Cosmic Draft — Privacy Policy

• Who We Are
• What This Policy Covers
• What Data We Collect
• How We Use It, and Our Legal Bases
• Who We Share It With
• International Data Transfers
• Data Retention
• Deleting Your Account and Data
• Your Privacy Rights
• Children
• Security
• Changes to This Policy
• Contact
• California residents
• Other U.S. states
• Residents of Türkiye

Cosmic Draft ("the Game", "we", "us", "our") is developed and published by Caretta 7 Studios Inc., a corporation incorporated in the State of Texas, United States. You can reach us about anything in this policy at support@caretta7studios.com, or through caretta7studios.com.

For the purposes of the EU and UK GDPR, Caretta 7 Studios Inc. is the data controller for the personal data described below. For the purposes of Turkish Law No. 6698 on the Protection of Personal Data, it is the data controller (veri sorumlusu).

This policy explains what data Cosmic Draft and its service providers process when you play the Game on Android through Google Play. It will apply equally to the iOS version when that ships. It covers Cosmic Draft only; our website and our other games have their own policies.

The Game is single-player and runs on your device. Data leaves your device for six reasons: to save your progress to the cloud, to show you on the leaderboard, to serve advertising, to measure how the Game is used, to verify that the copy of the Game talking to our servers is genuine, and to complete a purchase. Each is described in Section 3.

The same text is available inside the Game under Settings, and it works with no connection at all. This page exists because Google Play and the App Store require a policy at a public web address.

Most of what the Game remembers never leaves your phone: your settings for sound, music, haptics, difficulty, quality and tutorials; your mid-run save; your reward inbox; your post-run summaries; notification scheduling state; the step-by-step markers that stop a tutorial repeating; first-time celebration flags; your analytics choice; any leaderboard entries you have hidden; and the local bookkeeping that prevents a purchase being granted twice.

This is written with Android's standard app-preference storage. We cannot read it, and it is deleted when you uninstall the Game or clear its data. Some of it is also copied to your cloud save, which is described next.

When you first play, the Game creates an anonymous account using Firebase Authentication. It is a random identifier, not your name, email address or phone number, and we never ask you for any of those. It is what makes your saved progress yours, and there is no way to have cloud save without one.

It is not created before you have been asked about ads and data: on first launch the Game waits for the consent question to resolve in either direction. If that question cannot be answered within about twenty seconds — the form will not load, or you have no connection — the account is created anyway so that your progress is not lost while you play. If you later sign in with Google Play Games, the same account is upgraded rather than replaced, so your progress carries over.

Your progress is stored in Google Cloud Firestore, in a document belonging to that account. It holds your currencies, your high score and highest level, your rank and experience, run counts and personal bests, which weapons, abilities, characters and skins you have unlocked or levelled, weapon evolutions, Nebula Forge upgrades, milestones, story progress, achievement progress, which tutorials you have completed, your ad-removal entitlement, your loadout and character selection, and your daily-streak state — 44 fixed fields, plus one entry per item of Game content you have touched, so it grows as you play. Our server rules restrict this document to the account that owns it: it is not shown to other players and is not part of the leaderboard.

Android's own backup service copies your sign-in credential — and only that credential — to your Google account, which is what lets a reinstall or a new phone find your cloud save again. Your game progress is deliberately excluded from it, as are your settings, your analytics choice and your consent answer. You can switch Android Backup off in your device settings.

If you sign in with Google Play Games and agree to appear, a leaderboard row is published under your Play Games display name, and every other signed-in player can see it. The row contains five things: your display name, your score, your highest level, your total number of runs, and the time it was last updated. It is stored under your account identifier, so another signed-in player reading the board can see that identifier alongside the name and scores; it is a random string and is not tied to your real identity, but you should know it is there.

The name comes from your Google Play Games profile. The Game has no field in which you can type a name, so to change how you appear you change your gamer name in the Google Play Games app and the leaderboard follows it. The Game asks you before it publishes anything, and if you decline, nothing of yours is published. If you never sign in to Play Games, no row exists at all.

We may remove a row whose score was not earned through normal play, or whose display name is offensive or impersonates someone. You can report a row, or hide it from your own view, by tapping it in the Game. Deleting your account removes your row, and so does turning the leaderboard off in Settings.

Signing in with Google Play Games is optional. It exists so that your progress follows your Google account rather than your device, and so that you can appear on the leaderboard and earn achievements. When you sign in we receive your player identifier, your display name and a link to your profile picture. Google Play Games does not give us your email address. Of those, only the display name is ever published; the profile picture is shown to you inside the Game and is not sent to our servers.

