Privacy Policy

This policy explains what information the Tiny Putt mobile game (“Tiny Putt”, “the app”, bundle id com.danielgerber.tinyputt) collects, why, who it’s shared with, and the choices and rights you have. It covers the iOS and Android apps and the Firebase backend that powers online play. By using Tiny Putt you agree to this policy.

1. Who we are

Tiny Putt is made by Daniel Gerber, an independent developer, who is the data controller responsible for your information. Given the small scale of this app, no Data Protection Officer or EU/UK representative has been appointed. You can reach us any time at danielgerberapps@gmail.com — this is the single channel for privacy questions and for exercising any of the rights described below.

2. Information we collect

You can play Tiny Putt entirely anonymously — we only receive a name or email if you choose to link an Apple or Google account. Here’s the full picture:

Information created automatically

• Anonymous player ID. The first time you open the app, we create a random Firebase identifier for your device. It isn’t linked to your real identity and is used to save your progress and run online features.
• Gameplay & multiplayer data. When you play online or the Daily Challenge, we store scores, strokes, ball positions, replay data, room/match state, and the generated course, so matches and leaderboards work.
• Progress backup. Your unlocks, achievements, stats, campaign progress, and daily streak are backed up to your player ID so you can restore them.
• Push notification token. Only if you turn on notifications, we store a Firebase Cloud Messaging token (and whether your device is iOS or Android) so we can send “your turn” and match alerts.
• Advertising & device identifiers. Google AdMob (our ad provider) collects device and advertising identifiers (such as the iOS IDFA or Android Advertising ID), IP address, and ad-interaction data to show and measure ads. See Advertising below.
• Diagnostics. If the physics engine hits a rare glitch, the app may send a small anonymous report (ball positions and course layout, capped at a few per day) so we can fix it. These reports contain no personal information.
• Device & app basics. Non-identifying details such as your platform (iOS/Android) and app/build version, used for compatibility and support.

Information you provide

• Nickname. A short display name you type (up to 14 characters) for multiplayer and the Daily Challenge. It’s whatever you choose — it doesn’t have to be your real name. Opponents in your match can see it, and if you post to the Daily Challenge it appears on that day’s public leaderboard alongside your score.
• Linked account (optional). If you tap “Sign in with Apple” or “Sign in with Google” to back up your account, we receive your name and email from that provider (if you use Apple’s “Hide My Email”, we only get Apple’s private relay address). This is stored inside Firebase Authentication to identify your account and is never written into our game database; it’s only shown to you in Settings.

Stored only on your device

Your settings and preferences — theme, haptics, music/SFX volume, reduce‑motion and other accessibility toggles, chosen ball skin, and local bookkeeping — are saved on your device only and are never sent to us.

What we do not collect

Tiny Putt does not access your location, camera, microphone, contacts, photos, calendar, or health/fitness data. We do not use Firebase Analytics or any general-purpose tracking analytics.

At a glance

3. How we use your information

• Provide the game: sign you in anonymously, save and restore progress, and run the campaign, daily challenge, and online multiplayer.
• Enable social features: matchmaking, private rooms, and public daily leaderboards.
• Send the notifications you opt into (e.g. “it’s your turn”).
• Show and measure ads that keep Tiny Putt free.
• Keep the game working and fair: diagnose crashes and physics glitches, and filter profanity in names.

4. Legal bases (EEA / UK / Switzerland)

If you’re in the EEA, UK, or Switzerland, we rely on these legal bases under the GDPR / UK GDPR:

• Performance of a contract — to provide the game features you request, including accounts, multiplayer, and progress backup.
• Legitimate interests — to keep the game secure, prevent abuse, fix bugs, and show non‑personalized ads.
• Consent — for personalized advertising, which we request through Google’s consent form (see below). You can withdraw consent at any time.

5. Advertising & your choices

Tiny Putt is free and supported by ads served through Google AdMob. To show and measure ads, Google and its ad partners may collect device and advertising identifiers, IP address, and information about how you interact with ads. Depending on your consent and settings, ads may be personalized (based on such data) or non‑personalized.

• EEA, UK & Switzerland: before serving personalized ads, we show Google’s consent form (User Messaging Platform). You can change your choice at any time, and declining still lets you play with non‑personalized ads.
• iOS: Apple’s App Tracking Transparency prompt lets you allow or deny use of your device’s advertising identifier for personalized ads.
• Device controls: on iOS you can limit ad tracking in Settings → Privacy & Security → Tracking / Apple Advertising; on Android you can reset or delete your Advertising ID and opt out of ad personalization in Settings → Privacy → Ads.

