Your progress.
Your choices.

The short version

You can play without Apple sign-in and without sharing optional play stats. Your game is saved on your device. Online rankings use a separate, pseudonymous profile. Purchases are handled by Apple and RevenueCat. Optional rewarded ads use Google AdMob.

Our play stats are designed to be anonymous, but not everything in the app is anonymous. A nickname, an Apple-linked profile, a friendship, a purchase record or an email to support can relate to you. This policy separates those things so you can make an informed choice.

We do not sell your personal data. We do not use the optional play-stat system to follow you across apps or build advertising profiles. Advertising providers process their own data separately, as described below.

Who is responsible

Combo Kingdom! is made and operated by Lifthill Studio / Thomas Geelens in the Netherlands, KVK 83559752. We are responsible for the personal data we process to run the game. Contact hello@lifthill.studio for support, privacy questions or requests about your data.

This policy covers the Combo Kingdom! app and its pages at lifthill.studio/combokingdom. Third-party stores, advertising services and music links have their own policies.

What you choose, and what you agree to

• Ordinary play: does not require Apple sign-in or consent to optional play stats. Local storage and essential service requests let us save the game, verify scores and provide purchases.
• Share anonymous play stats: is off until you choose to share. Saying yes covers the daily totals and temporary live-play signals described below. You can say no and still play and buy the same content.
• Apple sign-in: is a separate, optional action to recover your online profile, choose a nickname and add friends. It is not permission for optional analytics.
• Ads: rewarded ads are your choice. The ad consent interface, where required, explains the providers and choices for advertising. Watching an ad or accepting the game’s terms is not the same as choosing to share our play stats.
• Purchases: require confirmation through Apple. Game access and purchase verification do not depend on play-stat consent.

The terms of use explain the rules of the game. Reading this policy or accepting those terms does not automatically turn on optional statistics or advertising consent.

What stays on your device

Your device stores your current rounds, scores, collections, lifetime merges and heroes, selected scenery, tutorial history, sound and motion settings, music preferences, privacy choice and cached purchase access. It also holds the sign-in credentials needed for your online profile and any gameplay submissions waiting to sync.

For optional statistics, the device remembers whether this is its first day of use or play and whether it has already counted today. It sends only the resulting counts or broad age category, not a permanent installation identifier. Reinstalling or clearing local data can count as a new installation.

Local progress is not a complete cloud save. Apple sign-in recovers the online profile; it does not promise to restore every local round or collection to another phone. Device backups may separately retain or restore local data.

The app does not request your contacts, photos, microphone or precise GPS location. You choose when to share a friend code using the device’s share menu.

Optional daily play stats

If you switch on Share anonymous play stats, the app sends small batches of structured counts to our game service on Cloudflare. These help us understand what people enjoy, find friction and improve worlds, music, purchases and voluntary ad upgrades.

The counts cover:

• App opens and time in the foreground, first-time and daily use, and broad return categories such as the next day or within a week.
• Worlds entered, time in a world and time actually playing a table; first-time and daily playing installations.
• How a run ended, its duration, merges and heroes, its game variant and a rough score range such as under 1,000 or under 10,000. These stats do not contain the exact leaderboard score.
• Songs played or skipped, and taps to open Spotify, Apple Music or YouTube.
• Purchase offers viewed; purchase and restore requests and outcomes such as completed, cancelled, pending or failed. These counts do not contain a receipt or payment details.
• Upgrade choices, whether they used in-run Bucks or an ad, and ad requests and outcomes such as rewarded, cancelled or unavailable.

Each report identifies the game, its test or release channel, the relevant world, song, upgrade or product, and the UTC calendar day. Daily reports contain no name, email, account ID, friend code, purchase ID, device ID, advertising ID or persistent installation ID. They contain no free-text messages and no time of day.

The server adds the reports to daily totals and does not keep the individual event records in the statistics database. A random identifier for each delivery is hashed and temporarily retained to prevent retries counting twice. That identifier belongs to a batch, not to a player. Reports waiting offline expire after seven days; duplicate-delivery receipts expire after about nine days and are removed by scheduled cleanup.

The studio sees totals such as “how much was this world played today?” It cannot use this statistics system to look up a named person’s play history. Daily player counts estimate installations, not identified people, and cannot establish a unique audience across multiple days.

A temporary “playing now” count

The same optional play-stat choice also enables a separate live signal while you are actively playing a table. It lets our private studio dashboard count active players and worlds. There is no public list of who is playing.

The app creates a random value held only in memory. It sends that value, the game/build channel, world, a sequence number and whether play is active. The server stores only a hash of that random value with the current world and an expiry. It is not joined to an account, friend list, purchase, device identifier or daily-stat history.

A signal is sent about every 30 seconds during active play. Menus, pauses, celebrations and the background do not count as active play. Leaving or pausing sends a stop when possible. Without another update, a signal expires after 90 seconds and scheduled cleanup removes it within the following minute. There is no personal activity timeline and no offline queue for live signals.

Even a temporary hash is an identifier for that short-lived connection; we do not describe it as “no data at all.” It exists only long enough to count active tables reliably.

Your online profile, rankings and friends

When online services are available, the app creates a guest profile with an opaque player identifier, generated nickname and authentication token. The service stores a hash of the token. To keep rankings fair, it receives gameplay actions and results, game version, run identifiers and timestamps and replays the run to verify it. It keeps per-world scores, merges, heroes and other profile/progression records needed for the rankings.

This is pseudonymous account data, separate from optional play stats. It can be connected to the same profile over time. Turning off play stats does not turn off the online profile, score verification, purchases or security requests.

