Grove Ridge

Grove Ridge Privacy Policy

Effective date: [EFFECTIVE DATE — set to the date the page goes live publicly]

Last updated: [EFFECTIVE DATE — set to the date the page goes live publicly]

This privacy policy explains what information is collected when you play Grove Ridge, our casual puzzle game for iPhone, iPad, and Android, and when you visit the Grove Ridge pages on our website at longsoftware.io, including the email sign-up form there. The rest of our website is covered by the Long Software website privacy policy. It covers who collects the information, why, how long it is kept, and the choices and rights you have.

1. Who we are and how to contact us

Grove Ridge is published by Long Software LLC ("Long Software", "we", "us", "our").

  • Email: support@longsoftware.io
  • Postal address: Long Software LLC, 8401 Mayland Dr #6010, Richmond, VA 23294, USA
  • EU/UK representative: [EU/UK REPRESENTATIVE if needed — delete this line if not appointed]

For data protection law purposes, Long Software LLC is the "controller" (or "business") responsible for the personal information described in this policy.

2. The short version

  • No accounts. You don't need to sign up or log in to play. The app doesn't ask for your name, email address, or phone number. We don't run our own servers or a player database.
  • Google services in the app collect some device and usage data. These are Firebase Analytics, Firebase Crashlytics, Firebase Remote Config, and Google AdMob. They use random identifiers for your app installation and, where allowed, your device's advertising ID.
  • Ads pay for the game. In the EEA, UK, and Switzerland we ask for your consent before ads are personalized. On iPhone and iPad, your advertising identifier is used only if you allow tracking.
  • Apple and Google handle payments. We never see your card details.
  • Email updates are opt-in. If you sign up on our website, we use your email address only to send Grove Ridge news. You can unsubscribe at any time.
  • Grove Ridge is not made for children under 13.

3. Information we collect

3.1 Information collected automatically in the app (through Google's SDKs)

When you use Grove Ridge, the Google software development kits (SDKs) built into the app collect the following:

  • Device and app information: device model and manufacturer, operating system and version, language and locale, time zone, country, app version, and technical details such as available memory and disk space.
  • App installation identifiers: random identifiers created for your installation of the app. These include the Firebase installation ID, the Google Analytics app-instance ID, and the Crashlytics installation ID. On Android, the AdMob SDK may also use the app set ID. These identifiers don't contain your name or contact details.
  • Advertising identifier: the Android Advertising ID (AAID) on Android, and the Identifier for Advertisers (IDFA) on iPhone and iPad only if you allow tracking in Apple's App Tracking Transparency prompt. See section 7.
  • Gameplay and usage events: for example, app opens, sessions, screens viewed, levels started and completed, undo use, and whether you watched a rewarded ad. These are collected by Firebase Analytics.
  • Ad interaction data: which ads were shown to you, whether you tapped or closed an ad, and whether you finished a rewarded video. These are collected by AdMob.
  • Crash and performance data: when the app crashes or hits an error, Firebase Crashlytics collects a crash report. This includes stack traces, the time of the crash, app and device state (for example, whether the app was in the background, and whether the device is jailbroken or rooted), and the identifiers listed above. AdMob also collects performance information such as app launch time and hang rate.
  • Approximate location derived from your IP address: your device's IP address is sent to Google when the SDKs connect, and Google uses it to estimate your general location (country, region, or city level). Google Analytics derives coarse location from a masked IP address and states that Google Analytics 4 does not log or store IP addresses. AdMob collects the IP address and may use it to estimate your general location for ads and fraud prevention. The app does not request access to your device's GPS or precise location.
  • Purchase events: Firebase Analytics automatically records in-app purchase events, such as the product purchased and its price. See section 3.2.

3.2 In-app purchases

Grove Ridge offers optional in-app purchases: one that removes forced (interstitial) ads, and two cosmetic skins. Apple (App Store) or Google (Google Play) processes all purchases. We don't receive or store your payment card number, billing address, or store account details. The store tells the app whether a purchase succeeded so the app can unlock what you bought and restore it later. As noted above, Firebase Analytics also records purchase events, such as the product and its price.

3.3 Information you give us

  • Email sign-up (website): if you sign up for Grove Ridge updates on our website, we collect your email address. The form asks for nothing else. Our website host, Webflow, also records the date and time of the submission and the IP address it came from. See section 9.
  • Emails you send us: if you email support@longsoftware.io, we receive your email address, your name if you include it, and whatever you choose to send, such as a bug report, a screenshot, or a device identifier.