Learn how Google uses this information at google.com/policies/technologies/partner-sites. We can’t list every downstream ad-network partner individually; they act in accordance with Google’s policies.

6. How information is shared

We don’t sell your personal information in the everyday sense. We share data only with the service providers that make the game work, and with other players as part of gameplay:

• Google Firebase — Authentication, Realtime Database, Cloud Messaging, and Cloud Functions act as our data processor to store your player ID, nickname, gameplay data, backups, and push tokens. See Firebase’s privacy information.
• Google AdMob — to serve and measure ads, as described above. See Google’s Privacy Policy.
• Apple & Google (sign-in) — only if you choose to link an account, as identity providers. See Apple and Google.
• Other players — your nickname, scores, and replays are visible to opponents in your match, and daily-leaderboard names and scores are visible to anyone viewing that day’s board.

We may also disclose information if required by law or to protect the rights, safety, and security of our players and the game.

7. International data transfers

Our providers (Google Firebase and AdMob) process data on Google’s infrastructure, including in the United States. Where data is transferred out of the EEA, UK, or Switzerland, it’s protected by appropriate safeguards — chiefly the European Commission’s Standard Contractual Clauses (with the UK and Swiss addenda) incorporated into Google’s Cloud Data Processing terms.

8. Data retention & deletion

We keep information only as long as it’s needed for the purposes above:

• Progress backups (unlocks, achievements, campaign, stats) are kept until you delete your account or uninstall.
• Online matches & rooms are removed when you leave or automatically after about 96 hours of inactivity.
• Daily Challenge entries expire after roughly 30 days.
• Push tokens are replaced when they refresh and removed when you delete your account; invalid tokens are pruned automatically.
• On-device settings remain until you clear them or uninstall.

Deleting your data. If you’ve linked an account, you can permanently delete it from Settings → Account → Delete account. This leaves any active matches, removes your cloud backup and today’s daily entry, deletes your sign-in record, and clears local data — a genuine, full deletion. You can also request deletion any time by emailing danielgerberapps@gmail.com. Uninstalling the app removes all on-device data.

9. Your rights & choices

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access a copy of your data and information about how it’s processed.
• Correct inaccurate data (e.g. your nickname, which you can edit in-app).
• Delete your data (see above).
• Restrict or object to certain processing, and request portability of your data.
• Withdraw consent for personalized ads at any time.

To exercise any right, email danielgerberapps@gmail.com and we’ll respond within the timeframe required by law (generally within 30 days). You won’t be treated differently for exercising your rights. If you’re in the EEA, UK, or Switzerland, you also have the right to complain to your local data protection authority (for example, the ICO in the UK).

10. California privacy rights (CCPA/CPRA)

If you’re a California resident, you have the right to know, access, delete, and correct your personal information, to opt out of “sale” or “sharing,” to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights.

We do not sell your information for money. However, showing personalized ads through AdMob may be considered “sharing” or a “sale” for cross‑context behavioral advertising under California law. You can opt out by:

• declining or changing your choice in Google’s consent form, and/or using the device‑level ad controls described in the Advertising section; and/or
• emailing danielgerberapps@gmail.com with the subject “Do Not Sell or Share.”

We honor Global Privacy Control (GPC) signals where applicable. Residents of other US states with similar laws (e.g. Virginia, Colorado, Connecticut, Texas, Oregon) have comparable rights, including opting out of targeted advertising, and can use the same contact and controls.

11. Children’s privacy

Tiny Putt is a general‑audience game and is not directed to children under 13 (or under 16 where a higher age of digital consent applies). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact danielgerberapps@gmail.com and we will delete it. We do not serve personalized ads to users identified as children.

12. Security

We protect your information with industry-standard measures: data is encrypted in transit (HTTPS), our database uses security rules that limit access to your own data, and sign‑in is anonymous by default, so you can play without sharing identifying details. No method of transmission or storage is ever 100% secure, but we work to protect your information and update our practices as needed.

13. Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the “Effective” date at the top, and we’ll keep our Apple App Privacy details and Google Play Data Safety information consistent with it. Material changes will be reflected here; please check back periodically.

14. Contact us