Privacy Policy of the app “Sunbeam Cats: Cozy Puzzle”

Effective from: 27 October 2026 · Version 1.0 · Terms of Service

1. Data controller

The controller of personal data processed in connection with the use of the app “Sunbeam Cats: Cozy Puzzle” (application ID: com.hexeosoft.sunbeamcats, the “Game”) is Mikołaj Badyl HexeoSoft, Polish tax ID (NIP) 6551992325 (“we”, “us”, the “Controller”).

For any matter concerning personal data, write to: contact@hexeosoft.com.

This policy follows Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”) and the Polish Electronic Communications Law of 12 July 2024.

2. What data we process

The Game does not collect data that directly identifies you (your name, email address, phone number, GPS location, contacts or photos). Only the categories of data below are processed, mainly by the Google and Meta service providers described in sections 4 and 5:

Device and app identifiers – the Google advertising ID, the Firebase app instance ID, the Meta anonymous install ID and the ID of your consent choices.
Technical data – device model and manufacturer, operating system version, language and time zone, Game version, network connection type and IP address (used, among other things, to determine your approximate country or region; we do not store it).
Data on how you use the Game – events such as starting, completing or failing a level, stars earned, moves, the number of undos and hints used, play time, ads shown and whether a rewarded ad was watched to the end, as well as installing and opening the Game.
Crash data – when the Game crashes or an error occurs: the error description and stack trace, the state of the app at the time (e.g. whether it was in the foreground), free storage and memory, device model and operating system version, and the Crashlytics installation ID.
Advertising data – information about ad impressions and clicks and, if you consent, data used to match ads to your interests.
Your privacy choices – a record of the consents you gave or refused.
Purchase information – if you make an in-app purchase (e.g. “Remove Ads” or a hint pack): the product ID, the purchase status and the purchase token received from Google Play.

We do not process special categories of data within the meaning of Article 9 GDPR.

3. Purposes and legal bases

Purpose	Legal basis
Showing personalised ads (matched to your interests) and storing or accessing information on your device for advertising	Your consent – Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law
Showing non-personalised or limited ads that fund the free Game, measuring their performance and preventing fraud	Our legitimate interest – Article 6(1)(f) GDPR (funding the free Game and protecting against ad fraud); to the extent required by law – your consent
Usage statistics (e.g. which levels are too hard) used to improve the Game	In the EEA, the United Kingdom and Switzerland – your consent (Article 6(1)(a) GDPR); elsewhere – our legitimate interest in developing the Game (Article 6(1)(f) GDPR)
Measuring our advertising campaigns on Meta services (Facebook, Instagram) – whether an install came from an ad, Game launches, completed tutorial and levels, and in-app purchases	In the EEA, the United Kingdom and Switzerland – your consent (Article 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law); elsewhere – our legitimate interest in promoting the Game (Article 6(1)(f) GDPR)
Detecting and fixing crashes and errors in the Game (crash reports)	Our legitimate interest in keeping the Game stable – Article 6(1)(f) GDPR
Recording and respecting your privacy choices	Legal obligation – Article 6(1)(c) GDPR (accountability, Article 7(1) GDPR)
Processing in-app purchases and restoring them	Performance of a contract – Article 6(1)(b) GDPR
Handling your messages and requests	Legitimate interest – Article 6(1)(f) GDPR; when exercising your rights – Article 6(1)(c) GDPR
Establishing, pursuing or defending legal claims	Legitimate interest – Article 6(1)(f) GDPR

Providing data is voluntary. Refusing consent does not block the Game – you can keep playing, and ads may then be less relevant.

4. Ads (Google AdMob)

The Game shows ads served by Google AdMob, provided for users in the EEA and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use:

interstitial ads – sometimes shown between levels, never in the first levels and never right after a lost level;
rewarded ads – watched only by your choice (e.g. for an extra hint, an extra hour of sun or double stars); the reward is granted by the Game, not by the advertiser.

The Game shows no banner ads.

Google and its advertising partners may use the device’s advertising ID, IP address and technical data to show ads, measure their performance, limit how often they are shown and detect abuse. We show personalised ads only if you consent. Without consent, Google may show non-personalised ads chosen from context (e.g. general location at country or city level) or limited ads.

The list of Google’s advertising partners is available in the consent dialog (“Manage options”) and at support.google.com/admob/answer/9012903. More on how Google uses data: policies.google.com/technologies/partner-sites.

5. Statistics, crash reports and campaign measurement (Firebase, Meta)

To understand how players use the Game, we use Google Analytics for Firebase (provider: Google Ireland Limited). We look at analytics data only as aggregated statistics – we do not try to identify players and we do not combine this data with other sources.

We use Google Consent Mode. If you do not consent, Firebase does not store analytics identifiers on your device, and Google receives only anonymous signals without identifiers that allow general statistics to be estimated.

We use Firebase Remote Config (provider: Google Ireland Limited) to adjust settings of the Game, such as how often ads appear, without releasing an update; it uses the Firebase app instance ID.

