Privacy Policy

Pebblock is a block-puzzle game for Android made by AK Puzzle Games ("we", "us"). This policy explains what information the game uses, why, who receives it, how long it's kept, and the choices and rights you have. It includes the notices required in the European Union, the UK and Switzerland, the United States (including COPPA and California), Brazil and India. At launch, Pebblock isn't offered in the EU/EEA, the UK, Brazil, Turkey, Indonesia or Vietnam. We keep the notices for those places here so they apply as soon as the game is.

1. Who we are and how to contact us

Pebblock is published by AK Puzzle Games. We decide why and how your personal data is processed, so in GDPR terms we are the controller.

• Developer: AK Puzzle Games, Adeel Khan
• Postal address: Wah Cantt, Punjab 47040, Pakistan
• Email: support@pebblock.com
• Phone: +92 316 8772645
• EU representative (GDPR Art. 27): to be appointed before Pebblock is available in the EU/EEA
• UK representative (UK GDPR Art. 27): to be appointed before Pebblock is available in the UK
• Privacy contact: Adeel Khan, support@pebblock.com. This person is also our data protection contact under Brazil's LGPD (encarregado), our grievance officer in India, and the person in charge of protecting personal information in Quebec.

Google's roles:

• Firebase: Google is our service provider (processor), under Google's data processing terms.
• Ads: Google is an independent controller under the Google Ads Controller-Controller Data Protection Terms. The ad technology providers listed in the consent form are responsible for their own use of data.
• Google Play and Play Games Services: Google provides them under its own terms and is responsible for your Google Account and Play Games profile.

2. Your age decides how the game handles data

The first time you open Pebblock, before any ads or analytics start, the game asks for your year of birth. There's no default answer and no hint about which answer "works". The game keeps only the resulting age band on your phone and never sends your age anywhere. Google receives only the matching ad setting, for example "treat this request as child-directed".

How we ask for consent:

• EEA, UK and Switzerland: Google's consent form (IAB Transparency & Consent Framework) asks before personalised ads and before analytics. In the UK, analytics may instead run under the statistical-purposes exception, with an opt-out in Settings → Privacy.
• United States: adults get personalised ads unless they opt out with Do Not Sell or Share (Settings → Privacy).
• Everywhere else: one in-game question, with equal "Yes" and "No" buttons, asks whether you want personalised ads. In India, the same question also asks about analytics. Unless you answer "Yes", you get non-personalised ads, and in India analytics stays off.

If you buy Remove Ads, the ads SDK doesn't start at all unless you choose to watch an optional rewarded video.

3. What we collect, why, and on what legal basis

We don't run servers. Information leaves your phone only through the Google services described below, and it's always encrypted in transit (HTTPS/TLS). Your game progress, settings and age band stay on your phone.

3.1 Google AdMob (ads)

The game shows banner ads, full-screen ads between games, and optional rewarded ads that you choose to watch for a bonus. Google's Mobile Ads SDK collects:

• device identifiers (advertising ID, app set ID, and identifiers related to accounts signed in on the device);
• your IP address, which can be used to estimate your general location;
• ad and app interactions, such as app launches, taps and video views;
• diagnostic information, such as app launch time, hang rate and energy usage.

Google uses this to deliver and measure ads and to prevent fraud. It uses it to personalise ads only for adults who allow it (section 2). Ads are limited to content rated PG or lower, and G or PG for under-13s.

• How Google uses information from apps that use its services: policies.google.com/technologies/partner-sites
• How Google uses data for advertising: policies.google.com/technologies/ads
• Your ad preferences: myadcenter.google.com

3.2 Google Analytics for Firebase and Firebase Remote Config

Where analytics is allowed (section 2), Firebase tells us which modes are popular, where players get stuck, and whether ads are shown too often. It collects:

• an app-instance ID and a Firebase installation ID (random IDs for this installation of the game) and your advertising ID;
• app opens, screens, session length, and game events we define (for example a finished game and its score, daily-challenge results, rewards claimed and ads shown);
• purchase events (product, price and currency);
• device model, operating-system version, app version, language, country and time zone;
• approximate location from a masked IP address. The IP address itself isn't stored.

