Aling Sarah’s Karinderya Privacy Policy

1 Summary

Aling Sarah’s Karinderya does not create player accounts or cloud saves, and your progress stays on your device. The Game shows ads from Google AdMob and, when AdMob has none, from Unity Ads; sells optional items through Google Play Billing; and, when you play the Daily Challenge or open the League screen, signs in anonymously to Firebase for the online leagues. MirandLuna Studio does not receive your name, contact details, advertising data or payment details.

2 Information stored on your device

Aling Sarah’s Karinderya stores the days you have played and their stars, best earnings and customer satisfaction, coins, experience and level, upgrades, pantry and cooked-food stock, idle-stall progress, tasks, the daily-challenge best score and streak, regular-customer progress, your settings (sound, music and volume, brightness and language), counts of in-game events that the Game uses itself (such as how often a day was restarted), daily ad limits, the identifiers of purchases already delivered, the sign-in token for the online league, whether reminders are switched on, and the last league standing the Game saw (your rank, the size of your group and your tier). If you allow notifications, the Game uses that standing to schedule reminders on your device: one in the evening for the Daily Challenge and one before your weekly league ends. Your phone creates and shows these reminders itself; nothing about them is sent to the Publisher or anyone else. You can switch them off in Settings, Reminders, or in your phone's notification settings. Except as described below, none of this is sent to the Publisher. Uninstalling the Game or clearing its storage deletes it.

On Android, Aling Sarah’s Karinderya uses the internet and network-state permissions (for ads, the consent message, purchases and the online league), the billing permission for purchases, the notification permission for the optional reminders (with the start-up and wake-lock permissions so a scheduled reminder still appears after the phone restarts) and, through the Google Mobile Ads software, the advertising-ID permission. On iPhone, reminders are shown only if you allow notifications.

3 Advertising: what Google AdMob and Unity Ads collect

Ads are served by Google AdMob (provided by Google LLC and, for users in the European Economic Area, the UK and Switzerland, by Google Ireland Limited): optional rewarded ads you may choose to watch for a reward (for example, more coins or a fast refill) and, from Day 8, a full-screen ad between some days.

When ads are requested or shown, Google AdMob and Google's User Messaging Platform (the consent message) may collect:

• Advertising identifiers: the Apple Identifier for Advertisers (only if you allow tracking) or the Google Advertising ID, and an app-specific identifier.
• IP address, and an approximate location derived from it.
• Device information: model, operating system and version, language, screen size, network type and app version.
• Ad interactions: ads requested and shown, impressions, clicks, viewing time and whether a rewarded ad was completed.
• Diagnostics: crash, performance and error information from the ad software, and fraud-prevention signals.
• Your consent choices.

Google uses this information to deliver, limit, measure and secure ads, to prevent fraud and, only where you consent or where the law allows, to personalize ads. Google's privacy policy: https://policies.google.com/privacy. How Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites.

When AdMob has no ad to show, ads may come from Unity Ads (provided by Unity Technologies), which collects similar information: advertising identifiers, IP address, device information and ad interactions. Ads from Unity Ads are requested as non-personalized. Unity's privacy policy: https://unity.com/legal/game-player-and-app-user-privacy-policy.

4 Your advertising choices

If you are in the European Economic Area, the UK or Switzerland (or another region where the law requires it), the Game shows Google's consent message, provided through a Google-certified consent-management platform, before any ad is requested. You can accept, reject, or choose individual purposes and ad partners. Even non-personalized ads may need to store or read information on your device, so the Game asks before doing so. If no choice has been made, no ads are requested.

You can change or withdraw your consent at any time in the Game's Settings. Withdrawing consent does not affect processing that took place before the withdrawal.

Aling Sarah’s Karinderya does not ask your age range. You can limit ad tracking on your device: on iPhone, in Settings, Privacy and Security, Tracking; on Android, in Settings, Privacy (or Google), Ads, where you can delete your advertising ID. Buying No Ads stops the full-screen ads.

5 Purchases

Payments are processed by Apple (App Store) or Google (Google Play) under their own privacy policies. To deliver, restore or reverse a purchase, the Game receives from the store the product identifier, a transaction identifier or purchase token, the purchase status, and notice of any refund or revocation. The Publisher does not receive your name, payment-card or bank details; it receives sales and tax reports from the stores.

Optional coin packs, experience packs, bundles and No Ads are sold through Google Play Billing and processed by Google as described in Section 5. The Game keeps each purchase's token on your device so it is delivered only once, and restores No Ads from Google Play if you reinstall. In-app purchases are not offered on iPhone yet.

