Privacy Policy for NoomiClone

This Privacy Policy explains how Matthew Jones (“we,” “us,” or “our”) collects, uses, and shares information when you play NoomiClone (the “Game”) on Android and iOS. The Game is supported by advertising and offers optional in-app purchases. By downloading or playing the Game, you agree to the practices described in this policy.

1. Who we are

The data controller responsible for your information is:

Matthew Jones
Email: Noomiclonedev@gmail.com

2. Information we collect

NoomiClone does not require you to create an account or sign in, and you do not need to give us your name, email address, or other directly identifying details to play. Starting with version 2.3.0, you can choose to sign in to back up your progress. If you do, Unity gives the Game a player ID (and, if Unity shares it, your account’s email address), as described in Section 2(d). Apart from optional sign-in, the information involved is collected automatically by the Game and by the third-party services listed in Section 6, primarily to display ads, process purchases, and keep the Game working.

a) Information collected automatically

• Advertising identifiers — Google Advertising ID (GAID) on Android and the Identifier for Advertisers (IDFA) on iOS, where available and permitted.
• Device and technical information — device model, operating system version, language, country/region, screen characteristics, network type, and similar diagnostic data.
• Approximate location — coarse, IP-derived location (such as country), used by ad partners for ad delivery and legal compliance. We do not collect precise GPS location.
• Ad interaction and performance data — events such as ad impressions, clicks, and rewarded-ad completions, used to serve and measure advertising.

b) In-app purchase information

If you buy an in-app product (for example, NoomiCoins or Remove Ads), the purchase is processed by the Apple App Store or Google Play through Unity’s in-app purchasing service. We receive a purchase/transaction record confirming what was bought, but we do not receive or store your full payment-card details — those are handled by Apple or Google.

From version 2.4.4, before the Game gives you the NoomiCoins from a purchase, it checks the purchase on our server code at Unity (Unity Cloud Code). The Game sends the store’s proof of the purchase, and our server code asks Google Play or the App Store whether the purchase is genuine, makes sure the same order is not used twice, and later takes back the NoomiCoins from an order that was refunded. If you aren’t signed in, this check runs through a separate anonymous Unity session that is not linked to you. We keep a record of each order checked this way: the store, the product, the store’s order number, the dates of the purchase and of any refund, and the player ID that sent it. It contains no payment details. The check also includes the app check described in Section 2(h).

c) Information stored on your device

Your settings and game progress are stored locally on your device (using the platform’s standard on-device storage). Your settings stay on your device and are not transmitted to us, whether or not you sign in. If you don’t sign in, your game progress also stays on your device and is not transmitted to us. If you sign in, your progress is also backed up to Unity Cloud Save, as described in Section 2(d).

d) Optional sign-in and cloud backup

Sign-in is available from version 2.3.0, in Settings > Account. It is optional: if you don’t sign in, nothing changes for you.

• How sign-in works — Sign-in uses Unity Player Accounts. Unity’s sign-in page opens in your browser, where you sign in with an email address and password, or with Google or Apple. Unity handles your sign-in credentials; the Game never sees your password.
• What the Game receives — Unity gives the Game a player ID. Unity may also share your account’s email address; if it does, the Game shows it only in masked form (for example, “ja***@example.com”), stores only that masked form on your device, and never sends your email address anywhere.
• What is backed up — Your regrabs, NoomiCoins balance, HQ replay credits, the items you bought with NoomiCoins, the tutorial lessons you’ve finished, the number of daily challenges you’ve completed, and the challenge rewards you’ve claimed are backed up to Unity Cloud Save under your player ID. From version 2.4.0, so are the maps you make and the list of maps you’ve downloaded (see Section 2(g)). Purchases from the App Store or Google Play, such as Remove Ads, are not backed up: the store restores them on your device.
• How your backup is checked — From version 2.4.4, your backup is written by our server code at Unity (Unity Cloud Code), not by your device. It checks each change against what can be earned in the Game, using the server’s clock (for example, how many NoomiCoins a day can come from challenges and ads), and corrects values that go over it. Your device then uses the corrected values. Corrections, progress held back because it is far above what can be earned, and failed app checks (see Section 2(h)) are logged with your player ID, where only we can see them. We review them, and may correct or remove progress that was not earned in the Game or disable a game account used for cheating.
• What stays on your device — Your settings, equipped skins and outfits, button layout, language, and daily challenge progress (today’s challenge and which days you’ve claimed) are not backed up and stay on your device only. The masked email address (if Unity shared one) and the time of your last backup also stay on your device only. Your player ID is stored on your device too (Unity also has it, because your backup is stored under it).
• Signing out — Signing out backs up your progress one last time and then removes it from your device. It stays in your cloud backup and comes back when you sign in again. If the backup can’t be made (for example, when you’re offline), you stay signed in. Purchases from the App Store or Google Play stay on your device.
• Deleting your data — To delete your cloud backup or your Unity account, or to ask for a copy of your data, see Section 8.

