Privacy Policy

This Privacy Policy explains how TestNCode OÜ ("we", "us", or "our") and the third-party services used in the mobile game Stretchlings: Pet Puzzle (the "Game") collect, use, and store information, and what choices you have.

1. Who We Are

2. Summary

• The Game does not require a player account. Your playable save, including progress, settings, pets, Treats, and custom levels, is stored on your device.
• Optional PostHog gameplay analytics is planned but is not active as of the effective date. If introduced, it will require a separate opt-in, use EU hosting, keep identifiable analytics for no more than 90 days, and have session replay disabled.
• Google AdMob processes advertising data, and Google Play processes real-money purchases. We receive purchase reports, Play Console reports, and messages you send to support.
• We do not sell personal information. You can change advertising consent where required and, if analytics is introduced, decline or withdraw analytics consent separately.

3. Information Stored on Your Device

The Game saves the following on your device so it can work: level progress, settings (such as sound volume), selected and unlocked pets, your Treats balance, a local record of your purchases, and any custom levels you create in the level editor.

The playable save file and custom-level contents are not uploaded to us. The local save is deleted when you uninstall the Game or clear its data, but your device may keep a backup depending on your settings. Deleting the local save does not delete data already held by service providers.

4. Internet Connectivity Check

While ads are active, the Game checks whether your device is online by sending a simple request to a Google connectivity endpoint (connectivitycheck.gstatic.com). The request does not contain your save file, custom levels, or purchase details. Like any internet request, it reveals your IP address to Google.

5. Advertising – Google AdMob

The Game uses Google AdMob (provided by Google LLC or Google Ireland Ltd) to display advertisements. AdMob may collect and use information such as your device's Advertising ID, app set ID and other device or account identifiers where applicable, IP address (which can indicate approximate location), device and app information, app and ad interactions, and diagnostic information. These are used to show ads, limit repeat ads, measure performance, and prevent fraud. Depending on your choices and location, ads may be personalized based on your activity across apps and websites.

Where required by law (for example in the EEA, UK, and Switzerland), you will be asked for consent before storing or accessing advertising identifiers on your device where consent is required, and before using personal data for personalized advertising. Non-personalized ads may also use identifiers for frequency capping, measurement, and fraud prevention; choosing non-personalized ads does not automatically remove consent requirements. You can revisit the advertising consent choices through the Game's privacy options. You can also limit ad personalization or reset or delete your Advertising ID in your device settings:

• Android: Settings → Google → Ads (or Settings → Security & privacy → Privacy → Ads)

An active ad-removal purchase prevents new AdMob initialization and ad requests, and removes loaded ads from the Game. It does not erase advertising data already processed by Google.

For more information, see how Google uses information from apps that use its services and Google's Privacy Policy.

6. In-App Purchases – Google Play

Optional in-app purchases are processed by Google Play Billing. Your payment-card details are handled by Google; we do not receive or store them through the Game. The Game receives information needed to deliver, verify, restore, and, where applicable, revoke purchases, such as the product ID, purchase status, and purchase token. A record of owned items is kept on your device.

Treats are earned through play and cannot be bought with real money. Spending Treats updates the local balance and unlocked items without charging your payment method.

Google provides us with transaction reports (for example product, price, country, and date) through the Google Play Console for accounting and tax purposes. Google's handling of your data is described in Google's Privacy Policy.

7. Optional Analytics, Crash Reports, and Statistics

Planned feature, currently inactive: We may introduce PostHog to understand which features players use and improve levels, minigames, and the Game's usability. No PostHog analytics is collected as of the effective date of this policy. Describing the feature here does not enable it or give us your consent.

Before any PostHog collection begins, the Game will explain the analytics and ask you to opt in separately from advertising and from accepting the Terms of Service. Analytics will stay off unless you choose to allow it. Declining will not prevent you from playing or using purchases. If introduced, the Game's privacy settings will let you withdraw consent at any time and stop further analytics collection. On withdrawal, we will also delete or irreversibly aggregate identifiable analytics already collected, unless a legal obligation requires limited retention. You can request deletion at any time as described in Section 12.

With your consent, analytics may include a randomly generated installation identifier, event timestamps, app version, operating system and device type, and selected gameplay events such as level starts and completions, completion time, minigame use, and feature selections. The identifier can link events from the same installation, so this information is personal data even though it does not include your name. We will limit collection to these disclosed categories; we will not send advertising identifiers, payment details, purchase tokens, support messages, playable save files, or custom-level contents to PostHog.

The planned integration will use PostHog's EU cloud hosting region. Network requests necessarily expose your IP address to the receiving service, but we will configure PostHog to discard it from stored analytics and disable IP-based location enrichment. Session replay will remain disabled: we will not use PostHog to record your screen, typed text, or gameplay sessions. PostHog Inc. will process analytics on our behalf under a data processing agreement; see PostHog's Privacy Policy and Data Processing Agreement. Retention and international transfers are explained in Sections 14 and 13.

The Game does not use a separate crash-reporting SDK. Google Play may provide crash diagnostics and aggregate installation or stability reports through Play Console according to your device settings and Google's policies. AdMob also processes ad measurements as described in Section 5.

