6(1)(f)).

More: How Google uses information from apps that use its services.

In-app purchases: RevenueCat, Google Play, Apple App Store

Purchases (No ads, bundles, coin packs, deals, avatar frames) are paid through Google Play or the App Store; we never see your payment details. RevenueCat, Inc. receives the purchase receipt, product, price, country and an app user identifier (anonymous, or your player ID if you signed in with Google), so the game can check and restore your purchases.

Legal basis: performing the purchase contract (GDPR Art. 6(1)(b)).

Support emails

If you write to us, we receive your email address and what you send, and use them only to answer you. We keep them for as long as needed to handle your request, at most two years.

Your choices

Your rights

Under the GDPR you have the right to access, correct and delete your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting what was done before. Most data is linked only to random identifiers, not to your name, so please tell us what you are asking about: your player name, or the email of the Google account you signed in with. Write to hello@luisscripcaru.com.

You can also complain to a data protection authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

How long data is kept

Data on your device stays until you uninstall the game. Your account, cloud save and leaderboard entries stay until you delete your account or ask us to remove them; when you delete your account they are removed straight away (backups of Google's systems are overwritten within about 30 days). Analytics data is kept for up to 14 months; crash reports for up to 90 days. Advertising and purchase data are kept by Google, Apple and RevenueCat under their own retention rules.

Transfers outside the EEA

Google and RevenueCat may process data in the United States and other countries. These transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

Children

The game is meant for players aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has used the game and data was collected, contact us and we will help remove it.

Security

Data sent by the game travels over encrypted connections (HTTPS). Downloaded levels are checked against a published list of checksums, so changed files are rejected.

Changes

If this policy changes, we will update this page and its effective date. Important changes will also be announced in the game.

Service providers' policies