3.4 Information stored only on your device

Your game progress, settings, and record of unlocked items are stored on your device. They are not sent to us. [ENGINEERING TO CONFIRM: no cloud save, Game Center, or Play Games sign-in.]

3.5 Information we do not collect

We don't collect your name, phone number, contacts, photos, microphone or camera data, precise GPS location, or payment card details through the app. We don't collect sensitive information such as health data.

4. How we use information

We and our service providers use this information to:

  • Run the game: deliver game settings and tuning values (Remote Config), unlock and restore purchases, and show ads, including rewarded ads you choose to watch for extra undos.
  • Keep the game stable and secure: find and fix crashes and bugs, and detect fraud, ad fraud, and abuse.
  • Understand and improve the game: measure in aggregate how players use levels and features, so we can improve difficulty, design, and performance.
  • Show and measure ads: serve ads, limit how often you see the same ad, measure ad performance, and, only where you have allowed it, personalize ads to your interests.
  • Communicate with you: send Grove Ridge email updates if you signed up, and reply to your support emails.
  • Meet legal obligations: respond to lawful requests and enforce our Terms of Use.

We don't use your information to make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Legal bases for processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

  • Consent. We rely on your consent for personalized advertising and the use of your advertising identifier for that purpose, for storing or accessing information on your device where the law requires consent, and for email updates. You give or refuse consent through the consent message in the app or by submitting the sign-up form. You can withdraw it at any time (see section 7 and section 9). Withdrawing consent doesn't affect processing that took place before you withdrew it.
  • Legitimate interests. We rely on our legitimate interests in providing a stable, secure, ad-supported free game and improving it for crash reporting (Crashlytics), app configuration (Remote Config), aggregate usage analytics (Firebase Analytics), non-personalized ads, frequency capping, ad measurement, fraud prevention, and replying to your emails. Where local law requires consent for storing or accessing information on your device for these purposes, we ask for it. [COUNSEL TO CONFIRM which of these purposes require ePrivacy/PECR consent in our configuration; see open-questions.md.] You have the right to object to processing based on legitimate interests (see section 11).
  • Performance of a contract. We rely on this to deliver and restore the in-app purchases you buy and to provide the game under our Terms of Use.
  • Legal obligation. We rely on this where we must keep or disclose information to comply with the law.

6. Who we share information with (third parties)

We don't sell your personal information for money. Information is shared with, or collected directly by, the following parties:

  • Google (Firebase Analytics, Firebase Crashlytics, Firebase Remote Config). Google provides these services. For Firebase, Google states that it generally acts as our data processor (GDPR) and service provider (CCPA). Google Analytics is subject to separate Google terms. Learn more: Privacy and Security in Firebase and the Google Privacy Policy.
  • Google AdMob (advertising). AdMob collects the data described in section 3.1 to serve, measure, and (if allowed) personalize ads, and to prevent fraud. For personalized advertising, Google and the advertisers and ad partners it works with may use this data for their own purposes, including combining it with data from other apps and websites. Learn more: How Google uses information from sites or apps that use its services, How Google uses cookies and identifiers in advertising, and the Google Privacy Policy. [If AdMob mediation or third-party ad sources are enabled, list each network here.]
  • Apple (App Store, App Tracking Transparency). Apple processes App Store purchases and your tracking choice. See the Apple Privacy Policy.
  • Google Play. Google processes Google Play purchases. See the Google Privacy Policy and the Google Play Terms of Service.
  • Google (Google Analytics on our website). This runs only as described in section 9, subject to your cookie choices and GPC signal. See the Google Privacy Policy.
  • Google (Google Fonts on our website). Google receives your IP address, user agent, and the referring page when your browser loads fonts from Google's servers. See section 9, the Google Fonts privacy FAQ, and the Google Privacy Policy.
  • Webflow (website hosting and email sign-up storage). See section 9 and the Webflow Privacy Policy.
  • Legal and safety. We may disclose information if the law requires it, to protect rights, safety, and security, or as part of a merger, acquisition, or sale of assets. In the case of a sale, this policy (or one at least as protective) will continue to apply.

We require service providers to protect information to the same standard as this policy, and we choose providers that publish their own privacy and security commitments.

