1. Introduction

Welcome to Biplane Battle (the “Game”), developed and published by JoeBung Apps (referred to in this policy as “I,” “me,” or “my”). I am an independent developer committed to protecting your privacy and being transparent about how I handle information when you play my Game.

This Privacy Policy explains what information I collect, why I collect it, how it is used, and what rights you have regarding your data. It applies to all users of the Game on both the Apple App Store (iOS) and Google Play (Android).

By downloading, installing, or playing the Game, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with my practices, please do not use the Game.

This Privacy Policy is available at: https://joebung.com/Biplane_privacy_policy.html. It may also be accessed via the in-game settings menu and through the Game’s App Store and Google Play listing pages.

2. Information I Collect

I collect the minimum information necessary to operate the Game and provide you with a functional experience. Below is a plain breakdown of the types of data involved.

2a. Information You Provide Directly

• In-App Purchases: When you make a purchase within the Game, the transaction is processed entirely by Apple (App Store) or Google (Google Play). I do not receive your payment card number, billing address, or other raw financial details. I receive only a purchase receipt and transaction ID to confirm and validate your purchase.
• Support Requests: If you contact me for help (e.g., by emailing joebungapps@gmail.com or submitting a support form), I collect the information you provide, such as your name, email address, and details about your issue. This is used solely to respond to your request.

2b. Information Collected Automatically

When you play the Game, certain technical information is collected automatically by the Game engine (Unity) and its integrated services:

• Device Identifiers: Device ID, Advertising ID (IDFA on iOS; Google Advertising ID / GAID on Android)
• Device Information: Device model, operating system version, and language/locale settings
• Gameplay Data: Session length, level progress, in-game events (e.g., level completions, purchases triggered)
• Purchase Receipts & Transaction IDs: Used solely to verify and restore in-app purchases
• Crash Logs & Performance Data: Diagnostic information sent when the Game crashes or experiences errors, to help me identify and fix bugs
• IP Address: Collected by servers for security and approximate geographic location (country/region level only — not precise location)

2c. Information from Third-Party SDKs

The Game integrates the following third-party software development kits (SDKs), which may collect data as described below:

Note: Apple does not share full payment card details with developers. Google Play does not either. My access is limited to receipt tokens used solely for purchase verification.

3. How I Use Your Information

I use the information described above for the following purposes:

• To operate and deliver the Game: Including processing in-app purchases, verifying entitlements, and enabling core gameplay features
• To verify and restore purchases: Using receipt data from Apple/Google to confirm prior transactions when you reinstall the Game or switch devices
• To debug and improve the Game: Crash logs and performance data help me identify and fix technical issues and improve future versions
• To comply with legal obligations: Including tax and accounting record-keeping, and fraud prevention
• To respond to support requests: To address questions or issues you raise with me directly
• To deliver rewarded advertisements: Relevant data (including Advertising IDs, with your consent where required) is used to serve and measure rewarded ads through Unity Ads, IronSource (Unity LevelPlay), and AdMob.

Legal Bases for Processing (GDPR / UK GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, I rely on the following legal bases under the General Data Protection Regulation:

4. In-App Purchases & Unity IAP

The Game offers in-app purchases (IAPs) processed through the Unity IAP SDK. All payment transactions are handled entirely by Apple (App Store) or Google (Google Play). The developer — JoeBung Apps — does not directly process, store, or have access to your payment card details, bank information, or billing address at any point.

How Purchases Work

• You initiate a purchase within the Game
• The Unity IAP SDK forwards the purchase request to Apple or Google’s payment infrastructure
• Apple/Google process the payment and return a signed purchase receipt to the Game
• The Game validates this receipt to confirm your purchase and unlock the associated content

What Data Is Involved

• Unity IAP may collect: transaction IDs, product IDs, and purchase timestamps
• Receipt data is used solely for purchase verification and to prevent fraudulent transactions
• No payment card details are ever stored by the developer

Refunds

Refund requests are governed by Apple’s and Google’s own store terms and policies. As the developer, I have no ability to issue refunds directly. Please contact Apple Support or Google Play Support for refund requests.

Third-Party Privacy Policies for Payments

• Unity Technologies: unity.com/legal/privacy-policy
• Apple: apple.com/legal/privacy/
• Google: policies.google.com/privacy

5. Device Identifiers & Advertising IDs

Advertising IDs are resettable, non-permanent identifiers assigned by your device’s operating system. They are distinct from your device’s hardware ID and are specifically designed to allow privacy-respecting tracking for advertising purposes.

