Privacy Policy

Effective as of 2026-09-01

This Privacy Policy applies to the Blocks Bay app for mobile devices, together with any related services operated by Glushko (collectively, the “Application”). Glushko is hereinafter referred to as the “Service Provider”.

Data Controller Information

Glushko acts as the Data Controller responsible for the processing of your personal data.

Name: Glushko
Address: Ukrain Kiev 12
Email: glushkosahr@gmail.com

For data protection inquiries and to exercise your GDPR rights, please contact the Data Controller using the contact information above.

What information does the Application obtain and how is it used?

The Application does not require you to create an account or provide personal information in order to play, and it does not collect user-provided data such as your name or email address through registration. If you contact the Service Provider directly (for example, by email), the information you send is used only to respond to your request and to send you required notices. The Service Provider does not send marketing communications.

What information does the Application collect automatically?

The Application collects certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device’s unique device identifier, the IP address of your mobile device, your mobile operating system, and information about the way you use the Application (in-app events and interactions). This information is collected through Google Analytics for Firebase and Unity Analytics (Unity Technologies), and is used to operate, maintain, secure, and improve the Application.

Unity Analytics additionally collects standard session and device information (such as a Unity-generated installation identifier, session start and length, app version, device model, operating system, language, and approximate region), used to produce aggregate engagement, retention, and device-breakdown reports.

The Application also uses Facebook App Events (Meta Platforms, Inc.) to collect event-level usage and purchase-confirmation data, and your device’s advertising identifier, for advertising campaign measurement. See the "third parties" section below for details.

Legal basis for processing your personal data

Where the GDPR applies, the Service Provider relies on one or more lawful bases to process your personal data, including:

Contract performance: processing necessary to provide the Application or fulfil a contract with you.
Consent: where you have given explicit consent to processing, including for analytics. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
Legitimate interests: where processing is necessary for the Service Provider’s specific legitimate interests, such as maintaining network and information security, preventing fraud and abuse, or improving the Application’s core functionality through analytics, provided those interests are not overridden by your data protection rights or fundamental freedoms.
Legal obligation: to comply with laws or government requests.

Cookies and similar technologies

The Application or its third-party SDKs may use SDKs, device and installation identifiers, and similar technologies to support functionality, analytics, and service delivery. Where required by law, the Service Provider will obtain your consent before using non-essential technologies of this kind.

Automated decision-making and profiling

The Application does not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Does the Application collect precise real-time location information of the device?

This Application does not gather precise information about the location of your mobile device. Approximate location may be inferred from your IP address for analytics and security purposes.

Do third parties see and/or have access to information obtained by the Application?

The Application sends event-level, pseudonymous usage data (associated with a Firebase installation / app-instance identifier and, as noted above, a device identifier) to Google as part of Google Analytics for Firebase, so that the Service Provider can measure and improve the Application. For this integration specifically, advertising storage, ad user data, and ad personalization are disabled, and Google does not receive an advertising identifier through it.

The Application also sends pseudonymous session and device data (associated with a Unity-generated installation identifier) to Unity Technologies as part of Unity Analytics, for the same measurement purpose.

The Application also sends event-level usage data (such as level completions, tutorial completion, and purchase confirmations) to Meta Platforms, Inc. through Facebook App Events, so that the Service Provider can measure and optimize advertising campaigns. This integration does use your device’s advertising identifier for campaign attribution — the Android Advertising ID on Android, or your iOS advertising identifier only if you grant permission through Apple’s App Tracking Transparency prompt.

Data collection by all three providers above begins only after you accept the consent request and can be withdrawn as described below; for Unity Analytics, withdrawal also triggers a request to delete data previously collected from you.

The Application uses third-party services that have their own privacy policies regarding the handling of data. Links to the privacy policies of the third-party service providers used by the Application:

In-app purchases are processed by the Apple App Store or Google Play. The Service Provider does not receive or store your payment card details; it receives confirmation of the product purchased and whether the transaction succeeded.

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena or similar legal process;
when it believes in good faith that disclosure is necessary to protect its rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with trusted service providers who work on its behalf, do not have an independent use of the information disclosed to them, and have agreed to adhere to the rules set forth in this privacy statement.