7. Advertising and tracking choices

Consent in the EEA, UK, and Switzerland

If you're in one of these regions, Grove Ridge shows Google's consent message (the User Messaging Platform) before ads are personalized. You can accept, refuse, or manage your choices. If you refuse, you may still see non-personalized ads. These are based on context, such as the app and your general location, rather than on a profile of you. Non-personalized ads may still use identifiers for frequency capping, aggregated ad reporting, and fraud prevention. You can change your choice at any time in the app under Settings › Privacy options. [ENGINEERING TO CONFIRM menu name.]

App Tracking Transparency (iPhone and iPad)

Grove Ridge asks your permission through Apple's App Tracking Transparency prompt before it accesses your device's IDFA. If you choose "Ask App Not to Track", the IDFA is not accessed. You can change this at any time in Settings › Privacy & Security › Tracking.

Resetting or deleting your advertising ID

  • Android: go to Settings › Google › Ads (or Settings › Privacy › Ads on some devices), then reset or delete your Advertising ID. If you delete it, apps receive a string of zeros instead of an identifier.
  • iPhone and iPad: turn off Allow Apps to Request to Track in Settings › Privacy & Security › Tracking. You can also manage Apple's own ads under Settings › Privacy & Security › Apple Advertising.

Opting out of personalized ads

  • Use the in-app privacy options described above.
  • US residents: see section 12 for how to opt out of "sale" or "sharing" for targeted advertising.
  • Manage Google ad personalization at My Ad Center.

Rewarded ads are always optional

Rewarded ads are always optional, and removing forced ads with an in-app purchase never requires you to allow tracking.

8. How long we keep information

We don't operate our own player database. Most retention is controlled by Google's systems and our settings for them:

  • Firebase Crashlytics: Google keeps crash stack traces and associated identifiers (Crashlytics installation IDs and Firebase installation IDs) for 90 days, then starts removing them from live and backup systems.
  • Firebase installation IDs (used by Remote Config): kept until the ID is deleted (for example, through the deletion steps in section 10). After deletion, Google removes the data from live and backup systems within 180 days.
  • Firebase Analytics (Google Analytics): user-level and event-level data is kept for the retention period set in our Google Analytics property. Google offers 2 or 14 months. Our setting is [2 / 14] months, after which the data is deleted automatically. Aggregated reports that don't identify individuals may be kept longer.
  • AdMob: Google retains advertising data under its own retention policies. See How Google retains data it collects.
  • Email sign-ups: kept until you unsubscribe or ask us to delete your address, or until we stop sending Grove Ridge updates [SET TRIGGER, e.g. "12 months after our last email"], whichever comes first. We may keep a record that you unsubscribed so that we don't email you again.
  • Support emails: kept only as long as we need them to resolve your request, then deleted, normally within [12] months.
  • On-device data: stays on your device until you delete the app or its data.

9. The Grove Ridge web pages and email sign-up

This section covers only the Grove Ridge pages on longsoftware.io (the pages under /games/grove-ridge, including this policy) and the Grove Ridge email sign-up form on those pages. The rest of longsoftware.io, including the contact form on our contact page, is covered by the Long Software website privacy policy.

Hosting

Webflow hosts our website, including the Grove Ridge pages. Webflow and its content delivery network automatically process technical information, such as your IP address, browser type, and the pages you request, so they can deliver and secure the site.

Email sign-up

  • What we collect: the email address you enter. Webflow also records the date and time of the submission and the IP address it was sent from, to help prevent spam and abuse.
  • Where it is stored: in the form submissions area of our Webflow site. Webflow processes it on our behalf as our processor, and stores data in the United States. See the Webflow Privacy Policy and the Webflow Data Processing Addendum. [If an email-sending service is used to send updates, name it here as a processor before the first email is sent.]
  • What we use it for: only to send Grove Ridge news and launch updates. We don't sell your email address, and we don't share it with advertisers.
  • Legal basis (EEA, UK, Switzerland): your consent, given when you submit the form.
  • Unsubscribe: use the unsubscribe link in any Grove Ridge email, or email support@longsoftware.io and ask to be removed. We honor opt-outs promptly, and in any case within 10 business days.