We use analytics only in aggregated reports and to choose settings for groups of players, never to identify you. Google Analytics deletes user-level data after 2 months. Remote Config, which delivers game settings such as difficulty and ad frequency, uses the Firebase installation ID, country and language.

• Firebase privacy and security: firebase.google.com/support/privacy

3.3 Google Play Games Services (optional)

If you're 13 or over and use a Google Play Games profile, the game can sign you in for leaderboards, achievements and cloud save:

• What Google shares with the game: your Play Games player ID, gamer tag and avatar.
• What the game sends to Play Games: your scores, unlocked achievements and saved progress.
• What we don't do: we don't send your player ID or gamer tag to Firebase or anywhere else.
• Who can see it: other players see your leaderboard entries according to your Play Games profile's visibility settings.

You can delete your Play Games data at play.google.com/games/profile or in your Google Account (myaccount.google.com).

3.4 Purchases: Google Play Billing

Google Play processes payments under the Google Play Terms of Service (play.google.com/about/play-terms), and we never receive your card or payment details. Google Play tells the game which product you bought and gives it a purchase token, which the game uses to unlock the item and to restore it after a reinstall (Settings → Restore purchases).

3.5 Unity

Pebblock is built with the Unity engine. Unity's own analytics, crash-reporting and performance-reporting services are switched off. Unity's in-app purchasing library connects the game to Google Play Billing. According to Unity, it processes some technical diagnostic and app-performance data in passing, only to make purchases work, without storing it. Unity's privacy policy: unity.com/legal/privacy-policy

3.6 Invites and challenges (Friend Stars)

From age 13, you can invite friends with a personal link and challenge them to beat your score. When a friend installs Pebblock from your link and plays 5 games over 2 days, you earn a Friend Star, and your friend gets a welcome gift. Rewards are in-game items with no cash value.

• What's stored:
  • a random 6-character invite code;
  • an anonymous Firebase Authentication user ID;
  • for each invited friend: which code invited them, how many games they've played until they qualify, timestamps, and whether they've qualified.
• The install link: when a friend installs from a link, the game reads the Google Play install referrer (the invite code and score) on first launch.
• What's never stored: names, contacts or device IDs. Links go through Android's share sheet, so we never see who you share with.
• When it starts:
  • Your anonymous account and records are created only when you open the invite screen or share your link.
  • If you arrive through a friend's link, the game asks "Let your friend know you joined? They'll earn a Friend Star." with equal Yes and No buttons. You get the welcome gift either way.
  • Only Yes creates your anonymous account and invite record. No sends nothing.
• Why: to give Friend Star rewards. The welcome gift needs no data.
  • Legal basis for the inviter: contract (you opened the feature).
  • Legal basis for the invited friend: consent (you tapped Yes), which you can withdraw at any time with Delete my data.
• Where: Google's Firebase Authentication and Cloud Firestore, as our processor, in the United States (Firestore location nam5). Firebase Authentication also sees your IP address, which it uses to prevent abuse.
• How long:
  • a record is deleted when the inviter collects its reward;
  • a record that never qualifies is removed after 60 days, when either player next opens the game. A small residue can remain only if both players stop playing;
  • either player can delete at any time: Settings → Privacy → Delete my data deletes your invite code, your own invite record, every invite record that points to you, and your anonymous account.
• Under 13: invites are switched off, and the Share button shares a plain link. A child who installs from a friend's link still gets the welcome gift on the phone, but nothing is sent to our database and the inviter isn't credited.

3.7 Providing data isn't required

You're not required by law or by contract to give us personal data, and you can play without an account. Some device data is sent automatically when the game runs (sections 3.1 and 3.2). If you refuse consent, you can still play: you'll see non-personalised or limited ads, and analytics stays off wherever it needs consent.

3.8 Automated decisions

If you consent to personalised ads, Google uses your data to choose ads for you (profiling). We make no decisions based solely on automated processing that have legal or similarly significant effects on you.