Google Play Games is Google's own service with its own privacy terms. Achievements and your Play Games profile belong to Google, not to us, and deleting your Cosmic Draft account does not delete them.

Cosmic Draft shows advertising through Google AdMob: full-screen ads between runs, and rewarded ads you choose to watch in exchange for something in the Game. There are no banner ads.

To deliver, cap, measure and protect those ads from fraud, Google and its advertising partners process your device's advertising identifier, your app set ID, data about the ads you are shown and interact with, an approximate location estimated from your IP address, and diagnostic information such as app launch time and crashes. This data is collected and processed by Google as a third party: we do not receive your advertising identifier and we do not build advertising profiles. Ad traffic is encrypted in transit.

The Game requests no location permission and reads no location from your device. The approximate location above is inferred by Google from your IP address, which every internet connection reveals, and we never receive it.

Personalized advertising is shown only where you have permitted it; otherwise you see contextual advertising, and the Game is fully playable either way. In the European Economic Area, the United Kingdom and Switzerland we present a consent choice using Google's User Messaging Platform before any personalized ad is served, and your answer also governs analytics and crash reporting. Where that choice applies, Settings carries a Privacy options entry that reopens the same form, so withdrawing is as easy as giving. On iOS, when that version ships, Apple's App Tracking Transparency prompt will be shown before the advertising identifier is used for personalized advertising, and declining it does not restrict the Game.

If you decline where the consent form applies, nothing about you is used to choose your advertising. Depending on your answer you may see basic ads chosen without any information about you, or none at all; where no ads can be shown, the optional rewards they pay for are unavailable while that is the case. No content is locked, no progress is affected, and nothing you have already earned or bought is touched. You can change your answer at any time in Settings. Declining tracking on iOS, or notifications on any platform, costs you nothing.

We set the maximum ad content rating to Teen, so advertising rated for mature audiences is not requested, and we do not enable child-directed or under-age-of-consent treatment. Advertising content is Google's rather than ours; if you see an ad you believe breaks that rule, use Report an Ad in Settings. For how we treat a player a platform identifies as a minor, see Section 10.

We use Google Analytics for Firebase to understand how the Game is played — which levels people reach, where runs end, which weapons get used, whether a tutorial worked — and Firebase Crashlytics to find out when and why the Game crashes. Analytics events describe what happened in the Game and carry a pseudonymous app-instance identifier, device and app information, and an approximate location derived from your IP address. Crash reports carry the state of the app when it failed, the device model and the operating system version.

Both are disabled in the app's own configuration and start disabled at launch, so nothing is collected before the consent question above has been answered. Settings also contains an analytics opt-out that works everywhere in the world regardless of your region: when it is on, analytics and crash reporting are both switched off for you. Analytics stops immediately; crash reporting stops from the next time you open the Game.

We use Firebase App Check with Google Play Integrity so that our servers can tell a genuine, unmodified copy of the Game from a tampered one — without it, a leaderboard is trivially faked. This processes a device-integrity signal produced by Google Play. It does not read the contents of your device, your files, or any other app.

Cosmic Draft can remind you that your energy has refilled or that a reward is waiting. These are scheduled entirely on your device: there is no push service, no server sends you anything, and no notification token exists. Nothing about your notifications leaves your phone except the analytics events described above, which record that a prompt was shown or a reminder opened, never what it said. We ask for notification permission only after showing you what it is for, never at first launch, and you can switch every reminder off inside the Game or in your Android settings.

Cosmic Draft sells emerald packs and energy packs, which are consumed as you play, and a one-time Remove Ads upgrade. Payment is handled by the store you bought the Game from — Google Play on Android, and the Apple App Store on iOS when that version ships. We never see your card number and we never receive your payment details. Purchase receipts are checked on your device; no receipt and no transaction record is sent to our servers.

What the purchase gives you does reach our servers, because it is part of your progress: emeralds and energy land in your balance, and that balance is in your cloud save. The only record that a purchase happened is a single yes/no flag recording that advertising has been removed, stored in the same place so the setting follows you to a new device. Your Remove Ads purchase belongs to your Google Play or Apple account rather than to your Cosmic Draft account, and is restored from the store.