Where the GDPR applies, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR. These DPAs impose the same data protection obligations on those service providers as described in this Privacy Policy.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data outside the European Economic Area (EEA). Where such transfers occur, the Service Provider will use an appropriate transfer mechanism required by GDPR Chapter V, such as:

adequacy decisions by the European Commission;
Standard Contractual Clauses (SCCs) approved by the European Commission;
other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted.

Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

What are my opt-out rights?

You can stop further collection of information by the Application by uninstalling it. Uninstalling stops the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties. To request deletion of your personal data, withdraw consent, or exercise any of your rights, contact the Service Provider at glushkosahr@gmail.com.

What is the data retention policy and how can you manage your information?

The Service Provider retains personal data based on its necessity for the stated purposes:

Automatically collected analytics data: for Google Analytics for Firebase, retained in accordance with the Application’s Firebase configuration, up to a maximum of 14 months; for Unity Analytics, retained in accordance with Unity’s data-retention settings for the project; for Facebook App Events, retained in accordance with Meta’s own data-retention policies, which are outside the Service Provider’s control. In each case a longer period may apply where required for legal compliance or security purposes.
Data you send to the Service Provider directly (e.g. support correspondence): retained for as long as needed to handle your request and for a reasonable period afterwards, unless a longer period is required by law.
Aggregated and anonymized data: retained indefinitely, as it no longer identifies you.
Data required for legal compliance: retained for as long as required by applicable law.

You have the right to request deletion of your personal data at any time, except where retention is required by law. Contact the Service Provider at glushkosahr@gmail.com and it will respond within the time required by applicable law.

How does the Application address children’s privacy?

The Application is not intended for children under 16 years of age, or where a higher age of digital consent is established under applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them. In the event the Service Provider discovers that a child has provided personal information, it will delete that information from its systems. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (glushkosahr@gmail.com) so that it can take the necessary actions.

How is your information kept secure?

The Service Provider is committed to safeguarding the confidentiality of your information. It implements physical, electronic, and procedural safeguards to protect information it processes and maintains. For example, access is limited to authorized personnel who need that information to operate, develop, or improve the Application. However, no security system can prevent all potential security breaches.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law. Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify you without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address it.

How will you be informed of changes to this Privacy Policy?

The Service Provider may update this Privacy Policy from time to time and will notify you of material changes by posting the updated Privacy Policy with a new effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect. Previous versions will be maintained and made available upon request by contacting the Service Provider at glushkosahr@gmail.com.

Under the GDPR, you have the following rights:

Right of Access: you can request access to your personal data.
Right to Rectification: you can request correction of inaccurate data.
Right to Erasure: you can request deletion of your personal data (the “right to be forgotten”).
Right to Restrict Processing: you can request that the Data Controller limits how it uses your data.
Right to Data Portability: you can request a copy of your data in a structured, commonly used, machine-readable format.
Right to Object: you can object to processing based on legitimate interests.
Right to Withdraw Consent: where processing is based on your consent, you can withdraw it at any time by contacting the Data Controller or by uninstalling the Application.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. Contact details for each country’s authority are available at edpb.ec.europa.eu/about-edpb/members_en. If you are located in the United Kingdom, you may contact the Information Commissioner’s Office at ico.org.uk.

What are your California privacy rights (CCPA/CPRA)?

If you are a resident of California, the CCPA and CPRA provide you with additional rights regarding your personal information:

Right to Know: you can request disclosure of the categories and specific pieces of personal information collected about you.
Right to Delete: you can request deletion of personal information collected from you, subject to certain exceptions.
Right to Correct: you can request correction of inaccurate personal information.
Right to Opt-Out: the Service Provider does not sell your personal information and does not share it for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: the Service Provider does not use sensitive personal information beyond permitted purposes.
Right to Non-Discrimination: the Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise any of these rights, contact the Service Provider at glushkosahr@gmail.com. You may designate an authorized agent to make a request on your behalf.

Where processing is based on consent, you provide that consent by affirmatively opting in when the Application asks you to. You may withdraw consent at any time by contacting the Data Controller or by uninstalling the Application, without affecting processing carried out before withdrawal. Processing based on other lawful bases, including contract performance, legitimate interests, or legal obligations, is carried out as described above.

How can you contact the Data Controller?

If you have any questions regarding privacy while using the Application, or questions about these practices, contact the Service Provider by email at glushkosahr@gmail.com. The Service Provider will respond within one month of receiving your request, extendable by up to two months where necessary due to the complexity or volume of requests, as permitted by applicable law.