Privacy Policy

Who we are

Golf Haiku is a minigolf game for Android and iOS (app ID com.myroapps.golfhaiku). It is published by GABRIEL PALMYRO MARTINS DESENVOLVIMENTO DE SOFTWARE LTDA, a company registered in Brazil under CNPJ 50.257.343/0001-04, based in São Paulo. In this policy, “we”, “us” and “our” mean that company, which is the controller of the personal data described here.

For anything about privacy, email apps@gabrielpalmyro.com.

The short version

• There are no accounts, no sign-in, no chat and nothing for you to write or upload.
• Your progress, coins and settings are stored only on your device. We do not run a server for the app.
• The app creates a random ID for each install. It identifies the install, not you, and is used for analytics, purchases and crash reports.
• Ads are served by Google AdMob. Where the law requires it, the app asks for your consent first, and on iPhone and iPad your advertising identifier is used only if you allow tracking.
• Purchases are paid through Google Play or the App Store. We never see your card details.
• You can change your ad choices at any time, and uninstalling the app deletes everything it stored on your device.

What stays on your device

The app saves on your device: your progress (holes and balls), your coin balance, settings such as sound, a record of purchases already delivered (so each purchase is granted only once), the install ID described below and your ad consent choices (saved by Google's consent tool). None of this is copied to a server of ours. Uninstalling the app or clearing its data deletes it.

Some of these values, like the hole you are on or how many coins you have, are included in the analytics events described below.

The install ID

The first time you open Golf Haiku, it creates a random identifier (a version 4 UUID) and saves it on your device. It does not come from your device's hardware, your phone number, your name or any account. The app shows it as your Player ID in the pause menu, where you can tap to copy it.

We use it as the ID for analytics, purchases and crash reports, so that events from the same install can be grouped and each purchase can be matched to the install that made it. If you uninstall and reinstall the app, a new ID is created and the old one is no longer used.

Who receives data

The app sends data directly to the service providers below. Each one receives only what it needs for its job.

Google AdMob (ads) and Google's consent tool

Golf Haiku is free and shows ads: optional rewarded ads, which you choose to watch for a reward such as extra balls or coins, and full-screen ads at natural breaks, between holes or at the end of a game. They are served by Google AdMob, which receives:

• your device's advertising ID (the Android advertising ID or, on iPhone and iPad, Apple's IDFA only if you allow tracking);
• your IP address and the approximate location derived from it;
• device and app information, such as model, operating system, language and app version;
• how you interact with ads, such as views, taps and rewarded ads watched to the end;
• your consent choices.

Before any ad is requested, the app runs Google's User Messaging Platform. Depending on where you are, it shows a consent form (in the European Economic Area, the UK and Switzerland), lets you opt out of the “sale” or “sharing” of your data for targeted ads (in US states with privacy laws) and, on iPhone and iPad, shows a short explanation followed by Apple's App Tracking Transparency prompt.

Whether ads are personalised depends on those choices and on your device's ad settings. Non-personalised ads still use some data, such as your IP address and device information, to deliver ads, limit how often you see them, measure them and prevent fraud.

Google uses this data under its own policies. See how Google uses information from sites or apps that use its services and the Google Privacy Policy.

RevenueCat (purchases)

RevenueCat validates and keeps the record of in-app purchases so they can be delivered and restored. It receives the install ID, the products you buy (product, price, currency, transaction identifiers and dates), device and app information and your IP address. It may attach the install ID to the purchase in Google Play or the App Store, so a purchase can be matched to the install. Payment is processed by Google or Apple under their own terms: we never receive your card details, name or email address. See RevenueCat's privacy policy.

PostHog (product analytics)

We use PostHog to understand how the game is played, so we can tune difficulty, fix confusing parts and decide what to build next. The app sends events such as app opened, hole started, shot, hole sunk, miss, game over, continue, shop opened, ad watched, purchase and restore, with game values like the hole number, balls, shots and coins.

With each event, PostHog receives the install ID, device and app information (such as model, operating system, language, time zone, screen size and app version) and your IP address, which it uses to estimate a coarse location such as country and city. Session recording is turned off. We look at this data in aggregate and do not try to find out who you are. See PostHog's privacy policy.

Firebase Crashlytics (crash reports)

If the app crashes or hits a serious error, Firebase Crashlytics, a Google service, collects a crash report: where in the code it happened, device model, operating system and app version, the state of the app at the time (such as free memory and screen orientation), a Crashlytics installation ID and our install ID. We use these reports only to find and fix bugs. See Privacy and Security in Firebase.

Google Play and the App Store

Google and Apple handle downloads, payments and updates under their own privacy policies. They give us sales reports and aggregated statistics and, if you agreed to share it with developers, diagnostic data such as crash reports.

Other cases

We may disclose data when the law or a valid order from an authority requires it, or to protect our rights or the safety of users. If the app or our company is sold or reorganised, the data may pass to the new owner, who must keep honouring this policy. We do not sell your data for money and we do not share it with anyone else.