Apple sign-in supplies an app-specific Apple identifier and verification proofs. The app does not request your Apple name or email address and never receives your Apple password. A linked player can choose a public nickname once. Your nickname, verified scores, ranking and collection counts are visible to other players. A verified Kingdom Pass owner can also display a public owner badge.

Friend codes, requests, accepted friendships, blocks and name reports are stored to operate and moderate social features. Requests must be accepted. We do not upload your address book. Use the in-app options to remove or block someone or report a name.

Purchases and Kingdom Pass ownership

Apple processes payments. RevenueCat helps us verify and restore access using an app-specific customer identifier, product and transaction information, purchase history and entitlement status. We do not receive your full card number or Apple password. Prices are shown by the App Store before purchase.

To show a trustworthy public Kingdom Pass badge, our service verifies the associated RevenueCat customer and lifetime entitlement and binds the verified ownership to your online profile. This purchase-verification data is separate from optional anonymous purchase counts.

Purchase records may need to remain available for the lifetime of an unlock, restores, refunds and legal obligations. Deleting your online profile does not cancel or erase your App Store purchases or the records Apple and RevenueCat need to manage them.

Optional rewarded ads

You can choose a rewarded ad for an in-run upgrade. Google AdMob and the partners shown in its consent interface handle the advertising. After the ad system is permitted to request ads, it may preload one so it is ready when requested. An ad is shown only after you choose it.

Advertising requests can involve an IP address and approximate location inferred from it, app/device or advertising identifiers where permitted, device and diagnostic information, ad interactions and consent choices. Which processing is permitted depends on your region, consent, iOS settings and the providers involved. This is separate from our own anonymous daily totals.

Where required, the ad consent form appears before an ad request. Declining a choice does not prevent ordinary gameplay; limited ads may still be available where permitted. Reopen Ad privacy choices in Settings when the ad service makes that option available. Your operating system’s tracking restrictions also apply.

Read Google’s privacy policy, its partner-app data explanation and the Mobile Ads SDK data disclosure. Turning off our play stats does not change your separate ad consent.

Why we process data and who receives it

We use necessary account, gameplay and purchase data to provide the features you use. Security, abuse prevention and support rely on our legitimate interests in keeping the service safe and answering requests. Optional play stats and advertising processing requiring permission rely on consent. Some records may be needed to meet legal obligations.

• Apple: app distribution, payments and optional sign-in. Apple privacy policy.
• RevenueCat: purchase verification, access and restoration. RevenueCat privacy information.
• Google AdMob and disclosed ad partners: optional ads, fraud prevention and related measurement under the choices available in the consent form.
• Cloudflare: hosting the game API, profiles, verified rankings and optional statistics. Cloudflare privacy policy.
• Vercel: hosting these website pages. These Combo Kingdom pages do not load our site’s optional analytics widget. Hosting providers still receive connection information needed to deliver and protect a page. Vercel privacy policy.

Network services necessarily receive connection information such as your IP address. Our API uses it to limit abuse, separately from the daily-stat counters. Hosting and security providers may process technical request/error logs, including request times. The “no time of day” statement above applies to the daily play-stat reports, not all internet infrastructure.

We use service-provider agreements and applicable data-protection safeguards for processing on our behalf. Providers may process data outside your country or the European Economic Area. Where required, transfers rely on applicable safeguards such as adequacy decisions or standard contractual clauses. Contact us for information about the arrangements relevant to your data.

If you email support, we receive your email address and what you include. We use it to answer the request. Music and other external links open the service you choose, whose own policy applies. Please do not send passwords, sign-in tokens or full payment details.

How long information is kept

• Local progress and preferences: until removed from the device; system backups may retain copies.
• Unsent optional stats: up to seven days, or until you turn sharing off. Turning it off clears the waiting queue.
• Live presence: expires after 90 seconds without an update; deleted within the following minute.
• Delivery receipts: about nine days, followed by scheduled cleanup. They cannot identify a player.
• Daily statistical totals: may be retained to compare long-term trends. They cannot be separated into an individual person’s history.
• Online account and game records: while needed to provide the profile and verified rankings, or until you delete the account. Expired sessions, temporary sign-in challenges and unused run tickets are cleaned up periodically.
• Purchase, support and security records: for the period needed for restoration, handling the request, preventing abuse and applicable obligations. Providers may have their own retention schedules; protected recovery copies may expire later than live records.

Change your mind or delete your account

Open Settings → Privacy → Share anonymous play stats to stop optional stats at any time. New reports stop and unsent reports are cleared. An already received live signal expires automatically. Totals already combined with everyone else’s cannot be looked up, exported or removed as “your” stats because the statistics system has no link back to you.

Open Settings → Your profile → Account options → Delete online account to delete a guest or Apple-linked online account and its associated profile, score and social records. Apple-linked deletion asks you to verify with Apple and revokes the associated sign-in authorization. This does not erase local game progress or App Store purchases. Signing out alone does not delete the online account.

For other personal data, email us to request access, correction, deletion, portability, restriction or objection where applicable. We may need reasonable information to verify the request. A legal retention requirement may limit deletion; we will explain any relevant exception. Withdrawing consent does not change processing that was lawful before you withdrew it.

You can complain to your local data-protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

Parents, security and policy changes

The game’s App Store age rating and parental controls apply. Parents or guardians with a question about a child’s information can contact us. We will review the request and remove information where required.

We use protected connections, access controls and server-side verification. No internet service can guarantee perfect security. Access to the studio dashboard is restricted; its activity charts show totals, not a public player directory.

We update this policy when our practices change and show the revision date. For a material change that needs new consent or notice, we will ask or inform you as required.