Privacy Policy — Fletcher

Version: 2.0 · Effective date: 27 July 2026

Summary

Fletcher does not ask for your name, email address, phone number, contacts, photos, microphone, camera or location. We do not run our own analytics, and we do not sell data.

However, Fletcher does show advertising supplied by Google AdMob, and offers optional in-app purchases handled by Apple or Google. That means some data — including an advertising identifier — is processed by those companies for their own purposes. This is set out in full below.

You control the advertising part. On first launch in the EEA, the UK or Switzerland you will be shown a consent screen. You can decline personalised advertising and still play the full Game — you will simply see non-personalised ads instead. You can change your choice at any time in Settings → Privacy → Ad preferences.

A note on terminology: a persistent identifier tied to a device is personal data under the GDPR even when it carries no name. So this is written as a full privacy notice, not a “we collect nothing” statement.

1. Who is responsible for your data

The data controller for the Game is:

Aura Deco Candles, S.L., trading as Picatoste Games
Registered office: Paseo de la Zona Franca 145, esc. A, 6-1, 08038 Barcelona, Spain
NIF/CIF: B-19394022 · EU VAT: ESB19394022
Privacy contact: support+privacy@picatostegames.com

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

Important — we are not the only controller involved. For advertising, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and its affiliates act as an independent controller for a substantial part of the processing they carry out through AdMob. For purchases, Apple or Google act as controllers of the payment transaction. We do not determine how those companies use the data they collect, and their own privacy policies govern it. Links are given in Section 7.

2. Scope

This policy covers the video game Fletcher (application id com.picatostegames.fletcher) on all platforms on which we publish it.

It does not cover the app store through which you obtained the Game. Apple, Google, Valve and itch.io are independent controllers of the data they collect about your account, purchases, device and downloads. We do not receive individual-level data from them; sales and crash information reaches us aggregated or anonymised.

3. What data we process, and why

3.1 Gameplay and progression data

What: Level and chapter progress, completion state, in-game statistics and achievements, settings and preferences, and the technical save-state data needed to restore a session.

Why: To provide the core functionality of the Game — to let you stop and resume where you left off.

Legal basis: Performance of the contract between you and us (Art. 6(1)(b) GDPR).

3.2 Installation identifier

What: A random, opaque value (a UUID) generated locally by the Game on first launch. It is not the advertising identifier, not the device serial number, IMEI, MAC address or Android ID, and it is not derived from any hardware characteristic.

Why: Solely to associate your saved progress and your purchase entitlements with your installation of the Game.

Legal basis: Performance of the contract (Art. 6(1)(b) GDPR).

Characteristics: It is regenerated if you uninstall and reinstall the Game or clear its application data. We cannot use it to identify you as a person. It is not shared with advertisers and is not used for advertising, attribution or cross-app tracking.

3.3 Advertising — Google AdMob

The Game displays advertising served by Google AdMob in order to fund its development and allow us to offer it free or at low cost.

What Google may process when an ad is requested or shown:

• your device’s advertising identifier — the Advertising ID (AAID) on Android, or the Identifier for Advertisers (IDFA) on iOS where you have permitted it;
• IP address, and coarse location derived from it (typically city or region level);
• device and technical information — model, operating system version, language, screen and network characteristics;
• ad interaction data — which ads were requested, shown, viewed, clicked or closed, and whether an action followed;
• data stored on or read from your device by the advertising SDK, for frequency capping, fraud prevention and measurement.

What we receive: aggregated, non-identifying reporting only — impression counts, click rates and revenue totals. We do not receive your advertising ID, your IP address or any individual-level ad data, and we cannot see what ads you personally were shown.

Legal basis:

• Personalised (interest-based) advertising: your consent (Art. 6(1)(a) GDPR), together with consent to the storing of and access to information on your device under Article 5(3) of the ePrivacy Directive and, in Spain, Article 22.2 LSSI. Consent is collected through a Google-certified Consent Management Platform integrated with the IAB Transparency and Consent Framework (TCF v2.2), as Google requires for serving personalised ads to users in the EEA, the UK and Switzerland.
• Non-personalised advertising: where you decline, ads are served on a contextual basis. Some limited processing still occurs for frequency capping, fraud prevention and aggregate reporting, and any device storage this requires is also covered by your consent choices. Note that non-personalised ads still involve a request to Google’s servers and therefore still disclose your IP address.

Your choice is real and reversible. Declining personalised ads does not restrict access to any part of the Game. You may change your choice at any time via Settings → Privacy → Ad preferences, and you can additionally reset or delete your advertising identifier in your device’s own operating system settings.