• IDFA (Identifier for Advertisers — iOS): On iOS 14.5 and later, Apple requires apps to request your permission before accessing the IDFA through the App Tracking Transparency (ATT) framework. The Game will display the standard ATT permission prompt before any IDFA access occurs. If you decline, the Game will function normally and no IDFA will be accessed.
• GAID (Google Advertising ID — Android): Android devices provide a resettable Google Advertising ID. This is collected for analytics purposes and for ad delivery through Unity Ads, IronSource, and AdMob.
• Advertising IDs are not used to personally identify you. They are used at an aggregate or pseudonymous level for analytics and ad delivery.
• You can reset your Advertising ID at any time:
  • iOS: Settings > Privacy & Security > Tracking
  • Android: Settings > Google > Ads > Reset Advertising ID
• You can also opt out of interest-based advertising entirely through your device OS settings.

6. Data Sharing & Third Parties

I do not sell your personal information to third parties. I share data only in the limited circumstances described below, and only to the extent necessary for those purposes.

All third-party service providers I work with are contractually required to handle data securely and in accordance with applicable privacy laws. Each third party is governed by their own privacy policy (links provided above).

7. Children's Privacy

The Game is not directed at children under the age of 13 (or under 16 in the EEA and UK, where a higher age threshold may apply under local law). I do not knowingly collect personal information from children in these age groups.

If you are a parent or guardian and you believe your child has submitted personal information to me — for example, through a support request — please contact me immediately at joebungapps@gmail.com. I will take prompt steps to delete such information from my records.

In-app purchases made by minors are subject to Apple’s and Google’s own parental controls and terms of service. I encourage parents to use available device-level parental controls to manage in-app spending.

8. Data Retention

I retain data only for as long as necessary for the purposes described in this Policy, or as required by law. The following retention periods apply:

When data is no longer needed, I will delete it or ensure it is anonymized so that it can no longer be associated with any individual.

9. Data Security

I take reasonable and appropriate technical and organizational measures to protect the data I hold against unauthorized access, loss, destruction, or alteration. These measures include:

• Encryption in transit: All data transmitted between the Game and my servers (or third-party services) is protected using TLS/HTTPS encryption
• Access controls: Access to any stored data is limited to authorized personnel (in practice, the developer only) on a need-to-know basis
• No payment data storage: Raw payment card details are never received or stored by me under any circumstances
• Third-party security: I use reputable third-party services (Unity, Apple, Google) that maintain their own robust security programs

Please note that no method of transmission over the internet or electronic storage is 100% secure. While I strive to protect your information, I cannot guarantee absolute security. If you believe your data has been compromised, please contact me at joebungapps@gmail.com.

10. Your Rights & Choices

10a. All Users

Regardless of where you are located, you have the following rights and options:

• Contact me at any time with privacy questions or concerns: joebungapps@gmail.com
• Opt out of analytics or advertising tracking via your device OS settings (see Section 5)
• Reset your Advertising ID at any time through your device settings
• Request deletion of any support communications you have sent me

10b. EEA, UK & Switzerland Users (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following additional rights under the GDPR and UK GDPR:

• Right of Access (Art. 15): Request a copy of the personal data I hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate personal data
• Right to Erasure / “Right to be Forgotten” (Art. 17): Request deletion of your personal data, subject to legal exceptions (e.g., tax record retention obligations)
• Right to Restriction of Processing (Art. 18): Request that I limit how I use your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) at ico.org.uk. In the EEA, contact your national Data Protection Authority (DPA).

To exercise any of these rights, please contact me at joebungapps@gmail.com. I will respond within 30 days of receiving your request.

10c. California Users (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information I collect about you, and how it is used and shared
• Right to Delete: Request deletion of personal information I have collected from you, subject to certain exceptions
• Right to Opt-Out of Sale/Sharing: I do not sell or share personal information as defined under CCPA/CPRA. No opt-out is required, but you may contact me to confirm this.
• Right to Non-Discrimination: I will not discriminate against you for exercising your CCPA/CPRA rights

To submit a CCPA request, contact me at: joebungapps@gmail.com.

11. UK/EU Consent Notice & GDPR Compliance (Google UMP / IAB TCF v2.2)

This section applies specifically to users in the European Economic Area (EEA), the United Kingdom, and Switzerland. It describes how I manage consent in compliance with the EU ePrivacy Directive, the General Data Protection Regulation (GDPR), and the UK GDPR.

11.1 Google User Messaging Platform (UMP SDK)

The Game uses Google’s User Messaging Platform (UMP SDK) to manage consent for users in the EEA, UK, and Switzerland. When you first launch the Game in these regions, you will be presented with a consent dialog before any advertising or advertising ID access occurs. This consent dialog is built on the IAB Transparency and Consent Framework (TCF) v2.2, the industry standard for GDPR-compliant consent management in mobile applications.

