Art Gallery Privacy Policy
This policy explains what personal data the mobile game Art Gallery (the “game”) collects, why, who receives it, how long it is kept and what rights you have. It applies to the game on iOS and Android. The game is developed and published by Serhii Shevchenko (“I”, “me”, “we”), who is responsible for your data.
1. Who is responsible for your data
The data controller is Serhii Shevchenko, independent game developer.
Contact for all privacy questions and requests:
gallerycoloringart@gmail.com
2. What data the game collects
Account and game data
- Player account. On first launch the game creates an anonymous guest account with Firebase Authentication and gives you a random user ID. No name or email is needed to play.
- Optional sign-in. If you choose to sign in with Apple, Google or Facebook, the game receives your account ID with that provider and, depending on what you allow, your name and email address (Apple lets you hide your email). Your guest progress is linked to that sign-in so you can restore it on another device.
- Saved progress. Your coin and booster balance, unlocked albums and items, purchase records and which pictures you have started or completed. This is stored on your device and, against your user ID, in Firebase Realtime Database so it is not lost.
Purchases
In-app purchases are processed by the Apple App Store or Google Play. The game receives a confirmation of the purchase (product, transaction ID, date and price). I never receive your card or bank details.
Device and usage data (analytics)
With your consent, the game sends usage data to Firebase Analytics (Google) and Facebook App Events (Meta): device and app identifiers, device model, operating system, language, approximate country derived from your IP address, app version, session times, and in-game events such as opening or completing a picture, buying an album, using a booster or watching an ad. Facebook App Events may also receive your device’s advertising identifier.
Crash reports
Firebase Crashlytics (Google) collects crash and error reports: the error trace, device model, operating system, free memory and storage, and a Crashlytics installation ID. These are used only to find and fix bugs.
Advertising
The game shows ads through Google AdMob. AdMob receives your device’s advertising identifier (Google Advertising ID on Android; on iOS the IDFA, only if you allow tracking), IP address, device information and how you interact with ads. If you consent, ads may be personalised to your interests; if you do not, AdMob shows non-personalised ads, which still use limited data for frequency capping, fraud prevention and ad measurement.
Notifications and remote settings
If you allow notifications, Firebase Cloud Messaging assigns your device a push token so the game can send you messages. Firebase Remote Config uses a Firebase installation ID to deliver game settings.
Photos and camera
Where the game lets you turn your own photo into a picture, it asks for access to your camera or photo library. The photo is processed on your device only and is not uploaded. When you share a finished picture, your device’s share sheet sends it to the app you choose; that app’s own privacy policy then applies.
Friend invites
When the friend-invite feature is available and you use it, the game stores an invite code and a record of which player invited which in Firebase Realtime Database, so both players can receive their reward. Invite links are handled by the ChottuLink deep-link service, which processes technical data about the link click (such as device type, operating system and IP address) to open the game and attribute the invite.
Support
If you email me, I receive your email address and whatever you write, and use it only to answer you.
The game does not collect your precise location, contacts, or the content of your messages, and does not sell your personal data.
3. Why the data is used, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running the game, saving and restoring your progress, delivering purchases | Account and game data, purchase records, Remote Config ID | Performance of a contract (Art. 6(1)(b)) |
| Fixing crashes and errors | Crash reports | Legitimate interest in a working game (Art. 6(1)(f)) |
| Understanding how the game is played and improving it | Analytics data | Consent (Art. 6(1)(a)) |
| Personalised advertising and ad measurement | Advertising ID, device data, ad interactions | Consent (Art. 6(1)(a)) |
| Non-personalised ads that fund the free game | Limited device data, IP address | Legitimate interest (Art. 6(1)(f)) |
| Push notifications | Push token | Consent, given through your device’s notification permission |
| Friend invites and rewards | Invite code, inviter/invitee link, link-click data | Performance of a contract (Art. 6(1)(b)) |
| Answering support requests, handling privacy requests, keeping purchase records required by law | Email, request content, purchase records | Legitimate interest; legal obligation (Art. 6(1)(c)) |
4. Third-party services
The game uses the services below. Some act as my processors (they handle data only on my instructions); advertising and social-login providers may also use data as independent controllers under their own policies.