On iOS: access to the IDFA also requires your permission through Apple’s App Tracking Transparency prompt. If you decline that prompt, the IDFA is not available to us or to Google, and advertising will be non-personalised regardless of any other setting.

Retention: Retention of advertising data is determined by Google under its own policies, not by us. See Google’s privacy policy and its “How Google uses information from sites or apps that use our services” page, linked in Section 7.

3.4 In-app purchases

The Game offers optional in-app purchases (for example an ad-free upgrade, hint packs or cosmetic items). These are processed entirely through the native store billing system of the platform you are using — Apple’s In-App Purchase or Google Play Billing.

We never see, receive or store your payment card number, bank details, billing address or the name on your payment method. Payment is handled by Apple or Google as the merchant of record and is governed by their terms and privacy policies.

What we do process: the purchase receipt or transaction token returned by the platform, the product identifier of what was bought, the purchase and any refund status, and the association of that entitlement with your installation identifier.

Why: To unlock the content you paid for, to let you restore purchases on the same store account, to validate receipts against fraudulent or replayed transactions, and to comply with our tax, accounting and consumer-law record-keeping obligations.

Legal basis: Performance of the contract (Art. 6(1)(b) GDPR), and compliance with legal obligations for the retention of transaction records (Art. 6(1)(c) GDPR, in conjunction with Spanish commercial and tax law).

Retention: Entitlement records are kept for as long as the entitlement is valid. Records with fiscal relevance are retained for the periods required by Spanish law — generally 4 years under the General Tax Law and 6 years under Article 30 of the Commercial Code.

3.5 Technical data inherent to a network request

What: If the Game contacts a server of ours (for example to validate a purchase receipt, or for an optional cloud-save feature), that server necessarily receives the metadata inherent to any internet request — IP address, timestamp, and a basic platform/user-agent string.

Why: To route the response to your device and to protect the service against abuse.

Legal basis: Performance of the contract and our legitimate interest in the security of our systems (Art. 6(1)(b) and 6(1)(f) GDPR).

Retention: Server access logs are kept for a maximum of 30 days and are then deleted. They are not combined with gameplay data to profile players.

3.6 Support correspondence

What: Your email address and whatever you choose to tell us, if you contact us for support, a refund query or to exercise your rights.

Why: To answer you and to keep records we are legally required to keep.

Legal basis: Art. 6(1)(b) and 6(1)(c) GDPR.

Retention: Up to 3 years from the last exchange, or longer where needed to defend a legal claim.

4. What we do not do

To be explicit, the Game does not:

• collect your name, email address, date of birth, phone number, postal address or payment details;
• request access to your contacts, calendar, photos, files, microphone, camera, or GPS location;
• contain analytics, attribution, A/B testing, heatmap or crash-reporting SDKs;
• contain social network SDKs, share plugins or third-party login;
• combine advertising data with your gameplay progress — the two are held separately and we hold no advertising data at individual level in any case;
• sell, rent or trade data to data brokers;
• take automated decisions producing legal or similarly significant effects concerning you.

On technical composition: the Game is built with the Godot Engine. Besides the engine and the components it bundles, the only third-party code we integrate is the Google Mobile Ads (AdMob) SDK, the Google User Messaging Platform (UMP) SDK or equivalent certified CMP, and the platform billing libraries required for in-app purchases. We have added no analytics, attribution or other tracking libraries.

5. Consent management

Where you are in the EEA, the UK or Switzerland:

• a consent screen is shown before any personalised ad request is made;
• the default state before you choose is denied;
• accepting and rejecting are presented as equally available choices;
• you can revisit and change your choice at any time in Settings → Privacy → Ad preferences;
• withdrawing consent is as easy as giving it, and takes effect for all future processing. It does not affect the lawfulness of processing carried out before withdrawal;
• the consent signal is transmitted to Google and downstream ad technology providers using the IAB TCF and Google’s Additional Consent specification.

The list of ad technology vendors that may process data under the TCF is presented within the consent screen itself and can be reviewed there in full.

6. Where your data is stored, and international transfers

Data we control. Your progress is stored on your own device. Fletcher currently operates no servers of its own and no first-party cloud service. If we later introduce an optional cloud-save, progress-sync or server-side receipt-validation feature, the data it needs will be processed by providers located within the European Union, each bound by a data-processing agreement meeting Article 28 GDPR, and this policy will be updated to name them before the feature is enabled.