4. Who receives your data

• Google (Google LLC and its affiliates, including Google Ireland Limited): AdMob, Firebase (including Firebase Authentication and Cloud Firestore for invites), Google Play and Play Games Services, as described in section 3.
• Ad technology providers that Google AdMob works with and lists in the consent form. They receive data only for adults who consent (EEA, UK, Switzerland and "everywhere else") or who haven't opted out (US).
• Authorities, if the law requires us to disclose information.

We don't sell your personal information for money, and we share it with no one else.

5. International transfers

AK Puzzle Games is based in Pakistan, which has no EU adequacy decision. We don't keep your data on our own systems. Google processes it, mainly in the United States, under the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework (including its UK Extension and the Swiss–US Data Privacy Framework). For users in Brazil, these transfers are made under Article 33 of the LGPD: they're needed to provide the game you asked for, and they're covered by standard contractual clauses.

6. How long we keep data

• On your phone (progress, settings, age band, consent choices): until you use Settings → Privacy → Delete my data, clear the app's storage, or uninstall.
• Google Analytics for Firebase: user-level data for 2 months; aggregated reports longer.
• Firebase installation ID and Remote Config: until you delete the app's data.
• Google AdMob: as set by Google's retention policies (policies.google.com/technologies/retention).
• Play Games: until you delete it in your Play Games profile or Google Account.
• Google Play purchase records: under Google Play's terms, so that you can restore purchases.
• Invites (Firebase Authentication and Cloud Firestore):
  • deleted when the reward is collected;
  • a record that never qualifies is removed after 60 days, when either player next opens the game (a small residue can remain only if both players stop playing);
  • deleted any time with Delete my data, by either player.

  See section 3.6.

• Emails you send us: until your request is resolved, then up to 12 months.
• Children under 13: see section 10.

7. Your choices: Settings → Privacy

Settings → Privacy in the game gives you these controls:

• Privacy options: shows Google's consent form again, so you can change or withdraw your consent. Withdrawing is as easy as giving consent.
• Do Not Sell or Share (US): opts you out of "selling or sharing" for personalised ads. Google then applies restricted data processing: no ads based on your past behaviour, and only non-personalised ad requests.
• Delete my data: deletes your local save and resets your analytics ID, so past analytics data can no longer be linked to you. It also deletes your cloud save in Play Games and, if you used invites, your invite code, your own invite record, every invite record that points to you, and your anonymous account. You can restore purchases afterwards from Google Play.
• Privacy ID: a random ID (your Firebase app-instance ID) that you can copy into an email to us, so we can find your data without an account. If no Privacy ID is shown, no analytics data is linked to your installation.
• Privacy policy: opens this page.

Outside the game:

• Advertising ID: reset or delete it in Android settings (on most phones, Settings → Privacy → Ads, or Settings → Google → Ads). After deletion, apps receive zeros instead of an ID.
• Notifications: turn reminders off in Android settings at any time.

8. Your rights (EEA, UK and Switzerland)

You have the right to:

• access your data and get a copy;
• correct it;
• have it erased;
• restrict its processing;
• receive it in a portable format;
• withdraw consent at any time, in Settings → Privacy → Privacy options, without affecting earlier processing.

Use Settings → Privacy, or email support@pebblock.com with your Privacy ID. We answer within one month; this can be extended by two months for complex requests.

You can also complain to a supervisory authority, for example where you live or work:

• EEA: the list of national authorities at www.edpb.europa.eu/about-edpb/about-edpb/members_en
• UK: the Information Commissioner's Office, ico.org.uk/make-a-complaint
• Switzerland: the Federal Data Protection and Information Commissioner, www.edoeb.admin.ch

9. Children and teens

Pebblock is meant for players aged 13 and over, and we design and market it that way. Younger children may still try it, so the age question in section 2 protects anyone who says they're under 13: contextual ads only, no analytics, no Play Games prompts, and no invites (the Share button shares a plain link). Privacy-protective settings are the default for everyone under 18:

• they never get personalised ads;
• we don't sell or share the personal information of anyone we know is under 16;
• in India, anyone under 18 needs a parent's or guardian's permission to play (section 13).

If you believe a child's data was handled in a way this policy doesn't allow, contact us and we'll delete it.

