Gym Garden

1. Playing without an account

The Game works fully offline and your saves stay on your device. Without signing in we don't know your name or e-mail address. Two kinds of data can still reach us: statistics with a random installation identifier (section 2 – you can turn them off in Options) and, if you get a refund for the full version, Google's notice of that refund (section 4).

2. Diagnostics and gameplay statistics

The Game may send gameplay events (e.g. day finished, chapter reached, panel opened, app error) and basic technical information (game version, device type, language) to our server. Every event carries a random game-installation identifier. We use this to improve balance and stability. It contains no name, e-mail address or location unless you sign in with Google. You can turn statistics off in the Game: Options → "Send game stats".

3. Google account (optional)

You may sign in with Google to use cloud saves and the Gym League. We then process:

• your Google account e-mail address – as your account identifier in the Game,
• your game saves – stored on our server to sync progress between devices,
• your gym name and League results – visible to other League players,
• the gameplay statistics from section 2, linked to your account,
• the full-version purchase confirmation (section 4) – if you own the full version and use cloud saves.

Sign-in uses Google Sign-In; we never receive your password. Your e-mail address is never shown to other players.

4. In-app purchases

The basic Game is free. The full version can be bought once through the Google Play store. Payment is handled by Google (Google Payments) – we never receive your card number or other payment details. The app receives a purchase confirmation and a purchase token from Google Play. Ownership of the full version is stored on your device and tied to your Google Play account, so you can restore it on another device.

When you use cloud saves, the Game sends the purchase token to our server, which checks it with Google Play (Google Play Developer API). We then store with your in-Game account: a one-way hash of the purchase token (we never store the token itself), the order number, the purchase type (e.g. test) and the dates of purchase, confirmation and any refund. One purchase works in the cloud for up to three Game accounts.

If you buy after signing in to the Game, the app attaches a pseudonym of your Game account to the Google Play purchase: a SHA-256 hash of your e-mail address with a fixed added value, never the address itself. Google Play keeps it with the order and returns it to us each time we check the purchase – we do not store it in our database. This way the account that was signed in when you bought always has a place in the cloud for that purchase, and up to two other Game accounts can use it. A purchase made without signing in, or with a promo code redeemed in the Google Play store, has no pseudonym – it then works for the first three accounts. Google may use this pseudonym to detect payment abuse under its own rules.

Google sends us the list of the Game's refunded purchases. Once a purchase is refunded, the cloud stops accepting saves that need the full version. We keep the hash of a refunded purchase token with no link to any account, so deleting the account doesn't restore the full version in the cloud.

If we can't check the purchase with Google Play when you save (for example during an outage or before purchase checks are switched on) and we haven't confirmed your purchase yet, we still accept a save that needs the full version, but mark it as accepted without confirmation. While checks are working, you can download such a save only once the purchase is confirmed – the Game confirms it by itself. Without a purchase the save waits in the cloud: we don't delete it, and the copy on the device it came from stays there. The mark applies only to that save and disappears when a new save that's accepted normally replaces it (for example after the purchase is confirmed).

If gameplay statistics (section 2) are enabled, we also receive events when the offer is shown, when a purchase is made, when a purchase or restore fails (with Google Play's message) and when a purchase confirmation fails (with the reason, e.g. a refund or the account limit) – without the amount or any payment details. Refunds are governed by Google Play.

5. Recipients, hosting and security

Data is stored on servers in the European Union with hosting, database and content-delivery providers that process it on our behalf. Some of these providers are based in the USA; such transfers rely on Standard Contractual Clauses or the EU-US Data Privacy Framework. To check a purchase we send its token back to Google, which issued it (Google Play Developer API); when you buy while signed in, we also pass Google Play the pseudonym of your Game account (section 4). We do not sell your data.

Connections to our server are encrypted: the app connects over HTTPS, the connection from the content-delivery network to our API server is encrypted with a separate key (AES-256-GCM), and the server connects to the database over TLS. Apart from the database provider mentioned above, only our API server and the administrator have access to the database. We don't store purchase tokens – only their one-way hashes. Keys and passwords for our services are kept outside the app and outside the source code.

6. Retention

Cloud saves, account data and the purchase confirmation are kept as long as your Game account exists. Gameplay statistics are kept for up to 24 months. The record of a completed account deletion (section 8) is kept for up to 24 months so that we can confirm the deletion took place. The hash of a refunded purchase token (not linked to any account) is kept for as long as the Game is available on Google Play, because Google Play purchase tokens don't expire – solely to prevent abuse. We do not store the purchase pseudonym of your account; Google Play keeps it with the order under its own rules.

7. Legal bases

We process your account, cloud saves, League data and purchase confirmation because they are needed to provide the Game's services you use (Art. 6(1)(b) GDPR). Gameplay statistics, preventing purchase abuse (hashes of refunded purchases, the account limit, the mark on saves accepted without a confirmed purchase), the purchase pseudonym of your account (the buyer's place with the purchase and abuse prevention) and the account-deletion record rely on our legitimate interests: improving the Game, protecting against fraud and being able to show that a deletion request was carried out (Art. 6(1)(f) GDPR).

8. Your rights

You may access, correct, delete and port your data, restrict processing and object to it. You can delete your account yourself in the Android app: Saves → "Account: your e-mail address" → "Delete account and data" (in versions up to 1.0.6: Options → "Account: your e-mail address"), then confirm. We then immediately delete your cloud saves, your gym and League results and the purchase confirmation, and unlink gameplay statistics from your account – all that stays in them is a random game-installation identifier, with no e-mail address (after the deletion the Game generates a new one). The account stops working on every device – each one signs out the next time it connects to our server.

Apart from that we keep only a record of the deletion itself – the date, the number of deleted records and a one-way hash of your e-mail address (the address cannot be recovered from it), solely to confirm the deletion if anyone asks – and the hashes of refunded purchase tokens (section 4). The pseudonym of your Game account attached to the full-version purchase stays in the Google Play order (we cannot remove it from there) – without your e-mail address; thanks to it, an account re-created with the same address gets the buyer's place in the cloud back. Your full-version purchase belongs to your Google Play account and stays – after you sign in again, the Game confirms it again, unless it was refunded.

You can also delete your account by e-mailing windchantstudios@gmail.com (e.g. if you no longer have the app, play in a browser or cannot sign in) – details on the account deletion page. For your other rights, write to the same address. We respond within 30 days. You also have the right to lodge a complaint with a data protection authority – in Poland, the President of the Personal Data Protection Office (UODO).

9. Children

The Game is not directed at children under 13 and we do not knowingly collect their data. We do not verify age ourselves: signing in requires a Google account, and Google sets the age rules and parental supervision for accounts (including Family Link supervised accounts). If you are a parent or guardian and want a child's in-Game account and related data deleted, e-mail us from that account's address or from the parent account that manages it in Family Link. We will delete the data within 30 days.

10. Changes

We will announce significant changes in the Game or on this page. The date of the last update is shown at the bottom of this document.

11. Contact

Windchant Studios, e-mail: windchantstudios@gmail.com.