Nooli — Privacy Policy

1. Who we are

Nooli is a mobile game for players 13+ and their families, published by an independent developer. For any privacy question or request, contact us at ahmedrali2@gmail.com.

2. What we collect (and what we never do)

When you play Nooli, the game creates a random anonymous ID so your progress is safe on our servers. Attached to that ID we store:

• Game progress — levels cleared, stars, coins, and best scores;
• Round results — the game trusts the results your device reports and our servers store them (within basic sanity limits); rounds are not re-checked on the server;
• An optional country flag you choose — it shows next to your name on the Explorers board. We store only the flag you pick from a list; it is never inferred from your network, SIM card, or location, and you can change or clear it at any time;
• Leaderboard data — your generated name, levels, stars, and chosen flag (if any) are visible to other players;
• Your player code — a 10-character code generated by the game and shown on the Settings screen, used only so we can find your account if you ask us to delete it;
• Device model — to diagnose problems on specific phones;
• Usage analytics (Google Analytics for Firebase) — always on; there is no in-game switch. Events about how the game is played (for example which level you played, whether you won, and coins earned or spent), automatic events such as sessions, an app-instance ID, your account ID, and a few profile facts: the country flag you picked (blank if you picked none), the chapter you have reached, a rough coin balance, whether you have linked a Google account, and which version of the game's downloadable levels and artwork you have. We use it to tune difficulty and catch problems. It is linked to your account ID (the random ID, never your name or email). We never send your email address or real name to analytics. Analytics does not read your device's advertising ID. Ad revenue from Google AdMob is combined with this game analytics so we can see which parts of the game earn (section 5);
• Approximate location — Google Analytics derives your country and region (state or province) from your IP address. We collect the country and region, never city or precise location; we turn off its granular location and device data collection, and we use location for nothing else;
• Crash reports (Firebase Crashlytics) — always on. Device and app state at the moment of a crash, including which screen and level were open, linked to your account ID and your game-generated explorer name; never your real name, player code, or email. Used only to fix bugs.

If you sign in with Google, we also store the backup details in section 4. This list covers the data attached to your ID; sections 4, 5 and 9 cover the advertising and analytics identifiers our SDKs handle separately.

We never collect: your real name (except the Google-account name in section 4, if you choose Google sign-in), address, phone number, contacts, photos, microphone or camera access, the advertising ID for personalized ads, or any free-form text — the game has no text input anywhere.

3. Explorer names

Every player receives an automatically generated name (for example, SnugQuokka336847). Names are produced by the game from a fixed child-safe word list. It is impossible to enter a real name or any personal information into Nooli.

4. Optional Google sign-in

Signing in with Google is entirely optional and only used to back up progress if you change or reset your device. If you choose it, we use your Google account solely to identify your backup. Your email address appears to you, masked (for example j•••@gmail.com), on the game's Settings screen — it is never shown in full, never shown to other players, and never used for marketing. Our sign-in provider (Firebase Authentication) also keeps your Google account's name and profile-picture link on your account record; the game never reads, shows or shares them, and they are deleted with your account (section 8).

5. Ads

Nooli may show ads served by Google AdMob. Every ad request is flagged for teen age-restricted treatment, which means no personalized advertising, and restricted to PG-rated content or milder. Ads appear only at calm moments: an optional rewarded ad you choose to watch in exchange for an in-game benefit, or a short ad between levels on the way back to the map — never inside a round. The ad SDK may still collect an app set ID and may read your device's IP address to estimate an approximate location, to serve and measure ads — never for personalization. The app declares access to the Android advertising ID because the ad SDK uses it; it is sent to Google with ad requests, which Google uses for advertising (not personalized), analytics and fraud prevention; in the EU/EEA, UK and Switzerland ads run in limited mode, which does not use device identifiers for ads. Google Analytics itself is set not to read it. Ad revenue (how much an ad earned, its format and country) is passed from AdMob to Google Analytics and combined with our game analytics, so we can understand which parts of the game earn. The ad SDK also collects basic app-interaction and performance data (app launches, taps, ad views, launch time, hang rate), which Google AdMob uses for ad delivery and fraud prevention — as declared in the Play Store's Data safety section.