10. Notice for parents of children under 13 (COPPA)

This notice explains what happens when a player tells the age question that they're under 13. It's given under the US Children's Online Privacy Protection Act and the FTC's rule (16 CFR Part 312).

• Operators: AK Puzzle Games answers all questions from parents: Adeel Khan, Wah Cantt, Punjab 47040, Pakistan, phone +92 316 8772645, email support@pebblock.com. Google LLC (Google AdMob and Firebase) also receives the information described below.
• What we collect: only persistent identifiers that the game's Google SDKs send automatically, such as an app set ID, advertising ID, Firebase installation ID or IP address. We don't collect a child's name, email address, phone number, photos, voice, precise location or any other personal information, and children can't chat or post anything in the game. Invites and challenges are switched off: the Share button shares a plain link, and nothing is sent to our database.
• Why: the game's internal operations only. The identifiers are used to:
  • show contextual ads (ads chosen from the game, not from the child's behaviour) through Google AdMob;
  • limit how often the same ad appears (frequency capping);
  • keep the game and its ads secure and prevent fraud;
  • deliver game settings through Firebase Remote Config.
• How we prevent behavioural advertising:
  • the game marks every ad request from a child with Google's child-directed treatment, which turns off interest-based advertising and remarketing;
  • ads are limited to G- or PG-rated content;
  • Firebase Analytics is switched off;
  • Play Games sign-in and leaderboards aren't offered;
  • we don't use or disclose children's identifiers for any other purpose.
• Disclosure: we disclose children's information only to Google, for the purposes above.
• Parental consent: because we collect only persistent identifiers to support these internal operations, COPPA doesn't require us to get a parent's consent first (16 CFR 312.5(c)(7)). Parents still have the rights below.
• Our data-retention policy, in summary:
  • We keep a child's information only as long as the purposes above need it, then it's deleted.
  • We store none of it on our own systems. On the device, it stays until Settings → Privacy → Delete my data, clearing the app's storage, or uninstalling.
  • At Google, ad-serving and security data follows Google's retention policies, and the Remote Config installation ID lasts until the app's data is deleted.
  • We never keep children's information indefinitely.
• Parents' rights: you can review your child's information, have it deleted, and refuse further collection.
  • On your child's device, use Settings → Privacy → Delete my data, or uninstall the game to stop all further collection.
  • Or contact us (details above) with the Privacy ID from Settings → Privacy.
  • We never require a child to give more information than is reasonably necessary to play.

11. Notice for California and other US states

Last updated: 18 October 2026. This section is our notice at collection and privacy policy under the California Consumer Privacy Act, as amended (Cal. Civ. Code §1798.100 and following; Cal. Code Regs. tit. 11 §7011). It also covers similar laws in other states. The Notice of Financial Incentive for Friend Stars is at the end of this section. Since launch (and in the last 12 months), we have collected the following categories:

We don't collect sensitive personal information as the CCPA defines it. Invites add no commercial information: Friend Star rewards are in-game items with no cash value.

Selling and sharing:

• We don't sell personal information for money.
• In the last 12 months, we have shared identifiers, internet or other electronic network activity, and approximate geolocation with Google AdMob for cross-context behavioral advertising. Google may draw inferences from them.
• We don't sell or share the personal information of consumers we know are under 16.

How to opt out: in the game, use Settings → Privacy → Do Not Sell or Share. Your choice takes effect on your device right away, and in every case within 15 business days.

Global Privacy Control (GPC): the game can't read browser signals like GPC, so please use the in-game setting. Our website, where this policy is hosted, doesn't collect personal information.

Your rights:

• to know what we collect, including the categories and specific pieces of information;
• to delete it;
• to correct it;
• to opt out of selling or sharing;
• to limit the use of sensitive personal information (we don't use any);
• not to be discriminated against for using these rights. We won't deny you the game, charge a different price or give you a worse experience.

How to submit a request (two ways):

1. In the game: Settings → Privacy (Delete my data, Do Not Sell or Share, and copy your Privacy ID).
2. Email support@pebblock.com with your Privacy ID, or call +92 316 8772645.