We use the data described above to run the Game and remember your progress and settings; to save that progress to the cloud and restore it on another device; to publish your leaderboard row if you have asked to appear, and to keep the board honest; to serve advertising, personalized only where you have permitted it, and to grant rewarded-ad benefits; to deliver your purchases and restore an ad-removal purchase you already own; to send the reminders you asked for; to understand how the Game is played and to fix crashes; and to prevent cheating, advertising fraud and abuse, and to comply with the law.

We do not sell personal information. Apart from the leaderboard row described in Section 3.3, which other signed-in players can see, we do not share it with anyone other than the service providers named in Section 5.

If you are in the European Economic Area or the United Kingdom, the following legal bases apply.

• Legal basis — What it covers
• Consent — Personalized advertising, analytics and crash reporting, and any non-essential access to information on your device. Collected through the consent form described in Section 3.5 and withdrawable at any time.
• Performance of a contract — Creating the account your saved progress depends on, storing and restoring that progress, publishing the leaderboard row you asked for, and delivering purchases you made.
• Legitimate interests — Contextual advertising, ad frequency capping, leaderboard integrity and anti-cheat, and fraud prevention. In each case we have weighed our interest against your rights and consider the processing to be what a player would reasonably expect.
• Legal obligation — Records we are required to keep and responses to lawful requests.
• Apple's App Tracking Transparency permission, on iOS, is a platform permission rather than a legal basis in its own right.

We use a small number of service providers, all of them Google:

• Google AdMob — advertising, ad measurement and fraud prevention. See Google's privacy policy (https://policies.google.com/privacy) and How Google uses information from sites or apps that use our services (https://policies.google.com/technologies/partner-sites).
• Google Firebase (Authentication, Cloud Firestore, Analytics, Crashlytics, App Check) — accounts, cloud save, the leaderboard, analytics, crash reporting and anti-cheat.
• Google Play Games Services — optional sign-in and achievements.
• Google Play Billing, and Apple's App Store on iOS — purchase processing.
• Unity Technologies supplies the game engine and the purchasing library that runs on your device. The purchasing library talks to the store; it is not a separate destination for your data.
• Every third party with whom the Game shares user data will provide the same or equal protection of user data as stated in this policy. Where a third party processes player data on our behalf, our contract with them requires it — for Google that is the Firebase Data Processing and Security Terms and the Google Ads Data Processing Terms. For advertising, Google is not only our processor: it also acts as an independent controller of the ad data described in Section 3.5, deciding its own purposes under its own privacy policy, and we cannot and do not impose our own terms on that part.
• We do not sell personal information and we do not share it with data brokers, advertisers of our own, or anyone not named above.

Caretta 7 Studios Inc. is based in the United States, and the service providers named above process data in the United States and in other countries.

If you are in the EEA or the UK, those transfers rely on the safeguards Google applies to the data it processes for us — the Firebase Data Processing and Security Terms, which incorporate the European Commission's Standard Contractual Clauses and the UK Addendum — and on the EU-US Data Privacy Framework where the recipient is certified under it. You may ask us for a copy of the safeguards that apply to you, or for information about where they are available, by writing to support@caretta7studios.com. If you are in Türkiye, see the annex at the end of this policy.

• What — How long
• Data stored only on your device — Until you uninstall the Game or clear its data. We cannot delete it for you and we cannot read it.
• Your cloud save — While your account exists. Deleted immediately when you delete your account.
• Your leaderboard row — While your account exists. Deleted immediately when you delete your account or turn the leaderboard off.
• Accounts with no activity — We do not currently delete accounts for inactivity. If we introduce an inactivity period we will say so here, and give notice before the first deletion.
• Analytics and crash data — Held by Google under the retention setting we choose in the Firebase console. Aggregated reporting that cannot be traced back to you is kept indefinitely.
• Advertising data — Held by Google under its own policies. We receive none of it, so we hold no copy to retain.
• Purchase records — Held by Google Play or Apple. They keep transaction records for their own accounting and tax obligations, which outlive your Cosmic Draft account.
• Backups — We keep no backups of your cloud save. Once it is deleted from our database it is gone from our systems. Google may hold internal copies for a limited period under its own policies, which we do not control and cannot see.
• Support emails — As long as needed to answer you and to keep ordinary business records.
• We may keep data beyond these periods where the law requires it, or where it is needed to resolve a dispute or enforce our Terms.

In the Game, immediately. Open Settings from the main menu, tap Delete Account and confirm. Your leaderboard row, your cloud save and your account are deleted there and then, and the progress on that device is erased with them. The Game tells you on screen when it is done, and tells you if any part could not be removed. Delete Account is offered from the main menu only; during a run it explains why and asks you to finish first, because a run that ends writes progress and progress written after a deletion would land in the wrong place.

