Privacy Policy — Glow Candy
Publisher: VTMX Interactive, a brand of VİTMAX LTD. ("VTMX", "we", "us", "our") • Effective date: 5 August 2026 • Last updated: 6 September 2026 (in-app purchases, Google Play Games sign-in, cloud save, downloadable content, notifications, in-app account deletion)
This Privacy Policy describes how we collect, use, share, and protect information in connection with the mobile game Glow Candy ("the Game") and the choices available to you. It applies to all versions of the Game distributed through the Apple App Store, the Google Play Store, and any other official channel.
We designed the Game to collect as little personal data as possible. You can play without creating an account, and we never ask for your real name, e-mail address, phone number, contacts, photos, or precise location. Signing in with Google Play Games and making purchases are optional; the Game is fully playable without either. Please read this Policy carefully; by installing or playing the Game you acknowledge the practices described below.
1. What Data We Collect
1.1 Data you provide directly
- Nickname. On first launch you choose (or randomly generate) a nickname of 3–14 characters. This nickname, together with your scores, appears on the public in-game leaderboard and is visible to other players worldwide. We ask you not to use your real name or any information that could identify you. Nicknames that contain personal information, or that are offensive or misleading, may be changed or removed by us.
- Optional Google Play Games sign-in. You may link your progress to your Google Play Games account ("Save your progress" in Settings). When you do, Google Play Games Services authenticates you and gives us a one-time server authorization code, which we pass to Unity Gaming Services to link your pseudonymous Player ID to your Play Games identity. We receive your Play Games player ID; we do not receive your Google e-mail address, real name, contacts, or password. You can unlink at any time from Settings ("Log out"). See Google's Privacy Policy (Section 3).
- In-app purchases. The Game offers optional in-app purchases (coin packs, bundles, the piggy bank, and the Glow Pass) processed entirely by Google Play Billing. Google handles your payment method and billing details; we never see or store card numbers or bank information. We receive only the product identifier, order/purchase token, purchase state, and the local price and currency, which we use to deliver the item, prevent fraud, and measure revenue (see AppsFlyer below).
- Support communications. If you contact us at info@vtmx.io, we receive your e-mail address and the content of your message. We use this information only to respond to you.
1.2 Data collected automatically
- Pseudonymous player identifier. When the Game first connects to online services, Unity Gaming Services Authentication assigns a random, pseudonymous Player ID to your installation. It does not directly reveal your real-world identity, but it is treated as personal data because it can distinguish a particular player or installation. Unity Leaderboards also processes this Player ID together with your IP address in order to operate and secure the service. The ID is used to associate your nickname and scores with your installation.
- Gameplay data linked to the online service. Your best scores are transmitted to and stored on the leaderboard service together with your pseudonymous Player ID and nickname.
- Cloud save. Your game progress (level, stars, coins, boosters, area decorations, events, settings) is backed up to Unity Cloud Save under your pseudonymous Player ID so that it can be restored on a new device or after reinstalling. If you link Google Play Games, the same progress follows your Play Games identity across devices. Cloud save data contains no directly identifying information.
- Downloadable content. To keep the download small, some artwork (area scenes and background themes) is downloaded on demand from our content delivery network operated by Cloudflare, Inc. When the Game fetches this content, Cloudflare processes your IP address and standard request metadata to deliver the files and protect the service. No account or identifier is sent with these requests.
- Notifications. With your permission, the Game schedules local reminders on your device (for example, when your lives are full or a daily reward is ready). These notifications are generated on the device; no data is sent to us or to a push service, and you can disable them in the Game's Settings or in your device settings.
- Analytics data. The Game uses Google Analytics for Firebase to understand how the Game is played and to improve it. Firebase collects a random app-instance identifier and event data such as session start/duration, level starts and completions, feature usage, approximate country (derived from IP), device model, operating system version, and app version. We use this data in aggregate; it is not used to identify you personally.
- Crash and diagnostics data. The Game uses Firebase Crashlytics to detect and fix crashes and errors. When a crash or error occurs, Crashlytics collects crash traces (stack traces), the state of the device at the time (model, OS version, free memory/disk, orientation), app version, and a Crashlytics installation identifier. This data is used solely for stability and quality purposes.
- Advertising data. The Game displays advertising served by Google AdMob, including optional rewarded ads. AdMob and its certified ad partners may collect and process: your device's advertising identifier (the Google Advertising ID on Android; on iOS the IDFA, which is accessed only if you allow it through Apple's App Tracking Transparency prompt); other device identifiers such as the App Set ID; IP address; coarse (approximate) location derived from IP; device type, model, and operating system version; ad-interaction and product-interaction events (ad views, clicks, taps, video views, app launches); app performance data (such as app launch time, hang rate, and energy usage); SDK crash and diagnostics information; and data about the advertisements shown to you. On Android, some of this data may be collected and shared automatically by the SDK for advertising, analytics, and fraud-prevention purposes. This processing is governed by Google's own policies (see Section 3). If you decline tracking on iOS, ads are still shown but the IDFA is not used.