Data handled by Google and the platforms. Advertising and purchase data is processed by Google and Apple on global infrastructure, which includes servers in the United States and other countries outside the European Economic Area. We do not control these transfers. They are carried out by those companies on the basis of the EU–US Data Privacy Framework adequacy decision of 10 July 2023, where the entity is certified under it, and/or the European Commission’s Standard Contractual Clauses together with supplementary measures.

You should be aware that the adequacy of the EU–US Data Privacy Framework is the subject of ongoing litigation before the Court of Justice of the European Union. Should the adequacy decision be invalidated, transfers would continue under Standard Contractual Clauses, and we will update this policy accordingly.

Device backups. Your operating system may back up the Game’s application data to Apple iCloud or Google Backup under settings you control. Those backups are governed by that provider’s privacy policy, not ours.

7. Who we share data with, and their policies

Ads shown in the Game may be supplied by third-party advertisers and ad networks participating in Google’s ad exchange. We do not select individual advertisers and are not responsible for their content or their data practices. Google maintains information on the ad technology providers it works with, accessible from the consent screen.

8. How long we keep data

9. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS), access control and least-privilege access to our infrastructure, EU-located hosting for any data we control, server-side validation of purchase receipts where used, and data minimisation by design.

No system is perfectly secure. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours under Article 33 GDPR, and notify affected users where Article 34 requires it. Given the pseudonymous nature of the data we hold, direct notification may not be technically possible; in that case we will publish a notice in the Game and on our website.

10. Children and young users

Fletcher is rated PEGI 3 and is not specifically directed at children.

Because the Game contains advertising and in-app purchases, the following applies:

• Personalised advertising is not served to users below the applicable age of digital consent. Under Article 8 GDPR that age is 16, which Member States may lower to 13; in Spain it is 14 under Article 7 of Organic Law 3/2018 (LOPDGDD). Where a user is identified as being below the applicable age, the Game applies Google’s under age of consent and, where relevant, child-directed treatment settings, and only non-personalised, age-appropriate advertising is requested.
• In-app purchases require the account holder’s authorisation. Purchases are made through Apple or Google account credentials. If you are a parent or guardian, we strongly recommend enabling the parental controls, purchase authorisation and spending limits provided by your platform — Ask to Buy on iOS, or purchase authentication in Google Play. Under Spanish law, contracts entered into by minors without the consent of their legal representative may be voidable; contact us and we will assist in seeking a refund through the platform.
• We do not knowingly collect data that identifies a child, and the Game creates no profile of any user.

If you are a parent or guardian and have a concern, write to support+privacy@picatostegames.com.

11. Your rights

Under the GDPR and Spanish Organic Law 3/2018, you have the right to access, rectify, erase, restrict, port and object to processing of your data, to withdraw consent at any time, and to lodge a complaint with a supervisory authority.

How to exercise them depends on who holds the data:

For data we hold (progress, entitlements, support correspondence) — write to support+privacy@picatostegames.com.

A practical limitation applies (Article 11 GDPR): because we deliberately hold no information identifying you, we normally cannot link a request to a specific person, and we are not required to collect additional identifying information just to service a request. In practice:

• The fastest route to erasure is in your own hands — deleting the Game’s application data or uninstalling the Game removes local progress and severs the link permanently.
• To have any server-side progress deleted or exported, supply your installation identifier, found in Settings → About → Installation ID.
• If you cannot supply it, we will tell you so and explain why we cannot act, as Article 12(2) GDPR requires.

For advertising data held by Google — because Google acts as an independent controller, exercise your rights directly with Google using the mechanisms in its privacy policy. You can also reset or delete your advertising identifier in your device settings at any time, and withdraw consent in Settings → Privacy → Ad preferences.

For purchase and payment data — contact Apple or Google, who hold it as merchant of record.

We respond within one month, extendable by two further months for complex requests. Exercising your rights is free unless requests are manifestly unfounded or excessive.

Right to complain. You may lodge a complaint with the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence. We would appreciate the chance to resolve the matter with you first.

12. Changes to this policy

We may update this policy when the Game changes or when law requires it. The version number and date at the top always reflect the current version. Where a change is material — for example if we begin processing a new category of data or add a new advertising partner — we will notify you in the Game before it takes effect, and where the change concerns processing based on consent, we will ask for your consent afresh.

Previous versions are available on request.

13. Contact

Questions about this policy, or to exercise your rights, can be sent to the addresses below. This policy is part of the Fletcher EULA framework and the company’s legal notice.

Aura Deco Candles, S.L. — Picatoste Games
Paseo de la Zona Franca 145, esc. A, 6-1, 08038 Barcelona, Spain · NIF B-19394022 · EU VAT ESB19394022
Privacy: support+privacy@picatostegames.com
General support: support@picatostegames.com