By email, if you have already uninstalled. Write to support@caretta7studios.com with the subject "Cosmic Draft account deletion request", telling us the player name shown on the leaderboard and the Google account or Play Games gamer name you used. We reply within 7 days and complete the deletion within 30 days of verifying the request. A full explanation, readable without installing the Game, is on our data-deletion page (https://caretta7studios.com/games/cosmic-draft/delete-account), and the same text is inside the Game under Settings › Data Deletion.

Deleting your account removes your cloud save, your leaderboard row, your account on our servers, and the progress stored on the device you delete from. It also destroys any unspent emeralds and energy, including any you paid for. This cannot be undone and cannot be refunded by us. Remove Ads is different: it belongs to your Google Play or Apple account rather than to your Cosmic Draft account, so deleting your account does not revoke it and reinstalling restores it from the store.

Two limits on the email route are worth stating. If you never signed in with Google Play Games there is no display name and no Google account to match you by, so an email cannot identify which save is yours — the in-game Delete Account button is the only route that works, and it needs none of that information. And if you signed in to a different account on the same device at some point, the save left behind by the earlier one is not reachable from your current account, by you or by us; we are working on that.

Some things are not ours to delete: your Google Play Games achievements and profile, which you manage at myaccount.google.com; Google Play or Apple purchase records, which they keep for billing and tax; and anonymous, aggregated analytics that is not linked to your account and cannot be traced back to you. Uninstalling is not deleting — removing the app takes the copy off your phone, while your cloud save and leaderboard row live on our servers, which is exactly why your progress survives a reinstall.

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent at any time. Several of these need no request at all.

• See your data and take a copy — Settings › My Data. It shows everything we hold, generated from the data we actually store rather than from a summary, and puts a copy on your clipboard. It works offline and it is immediate.
• Delete your data — Settings › Delete Account, described in Section 8.
• Stop personalized advertising — Settings › Ad Privacy, or decline the App Tracking Transparency prompt on iOS. You can also reset or delete your advertising identifier in your device settings.
• Stop analytics — Settings › Analytics, which applies everywhere in the world.
• Correct your display name — it comes from your Google Play Games profile, so change it there and the leaderboard follows.
• Withdrawing consent does not make anything we did beforehand unlawful; it stops the processing from that point on. We make no automated decisions about you that have a legal or similarly significant effect, and we do not profile you for any such decision. Advertising can be personalized where you have permitted it, which involves Google profiling for ad selection; nothing in the Game decides what you may access, what you pay, or what you are shown of the Game itself on the basis of automated analysis.
• You are not obliged to provide any of this, and there is no statutory or contractual requirement that you do. Providing it is simply how cloud save works: without an account and a saved document your progress stays on the device you are playing on and is lost if you uninstall the Game or change phone. Nothing else about the Game is withheld.
• For any other request, email support@caretta7studios.com. We will answer within 30 days, or tell you why we need longer. We do not charge for this and we will not treat you differently for asking. If you are in the EEA or the UK and you think we have handled your data wrongly, you may complain to a supervisory authority — in the country where you live, where you work, or where you believe the problem happened. The list of EEA authorities is published by the European Data Protection Board at edpb.europa.eu (https://edpb.europa.eu/about-edpb/board/members_en); in the United Kingdom it is the Information Commissioner's Office at ico.org.uk.

Cosmic Draft is intended for players who are at least 13 years old, or the higher minimum age of digital consent that applies in your country. It is not directed to children under 13 and we do not present it as a children's game. We do not knowingly collect personal information from a child under 13. The Game does not ask your age and does not attempt to verify it, so we do not build a picture of how old any individual player is.

Where an app store or operating system tells us that a player is under 18, we use that to make the experience age-appropriate rather than to exclude them. For a player identified as under 13 that means advertising is no longer personalized and no advertising identifier leaves the device, analytics is switched off for the session, and no leaderboard row is published — a row already published is removed. Their cloud save is kept, because it is their own progress and readable only by them. We do not store the age information itself: it is used for those decisions and then discarded.

The maximum ad content rating is set to Teen, and we do not enable child-directed advertising treatment. The Game has no chat, no voice, no messaging and no free-text field of any kind; the only thing another player can see about you is your Play Games display name and your scores, on the leaderboard. If you are a parent or guardian and you believe a child under 13 has given us personal information, email support@caretta7studios.com and we will delete it.