- Attribution data (marketing measurement). The Game uses AppsFlyer, a mobile measurement partner, to understand which marketing campaign or channel led to an install and to measure the effectiveness of our advertising. AppsFlyer may collect your device's advertising identifier (Google Advertising ID on Android), IP address, device and technical information (model, operating system version, app version, language, carrier/network type), install and app-open timestamps, and a pseudonymous player identifier we assign for support and deletion purposes. This data is used for campaign attribution, aggregate marketing analytics, and fraud prevention; it is not used to identify you personally.
- Technical service data. Our service providers automatically process limited technical information required to operate securely and reliably — for example IP address, request timestamps, device platform, and app version. The Game also performs a lightweight network time check (reading the date from standard web server responses) to prevent reward abuse; this request does not transmit any personal data beyond your IP address, which is inherent to any internet connection.
- Locally stored data. Your game progress (levels, stars, coins, lives, boosters, daily quests, streaks, settings such as sound and vibration) is stored only on your device using the platform's local storage. We cannot access it remotely. Local data is normally removed from the device when you clear the Game's storage or uninstall it; however, depending on your Apple or Google backup settings, copies may remain in — or be restored from — operating-system backups that you control.
1.3 Data we do NOT collect
We do not collect, request, or process: real names; e-mail addresses (except when you voluntarily contact support); phone numbers; contact lists; photos, camera, or microphone data; precise GPS location; biometric data; payment information (payments are handled entirely by Google Play; see Section 1.1); or data from social networks.
2. How We Use Data and Our Legal Bases
| Purpose | Data used | Legal basis (GDPR / KVKK) |
|---|
| Operating the online leaderboard: displaying nicknames, scores, and rankings to all players | Pseudonymous Player ID, nickname, scores | Performance of a contract — providing the features you request (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) |
| Saving and restoring your progress, including cloud backup and cross-device restore | Locally stored game data, cloud save data, pseudonymous Player ID | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) |
| Linking your progress to Google Play Games (optional) | Play Games player ID, server authorization code, pseudonymous Player ID | Performance of a contract at your request (GDPR Art. 6(1)(b); KVKK Art. 5/2-c) |
| Delivering in-app purchases, preventing purchase fraud, and keeping accounts | Product ID, purchase token, purchase state, price and currency | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5/2-c); legal obligation for accounting records (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç) |
| Delivering downloadable artwork through a content delivery network | IP address, request metadata | Legitimate interest — operating the service efficiently (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) |
| Sending local reminder notifications | Notification permission state, on-device schedule | Consent — the permission you grant on your device (GDPR Art. 6(1)(a); KVKK Art. 5/1) |
| Understanding how the Game is played, improving levels, difficulty, and features | Firebase Analytics events, app-instance ID, device data, approximate country | Consent in the EEA/UK/Switzerland: where legally required, Firebase Analytics is enabled or disabled based on the analytics-related privacy choices made through the consent message presented in the Game (GDPR Art. 6(1)(a); KVKK Art. 5/1); legitimate interest elsewhere (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) |
| Detecting, diagnosing, and fixing crashes and errors | Crash traces, device state, app version, Crashlytics installation ID | Legitimate interest — stability and quality of the Game (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) |
| Serving and measuring advertising, which keeps the Game free | Advertising ID, ad-interaction data, coarse location, device data | Consent in the EEA/UK/Switzerland, collected via the consent message (GDPR Art. 6(1)(a); KVKK Art. 5/1); legitimate interest elsewhere, subject to your device-level opt-outs (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) |
| Preventing cheating and reward abuse; keeping the service secure and fair | Network time check, technical service data, leaderboard data | Legitimate interest — protecting the integrity of the service (GDPR Art. 6(1)(f); KVKK Art. 5/2-f) |
| Responding to support requests | Your e-mail and message content | Legitimate interest / performance of a contract (GDPR Art. 6(1)(b),(f); KVKK Art. 5/2-c,f) |
| Complying with legal obligations | Any of the above, as required | Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5/2-ç) |
We do not use your data for profiling that produces legal effects, and we do not make automated decisions about you.
