FLUX privacy policy

Last updated: 1 October 2026. This notice covers FLUX puzzle (Android package com.playflux.puzzle) and greatoysbg.eu.

1. Who is responsible

GREAT TOYS LTD, established in Bulgaria, is the controller responsible for the personal data we process for FLUX. Contact us for privacy questions or rights requests using either address below.

GREAT TOYS LTD
VAT number: BG206545664
34A Danail Nikolaev Blvd, floor 6, apartment 16
Sofia 1527, Bulgaria
Email: greatoysbg@gmail.com

We have not appointed a data-protection officer. Our business email is the privacy contact; it is monitored for support and data-rights requests.

2. Information and purposes

Playing on your phone

FLUX saves your puzzle position, move history, progress, earned hints, theme, settings and age-band choice locally. We do not receive your date of birth. This information supports play, Undo and restarting after closing the app. Clearing app data or uninstalling can remove it. Signing in restores paid hint entitlements; it does not synchronise campaign progress between phones.

Accounts and paid hints

An account is optional for playing and required for buying or restoring paid hints. Firebase Authentication receives your email, account ID, provider, verification status and authentication information. Google sign-in can also supply a name and profile-image reference to Firebase. We do not use your account profile for advertising. Firebase handles passwords; our wallet server does not store them.

Google Play handles payments. We do not receive your full card details. Our purchase service processes your account ID, a derived purchase-account identifier, product, purchase token, order reference, quantity, status and paid entitlements. To avoid charging twice for the same hint, it stores a request identifier, a hashed puzzle-state reference, hint cost and timestamp. It receives authenticated requests and IP addresses to deliver hints, verify purchases, restore entitlements, process refunds and prevent abuse. The hashed references and purchase tokens are still treated as personal data, not anonymous data.

Optional reporting

With gameplay analytics enabled, Firebase Analytics receives installation and device identifiers, app and operating-system information, IP-derived approximate region, and events such as level starts/completions, moves, play duration, hint use and video outcomes. With crash reporting enabled, Crashlytics receives errors, stack traces, installation identifiers, device details, app version and diagnostic context such as the current level. These reports help us improve puzzles and diagnose faults. FLUX does not attach your account email or sign-in ID to these reports. Advertising personalisation through gameplay analytics is disabled.

Videos and advertising choices

Rewarded videos use Unity LevelPlay and Unity Ads. Their SDKs can process IP address and approximate location, advertising/device/installation identifiers, device and app details, ad interactions, diagnostic information and purchase-related information described in their disclosures. They use these for ad delivery, measurement, rewards, security and fraud prevention. Earlier test builds can permit advertising profiling through consent choices. From the revised 1.0.1 release (build 18), FLUX requests non-behavioural advertising treatment for all players and opts out of advertising device-ID use. This restriction is separate from consent; non-personalised or limited ads can still process technical data.

Google’s User Messaging Platform manages regional advertising choices and consent signals. Consent-related technical information is processed to determine and save applicable choices. FLUX requests advertising when you request a video; it does not automatically play ads. Advertising providers may act as separate controllers for their own advertising and fraud-prevention purposes. Their notices and rights channels appear below.

Support and website security

When you contact us, we receive your email, message and any attachments you choose to send. We use them to answer your request. Please avoid passwords, sign-in codes and card details. Website and API access/error logs can contain IP addresses, requested paths, browser details and timestamps for operation and security. Our website has no analytics scripts, advertising pixels or tracking cookies.

Information comes from you, your device, and the services you use: Google sign-in supplies authentication/profile information; Google Play supplies transaction verification; advertising SDKs supply delivery and reward events. We do not request precise GPS location, contacts, microphone access or your photo library for gameplay.

3. GDPR legal bases

• Consent (Article 6(1)(a)): optional gameplay analytics and crash reports; advertising personalisation and non-essential advertising storage/access where consent is required. Choosing a video is not blanket consent.
• Contract (Article 6(1)(b)): account services you request, purchase verification, delivering and restoring paid hints, and related transaction support.
• Legitimate interests (Article 6(1)(f)): essential website/service security, preventing duplicate rewards and fraud, and responding to general enquiries. Our interests are operating a secure game and resolving requests, balanced against your rights.
• Legal obligation (Article 6(1)(c)): applicable accounting records, legally required disclosures and handling statutory data-rights requests.

Device-storage/access rules apply separately from GDPR legal bases. We request required consent rather than treating an advertising provider’s commercial interest as permission for tracking.

4. Choices and required information

In the game’s privacy settings you can turn gameplay analytics and crash reports on or off separately, and open advertising privacy choices. Refusing optional reporting does not stop you playing. Withdrawal stops future optional collection; it does not undo processing that was lawful before withdrawal or automatically erase earlier records. For earlier records, contact us.

We need authentication and transaction data to provide an account or paid hints; without them you can continue playing as a guest. We need sufficient information to verify a privacy request securely. We do not use automated decision-making with legal or similarly significant effects. Automated purchase checks verify payment and prevent duplicate grants; advertising profiling is described above.

5. Recipients and international transfers

Authorised personnel and service providers receive information only for the purposes described. Firebase supplies authentication, analytics and diagnostics; Google Play supplies billing; Google supplies sign-in and the consent platform; Unity supplies mediation and ads; Amazon Web Services hosts our website and wallet service in Frankfurt, Germany. Our support inbox is hosted by Gmail. Authorities or professional advisers may receive records when required by law or necessary to resolve a legal claim. We do not trade players’ account details or sell our player database.