11.2 Types of Consent Requested

The consent dialog may request your agreement for one or more of the following data processing purposes:

• Storage and/or access to information on the device — e.g., reading/writing cookies or device identifiers
• Personalised advertising — using your data to select and deliver ads tailored to your interests
• Ad selection, delivery, and reporting — measuring ad performance and frequency
• Content selection, delivery, and reporting — used for rewarded ad targeting and performance measurement
• Measurement — analytics to understand how the Game is used

Ad networks active in this Game include Unity Ads, IronSource (Unity LevelPlay), and AdMob (Google). Each network operates under its own privacy policy and data processing agreements, including Standard Contractual Clauses for EEA/UK data transfers.

11.3 Legal Basis Mapping Under TCF v2.2

11.4 How to Update or Withdraw Consent

You may update or withdraw your consent at any time without any negative consequences to your access to the Game:

• Via the in-game settings menu: A “Privacy Options” or “Manage Consent” button — powered by the UMP SDK — is available in the Game’s settings. Tapping this allows you to review and modify your consent choices at any time.
• Effect of withdrawal: Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal. After withdrawal, no consent-dependent processing (such as personalized advertising) will occur.

11.5 Advertising Without Consent

• The Game will not serve personalized advertisements to users who have not provided consent for personalized advertising.
• Non-personalized advertisements may still be served based on legitimate interest (e.g., for basic frequency capping and fraud detection), consistent with TCF v2.2 guidelines.
• Users who decline all consent will still have full access to the Game’s core functionality.

11.6 Children and Consent (TagForUnderAgeOfConsent)

For users identified as potentially being under the age of consent for data processing in their jurisdiction (e.g., under 13 in the US; under 16 in many EEA countries), the Game uses the TagForUnderAgeOfConsent (TFUA) flag in the UMP SDK configuration. This ensures that no consent dialog is shown to child users, and no advertising data collection occurs in connection with such users.

11.7 Data Controller Information

For the purposes of the GDPR and UK GDPR, the data controller is:

• Name: JoeBung Apps
• Address: United States
• Email: joebungapps@gmail.com

11.8 Data Protection Officer

As a small independent (solo) developer, I am not legally required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. No DPO has been appointed. However, I am committed to GDPR compliance and will respond promptly to all data protection inquiries directed to joebungapps@gmail.com.

11.9 UK ICO Registration

N/A (not currently registered). JoeBung Apps is based in the United States and is not subject to UK ICO registration requirements. If this changes, this section will be updated accordingly.

12. International Data Transfers

As an independent developer using globally operated services, data collected through the Game may be processed outside of your country of residence. In particular:

• Unity Technologies (United States): The Unity IAP SDK and Unity Ads SDK are operated by Unity Technologies, Inc., headquartered in the United States. Data processing by Unity is governed by their Data Processing Agreement and Standard Contractual Clauses (SCCs).
• Google (Google Play / UMP SDK / AdMob) (United States): Data processed in connection with the Google Play store, UMP SDK, and AdMob may be transferred to the US. Google relies on SCCs and other approved transfer mechanisms for EEA/UK data.
• Apple (App Store) (United States): Purchase data processed by Apple is subject to Apple’s own privacy policy and transfer mechanisms.
• IronSource (Unity LevelPlay), headquartered in Tel Aviv, Israel and operating globally, also processes data in the United States. This is covered by Standard Contractual Clauses (SCCs).

For users in the EEA and UK, international transfers of personal data are covered by:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• UK International Data Transfer Agreement (IDTA) for transfers from the UK, where applicable

By using the Game, you acknowledge that your data may be transferred to and processed in countries outside your jurisdiction, subject to the safeguards described above.

13. Changes to This Policy

I reserve the right to update or modify this Privacy Policy at any time. Changes may be made to reflect updates in the Game, changes in applicable laws, or improvements to my practices.

When I make material changes to this Policy, I will notify you through one or more of the following methods:

• An in-game notice displayed on first launch after the update
• An updated description in the App Store and/or Google Play listing
• A revised “Last Updated” date at the top of this document

Your continued use of the Game after any update to this Policy constitutes your acceptance of the revised Policy. If you do not agree with the updated Policy, you should discontinue use of the Game and may uninstall it at any time.

I encourage you to review this Policy periodically. The most current version will always be available at https://joebung.com/Biplane_privacy_policy.html.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact me using the details below. I will make every effort to respond promptly and in a manner consistent with my legal obligations.

For GDPR-specific requests (access, erasure, portability, objection), please include “GDPR Request” in the subject line of your email and describe your request clearly. I may ask you to verify your identity before processing certain requests.