3. How We Share Data
We do not sell personal information for money. Google AdMob and selected advertising partners may process information to deliver, measure, secure, and — where permitted and consented to — personalize advertisements. Certain laws may classify some of this processing as "sharing", "targeted advertising", or "cross-context behavioral advertising"; the choices available to you are described in Section 6.
We require service providers that process personal data on our behalf to provide protections consistent with this Policy and applicable data-protection laws. Advertising partners that process data for their own purposes do so as independent controllers under their own policies, subject to the consent and opt-out mechanisms described in this Policy.
Data is disclosed only to the following categories of recipients:
- Unity Technologies (Unity Gaming Services). Provides authentication, the leaderboard backend, and cloud save. Unity processes the pseudonymous Player ID, IP address, nickname, scores, cloud save data, and related technical data on our behalf. See Unity's Privacy Policy: unity.com/legal/privacy-policy
- Google Firebase (Google Analytics for Firebase and Firebase Crashlytics). Processes the analytics and crash data described in Section 1.2 on our behalf. See Firebase's privacy and security documentation: firebase.google.com/support/privacy
- Google AdMob and its certified advertising partners. Provide and measure the advertisements shown in the Game. In the European Economic Area, the United Kingdom, and Switzerland, a consent message (Google's UMP framework) is shown before personalized advertising is used, and you may decline or later change your choice. Google's Privacy Policy: policies.google.com/privacy — list of AdMob's ad technology providers: support.google.com/admob/answer/9012903
- Google Play Games Services and Google Play Billing (Google LLC). Google operates the optional Play Games sign-in and processes all in-app purchases and payments as an independent controller under Google's Privacy Policy: policies.google.com/privacy. Purchase and refund handling is governed by Google Play's policies.
- Cloudflare, Inc. Delivers downloadable game artwork through its content delivery network and processes IP addresses and request metadata for that purpose. See Cloudflare's Privacy Policy: cloudflare.com/privacypolicy
- AppsFlyer Ltd. Provides install attribution and marketing measurement (see Section 1.2). AppsFlyer processes the attribution data described above on our behalf. See AppsFlyer's Services Privacy Policy: appsflyer.com/legal/services-privacy-policy — you may also opt out of AppsFlyer's measurement at any time via appsflyer.com/optout
- Legal and safety disclosures. We may disclose information if required by law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, property, or safety of players, the public, or VTMX.
- Business transfers. If VTMX or the Game is involved in a merger, acquisition, or sale of assets, data may be transferred as part of that transaction; this Policy will continue to apply until a new policy takes effect and is announced.
Public visibility note: your nickname and scores are, by the nature of a leaderboard, visible to every player of the Game. Treat your nickname as public information.
4. International Data Transfers
Our service providers (Unity, Google, Cloudflare, AppsFlyer) operate globally, and data described in this Policy may be stored or processed on servers located outside your country, including in the United States and the European Union. Where data of EEA/UK/Swiss residents is transferred internationally, our providers rely on recognized safeguards such as adequacy decisions and Standard Contractual Clauses. Where Turkish law applies, cross-border transfers are subject to the transfer mechanisms set out in the KVKK. This section is provided for transparency about where data is processed.
5. Data Security and Retention
We and our service providers apply reasonable technical and organizational measures appropriate to the nature of the data processed — including transport encryption (HTTPS/TLS) for online communications and access controls on backend services. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but the data processed by the Game is deliberately minimal and pseudonymous.
Retention periods:
- Leaderboard data (pseudonymous Player ID, nickname, scores): retained while the leaderboard service operates, or until you request deletion (see Section 6), after which it is deleted or irreversibly anonymized within 30 days.
- Cloud save data: retained while your Player ID exists, or until you delete your account in the Game (Settings → Delete Account) or request deletion; deleted within 30 days thereafter.
- Purchase records: product and order identifiers are retained as long as required for delivery, fraud prevention, and statutory accounting periods (up to 10 years under Turkish commercial law); payment details are held only by Google.
- Support e-mails: retained up to 24 months after the matter is resolved, then deleted.
- Analytics data: user-level data collected by Google Analytics for Firebase is retained for up to 14 months, after which it is automatically deleted; aggregated reports may be kept longer but contain no identifiers.
- Crash data: crash reports and related identifiers are retained by Firebase Crashlytics for 90 days.
- Advertising data: retained by Google under Google's own retention policies; we do not store it.
- Attribution data: retained by AppsFlyer under its own retention policies for as long as needed for attribution and analytics purposes; we do not store it ourselves.
- Local game data: remains on your device until you clear the app's data or uninstall the Game.
