Privacy Policy
How HYLVYN collects, uses, protects and handles information in our mobile games and applications.
1. Introduction and Scope
This Privacy Policy explains how HYLVYN ("we," "us," or "our") collects, uses, protects, and handles information when you use our mobile games and applications ("Apps") available on the Google Play Store, Apple App Store, and other platforms. HYLVYN, based in Belgium, is the data controller for the processing described in this policy. By downloading, accessing, or using our Apps, you agree to the practices described here.
At HYLVYN, we build our applications on a foundation of Privacy by Design and Data Minimization. Our core philosophy is to process as much data as possible locally on your device, avoiding unnecessary server-side collection of personal information.
This policy covers all current and future HYLVYN Apps. Some sections describe features (such as accounts, online services, user-generated content or AI features) that only apply to the specific Apps that actually contain those features; where a feature is absent from an App, the corresponding processing does not take place.
2. Data Collection: What We Collect and How
HYLVYN itself collects no data about you. Our Apps do not require you to create an account, and we do not ask for your name, email address, physical address, or phone number. We operate no servers, and no information about you is ever sent to us.
The technical and advertising data described in Section 2.2 is collected by third-party SDKs and transmitted directly to those providers — principally Google — who process and retain it under their own policies. We never receive a copy of it and cannot access it. Under Google Play's data disclosure rules this collection is nevertheless attributed to the App, and it is declared in each App's Data safety section.
2.1. Local Game Data (Zero-Party Data)
Game progress, including scores, unlocked content, in-game currency, settings, and user preferences, is stored strictly locally on your device's internal storage within the App's secure sandbox. This data is never transmitted to our external servers.
2.2. Automatically Collected Technical Information
To ensure our Apps function correctly, debug crashes, and serve advertisements, we integrate specific trusted third-party Software Development Kits (SDKs). These third parties may automatically collect:
- Device Information: device model, operating system version, screen resolution, and language settings.
- Identifiers: resettable device advertising identifiers (such as the Google Advertising ID or Apple IDFA) and app-instance diagnostic IDs.
- Network Data: IP address (used for approximate, city-level localization and ad delivery) and network connection type.
- App Interactions: in-app events such as app launches, taps, session length, and advertisement impressions or video views.
- Diagnostics: crash logs, launch time, hang rate, and energy usage, used to keep the Apps stable and performant.
These categories match the disclosures we make in the Google Play Data safety section and the Apple App Privacy label of each App.
3. Sensitive Device Permissions and Prominent Disclosures
In accordance with platform guidelines (the Google Play Developer Policies and Apple App Store Review Guidelines), our Apps request access to sensitive device hardware or data only when strictly necessary for a core gameplay feature, and never in the background without your knowledge. Any permission listed below is only present in an App that actually uses that feature.
Prominent Disclosure and Consent: before an App requests a sensitive permission through the operating system dialog, we present a prominent in-app disclosure explaining exactly why the permission is needed and how the data will be used. You must provide affirmative consent before the system prompt appears.
| Requested Permission | Purpose and Data Handling (Local Processing Only) |
|---|---|
| Camera & Photos | Used exclusively for Augmented Reality (AR) mechanics or custom avatars. The camera feed is processed in real-time on the device and is never recorded, transmitted, or stored on our servers. |
| Microphone / Audio | Used for voice-activated gameplay or ambient sound mechanics. Audio data is analyzed locally on the device in real-time; no recordings are saved or transmitted. |
| Physical Activity / Pedometer | Used to integrate real-world movement (e.g., step counts) into game progress. This health/fitness data is strictly local and powers specific game mechanics without leaving your device. Where an App reads such data through Android Health Connect, we access only the data types disclosed at the system prompt and never use them for advertising. |
| Location (Coarse/Fine) | Used transiently for location-based in-game events. We do not track your historical location, and precise coordinates are not stored externally. |
| Notifications | Used only to deliver optional gameplay reminders or event notices you can disable at any time in your device settings. |
4. Advertising, Consent & Third-Party Services
To keep our Apps free and accessible, we use third-party monetization and analytics services. These providers operate under their own privacy policies.
Google AdMob: we use AdMob to serve banner, interstitial, and rewarded video ads. Where legally permissible and with your consent, AdMob may use device identifiers and IP addresses to serve personalized advertisements. Policy: policies.google.com/privacy. You can learn how Google uses data from apps at policies.google.com/technologies/partner-sites.
European Consent (GDPR / Google UMP): in the European Economic Area, the United Kingdom and Switzerland we show a consent dialog powered by a Google-certified Consent Management Platform (the Google User Messaging Platform, integrated with the IAB Transparency & Consent Framework) BEFORE any advertisement is loaded. You may consent, refuse, or choose non-personalized ads, and you can change your choice at any time via the privacy options entry in the App's settings menu.
Apple App Tracking Transparency (ATT): on iOS devices we comply with the App Tracking Transparency framework. Before any third-party SDK (such as AdMob) tracks your activity across other companies' apps and websites for targeted advertising, the standardized iOS ATT prompt requests your permission. If you select "Ask App Not to Track," personalized tracking identifiers (such as the IDFA) are not accessed.
Google Play Billing / Apple In-App Purchases: if you choose to make a purchase, the transaction is handled entirely by Google or Apple, including receipts, taxes and statutory refund rights. HYLVYN never receives, processes, or stores your credit card or financial information.
Crash Reporting & Analytics: certain Apps may additionally use a crash-reporting or analytics service (such as Firebase Crashlytics or Google Analytics for Firebase) to monitor stability and gather aggregated, pseudonymous usage statistics. Where an App uses such a service, this is reflected in that App's Data safety section.