Unity provides sign-in and cloud backup through Unity Player Accounts, Unity Authentication, and Unity Cloud Save. According to Unity, it collects the following information for these services and processes it under Unity’s privacy policy:

• Linked to you — email address, other contact information, user ID, approximate location, customer-support information, and other usage data.
• Not linked to you — crash data.

Unity says it uses this information to provide these services and, for some of it, for analytics, and that none of it is used for tracking.

e) If you contact us

If you email us, we will receive your email address and the contents of your message, which we use only to respond to you.

f) Checking today’s date

The Game’s daily challenges give a reward once a day. So that a device clock moved forward can’t claim rewards early, the Game reads today’s date from a standard web request to one of these servers: Google (www.google.com), Yandex (yastatic.net), or Unity (player-auth.services.api.unity.com). It does this when the Game starts, about every half hour while it is open, and when you come back to it.

• What is sent — The Game adds no information about you or your game to the request: no player ID, advertising identifier, or progress. These servers set no cookies for it, and the Game reads only the date from the reply.
• What the server receives — As with any internet request, the server receives your device’s IP address and basic technical details of the request (such as the name and version of the software that made it). Google, Yandex, and Unity handle this under their own privacy policies (see Section 6).
• What is stored — The last date the Game received is stored on your device only, with your daily challenge progress.

g) Custom maps (Map Maker)

From version 2.4.0 you can build your own maps in the Map Maker and share them with other players by a code.

• Your maps — The maps you make (their pieces and the names you give them) are stored on your device. If you sign in, they are also backed up to Unity Cloud Save under your player ID, with the list of maps you’ve downloaded (see Section 2(d)).
• Sharing a map makes it public — Sharing needs sign-in. When you share a map, its pieces and its name are stored in the public part of your Unity Cloud Save data with a 7-character code, made from a random sharing handle that is not connected to your name or email address. Anyone with the code or a link to it (noomiclone.dev/m/…) can download and play the map, and their copy of the Game keeps your player ID to fetch the map’s updates. The Game shows no creator name, and none of your other progress or account details are shared. You can stop sharing a map, or delete it, in My Maps; either removes it from the public data. Copies that other players have already downloaded stay on their devices.
• Getting a map by code — If you aren’t signed in, the Game reads the map through a separate anonymous Unity session, which has its own random player ID and is not linked to you, your progress, or an email address. Maps you download are stored on your device.
• Keeping shared maps friendly — Before your first share, the Game shows the sharing rules and asks you to agree to them. It checks map names with a word filter on your device, and reads a list of removed map codes from Unity Cloud Save without sending anything about you. We may remove any shared map that breaks the rules. If you report a map, the Game hides it (or every map by its maker) on your device and opens your email app with a message that includes the map’s code; if you send it, we receive what is described in Section 2(e).

h) Checking the Game is genuine

From version 2.4.4, so that modified copies of the Game can’t put cheated progress or purchases into game accounts, the Game proves it is the genuine app from Google Play or the App Store each time it backs up your progress (see Section 2(d)) and each time it checks a NoomiCoins purchase (see Section 2(b)). These checks don’t use your advertising identifier.