8. Support Messages

If you email us, we receive your email address and whatever you choose to include in your message. We use it only to reply to you and to fix problems you report, and we delete it when it is no longer needed.

9. What We Do Not Do

• We do not sell personal information.
• We do not ask for your name, email address, precise location, contacts, or photos in the Game.
• We do not upload your playable save file or custom-level contents.
• We do not record your screen, typed text, or gameplay through a session-replay service.

10. Legal Basis (EEA / UK Users)

Advertising device storage/access and personalized advertising require consent where applicable (GDPR Article 6(1)(a) and applicable device-storage rules). Choosing non-personalized ads is not treated as consent to identifier storage. Consent can be withdrawn through the advertising privacy controls without affecting the lawfulness of processing before withdrawal.

Optional PostHog analytics, if introduced, will rely on your consent (Article 6(1)(a)), including consent to analytics-related device storage or access where required. Advertising consent does not authorize analytics. You may withdraw analytics consent without affecting the lawfulness of processing before withdrawal. We will not substitute legitimate interests for a declined or withdrawn analytics choice.

Processing necessary to deliver and restore purchases is based on performance of our contract with you (Article 6(1)(b)). Required accounting and tax records are kept to comply with legal obligations (Article 6(1)(c)). Support, necessary connectivity checks, and proportionate security or fraud prevention may rely on our legitimate interests in operating a reliable Game, answering requests, and preventing abuse (Article 6(1)(f)), where permitted. These interests do not override a consent requirement for advertising identifiers or other access to your device.

11. Children's Privacy

The Game is not directed at children under 13. Where local law requires a higher age for valid consent, the required parental or guardian authorization must be obtained before consent-based advertising or optional analytics is enabled. We do not knowingly collect children's personal information without the authorization required by law. If you believe we or a service provider collected your child's information improperly, contact us so we can investigate, stop the processing, and arrange deletion where required.

12. Your Rights and Choices

Depending on where you live, you may have the right to:

• access, correct, or delete personal information we hold about you;
• object to or restrict certain processing;
• receive eligible information in a portable format;
• withdraw consent for consent-based advertising and, if introduced, optional analytics at any time;
• lodge a complaint with a data protection authority (in Estonia: the Andmekaitse Inspektsioon).

You can delete the local save by clearing the Game's data or uninstalling it. To request access to or deletion of purchase reports, support data, or any future PostHog analytics we hold, email testncodeou@gmail.com. Because there is no player account, we may need limited information about your support message, purchase, or analytics installation identifier to locate the relevant record. If analytics is introduced, its privacy controls will provide a way to obtain that identifier for data requests. We will explain any identification difficulty without asking for unnecessary identity documents. Do not email payment-card details. For data Google controls, use Google's privacy and account tools or contact Google as described in its Privacy Policy.

We respond within the period required by applicable law, normally one month under the GDPR. Where an exception requires retaining records, we will explain the reason and applicable limits. You may contact your local data protection authority as well as the Estonian authority listed above.

13. Security and International Transfers

If PostHog analytics is introduced, the primary analytics storage will be in the EU region. EU hosting does not mean all processing stays within the EU: PostHog and its subprocessors may process data elsewhere, including for support. Where required, transfers will use the applicable safeguards in our data processing agreement, such as standard contractual clauses or an applicable adequacy decision. You can contact us for information about these safeguards.

We use reasonable safeguards, including encrypted transmission to service providers and restricted access to purchase reports and support records. No system is completely secure. Google may process data outside your country, including in the United States, as described in its policies, subject to applicable transfer safeguards such as adequacy decisions, the EU–US Data Privacy Framework where applicable, or standard contractual clauses. You can contact us for information about safeguards applicable to the data we control. Google's policies explain the safeguards for data it controls.

14. Retention and Deletion

Local saves remain on your device until you delete them, subject to any device backups. Aggregate reports that do not identify a player may be kept to understand installations, stability, and sales trends.

If PostHog analytics is introduced, identifiable raw analytics events will be deleted or irreversibly aggregated no later than 90 days after collection. Associated server-side identifiers and profiles will be removed when no retained events require them. We may keep statistics longer only if they have been irreversibly aggregated so they no longer identify a player or installation. We will enable analytics only after a deletion process that enforces this period is in place. Backup copies awaiting expiry will be restricted from ordinary use and handled under the processor's agreed deletion and backup schedules.

Support messages are kept while needed to resolve your request and related disputes. Purchase, refund, and accounting records are retained for the applicable statutory accounting and tax periods, or while necessary to resolve a purchase dispute or legal claim. Records retained for these purposes are limited to what is necessary. Google retains data it controls under its own policies. Deletion from live systems may be followed by expiry from restricted backups under the providers' backup schedules.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example if the Game gains new features. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice in the Game or on our website. Introducing the optional analytics described here will still require the in-game explanation and opt-in before collection begins. If its purposes, data categories, providers, or other relevant terms change, we will update the disclosures and obtain new consent where required before that processing.

16. Contact Us