Everything the Game sends is encrypted in transit. Your cloud save is readable only by your own account, enforced by server-side rules rather than by the app asking nicely, and App Check exists so that our servers can reject requests that do not come from a genuine copy of the Game. No app, device or network can be guaranteed to be completely secure, and we do not claim otherwise.

We will update this policy when the Game changes or when the law does, and the date at the top shows the current version. If a change is material we will ask you to review it inside the Game rather than relying on you to come back to this page. If we ever want to use data we already hold for a genuinely new purpose, we will tell you before we start, and where the law requires your consent for it we will ask first.

Caretta 7 Studios Inc., State of Texas, United States

support@caretta7studios.com · caretta7studios.com

We do not sell personal information for money. Serving personalized advertising through Google AdMob may nevertheless count as "sharing" for cross-context behavioural advertising under California law. You can stop that sharing from inside the Game: decline personalized advertising in the consent form, or switch on the analytics opt-out in Settings; on iOS, decline the App Tracking Transparency prompt. Those are the controls, and there is no separate form to fill in. This website sets no cookies, runs no scripts and carries no advertising, so there is nothing to opt out of here — opt-out preference signals such as Global Privacy Control are sent by web browsers and there is nothing for one to act on in a mobile game.

California residents have the right to know what personal information is processed, to have it deleted, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of those rights.

The categories that may be processed are: identifiers (advertising identifier, app set ID, the account identifier we create, your Play Games player identifier and display name); internet and network activity (IP address, ads shown and interacted with, in-game analytics events); approximate location inferred from an IP address; commercial information (that an ad-removal purchase exists); and content you generate in the Game (your scores and leaderboard row). We do not process sensitive personal information as California law defines it.

To exercise a California right, email support@caretta7studios.com. You may use an authorised agent, and we may ask you to verify the request.

Many U.S. states now have their own privacy law and more are passing every year. Rather than list them and let the list go stale, we grant the rights they share to every player in the United States, whichever state you live in.

You may ask us to confirm whether we process your personal data and give you access to it, to correct it, to delete it, and to give you a portable copy of the data you provided. You may opt out of processing for targeted advertising, and of any sale or sharing of your personal data — and you do not have to write to us to do it, since the controls in Section 3.5 and Section 9 do it from inside the Game. You may withdraw consent at any time, and we will not treat you differently for exercising any of these rights.

If we decline a request, you may appeal by replying to our response or writing to support@caretta7studios.com. We will respond in writing within 60 days explaining our decision, and if we still decline we will tell you how to complain to your state's Attorney General. Caretta 7 Studios Inc. is a Texas corporation, so for Texas residents that is the Texas Attorney General.

We do not sell sensitive personal data and we do not sell biometric data. We collect no biometric data and no precise geolocation, so there is none of either to sell. Several states restrict targeted advertising to people under 18; how we handle a platform signal that a player is a minor is described in Section 10.

For players in Türkiye, Caretta 7 Studios Inc. is the data controller (veri sorumlusu) under Law No. 6698 on the Protection of Personal Data. The personal data processed is set out in Section 3: an account identifier, a display name and scores if you sign in to Play Games, an advertising identifier, an IP address, in-game analytics events, and crash diagnostics. The purposes are those in Section 4, and the legal grounds are your explicit consent for personalized advertising and analytics, and the performance of a contract and our legitimate interests for the rest.

The Game's servers and every service provider named in Section 5 are outside Türkiye, principally in the United States, and Türkiye has issued no adequacy decision for the United States. That transfer is inherent in the Game working at all: without it there is no cloud save, no leaderboard and no crash reporting. We rely on the safeguards Google applies to the data it processes for us. Where a safeguard under Article 9 of Law No. 6698 is required of us directly, we would put one in place and describe it here — we would rather state that plainly than claim a safeguard before it exists.

Under Article 11 of Law No. 6698 you may ask whether your personal data is processed, request information about it, learn its purpose, ask for correction or deletion, and object to a result produced solely by automated analysis. Write to support@caretta7studios.com. This policy is published in English, which is the language the Game is played in; if a Turkish version of the Game is released, a Turkish version of this notice will be published with it.

Caretta 7 Studios Inc. — Cosmic Draft. See also the Terms of Service (https://caretta7studios.com/games/cosmic-draft/terms) and the Data Deletion page (https://caretta7studios.com/games/cosmic-draft/delete-account).