When the Game crashes, Firebase Crashlytics (provider: Google Ireland Limited) sends us the technical report described in section 2. Reports contain no data that identifies you and are used only to find and fix errors. Crashlytics does not use the advertising ID.

Firebase data processing terms: firebase.google.com/support/privacy.

When we advertise the Game on Facebook and Instagram, we use Meta App Events (provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) to check whether an ad led to an install of the Game and how often it is used afterwards. Meta receives only: the install and launches of the Game, completion of the tutorial and of levels, and in-app purchases (with price and currency), together with the device’s advertising ID and the technical data described in section 2. We do not send Meta your progress, the names you give your cats or any contact data.

In the EEA, the United Kingdom and Switzerland, Meta App Events stays switched off until you consent in the consent dialog (section 6) – until then the Game sends no data to Meta. Meta may also use this data as a separate controller under its own privacy policy: facebook.com/privacy/policy.

If you use the Game in the EEA, the United Kingdom or Switzerland, a consent dialog managed by Google (a certified consent management platform compliant with the IAB TCF) is shown on first launch. You can:

consent to all purposes,
refuse consent with a single button,
choose individual purposes and partners under “Manage options”.

You can change or withdraw your consent at any time in the Game’s settings, under “Ad privacy settings”. The same choice applies to Firebase statistics and Meta campaign measurement. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Independently of the Game, you can reset or delete your advertising ID in Android settings (Settings → Privacy → Ads, or Google → Ads).

7. Recipients of data

Data may be shared only with:

Google Ireland Limited and Google LLC – as providers of AdMob, Firebase and Google Analytics;
Google’s advertising partners – to the extent your consent allows;
Meta Platforms Ireland Limited and Meta Platforms, Inc. – as providers of Meta App Events, only after you consent;
Google Commerce Limited / Google Play – for distributing the app and processing payments for in-app purchases, under Google Play’s terms. Card and other payment data are processed only by Google; the Game receives only information about the purchase (product ID, its status and the purchase token) to deliver what you bought;
public authorities – only where required by law.

We do not sell personal data.

8. Transfers outside the European Economic Area

Google, Meta and some advertising partners may process data in countries outside the EEA, in particular in the United States. Google LLC and Meta Platforms, Inc. participate in the EU-U.S. Data Privacy Framework, covered by an adequacy decision of the European Commission (Article 45 GDPR). In other cases, transfers are based on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to the email address in section 15.

9. How long we keep data

Analytics data linked to identifiers – for the period set in Google Analytics: 2 months, after which it is deleted automatically; aggregated data (without identifiers) may be kept longer.
Advertising data – for the periods set by Google and its advertising partners in their policies.
Meta campaign measurement data – for the periods set by Meta in its privacy policy.
Crash reports – 90 days, after which Crashlytics deletes them automatically.
Consent record – until you change or withdraw it, or uninstall the Game.
Correspondence – for as long as needed to handle the matter, and then until the limitation periods for any claims expire.

10. Data stored on your device

Your progress (completed levels, stars, hints, adopted cats and the names you give them, room decorations, the Daily Nap streak) and settings (e.g. sound, vibration and reminders) are stored only locally, on your phone. We do not send them to our servers – we have no access to them. You remove them by clearing the Game’s data or uninstalling it; your progress is then lost as well. In-app purchases are linked to your Google account and can be restored.

The Game also works without an internet connection; ads and statistics are then unavailable.

11. Your rights

Under the GDPR you have the right to:

access your data and receive a copy of it (Article 15),
rectification (Article 16),
erasure (Article 17),
restriction of processing (Article 18),
data portability (Article 20),
object to processing based on legitimate interest (Article 21),
withdraw consent at any time (Article 7(3)),
lodge a complaint with a supervisory authority – in Poland this is the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw (uodo.gov.pl); you may also complain to the authority in the country where you live or work.

Because we do not run user accounts, we cannot link data processed by Google and Meta to a specific person without additional information. If you want to exercise your rights, write to us – we will help and, if needed, ask for an identifier that allows the data to be found. The quickest way to remove analytics and advertising data is to reset the advertising ID in Android settings and clear the Game’s data.

We do not make decisions based solely on automated processing that would have legal effects on you or similarly significantly affect you. Personalised ads are selected by Google only with your consent.

12. Children

The Game is intended for a general audience and is not directed at children. We do not knowingly collect data from people under 16. If you are a parent or guardian and believe a child has given us data, contact us and we will delete it.

13. Security

The Game communicates with Google and Meta services over encrypted connections (HTTPS/TLS). Only authorised people have access to the Google AdMob, Firebase and Meta consoles, protected by two-factor authentication.

14. Changes to this policy

We may update this policy, for example when adding new features or changing providers. The current version is always available at this address, and the date of the last change is given at the top of the document. We will inform you of significant changes in the Game.

15. Contact

For privacy matters, write to: contact@hexeosoft.com
Controller: Mikołaj Badyl HexeoSoft, Polish tax ID (NIP) 6551992325.
The rules for using the Game are set out in the Terms of Service.