6. Age and children's privacy

Nooli is intended for players age 13 and up and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected data from a child under 13, we will delete it — contact us at ahmedrali2@gmail.com and we will remove it and confirm by reply, the same path as Deleting your data (section 8). The game collects only persistent identifiers (your random account ID, your player code, the analytics app-instance ID, and — while the ad SDK is active — an advertising identifier and app set ID) and game data (progress, round results, usage analytics, crash reports, device model and diagnostics, your game-generated explorer name, the country flag you chose if any, and an approximate location — country and region — derived from your IP address by Google Analytics and the ad SDK). We use these for: saving progress, understanding how the game is played, diagnosing problems, and serving and measuring ads. Every ad request is made with teen treatment, PG-rated, non-personalized settings (section 5). We never ask anyone for a name, contact details, or any free-form text. An email address, and the Google account's name and profile-picture link, are collected only if you choose to sign in with Google to back up progress (section 4). We do not sell this data.

7. Sharing and storage

Your data is stored on Google's secure cloud infrastructure (Firebase) on our behalf. The only service providers involved are Google Firebase (authentication, database, Cloud Functions, Cloud Storage for the game's downloadable artwork, which holds no player data, App Check / Play Integrity, Analytics, Crashlytics, and hosting) and Google AdMob (ads). For ad serving and measurement, Google acts as an independent controller of the data its ad SDK collects; see how Google uses information from sites or apps that use its services. We do not sell, rent, or share your data with any other party for any purpose.

8. Deleting your data

You can erase all stored progress at any time: uninstalling the app removes it from your device, and you can ask us to erase the server copy as well — just email ahmedrali2@gmail.com from the address linked to the game, or with your device's player code (shown in the game's Settings screen). We will confirm by reply once your game data is erased and the Analytics and Crashlytics deletion requests are filed; Google completes them within about two months. This covers your game data and your analytics and crash data linked to your account ID: we ask Google Analytics to delete the events for your ID, and we ask Firebase support to delete your crash records, which otherwise expire on their own after about 90 days. A few events recorded before the game created your account ID carry only an anonymous app-instance ID that we cannot match to you; those expire after 14 months.

9. Your rights & retention

You can ask us, by email, at any time, to:

• access or export a copy of the data attached to your account;
• correct inaccurate data (there is little to correct — your flag is chosen by you and your explorer name is picked by the game, and you can reroll it in the app);
• object to, or ask us to restrict, how we use your data. For analytics and crash data, objecting means we delete that data (section 8); the game cannot stop sending new usage and crash data while it is in use — uninstalling the game stops it;
• delete (erase) your account and its data — see Deleting your data (section 8).

Legal basis: we process gameplay data under our contract with you to provide the game, and diagnostic data (crash reports, analytics) under our legitimate interest in keeping Nooli working well. In the EU/EEA, UK, and Switzerland, the ad consent request is marked as coming from someone under the age of digital consent, so no consent prompt is shown there, and ad requests carry teen age-restricted treatment; ads in those regions are served in a limited, non-personalized mode automatically, on our legitimate interest in keeping ads limited and non-personalized there. In the US, ad requests also carry Google's restricted data processing signal, which limits how Google uses data for ads under US state privacy laws (such as California's); US state-law rights are exercised through the email requests above. Firebase Analytics is set to collect no advertising identifier, no Android ID and no ad-personalization signals for anyone. Analytics and crash reports are always on and there is no opt-out in the game; we rely on our legitimate interest for them, and you can object (which means we delete the data, section 8) or ask us to delete it at any time. If you are in the EU/EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data-protection supervisory authority.

International transfers: your data is processed on Google Cloud infrastructure, which may be located outside your country; where required, transfers rely on the EU Standard Contractual Clauses.

Retention: we keep game progress, leaderboard data, and your Google-linked progress backup (if any) for as long as your account exists — including an account created but never deleted after the app is uninstalled; deleting your data under section 8 removes it, including that backup. Usage-analytics events are kept for 14 months in Google Analytics; Crashlytics crash reports are kept for about 90 days. Both are linked to your account ID, so a deletion request under section 8 covers them. The database keeps a rolling 7-day recovery history so we can undo mistakes; data you delete leaves that history within 7 days.

10. Changes to this policy

If we change this policy, the new version will appear on this page with a new effective date.