We confirm requests within 10 business days and answer within 45 days. If we need more time, we'll tell you why, and we can extend this by up to another 45 days.

Verification: we don't know who you are, so we verify requests by matching the Privacy ID from your device. We never ask for more information than we need.

Authorized agents: you can use an authorized agent. We'll ask for your signed permission and may ask you to confirm the request directly.

Other US states: residents of states such as Colorado, Connecticut, Virginia, Oregon and Texas have similar rights. If we decline your request, reply to our answer with "Appeal". We'll respond within the time your state's law requires. If we deny your appeal, you can contact your state's attorney general.

Notice of Financial Incentive (Friend Stars)

This notice describes the Friend Stars invite program. California law may treat it as a financial incentive, because its rewards are linked to personal information (Cal. Code Regs. tit. 11 §7016).

• Summary:
  • When a friend installs Pebblock from your invite link, says Yes to letting you know, and qualifies, you earn a Friend Star and in-game rewards.
  • Your friend gets a welcome gift (150 coins, 1 Refresh and 1 Bomb) whether or not they say Yes.
• Material terms:
  • The program is for players aged 13 and over.
  • A friend qualifies after playing 5 games and coming back at least 20 hours after installing.
  • Current rewards:
    • 1 star: 300 coins;
    • 3 stars: the Moonstone theme;
    • 5 stars: 5 Bombs and 5 Refreshes;
    • 10 stars: the Golden Pebble theme;
    • each star from 11 to 30: 100 coins.

    Stars above 30 still count but give nothing more.

  • The Invite friends screen always shows the current rewards, and we'll update this notice if they change.
  • Rewards are in-game items with no cash value. They can't be exchanged for money or transferred to another player.
• Personal information involved:
  • identifiers: the anonymous Firebase Authentication user ID and the invite code;
  • internet or other electronic network activity: the games-played counter and the install referrer (invite code and score).
• How to opt in:
  • as the inviter, open Invite friends or share your invite link;
  • as the invited friend, tap Yes on the welcome card.
• Your right to withdraw: you can withdraw at any time with Settings → Privacy → Delete my data. It deletes your invite code, your invite records and your anonymous account, and, like every use of Delete my data, your local save. You can also stop sharing your link, or tap No.
• Value of your data: in good faith, we estimate the value of the consumer's data to us as equal to the cost of the rewards we provide. That cost is nominal, because the rewards are in-game items with no monetary value. We calculated it with the cost method: the expenses related to offering the incentive, one of the methods listed in Cal. Code Regs. tit. 11 §7081.

12. Brazil: notice under the LGPD

[TRANSLATION NEEDED: pt-BR] This section, and the in-game privacy summary, must be published in Brazilian Portuguese before Pebblock is offered in Brazil.

• Controller and contact: AK Puzzle Games (section 1). Data protection contact (encarregado) and communication channel (LGPD Art. 41): Adeel Khan, support@pebblock.com. Legal representative in Brazil: to be appointed before Pebblock is available in Brazil.
• Purposes and legal bases (Art. 7):
  • consent: personalised ads, analytics where we ask, and letting a friend know you joined through their invite link;
  • performance of a contract: the game, purchases, Play Games features, invites you send;
  • legitimate interest: non-personalised ads, security and fraud prevention;
  • compliance with legal obligations: transaction records and rights requests.

  How long each is kept is in section 6.

• Sharing and international transfer: with Google (section 4), outside Brazil, mainly in the US, under the safeguards of Art. 33 (section 5).
• Children and adolescents (Art. 14): we process their data only in their best interest.
  • Under-13s get contextual ads only, with no analytics.
  • We never profile anyone under 18 for advertising.
• Your rights (Art. 18):
  • confirmation that we process your data;
  • access: a simplified reply right away, or a complete one within 15 days;
  • correction;
  • anonymisation, blocking or deletion of unnecessary or excessive data;
  • portability;
  • deletion of data processed with your consent;
  • information about who we share data with;
  • information about refusing consent and its consequences;
  • withdrawal of consent (Settings → Privacy);
  • objection;
  • the right to petition the ANPD, Brazil's data protection authority (www.gov.br/anpd).