6 Online leagues and the daily race

When you start the Daily Challenge or open the League screen, the Game signs in to Firebase Authentication (provided by Google) with an anonymous account: no name, email address, phone number or Google account is used, and Firebase gives the Game a random user identifier. The Game then sends the Publisher's league server (Cloud Functions and Cloud Firestore for Firebase, provided by Google, with league data stored in Singapore) that identifier, the date and score of each Daily Challenge you finish, how long the run lasted and how many coins you had every five seconds during it. The server gives you a player name made from fixed words and a number (for example, Masipag na Tapa #1234); you cannot type or choose a name. The server keeps your league tier, your weekly league group and your weekly points.

Players in your weekly league group see your player name, tier, rank and weekly points. Your best Daily Challenge run of the day may be shown to other players as a rival to race, with your player name, your score and how your coins rose during the run. Nothing else about you is shown.

This information is used to run the leagues and the daily race at your request (performance of a contract, Article 6(1)(b)) and to reject impossible scores so the leagues stay fair (our legitimate interest, Article 6(1)(f)). Google also processes your IP address and device information to provide Firebase. League and race data is kept for as long as the Game offers its online features. Uninstalling the Game removes the sign-in token from your device but not the server's records: to have them deleted, email admin@mirandstudios.com with the subject Privacy Request and the player name shown on your League screen. How Firebase handles data: https://firebase.google.com/support/privacy.

7 Testing, support and feedback

If you are invited to test the Game, the Publisher holds the email address used for your invitation in Google Play Console or App Store Connect to manage the test, and receives the feedback, screenshots and device details you choose to send through the store's testing tools. If you email the Publisher, your email address, the content of your message and any attachments are used to answer you.

8 Purposes and legal bases

Where the GDPR applies, each kind of processing relies on these legal bases:

• Saving progress and settings on your device: necessary to provide the Game you asked for (performance of a contract, Article 6(1)(b)).
• Personalized advertising, and storing or reading information on your device for ads: your consent (Article 6(1)(a), and the ePrivacy rules on device storage).
• Non-personalized ads, ad measurement, ad security and fraud prevention, where consent is not required: the legitimate interest in funding a free game and keeping ads safe (Article 6(1)(f)).
• Delivering, restoring and reversing purchases: performance of a contract (Article 6(1)(b)).
• Keeping purchase and financial records: legal obligations (Article 6(1)(c)).
• The online leagues and the daily race (Section 6): performance of a contract at your request (Article 6(1)(b)), and our legitimate interest in rejecting impossible scores so the leagues stay fair (Article 6(1)(f)).
• Managing tests and answering support and privacy requests: performance of a contract and the legitimate interest in supporting players and improving the Game (Article 6(1)(b) and (f)), and legal obligations for rights requests (Article 6(1)(c)).

Where processing relies on legitimate interests, you may object to it.

9 Who receives information

The Publisher does not sell personal information for money. Information is received by:

• Google (Google LLC and Google Ireland Limited): advertising, the consent message, Google Play distribution, testing and payments, and Firebase (anonymous sign-in and the league server).
• Unity Technologies (Unity Software Inc. and its affiliates): backup advertising, as described in Section 3.
• Apple (Apple Inc. and Apple Distribution International Ltd.): App Store distribution and TestFlight testing.
• Payment providers: Google acts as the merchant and payment processor for in-app purchases; no other payment provider is used.
• Professional advisers, authorities when legally required, or a successor in a merger or sale, subject to equivalent protection.

10 How long information is kept

• Information on your device: until you use Reset Progress in Settings, clear the Game's storage or uninstall it. A device backup may keep a separate copy under your Apple or Google settings.
• Advertising data: kept by Google under its retention policy (https://policies.google.com/technologies/retention).
• Purchase records: kept by Apple and Google under their policies; the Publisher keeps sales reports for as long as tax and accounting law requires (generally up to 7 years).
• Tester invitations and feedback: until the test ends, or earlier if you ask to leave it.
• Support emails: up to 2 years after the request is resolved, unless longer is needed for a legal claim.
• League and race data: for as long as the Game offers its online features (see Section 6).