5. Optional Features in Specific Apps
The following features exist only in the specific Apps that offer them:
- Google Play Games Services / Apple Game Center: if an App offers sign-in for achievements, leaderboards, or cloud saves, that sign-in is provided and processed by Google or Apple under their own privacy policies. We receive at most your public player profile (gamer tag and avatar) and the scores or progress you choose to submit.
- User-Generated Content & Chat: if an App allows creating or sharing content or messages, we provide in-app reporting and blocking tools, and we may review or remove content that violates our terms. We do not use such content for advertising.
- AI Features: if an App contains a feature that generates content with artificial intelligence at your request, your prompts are processed only to produce the requested output, offensive output can be reported in-app, and generated content is moderated in line with platform policies. Apps that merely contain pre-made artwork or audio produced with AI tools during development do not process any of your data for AI purposes.
6. Accounts and Account Deletion
Our Apps as published today do not create HYLVYN user accounts. If a future App introduces account creation, that App will provide an in-app path to delete the account and associated data, plus a public web link to request deletion without reinstalling the App, in line with Google Play's account deletion policy; this policy will be updated accordingly.
7. Data Retention and Security
Retention: HYLVYN does not store or retain any user data. We operate no servers that hold personal data, we retain none of the data described in Section 2, and we have no ability to access, restore, or export it. Local game data — including game progress, settings, and any photos you take with an in-app camera feature — is stored only on your device and is retained there for as long as the App is installed; uninstalling the App permanently deletes it, and you can also delete it at any time from within the App or by clearing the App's storage in your device settings. Data collected through the third-party services described in Section 4 is retained by those providers under their own policies, not by us, and typically for no longer than 14 to 24 months, after which it is deleted or anonymized.
Security: because we rely on the operating system's native application sandbox, your local data benefits from device-level encryption. We keep the third-party SDKs we integrate up to date and compliant with platform policies, and we do not operate our own servers holding your personal data.
8. International Data Transfers
While HYLVYN is based in Belgium, the third-party services we use (such as Google) operate globally. Technical data (such as IP addresses and advertising identifiers) may be transferred to and processed in the United States or other countries. These third parties rely on legally valid transfer mechanisms, such as Standard Contractual Clauses (SCCs) or certification under the EU-U.S. Data Privacy Framework.
9. Children's Privacy (COPPA & GDPR-K Compliance)
We are committed to protecting the privacy of children. Many of our Apps are designed to be family-friendly and suitable for a general audience. We do not knowingly collect personal information from children under the age of 13 (or 16 in certain EU jurisdictions).
For Apps that are specifically directed at children, or when we are aware a user is a child, we strictly adhere to the Children's Online Privacy Protection Act (COPPA), Google Play's Families Policy, and the Apple App Store Kids Category requirements. In such cases we configure our advertising networks to serve only non-personalized (contextual) ads, we disable third-party behavioral tracking and profiling, we do not transmit the advertising identifier, and we restrict the use of APIs or SDKs not approved for child-directed services.
Parents can manage or revoke device permissions and purchase settings via their device's native parental controls (e.g., Google Family Link or Apple Screen Time).
10. Your Global Privacy Rights
10.1. European Economic Area (GDPR) and UK
Under the General Data Protection Regulation (GDPR) and UK GDPR, we rely on Consent (for personalized advertising and sensitive permissions) and Legitimate Interest (for basic app functionality, security and crash reporting) as our lawful bases for processing. You possess the following rights:
- Right to Access & Portability: request details of the data processed. As we hold no server-side personal data, such requests are typically fulfilled by the third parties listed above; we will assist you in directing your request.
- Right to Erasure: achieved by uninstalling the App and resetting your device Advertising ID; for third-party data you may additionally contact us and we will assist.
- Right to Withdraw Consent: revoke consent for personalized ads at any time via the in-app privacy options (Google UMP) or your device settings; revoke sensor permissions via your device's settings.
- Right to Object and to Restriction of processing based on legitimate interest.
- Right to Lodge a Complaint with your local Data Protection Authority (for Belgium: the Gegevensbeschermingsautoriteit / Autorité de protection des données, www.dataprotectionauthority.be).
10.2. California and USA Residents (CCPA / CPRA)
The California Consumer Privacy Act (CCPA), as amended by the CPRA, grants California residents specific rights. We do not "sell" your personal information for monetary compensation. However, allowing third-party ad networks to collect identifiers for targeted advertising may be considered "sharing" under California law.
- Right to Know & Access: the categories of data collected are outlined in Sections 2 and 3.
- Right to Delete: delete your data by uninstalling the App.
- Right to Opt Out of "Sharing": opt out of cross-context behavioral advertising via your device settings ("Delete advertising ID" / "Opt out of Ads Personalization" on Android, or "Ask App Not to Track" on iOS) or via the in-app privacy options.
- Right to Limit Use of Sensitive Personal Information: we only use sensitive hardware data locally to provide the game service; it is never used to infer characteristics about you.
We do not discriminate against users who exercise their privacy rights.
10.3. Brazil (LGPD)
In accordance with the Lei Geral de Proteção de Dados Pessoais (LGPD), Brazilian users have the right to confirmation of the existence of processing, access to data, correction of incomplete or inaccurate data, and anonymization, blocking, or deletion of unnecessary data.
11. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect technological, legal, or operational changes. The "Last Updated" date at the top of this document will be revised accordingly. For significant material changes regarding data processing, we may provide an in-app notification upon your next launch of the App.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Team at:
HYLVYN (data controller) — Belgium
Email: info@hylvyn.com
We aim to respond to privacy requests within 30 days.