Cookies, Google Analytics, and your consent choices

Our website uses Google Analytics to understand, in aggregate, how visitors use our pages: for example, the pages viewed, the device and browser type, and the approximate location derived from the visitor's IP address. Google Analytics uses cookies and similar technologies. We use a cookie consent banner with Google Consent Mode to control whether Google Analytics loads. What happens depends on where you are and on your browser settings:

  • EEA, UK, and Switzerland: Google Analytics is off until you choose "Accept" in our cookie banner. Until then, the Google Analytics script doesn't load at all. No analytics cookies are set, and no measurement data is sent to Google. If you decline, or never choose, it stays off.
  • Everywhere else: Google Analytics loads by default when you visit. You can turn it off at any time using Cookie settings (see below). After that, Google Analytics no longer loads for your browser on our site.
  • If your browser sends a Global Privacy Control (GPC) signal, wherever you are: Google Analytics does not load, and the cookie banner isn't shown, because we treat the signal as your choice to opt out. See also section 12.

Changing or withdrawing your choice: you can change or withdraw your cookie choice at any time using the Cookie settings link in the footer of our website. Withdrawing consent doesn't affect anything that happened before you withdrew it. You can also delete cookies in your browser settings, or install Google's Google Analytics opt-out browser add-on.

Strictly necessary storage: we keep a small record of your cookie choice so we don't ask again on every visit. Webflow may also use storage that is strictly necessary to deliver and secure the site. These don't require consent.

No advertising use: our website doesn't run advertising cookies. Google Signals and Google Analytics advertising features are turned off for our website. [BRANDON: also turn these off in the GA4 Admin settings before publishing; see open-questions.md.]

Google Fonts

Our website loads some of its fonts (Public Sans and JetBrains Mono) from Google Fonts, a service provided by Google. When a page loads, your browser connects to Google's font servers. Google receives standard request information, including your IP address, your browser's user agent, and the referring page (the address of the page you are viewing). Google describes how it handles this information, including its statements on cookies and logging, in the Google Fonts privacy FAQ [VERIFY current FAQ wording before publishing]. Learn more in the Google Fonts privacy FAQ and the Google Privacy Policy. Font loading happens when the page loads, before you make a cookie choice. Other fonts on our site, such as Inter, are hosted on our own site and don't involve a third party.

10. Deleting your data

Grove Ridge has no accounts, so we can't look up your data by your name or email address. Data held by Google's services is tied to random identifiers for your app installation. You can control and delete it in these ways:

  1. Stop collection: uninstall Grove Ridge. This stops all further collection by the app and deletes game data stored on your device.
  2. Break the link to your advertising ID: reset or delete your advertising ID, as described in section 7.
  3. Reset your app identifiers: [IF IMPLEMENTED] in the app, go to Settings › Privacy options › Reset my data. This deletes your Firebase installation ID and resets your analytics identifier, so new data can't be linked to old data. Google then deletes data linked to the deleted installation ID from its systems as described in section 8.
  4. Ask us to delete data: email support@longsoftware.io with the subject "Data deletion request – Grove Ridge". So that we can find your data, please include your app instance ID, which you can copy in the app under Settings › Privacy options [IF IMPLEMENTED], and, if you like, your advertising ID. We will then ask Google to delete the analytics data linked to that identifier, and we will delete any email or support data we hold about you. We confirm deletion requests within 30 days, or sooner where the law requires. Some data, such as crash reports, is deleted automatically on the schedule in section 8.
  5. Email sign-up data: unsubscribe, or email us from the address you signed up with and ask us to delete it.

Some limited information may be kept where the law requires it, for example records needed to comply with a legal obligation or to show that we honored your opt-out.

11. Your rights under GDPR and UK GDPR

If you are in the EEA, UK, or Switzerland, you have the right to:

  • access the personal data we hold about you and get a copy of it;
  • correct inaccurate data;
  • delete your data ("right to be forgotten");
  • restrict how we use it;
  • object to processing based on our legitimate interests;
  • data portability, meaning you can receive data you provided to us in a portable format;
  • withdraw consent at any time, without affecting earlier processing; and
  • complain to your local data protection authority, or in the UK, the Information Commissioner's Office. We would appreciate the chance to address your concern first.

To exercise these rights, email support@longsoftware.io. Because we don't hold accounts, we may need an app identifier (see section 10) to find data linked to your installation. We will respond within one month, which the law allows us to extend in some cases.

12. US state privacy rights (including California)

Depending on where you live, residents of California, Virginia, Colorado, Connecticut, and other US states with comprehensive privacy laws may have the rights described below. We extend them to all US residents.

