Privacy Policy
Last updated: 29 October 2026
Candy Box Sort (the "Game") is made by Cinnamon Paws Studio, the trading name of Csaba Körmöci, an individual developer in Romania ("we", "us"). We are the controller of the personal data described here. This policy explains what information the Game uses, why, and the choices you have. It applies to the Game on Android, iOS and the web.
Contact: kormocicsaba@gmail.com, or by post to Csaba Körmöci, Aleea Carpati 31B, 540318 Targu Mures, Mures county, Romania.
1. The short version
- You can play the whole Game without an account, and offline.
- Your progress is stored on your device (in your browser, on the web).
- The Game asks for your year of birth. Players under 16 see no ads, and no analytics are ever collected about them.
- Ads are only personalized, and analytics only collected, if you are 16 or older and agree.
- On Android the Game uses Google Firebase for crash reports and, only if you are 16 or older and agree, analytics. It uses no ad network yet. Section 10 lists the services the Game uses, and we add any new one there before an update that uses it reaches you.
- You can change your choices at any time in Settings → More settings → Privacy options, and erase your data in Settings → More settings → Delete my data.
2. What we use and why
| Information | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Game progress: levels, coins, items, settings | You, while playing | To run the Game and keep your progress | Contract (providing the Game), art. 6(1)(b) |
| The year of birth you enter | You, once | To give younger players the experience the law requires (section 6) | Legal obligation, art. 6(1)(c), and art. 8 |
| Your privacy choices and purchase records | You and the app store | To respect your choices and give you what you bought | Legal obligation; contract |
| Gameplay analytics: levels started, won and failed, boosters and ads chosen, session length, purchases, device model, OS version, language, a random install ID | The Game, only if you are 16+ and agree, and only once an analytics service is listed in section 10 | To tune difficulty and find problems | Consent, art. 6(1)(a) |
| Crash and error reports: the error, device model, OS version, Game version, recent in-game steps | The Game, once a crash-reporting service is listed in section 10 | To fix crashes | Legitimate interest in a working Game, art. 6(1)(f) |
| Advertising data: advertising ID (where allowed), the ad network's own user and session IDs, IP address, device and app information, ad interactions, in-app purchase history | Ad partners' software, once listed in section 10; never for players under 16 | To show ads, measure them and prevent fraud; to personalize them only if you agree | Consent (personalized ads); legitimate interest (non-personalized ads, fraud prevention) |
| Purchase information: the product and a receipt | Google Play or the App Store | To deliver and restore purchases | Contract |
We do not collect your name, email address, contacts, precise location, photos or payment card details. Payments are handled by Google or Apple; we only receive a receipt. If you email us, we use your message and address only to answer you.
The year of birth stays on your device. We never ask for your full date of birth.
3. Ads
The Game is free and supported by ads. There are two kinds:
- Rewarded ads, which you choose to watch for a reward. They are always optional.
- Between-level ads. The first can appear after you finish level 25, then at most once every 20 levels you win. They appear on the win screen only, never right after you lose a level. Buying Remove Ads stops them.
- EEA, UK and Switzerland: before any personalized ads or analytics, you are asked for consent through a consent form (Google's User Messaging Platform). Saying no does not change the Game.
- iOS: players 16 and over are asked for permission to track (App Tracking Transparency). If you decline, your advertising identifier is not shared.
- US state privacy laws (for example California): if you do not agree to personalized ads, we tell our ad partners not to "sell" or "share" your information for targeted advertising.
- Under 16: no ads at all (section 6).
4. Who we share information with
- The services listed in section 10, for the purposes given there. Each processes data under its own privacy policy or under a contract with us.
- Google and Apple, for purchases (under their own privacy policies).
- Authorities, where the law requires it.
We do not sell your personal information for money.
5. Where it is kept and for how long
- On your device: until you delete the Game or use Delete my data.
- Analytics: 14 months, then deleted.
- Crash reports: 90 days.
- Emails to support: as long as needed to help you, and at most 2 years.
- Ad partners keep data according to their own policies.
Some services we use may process data outside the European Economic Area, including in the United States. Where they do, they rely on safeguards the GDPR accepts, such as the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
6. Children and teenagers
The Game is not made for children under 13. It asks for your year of birth after your first win, with no answer suggested. If you are under 16, or give no usable answer:
- no ads are shown and the ad software is not started, so no advertising data is collected;
- no analytics are collected;
- you are not asked for tracking permission on iOS.
Because only the year is asked, you count as under 16 until the year in which you surely are 16. When you turn 16 nothing is switched on by itself: you choose in Privacy options. If you are a parent and believe your child has given us information, write to kormocicsaba@gmail.com and we will delete it.
7. Your rights and choices
- Change your choices: Settings → More settings → Privacy options (personalized ads, analytics, the ad consent form). Withdrawing consent is as easy as giving it and does not affect what was done before.
- Delete your data: Settings → More settings → Delete my data erases your progress and settings on the device. Purchases can be restored afterwards. For any data held by us or a service in section 10, email us; see the support page.
- Under the GDPR you have the right to access, correct, delete or port your data, to restrict or object to its processing, and to withdraw consent at any time. Write to kormocicsaba@gmail.com; we answer within one month.
- You can complain to a data protection authority. In Romania this is the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, dataprotection.ro); elsewhere in the EEA, the authority where you live.
8. Security
Data is sent over encrypted connections. No method is perfectly secure, but we take reasonable steps to protect your information.
9. Changes
We may update this policy, for example when we add a service to section 10. The date at the top shows the latest version. If a change is significant we will tell you in the Game.
10. Services the Game uses
- Unity (Unity Technologies), the engine the Game is built with. The engine may send basic device and performance data to Unity. Unity's privacy policy.
- Google Play and the App Store, for downloads and purchases. Google, Apple.
- Netlify, which hosts the web version of the Game, and Cloudflare, which hosts these pages. Each processes your IP address to deliver them. Netlify's privacy policy, Cloudflare's privacy policy.
- Google Firebase (Google Ireland Limited), in the Android version: Crashlytics for crash and error reports, Google Analytics for Firebase for gameplay analytics (only if you are 16 or older and agree; it is switched off otherwise, and turned off again with its data reset if you withdraw), and Remote Config, which downloads game settings such as ad pacing and prices. Firebase uses a random installation ID, your device model, OS version and IP address. We have turned off Google's data sharing, and the analytics data is not used for advertising. Firebase privacy information, Google's privacy policy.
- Google AdMob (Google Ireland Limited), in the Android version, which chooses and shows the ads, and Google's User Messaging Platform, the consent form. Only for players 16 and over. AdMob uses your advertising identifier (unless you reset or delete it), your IP address, device and app information, and how you interact with ads, to show ads, measure them and prevent fraud; it personalizes them only if you agree. How Google uses information from apps that use its services, Google's privacy policy.
- Unity Ads (Unity Technologies), an ad network that offers ads through AdMob, under the same rules and your same choices. Only for players 16 and over. Unity Ads uses your advertising identifier (where allowed), its own user and session identifiers, your IP address (for approximate location), device and app diagnostics, how you interact with its ads, and your in-app purchase history, to show ads, measure them and prevent fraud; it personalizes them only if you agree. Unity's privacy policy.
If we add another ad network, it will be named here, with a link to its privacy policy, before an update that uses it reaches you.
11. Contact
Cinnamon Paws Studio (Csaba Körmöci), Aleea Carpati 31B, 540318 Targu Mures, Mures county, Romania. kormocicsaba@gmail.com.