• Android: Google Play Integrity — Google Play services on your device sends Google a fingerprint of the backup or purchase being checked, information about the app (its package name, version, and signing certificate), whether the Google accounts on the device got the app from Google Play, and an attestation of the device generated by Google Play services. Google sends its verdict to our server code. According to Google, it uses this data only to verify the app, its licence, and the device, does not transfer it to third parties, and deletes it after a fixed retention period (Play Integrity API data safety).
• iOS: Apple App Attest — The first time the Game needs this check on a device, it creates a key on the device, and Apple confirms that the key belongs to the genuine app on a genuine Apple device. Our server code keeps the key’s public part and a counter with your player ID, and each later backup or purchase check is signed with the key. The key is not an advertising identifier and carries no information about you.
• If the check fails — for example on a modified copy of the Game, a rooted phone, or most emulators — you can keep playing, but your backups pause until the check passes, and the failure is logged with your player ID for our review (see Section 2(d)).

3. How we use information

• To operate, maintain, and improve the Game and its performance.
• To display advertising, including, where permitted, personalized advertising, and to measure its effectiveness.
• To process and validate in-app purchases and prevent fraud.
• If you choose to sign in, to back up your progress so it is not lost if you reinstall the Game or change devices.
• To keep daily challenge rewards fair, by checking today’s date (see Section 2(f)).
• To let you make, back up, share, and download custom maps, and to remove shared maps that break the sharing rules (see Section 2(g)).
• To keep cheated progress and purchases out of game accounts: checking that backups and NoomiCoins purchases come from the genuine Game, and taking back NoomiCoins from refunded purchases (see Sections 2(b), 2(d), and 2(h)).
• To diagnose technical issues and crashes.
• To comply with legal obligations and enforce our terms.

4. Advertising and your consent choices

NoomiClone shows ads through a mediation platform that works with several advertising networks (see Section 6). Depending on your consent and device settings, ads may be personalized (based on advertising identifiers and interests) or non-personalized.

• European Economic Area, United Kingdom, and Switzerland. We use a Google-certified Consent Management Platform (Google’s User Messaging Platform) compliant with the IAB Transparency & Consent Framework (TCF v2.2). When required, you will be shown a consent message before personalized ads are served, and your choices are passed to our advertising partners.
• United States. Where your state’s privacy law gives you the right, the Game offers Settings > Other > Privacy Options, where you can opt out of the sale or sharing of your personal information for targeted advertising. The Game passes your choice to our advertising partners.
• Apple App Tracking Transparency (iOS). On iOS, Apple requires your permission before the IDFA can be used for tracking. If you decline, ad partners will not use the IDFA to track you across apps, and you may receive non-personalized ads.
• Resetting or limiting ad tracking. You can reset or limit your advertising ID at any time in your device settings (Android: Settings > Privacy/Google > Ads; iOS: Settings > Privacy & Security > Tracking and Apple Advertising).

5. Legal bases for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Consent — for personalized advertising and use of advertising identifiers where consent is required. You may withdraw consent at any time.
• Performance of a contract — to provide the Game, process your in-app purchases, and, if you choose to sign in, back up your progress.
• Legitimate interests — to operate, secure, and improve the Game, serve non-personalized ads, and prevent fraud and cheating (including the purchase checks and app checks in Sections 2(b) and 2(h)), balanced against your rights.
• Legal obligation — to comply with applicable law.

6. Third-party services and advertising partners

We share the information described above with the following service providers, who process it under their own privacy policies. We encourage you to review them:

The Yandex Mobile Ads SDK includes AppMetrica, Yandex’s measurement and analytics service. According to Yandex, on iOS it collects your advertising identifier (only if you allow tracking, and then it is used for tracking), purchase history, product interaction, crash and performance data, and other diagnostic data, and uses them for advertising and analytics. It collects location only when an app has location access, which the Game never asks for.

We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of our users or others. We do not sell your personal information for money.

7. Data retention

We retain information only for as long as necessary for the purposes described in this policy or as required by law. Advertising and diagnostic data is retained by our third-party partners according to their own retention policies. Information stored locally on your device remains until you delete it or uninstall the Game.

If you sign in, your cloud backup is kept until you delete it in the Game (Settings > Account > Delete my progress) or ask us to delete it (see Section 8). Signing out or uninstalling the Game does not delete it, because its purpose is to keep your progress if you reinstall the Game or change devices. Your Unity account, and the information Unity collects for sign-in and cloud backup (see Section 2(d)), are kept according to Unity’s privacy policy.

A map you share stays public until you stop sharing it, delete it, or delete your progress in the Game (see Section 2(g)). Maps backed up to your account are kept with your cloud backup.