6. Your Rights and Choices
6.1 Rights available to everyone
Regardless of where you live, you can:
- Delete your account and online data from within the Game. Open Settings → Delete Account. This permanently deletes your pseudonymous Player ID, your Unity Authentication record, your cloud save, and your leaderboard entry, and unlinks Google Play Games; local progress on the device is reset. This cannot be undone and consumed purchases are not refundable by us (see the Terms of Use).
- Delete your online data by request. Use the request page at vtmx.io/glowcandy/delete-data, or e-mail info@vtmx.io from any address, stating your Player ID (shown at the bottom of the Game's Settings and Profile screens; tap it to copy — this random ID uniquely identifies your record — a nickname alone is not sufficient, because nicknames are not unique). Within 30 days we delete both your Unity Leaderboards entry (nickname, scores) and the underlying Unity Authentication record (pseudonymous Player ID), and confirm by reply.
- Change your nickname. Tap your own row on the in-game leaderboard to edit your name at any time.
- Reset all local data. Clear the app's storage in your device settings, or uninstall the Game.
- Control advertising at device level. On Android you can delete or reset your Advertising ID and opt out of ads personalization: Settings → Google → Ads. On iOS you can withdraw tracking permission at any time: Settings → Privacy & Security → Tracking (and limit Apple's own ad personalization under Settings → Privacy & Security → Apple Advertising). In both cases ads will still be shown but will not use those identifiers.
6.2 EEA, United Kingdom, and Switzerland (GDPR / UK GDPR)
You have the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection, as well as the right to withdraw consent at any time (withdrawal does not affect processing carried out before withdrawal). Personalized advertising is only used with your consent, collected through the in-game consent message (a Google-certified consent management platform). You can review or change your advertising and analytics choices at any time by opening Settings → Privacy Options in the Game, or via your device's ad settings. If you do not consent, the Game shows non-personalized or limited ads instead. You also have the right to lodge a complaint with your local supervisory authority.
6.3 United States (including California — CCPA/CPRA)
In the 12 months preceding the effective date, the categories of personal information processed are: identifiers (pseudonymous player ID, advertising ID, App Set ID, Firebase app-instance ID, IP address), internet or network activity (ad interactions, analytics events, crash and diagnostics data, service logs), and user-generated content (nickname, scores). We do not sell personal information for money. To the extent ad-supported processing constitutes "sharing" for cross-context behavioral advertising under the CPRA, you can opt out by disabling ads personalization or deleting your Advertising ID in your device settings (Settings → Google → Ads). California residents may exercise rights to know, delete, and correct by contacting info@vtmx.io; we will not discriminate against you for exercising your rights. Authorized agents may submit requests on your behalf with proof of authorization.
6.4 Türkiye (KVKK)
Türkçe aydınlatma metni: KVKK m.10 uyarınca hazırlanan ayrıntılı Türkçe aydınlatma metnine vtmx.io/glowcandy/kvkk adresinden ulaşabilirsiniz.
Under Law No. 6698 on the Protection of Personal Data, you may request information on whether your data is processed, request correction or deletion, and object to results arising from automated analysis. Requests may be sent to info@vtmx.io and will be answered within the statutory period.
6.5 Brazil (LGPD)
Brazilian users additionally have the rights to confirmation of processing, anonymization or blocking of unnecessary data, and information about sharing, exercisable via info@vtmx.io.
7. Children's Privacy
The Game is designed for users aged 13 and over. It is not directed to children under 13 (or the higher minimum age required in your country, such as 16 in certain EEA member states without parental consent). We do not knowingly collect personal data from children below the applicable age, and we do not knowingly serve personalized advertising to them. Purchases require a Google account and payment method controlled by the account holder; parents can restrict purchases through Google Play's parental controls and purchase authentication settings. If you are a parent or guardian and believe a child has provided personal data through the Game (for example, used personal information as a nickname), contact us at info@vtmx.io and we will delete it promptly.
8. Third-Party Links and Services
The Game may contain links that open external websites or your e-mail application (for example, our website or support address), and advertisements may lead to third-party sites or apps. Those destinations are governed by their own privacy policies, which we do not control and are not responsible for.
9. Changes to This Policy
We may update this Policy as the Game evolves (for example, if we add new features or service providers). The current version, with its effective date, is always available at this address. For material changes, we will provide reasonable prominent notice — such as an in-game notification — before the changes take effect. Continued use of the Game after the effective date of an updated Policy constitutes acceptance of it.
10. Contact Us
Data controller: VTMX Interactive, a brand of VİTMAX LTD.
E-mail: info@vtmx.io
Website: https://vtmx.io
If you contact us about a privacy matter, please include "Privacy Request" in the subject line and your Player ID (shown at the bottom of the Settings and Profile screens; tap to copy) where relevant, so we can locate the correct record.