Why we use data, and our legal bases

Under Brazil's LGPD, the EU GDPR and the UK GDPR, each use of personal data needs a legal basis. These are ours:

• Delivering and restoring purchases, and helping with them: performing our contract with you, and legal obligations such as tax and accounting records.
• Personalised ads and tracking: your consent, given in the consent form or in Apple's tracking prompt. Where no consent form is shown, our legitimate interest in keeping the game free, which you can oppose at any time in your device's ad settings.
• Non-personalised ads, ad measurement and fraud prevention: our legitimate interest in funding a free game.
• Crash reports: our legitimate interest in keeping the app working and secure.
• Analytics: our legitimate interest in improving the game, using pseudonymous data looked at in aggregate.
• Answering your messages and requests: our legitimate interest in helping you, and our legal obligations under data protection law.

Where we rely on legitimate interest, we have weighed it against your interests, kept the data to what is needed and tied it to a random ID instead of your identity. You can object at any time (see “Your rights”).

Your choices

• Privacy settings in the app. Where Google's privacy messages apply to your region, the pause menu shows “Privacy settings”. It opens Google's form, where you can change or withdraw your consent or, in US states with privacy laws, opt out of the sale or sharing of your data for targeted ads.
• Android. In your device settings (usually Settings > Privacy > Ads, or Settings > Google > Ads), you can delete or reset your advertising ID. Once it is deleted, apps no longer receive it.
• iPhone and iPad. In Settings > Privacy & Security > Tracking, you can turn tracking off for Golf Haiku or for all apps.
• Analytics and crash reports. There is no switch in the app to turn them off. You can object by email: we will delete the data linked to your install and leave it out of further analysis.
• Uninstalling. Uninstalling the app deletes all the data it stored on your device, including the install ID, and stops all collection.

You do not have to give us any data to play, and refusing consent does not block the game: you may still see ads, but they will not be personalised.

Your rights

Wherever you live, you can ask us to:

• tell you whether we process data about you, and give you a copy;
• correct it;
• delete it;
• send it to you or to another service in a portable format;
• stop or limit a use of it, or object to a use based on legitimate interest;
• tell you who we share it with.

You can also withdraw your consent at any time, which does not affect what happened before. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

Brazil (LGPD)

You have the rights in article 18 of the Lei Geral de Proteção de Dados (Law 13,709/2018), including confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with your consent, information about who we share data with and about the consequences of refusing consent, and revocation of consent. You can also petition the national data protection authority, the ANPD.

European Economic Area, United Kingdom and Switzerland

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can complain to the data protection authority where you live or work, such as the ICO in the UK or the FDPIC in Switzerland.

United States

Some state laws, such as California's CCPA as amended by the CPRA, give you the right to know what personal information we collect, to access, correct and delete it, to opt out of its sale or sharing, and not to be treated differently for using these rights. You can also make a request through an authorised agent.

We collect these categories of personal information, from the app on your device, for the purposes in this policy: identifiers (install ID, advertising ID, IP address), commercial information (purchase records), internet or other electronic network activity (gameplay events and ad interactions) and approximate location derived from your IP address. We disclose them to the service providers listed above.

We do not sell personal information for money. Letting Google use your advertising ID and related data for personalised ads may count as “selling” or “sharing” for cross-context behavioural advertising under these laws. You can opt out with “Privacy settings” in the app (where shown) or in your device's ad settings. We do not collect sensitive personal information, and we do not knowingly sell or share the personal information of anyone under 16.

How to make a request

Email apps@gabrielpalmyro.com with your Player ID (pause menu, tap to copy). Because there are no accounts and we do not know who you are, that ID is how we find your data; if you no longer have the app, tell us your device model, roughly when you played and, for a purchase, the order number on your Google Play or App Store receipt. If we can link your request to an install ID, we delete or export the analytics, purchase and crash data tied to it at our providers, except records we must keep by law, such as tax records of purchases. If we cannot reasonably link the request to any data, we will tell you. Ad data that Google handles as an independent controller follows Google's policies, and you can exercise your rights with Google directly. We answer within the time limits set by the law that applies to you.

International transfers

We are based in Brazil, and our providers may process data in the United States and in other countries. When data leaves your country, the transfer relies on safeguards the law recognises, such as the standard contractual clauses in the providers' data processing terms or an adequacy decision.

How long we keep data

• On your device: until you uninstall the app or clear its data.
• Analytics (PostHog): as long as needed to understand and improve the game, and no longer than the retention period set in our PostHog project.
• Crash reports (Crashlytics): as long as needed to fix the problems they show, and no longer than Firebase's retention period for crash data.
• Purchases (RevenueCat, Google Play, App Store): as long as needed to deliver, restore and support your purchases, and for as long as tax and accounting laws require.
• Ads (Google): under Google's own retention policies.
• Your emails to us: as long as needed to handle your request and keep a record that we did.

Security

The app sends data to these providers over encrypted connections (HTTPS). Access to their dashboards is limited to the people who work on Golf Haiku. No system is perfectly secure, so if an incident is likely to affect you, we will take the steps the law requires, including notifying the authorities and you when required.

Children

Golf Haiku is meant for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children under 13, or under the minimum age set by the law where they live. If you believe a child has used the app and data about them was collected, email us and we will delete the data we can link to their install.

Changes to this policy

When we change this policy, we publish the new version on this page with a new effective date. If a change is significant, such as a new partner receiving data, we will also tell you in the app or on the store listing before it applies, and ask for your consent again where the law requires it.

Contact

Questions, requests or complaints: apps@gabrielpalmyro.com. This is also our channel for data subjects under the LGPD. We are based in São Paulo, Brazil. To contact Google, RevenueCat or PostHog directly, use the links to their policies above.