| Service | Provider | Used for |
|---|---|---|
| Firebase Authentication, Realtime Database, Analytics, Crashlytics, Cloud Messaging, Remote Config | Google LLC / Google Ireland Ltd. | Accounts, saved progress, analytics, crash reports, notifications, game settings — Firebase privacy |
| Google AdMob | Google LLC / Google Ireland Ltd. | Advertising — How Google uses data from partner apps |
| Facebook SDK (Login, App Events) | Meta Platforms, Inc. / Meta Platforms Ireland Ltd. | Optional sign-in, app analytics — Meta privacy policy |
| Sign in with Apple, App Store purchases | Apple Inc. | Optional sign-in, payments on iOS — Apple privacy policy |
| Google Sign-In, Google Play Billing | Google LLC | Optional sign-in, payments on Android — Google privacy policy |
| ChottuLink (when friend invites are available) | ChottuLink | Invite deep links |
I may also disclose data if required by law or to protect the rights and safety of players or myself.
5. Your choices and consent
- Consent dialog. On first launch the game asks whether you agree to analytics and personalised ads. You can accept or decline; the game works either way. In the EEA, the UK and Switzerland, ad consent is collected through Google’s certified consent form.
- Changing your mind. You can review and change your consent at any time in the game’s Settings. Withdrawing consent does not affect processing that happened before.
- iOS tracking. On iOS the game asks for permission before using the advertising identifier (IDFA). You can change this in iOS Settings → Privacy & Security → Tracking.
- Advertising ID. On Android you can reset or delete your advertising ID in your device settings (Settings → Google → Ads, or Settings → Privacy → Ads).
- Notifications. You can turn notifications off in your device settings.
6. Transfers outside the EU/EEA
Google, Meta and Apple process data in the United States and other countries outside the EU/EEA. Where data is transferred to a country without an EU adequacy decision, the transfer relies on the EU–US Data Privacy Framework (where the provider is certified) or on the European Commission’s Standard Contractual Clauses. You can ask me for more information about these safeguards.
7. How long data is kept
- Account and saved progress: until you delete your account or ask me to delete it. Guest accounts that have not been used for 24 months may be deleted.
- Analytics data: event-level data is kept for up to 14 months, then only aggregated reports remain.
- Crash reports: 90 days.
- Purchase records: as long as tax and accounting law requires.
- Support emails: up to 2 years after the request is resolved.
- Data on your device: until you uninstall the game or clear its data.
Advertising and social-login providers keep data under their own retention policies, linked above.
8. Your rights
Under the GDPR and similar laws you have the right to:
- access the personal data I hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how your data is used;
- receive your data in a portable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
To use any of these rights, email gallerycoloringart@gmail.com. I will answer within one month. If you are a California resident, you also have the right to know, delete and correct your data and not to be discriminated against for using these rights; I do not sell or share personal information for cross-context behavioural advertising except as described in section 5, which you can turn off there.
9. Deleting your data or account
- In the game: Settings → Delete account removes your account and saved progress from the server.
- By email: write to gallerycoloringart@gmail.com with the subject “Delete my data”. Include your player ID (shown in the game’s Settings) so I can find your account. You do not need the game installed to make this request.
Step-by-step instructions: art-gallery-7e077.web.app/delete-account.
Deletion is completed within 30 days. Purchase records that the law requires me to keep are retained only for that purpose. Uninstalling the game deletes the data stored on your device but not your server account.
10. Children
The game is not directed at children under 13, and I do not knowingly collect personal data from them. In the EEA, players under 16 (or the lower age set by their country) need a parent’s or guardian’s permission to agree to analytics and personalised ads. If you believe a child has given me personal data, contact me and I will delete it.
11. Security
Data sent between the game and the services above is encrypted in transit. Server data is held by Google Firebase, and each player’s saved data can be read and written only by that player’s signed-in account. No system is completely secure, but I take reasonable technical and organisational measures to protect your data.
12. Changes to this policy
I may update this policy when the game or the law changes. The date at the top shows the latest version. If a change significantly affects how your data is used, the game will tell you before it takes effect.
13. Contact
Serhii Shevchenko
Email: gallerycoloringart@gmail.com