  Use Settings → Privacy, or email us.

13. Notice for users in India (Digital Personal Data Protection Act, 2023)

This notice can be read on its own.

Who we are: AK Puzzle Games is the Data Fiduciary for Pebblock. Contact person: Adeel Khan, support@pebblock.com, Wah Cantt, Punjab 47040, Pakistan.

What we process, and the purpose of each item:

• Advertising ID and app set ID: to show ads. Personalised ads only for adults who agree.
• IP address (approximate location): to show ads, measure use (if you agree) and prevent fraud.
• App-instance ID and Firebase installation ID: to measure how the game is played (only if you agree) and to deliver game settings.
• Game and ad interactions, device and app details: to understand and improve the game (only if you agree) and to count ad views.
• Purchase records: to deliver what you buy.
• Play Games scores, achievements and saved games (only if you sign in): leaderboards and cloud save.
• Invite code, anonymous user ID, invite records and the install referrer (only if you use invites, or arrive through a friend's link and tap Yes): to give Friend Star rewards.
• Your email address and Privacy ID (only if you contact us): to answer you.

Your consent, and how to withdraw it: we ask in the game before personalised ads or analytics, and before letting a friend know you joined through their link. You can withdraw as easily as you gave consent:

• for ads and analytics, one tap in Settings → Privacy → Privacy options;
• for invites, Settings → Privacy → Delete my data.

Withdrawing doesn't affect processing that took place before.

Children: under Indian law, anyone under 18 is a child. If you're under 18, you need your parent's or lawful guardian's permission to use the game. We never show targeted ads to anyone under 18, and we never track their behaviour: they get non-personalised ads only, and analytics stays off. If they use invites, only the invite record in section 3.6 is kept.

Your rights:

• to get a summary of your data and how it's processed;
• to correct, complete, update or erase it;
• to have your grievances redressed;
• to nominate someone to exercise these rights if you die or become unable to.

Use Settings → Privacy, or email us.

Grievances: contact Adeel Khan at support@pebblock.com. We'll respond within 90 days. If you're not satisfied, you can complain to the Data Protection Board of India.

Language: this notice is in English. If you'd like it in another language listed in the Eighth Schedule to the Constitution of India, email us and we'll provide it.

14. Other features

• Notifications: reminders, for example that your daily challenge is ready, are scheduled on your phone by the game. No push service or server is involved. On Android 13 and later, the game asks for permission first.
• Sharing: when you tap Share, Android's share sheet opens and you choose where to send your result. You can edit the text before sending.
  • The text contains your score and a link: from age 13 the link carries your invite code (section 3.6); for under-13s it's a plain link.
  • Links are tagged with the type of share, so installs from shares can be counted in aggregate.
  • We don't learn who you shared with.
• Phone backup: if Android's backup is on, Android may include the game's saved data in your phone's backup to your Google Account, so it can be restored on a new phone. That includes progress, settings, your age band and, if you use invites, the invite sign-in token. We can't access these backups.
• Permissions: the game uses:
  • internet and network-state access, for ads, analytics and Play services;
  • the advertising ID and Android's ad-services (Privacy Sandbox) APIs, which the Google Mobile Ads SDK uses;
  • notifications;
  • vibration (haptics);
  • Google Play billing;
  • Google Play's install-referrer service, to read invite links;
  • wake-lock and foreground-service permissions, which Google's libraries use to schedule background work.

  It doesn't request location, contacts, phone-state, camera, microphone or storage permissions.

15. Security

Data is encrypted in transit, and Google stores it on secured servers. Your game data on the phone stays in the app's private storage. Only we can access the Google consoles that hold your data, and they're protected with two-step verification. We follow a written information-security programme and a written data-retention policy.

16. Changes to this policy

When we change this policy, we update it at this address and change the "Last updated" date. If a change is significant, we'll tell you in the game and, where the law requires it, ask for your consent again.

17. Contact

AK Puzzle Games, Adeel Khan, Wah Cantt, Punjab 47040, Pakistan, support@pebblock.com, +92 316 8772645. Data deletion steps: pebblock.com/delete-data