The log of corrections and failed app checks (Section 2(d)), and the other data our server code keeps for its checks (App Attest keys, see Section 2(h), and counts of recent purchase checks), are kept with your cloud backup and deleted with it. The record of each NoomiCoins purchase our server code checked (Section 2(b)) is kept for as long as we need it to stop the same order being used twice and to take back refunded purchases, including after you delete your game account.

8. Your privacy rights

EEA, UK, and Switzerland

You have the right to access, correct, delete, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

United States (including California)

Depending on your state, you may have the right to know what personal information is collected, to access or delete it, to correct it, and to opt out of “sales” or “sharing” of personal information for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.

How to exercise your rights

You can exercise these rights by emailing us at Noomiclonedev@gmail.com. You can also change your advertising consent, or opt out of the sale or sharing of your personal information, in Settings > Other > Privacy Options (where shown) and your device’s ad and tracking settings.

Sign-in and cloud backup

If you signed in (see Section 2(d)):

• Deleting your game account — See Deleting your NoomiClone account and data below.
• Getting a copy of your game data — To ask for a copy of your cloud backup or other information we hold about you, email us at Noomiclonedev@gmail.com.
• Deleting your Unity account — Your Unity account works across games, so deleting your game account does not delete it. You can delete your Unity account at player-account.unity.com/delete-account. The Game also links to this page.
• Other Unity account requests — To ask Unity for a copy of your Unity account data, or for any other request about your Unity account, email Unity at unity-player-login-privacy@unity3d.com.

Deleting your NoomiClone account and data

This is how to delete the game account and cloud backup you created by signing in to NoomiClone (developer: Matthew Jones). You don’t need to reinstall the Game to ask for deletion.

1. In the Game — Go to Settings > Account, tap Delete next to “Delete my progress”, then tap Delete on the “Delete your progress?” card to confirm. This deletes your cloud backup and the Game’s player record at Unity, takes down the maps you’ve shared (their codes stop working), removes your progress from your device, and signs you out.
2. Without the Game — Email Noomiclonedev@gmail.com with the subject “Delete my NoomiClone account” and your Player ID. The Game shows it under Settings > Account, in the “Player ID (for support)” row, with a Copy button. We can find your account only by its Player ID, because we never receive or store your full email address. We delete your game account and cloud backup within 30 days and reply to confirm.
3. If you don’t have your Player ID — Delete your Unity account at player-account.unity.com/delete-account. After that, nobody can sign in to your game account again, and what is left of it (game progress stored under a random player ID) is no longer connected to you or your email address. Maps you shared stay playable by their codes, so stop sharing them in the Game first if you don’t want that.

What is deleted: your cloud backup (regrabs, NoomiCoins, HQ replay credits, items bought with NoomiCoins, and your backed-up maps), the data our server code keeps with it for its checks (Sections 2(d) and 2(h)), the maps you’ve shared, and the Game’s player record at Unity. What is kept: the record of each NoomiCoins purchase our server code checked (Section 2(b)): the store, the product, the store’s order number, the dates, and the player ID, with no name, email address, or payment details. We keep it so the same order can’t be credited twice and refunds can be handled. We keep nothing else about your game account. Your Unity account is kept by Unity until you delete it on Unity’s page. Purchase records are kept by Apple or Google, and advertising data by our advertising partners, under their own policies (see Section 6).

9. International data transfers

We and our service providers are located in, or transfer data to, countries that may have different data-protection laws than your own, including the United States. The same applies to the information involved in optional sign-in and cloud backup, which Unity processes. Where required, our partners rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for such transfers.

10. Children’s privacy

NoomiClone is a general-audience game and is not directed to children under the age of 13 (or under 16 in the European Union and other jurisdictions where that is the applicable age of digital consent). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at Noomiclonedev@gmail.com and we will take steps to delete it. If a child has signed in to the Game, you can also delete their game account, cloud backup, and Unity account as described in Section 8.

11. Security

We and our service providers use reasonable technical and organizational measures to protect information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and post the new version at this URL. Significant changes may also be announced within the Game. Your continued use of the Game after an update constitutes acceptance of the revised policy.

13. Governing law

This Privacy Policy is governed by the laws of the State of New York, United States, without regard to its conflict-of-laws principles, except where overridden by mandatory data-protection laws applicable to you.

14. Contact us