11 International transfers

The Publisher is located in the United States, and Google and Apple process information in the United States and other countries. Transfers of personal data from the European Economic Area, the UK or Switzerland to the United States rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), in which Google LLC and Apple Inc. participate, and on the European Commission's Standard Contractual Clauses. Information you send the Publisher directly, such as an email, is processed in the United States. You can ask for more information about these safeguards at admin@mirandstudios.com.

League data is stored by Google in Singapore, and sign-in data may be processed in the United States and other countries where Google operates, under the safeguards described in this section.

12 Your rights in Europe and the UK

If the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal data held about you and receive a copy.
• Correct inaccurate data.
• Delete your data.
• Receive your data in a portable format (portability).
• Object to processing based on legitimate interests, including profiling.
• Restrict processing.
• Withdraw consent at any time, in the Game's Settings, without affecting earlier lawful processing.

Your progress is stored only on your device, so you can access or delete it yourself (Reset Progress in Settings, clearing the Game's storage or uninstalling it). To have league and race data deleted, email admin@mirandstudios.com with the subject Privacy Request and the player name shown on your League screen. Advertising data is held by Google; you can exercise your rights with Google at https://myaccount.google.com and https://support.google.com/policies. Purchase data is held by Apple or Google.

You also have the right to lodge a complaint with the data-protection authority where you live, work or think a breach occurred. A list of EU authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK: the Information Commissioner's Office, https://ico.org.uk.

13 Your rights in the United States

Residents of California and of other states with consumer privacy laws may have the right to know what personal information is collected and how it is used and disclosed, to access, correct and delete it, to opt out of its sale, of sharing for cross-context behavioral advertising and of targeted advertising, and not to be discriminated against for using these rights.

In the last 12 months, the categories of personal information handled through the Game were: identifiers (advertising identifiers and IP address, collected by Google AdMob and Unity Ads; the anonymous Firebase user identifier and your player name; email address if you contact the Publisher or are invited to a test); internet or network activity (ad interactions and diagnostics); game activity (your Daily Challenge scores and runs, shown to other players as described in Section 6); approximate geolocation derived from IP address; and commercial information (purchase records held by Google). They are used for the purposes in Sections 3 to 8 and disclosed to the recipients in Section 9. The Game does not collect sensitive personal information.

The Publisher does not sell personal information for money. Allowing Google or Unity to show personalized ads may be considered sharing for cross-context behavioral advertising, or targeted advertising, under some state laws. To opt out, limit ad tracking or delete your advertising ID as described in Section 4, or email admin@mirandstudios.com with the subject Do Not Sell or Share. The Publisher does not knowingly sell or share the personal information of consumers under 16. The Game does not respond differently to browser Do Not Track signals, because it is not a website.

You may make a request yourself or through an authorized agent, by email as described in Section 14. The Publisher will confirm your request and respond within 45 days (extendable once by 45 days, with notice). If a request is refused, you may appeal by replying to the decision with the subject Appeal; if the appeal is denied, you may contact your state attorney general. California residents may also ask, once a year, for information about disclosures of personal information to third parties for their own direct marketing; the Publisher makes no such disclosures.

14 How to make a privacy request

Email admin@mirandstudios.com with the subject Privacy Request, saying which right you want to use and where you live. Because the Publisher does not hold accounts, it may ask for information needed to find and confirm the data concerned, such as the email address you used to contact it. It will respond within one month for requests under the GDPR (extendable by two months for complex requests, with notice), or within the period set by your state's law. Requests are free unless they are clearly unfounded or excessive.

15 Children

The Game is not directed to children under 13, and it does not ask your age. The Publisher does not knowingly collect personal information from children under 13. If you believe a child has sent the Publisher personal information, contact admin@mirandstudios.com and it will be deleted.

16 Security

Reasonable administrative, technical and organizational safeguards are used for information under the Publisher's control. No method is completely secure.

17 Changes to This Privacy Policy

We reserve the right, at our sole discretion, to modify, amend, update, or replace this Privacy Policy from time to time, for example when the Game, its providers or legal requirements change. If we make material changes, we may provide notice through the Game, the store listing, by email, or by other reasonable means. Unless otherwise required by applicable law, changes will become effective on the date specified in the updated Privacy Policy. Your continued access to or use of the Game after the effective date of the revised Privacy Policy constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must discontinue use of the Game. Where the law requires your consent to a change (for example, to new uses of your personal data), we will ask for it.

18 Contact

MirandLuna Studio, 304 Lansdale Ave, Millbrae, California, United States

Phone: +1 (650) 608-5052

Email: admin@mirandstudios.com

Website: https://mirandstudios.com