Hosting the wallet in Germany does not keep all data inside the EEA. Firebase Authentication operates in the United States; other Google and Unity services can process data internationally. Relevant provider terms use EU Standard Contractual Clauses and, where applicable, recognised adequacy mechanisms. You can request information or a copy of applicable safeguards from us, with confidential details redacted where necessary.

• Firebase data types, retention and locations and Firebase processing terms and transfer safeguards.
• Google privacy notice and Google advertising/Analytics processing terms.
• Unity’s Game Player and App User Privacy Policy, including profiling, retention, transfers and requests.
• AWS GDPR and processing safeguards.

Google and Unity also process some data independently under their notices. We will help identify the relevant controller when you make a request; this does not remove our responsibility for processing we control.

6. How long information remains

• Local game data and age choice: until you clear app data, uninstall or replace it through gameplay/settings.
• Active account and wallet: while the account exists and information is needed to provide paid entitlements, including unlimited hints. Deletion removes the active account, balances and hint-request history. Firebase retains security IP logs for a few weeks; after account deletion its removal from live and backup systems can take up to 180 days.
• Retained receipts after account deletion: settled purchase records are detached from the active account and retained for disputes, refunds and duplicate-purchase prevention, no later than 24 months after their purchase timestamp. They are restricted, remain personal data, and are not used for gameplay or advertising. Separate statutory accounting documents or specific legal-claim records can require longer retention; we explain any applicable exception in our response.
• Our wallet recovery backups: rolling daily backups expire after 30 days. They are restricted to recovery use; a restored copy must have completed erasures reapplied before use.
• Analytics: identifiable event and user retention is configured to 14 months, without resetting user retention on new activity. This supports annual comparisons of progression, returning-player behaviour and hint conversion, including the effects of game updates. Google’s change takes effect after 24 hours and expiry runs monthly. Standard aggregate reports are outside that expiry setting.
• Crash reports: Crashlytics retains crash data and associated identifiers for 90 days before beginning removal from live and backup systems.
• Website access/error logs: daily rotation with 14 previous files, normally about 15 days. Relevant incident extracts may be kept until an investigation or legal claim is resolved.
• Support and privacy correspondence: normally up to 12 months after resolution; a minimal record of a rights request may be kept to demonstrate our response. A specific dispute or legal obligation can justify longer retention.
• Ad-provider records: Unity and Google use their own retention criteria for delivery, measurement, fraud, legal obligations and claims, as described in their notices. We cannot promise their independent records are deleted on the same schedule as our wallet.

7. Delete an account or particular data

Use our deletion page or email greatoysbg@gmail.com. You may request deletion of particular information without closing your account, subject to information needed for an active entitlement or another lawful exception. You do not need to buy anything or reinstall the game.

For an account, write from the associated email if possible. We verify ownership before removal. Deletion removes paid balances and unlimited-hint access from the active wallet; these cannot be transferred automatically to a new account. It does not delete your Google account or itself refund a Google Play payment. Ask us about any unresolved purchase before deleting.

Uninstalling does not delete a server account. We cannot remotely erase local phone data. Analytics and advertising installation identifiers are not the same as your account ID; if you request their deletion, we may need limited device/installation information to locate records or assist with a provider request.

8. Your rights and complaints

Under GDPR, where applicable, you can ask to access and correct data, erase it, restrict processing, receive a portable copy of eligible data, or object to processing based on legitimate interests. You may withdraw consent at any time. We provide the same email route to all players and honour applicable local rights.

Send your request to our privacy email or postal address. No special wording is required. Requests are normally free. We respond without undue delay and within one month of receipt. For a complex or numerous request, an extension of up to two further months can apply; we explain it within the first month. We ask only for proportionate ownership checks, never your password. If we cannot fulfil part of a request, we explain the reason and your complaint options.

You can complain without contacting us first to your local supervisory authority, including Bulgaria’s Commission for Personal Data Protection (CPDP), or the authority where you live, work or believe an infringement occurred. Judicial remedies remain available.

9. Younger players

FLUX is intended for players aged 13 and older, rather than children under 13. From version 1.0.1, the app asks for an age group before account setup. A player who selects “Under 16” can play local puzzles and earn hints by completing levels, but cannot use accounts, purchases, rewarded videos or optional reporting. The choice is stored on the phone; we do not collect a birthday or verify identity documents. Selecting “16 or older” enables eligibility, not automatic consent to reports or advertising storage/access. The revised release requests contextual ads for everyone, including adults.

We do not provide a parental-consent registration process for under-16 online features. Younger players should not enter an older age group. Players under the age of legal adulthood should obtain a parent or guardian’s permission for purchases as required by local law. If you believe a child has supplied account or other personal data, contact us so we can investigate, stop inappropriate processing and address deletion.

10. Security and changes

We use HTTPS, restricted administrative access and protected wallet storage/backups. Security measures reduce risk but cannot guarantee that any system is completely secure. Where required, we notify the authority and affected people of a personal-data breach.

We update this notice when practices change and show the date above. Changes requiring new consent are presented before the relevant processing. Questions can be sent to our privacy contact.