Categories of personal information collected in the last 12 months

  • Identifiers: advertising ID, app-instance and installation IDs, IP address, and, if you sign up or email us, your email address.
  • Commercial information: in-app purchase events (which product, and its price).
  • Internet or other electronic network activity: gameplay and app-usage events, ad interactions, and crash and diagnostic data. On our website: pages viewed.
  • Geolocation data: approximate (not precise) location derived from IP address.
  • Inferences: interest inferences that Google may draw for personalized ads, where personalized ads are allowed.

We don't collect sensitive personal information as defined by California law.

Sources, purposes, and recipients

  • Sources: your device (through the SDKs), your browser (Grove Ridge web pages), and you (email sign-up and support emails).
  • Purposes: the purposes described in section 4.
  • Recipients: the parties in section 6. We disclose information to Google (Firebase) and Webflow as service providers or processors, and to Google AdMob and its ad partners for advertising.

"Sale" and "sharing" for targeted advertising

We do not sell personal information for money. However, when ads are personalized, AdMob and its partners receive identifiers such as your advertising ID, together with app activity, and use them for cross-context behavioral advertising. Under California law this counts as "sharing". Under California and some other state laws it may also count as a "sale" (a disclosure for "valuable consideration"), and it is "targeted advertising" under laws such as Virginia's. We don't knowingly sell or share the personal information of consumers under 16. We never sell or share email addresses from our sign-up form.

Your rights

  • Know or access the personal information we have collected about you.
  • Delete your personal information (see section 10).
  • Correct inaccurate personal information.
  • Opt out of sale, sharing, and targeted advertising. You can opt out in any of these ways:
    • In the app, under Settings › Privacy options › Do Not Sell or Share My Personal Information [ENGINEERING TO CONFIRM: Google UMP US-states message / privacy options form].
    • On Android, delete your advertising ID. On iPhone and iPad, choose "Ask App Not to Track".
    • Email support@longsoftware.io with the subject "Do Not Sell or Share".
    • Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a valid request to opt out of sale and sharing for that browser on our website. Google Analytics does not load and the cookie banner isn't shown (see section 9). The app doesn't receive browser signals, so please use the in-app option for the app.
  • Appeal: if we deny your request, you can appeal by replying to our decision. If your appeal is denied, you may contact your state Attorney General.
  • Non-discrimination: we won't deny you the game, charge you a different price, or give you a different quality of service because you exercised your rights. You'll still see ads, but they will be non-personalized.

To make a request, email support@longsoftware.io. We may ask for an app identifier to locate your data (see section 10), and we may need to verify requests other than opt-outs. You may use an authorized agent. If you do, we may ask for proof that you authorized the agent. We respond within 45 days, which the law allows us to extend once by another 45 days. We act on opt-out requests within 15 business days.

13. Children

Grove Ridge is rated 12+ on the App Store and Teen on Google Play. It is a general-audience game that is not directed at children under 13. It is not in Apple's Kids category or Google Play's Families program, and our ads are not configured as child-directed. We don't knowingly collect personal information from children under 13, and our email sign-up is not intended for them.

If we learn that we have collected personal information from a child under 13, for example because a parent tells us, we will delete it. We will also ask Google to delete analytics data associated with that app installation, and we will treat that installation as child-directed for ads where we can. If you are a parent or guardian and believe your child has provided personal information to us, email support@longsoftware.io. Where possible, include the app instance ID (see section 10) and the email address used for any sign-up.

14. International data transfers

Long Software LLC is based in the United States. Google and Webflow process data in the United States and other countries. When personal data from the EEA, UK, or Switzerland is transferred to the US or other countries, the transfer is protected by appropriate safeguards:

  • Google states that it complies with the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework, and that it offers the Standard Contractual Clauses in its data processing terms.
  • Webflow states that it relies on the Data Privacy Framework and/or Standard Contractual Clauses (and the UK International Data Transfer Addendum) in its Data Processing Addendum.

You can ask us for more information about these safeguards by emailing support@longsoftware.io.

15. Security

All data that the Google SDKs collect is encrypted in transit (HTTPS/TLS). We don't operate our own servers for player data. Access to our Firebase, AdMob, and Webflow accounts is limited to the people who run Long Software and protected with two-factor authentication [CONFIRM]. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

16. Changes to this policy

We may update this policy, for example when we add features or change the services we use. When we do, we'll change the effective date at the top. If the changes are significant, we'll also give notice in the app or on this page before they take effect. Where the law requires it, we'll ask for your consent again.

17. Contact us

Questions, requests, or complaints about this policy or your information: