Cinder — Privacy Policy
The short version: Cinder plays on your phone and keeps your progress there. Nothing that leaves the device is tied to you until you have an account, and you need one only to buy something. After each run the game sends us statistics about that run: anonymous without an account, and carrying your user id with one (plus your email address, if you signed in with Google or Apple). Before your first purchase the game asks you to sign in with Google or Apple, or to play as a guest; each purchase is then recorded on our server under that account, so it stays yours. We never see your payment details. With an account, the game also saves your progress to our server so a new phone can pick it up. There is no advertising and no tracking, and nothing is sold to anyone. The game also counts anonymous gameplay events through Google Analytics for Firebase — runs, the first-run lessons, where gold and gems come from and go, the market being opened — and sends a report when something breaks, through Firebase Crashlytics; neither carries a name or an account. The run statistics, the gameplay events and the crash reports all stop at the source when you turn off Settings → Help improve the game. A message you choose to send from Settings → Contact support goes to our server too (section 13).
1. Who we are
Cinder is published by BrotherAI. If you have a question about this policy, write to brotheraicompany@gmail.com.
2. How you are identified
Without signing in: the game makes up a random install identifier the first time it runs. It is not your device's advertising identifier, serial number or anything else that exists outside the game, and it is forgotten when the game is uninstalled — a reinstall gets a new one, and we have no way to connect the two. It exists so that forty runs by one player can be told apart from one run by forty players.
With an account: you are identified by a user id issued by Firebase Authentication (see section 4). Your cloud save and your purchases are stored under that id. A guest account has a user id too, but no name and no email address.
Google Analytics: the gameplay events in section 3 carry a random app-instance identifier that Google Analytics for Firebase creates when the game is installed. Like the install identifier, it is not your device's advertising identifier (the game collects none), it names nobody, and it is reset when the game is uninstalled. It is never joined to your sign-in: the game does not give Google Analytics your user id or your email address.
3. What our server receives
The game talks to a server we operate. This is everything it sends, and why, together with the one thing the app stores send us about your purchases:
The run statistics, the gameplay events and the crash reports are the three things the game sends on its own, and one switch controls all three: turn off Settings → Help improve the game and none of them leaves the device from that moment on. The purchase notice and the cloud save are tied to actions you take.
The one exception is a message you write and send us yourself (section 13).
| What | When | Why |
|---|---|---|
| Run statistics: the install identifier, the app version, the arena and character played, how long the run lasted, enemies defeated, level reached, gold earned, your permanent-shop level, whether you won, died or gave up, how many runs this install has finished, your max health, the health you lost to each source (enemies, bosses, fire, lava or acid on the ground, your own Ultimate) and which one dealt the final blow, and the weapons you carried at the end with their levels | After each run | To see how the game is balanced — whether an arena is too hard, whether a character is never picked. Without an account, a run carries none at all. With one, it carries your user id, and your email address if you signed in with Google or Apple, so the same question can still be answered after you change phone. |
| Crash report: what went wrong, where in the code, the device model and operating-system version, and the install identifier — through Firebase Crashlytics, a Google service | When something breaks; sent on the next launch | So a crash nobody reports still gets fixed. Kept by Crashlytics for 90 days, then dropped. |
| Gameplay events, through Google Analytics for Firebase, a Google service: a run started and ended (arena, character, campaign or daily, won, died or gave up, seconds played), the first-run lessons started and finished, skipped or cut short (and at which lesson), achievements unlocked, gold and gems earned and spent (how much, and from or on what), the daily gift claimed (the streak day), a reminder opened, the market opened (from which screen), a purchase tried, its result and its delivery (the product only), a sign-in (Google or Apple — never the account), the screens you open, and three coarse facts: whether this install has ever bought something, whether it is signed in, and how many arenas it has cleared. With these, Google Analytics automatically records the app-instance identifier described in section 2, app opens and sessions, the game's version, the device model, operating system and language, an approximate location (city, region and country) worked out from the IP address, which Google Analytics does not store, and in-app purchases made through the store (the product, its price and currency — never your payment details) | While you play; the SDK sends them in batches | To see how players get on across the whole game — who finishes the first run, which way into the market is used, whether the daily gift brings people back — without knowing who anyone is. Advertising identifiers and ad personalisation are switched off. Kept by Google Analytics for 2 months, then deleted. |
| Purchase: the product, which store sold it, the price the store displayed, the store's transaction number and its signed proof of the sale (Apple's signed transaction, or Google Play's purchase token), your account's user id (and email address, if you signed in with Google or Apple), the install identifier, the app version, and whether you had just bought it or pressed Restore purchases | After a purchase, and when you press Restore purchases | So the purchase belongs to your account and nobody else's: our server checks the proof with the store, keeps one record per purchase under your user id, with the country of the store that sold it, and tells the game what your account owns. It carries no payment details: we never see a card, and neither the transaction number nor the proof can be used to charge you. |
| Refunds and reversals, sent by Apple or Google rather than by the game: which purchase was refunded, revoked or reversed, and when | When a store refunds or reverses a purchase | So a refunded purchase stops counting as owned, and our sales figures stay true. |
| Cloud save: your account's user id and your game progress — gold and gems ledgers, unlocks, achievements, statistics and settings — with a revision number | Only when you have an account (signed in, or a guest), after runs and purchases and when you press Sync | So your progress survives a new phone. It is stored under your user id and returned only to a device signed in to the same account. A guest cannot sign in anywhere else, so a guest's save comes back only to the phone that made it. |
4. Accounts: signing in, or playing as a guest
You can play the whole game without an account. You need one only to buy something: before your first purchase the game asks you to sign in with Google or Apple, or to play as a guest. The account owns what you buy and keeps your cloud save.
You can sign in with Google or with Apple. Both go through Firebase Authentication, a service operated by Google. When you do, we receive the user id Firebase issues and the email address your provider shares (Sign in with Apple lets you hide it behind a relay address; with Apple we may also receive your name, once). We use the user id to find your cloud save and your purchases, and nothing else. We do not send you email, and we do not read your Google or Apple account. Firebase keeps that email address in its account record; the game and our server keep the opaque user id, which provider issued it, and that email address — so that a message from you about your account can be matched to your save. Never your name, and never a password.
A guest is an account that Firebase Authentication creates without any sign-in: it has a user id and nothing else, no name and no email address. It lives only on this phone: uninstall the game or lose the phone, and the guest and what it bought cannot be reached again. You can link Google or Apple to a guest at any time in Settings. The user id stays the same, and if that Google or Apple account already has a Cinder account, the guest's purchases move to it.
Signing out on the device keeps your cloud save on the server so you can sign back in later. To have it and your account deleted, see section 8. A guest cannot sign back in, so signing a guest out loses it for good.
5. What stays only on your phone
The game saves the following in its own app storage. It stays on the device, is included in whatever device backup you have configured with Apple or Google, and reaches our server only as part of a cloud save when you are signed in.
| What | Why it exists |
|---|---|
| Gold and gems — how much you have earned and spent on this device | So your upgrades and unlocks carry from one run to the next. |
| Unlocks, achievements and lifetime numbers — runs played, best time, enemies defeated | So the game can show them to you and open what you have earned. |
| The character you last picked, and your best daily-run score for each day | So the menu preselects it and can tell you when you beat it. |
| Settings — sound, language, joystick side, camera, whether the first-run hints have played | So the game behaves the way you set it up. |
| Purchase records: what your account owns as our server last confirmed it, kept separately for each account used on this phone, the receipt of each gem pack, and purchases still waiting for the server's answer | So a purchase is credited exactly once, still works offline, and can be read back under Settings. The game asks our server again when it starts and when you sign in; it asks the store only when you press Restore purchases. |
6. Purchases
Cinder sells three things through the app store you installed from — Google Play or the Apple App Store: two packs of gems (consumable) and one character, the Glassheart (a one-time purchase). We never see your payment details. A purchase needs an account (see section 4). When you buy, the game hands the store an opaque code made from your user id, so the store's own record of the purchase names the same account. The store confirms the purchase to the game, the game credits it and sends us the purchase described in section 3, and our server checks it with the store and records it under your account.
Gems buy time on an unlock ladder that can also be climbed by playing; nothing is sold at random and there are no loot boxes or subscriptions. A consumed gem pack cannot be restored: it is credited the moment it is bought. The Glassheart belongs to the account that bought it and comes back on any phone signed in to that account. Restore purchases asks the store only when you press it. If the store hands back a purchase that belongs to a different Cinder account, the game says so and shows a masked hint of that account's email address (for example l***@gmail.com), so you can sign in to the right one.
Your purchase is governed by that store's own privacy policy and terms: Google Privacy Policy · Apple Privacy Policy.
7. Services we use
Five parties can see some of your data, and none of them is an advertiser or a data broker. We do not sell, rent or share your data with anyone else, and we do not use it for advertising or for tracking you across other apps or websites.
- Firebase Authentication (Google LLC) — only if you have an account; it verifies your Google or Apple sign-in, or creates a guest, and issues the user id. Firebase's handling of that data is described in its Firebase privacy documentation.
- Firebase Crashlytics (Google LLC) — receives the crash reports described in section 3, holds them for 90 days, and is switched off with the same setting.
- Google Analytics for Firebase (Google LLC) — receives the gameplay events described in section 3, with advertising identifiers and ad personalisation switched off; keeps them for 2 months, and is switched off with the same setting. See how Google safeguards Analytics data.
- Your app store (Google Play or Apple) — handles payment, knows what you bought and the opaque account code the game attached to it, and tells our server when a purchase is refunded or reversed, under its own policy.
- Discord — our team gets a message in a private Discord channel for each purchase: the product, its price, the store and its country, the store's transaction number and the app version. Never an account, a name or an email address. It also gets a copy of a message you send from Contact support (section 13).
- Our server — receives what section 3 lists, and nothing else. The one exception is a message you write and send us yourself (section 13).
8. How long we keep it, and how to erase it
On your phone: uninstalling the game, or clearing its data in your device settings, erases everything stored locally.
Run statistics sent without an account carry no name or account; we keep them as balance figures. Run statistics sent with an account carry your user id (and your email address, if you signed in with Google or Apple; see section 3) and are kept the same way. Purchase records are kept with no end date, because a purchase can be restored at any time. Crash reports are held by Firebase Crashlytics for 90 days and then dropped. Gameplay events are kept by Google Analytics for 2 months and then deleted; they carry no name or account, so they cannot be looked up by person. The switch in Settings → Help improve the game stops run statistics, gameplay events and crash reports at the source.
Your cloud save and account are kept for as long as you keep the account, so you can come back to them. To have them deleted, write to brotheraicompany@gmail.com from the email address you signed in with — subject Cinder — delete my data, and say which provider you signed in with; we delete the cloud save from our server and the account from Firebase Authentication within 30 days and confirm by reply. Once the account is deleted, what it bought can no longer be restored.
Messages you send from Contact support are kept to answer them and to improve the app, and deleted when you ask; write to the address in this policy.
9. Permissions the app asks for
Cinder asks you for one runtime permission, and only if you switch the daily gift reminder on. The rest of the permissions below are declared by the components it is built from; the network ones are what carries section 3 and the sign-in.
If you switch on the daily gift reminder, the game schedules a local notification with your device's own operating system — at most two a day, generated on the device. Nothing is sent through a push server; no reminder ever travels over the internet. The boot-completed permission only lets the device restore that scheduled reminder after a restart.
- Notifications (Android
POST_NOTIFICATIONS, iOS notifications) — requested only at the moment you switch the reminder on. Decline it and the game works normally; you simply get no reminder. - Run after restart (Android
RECEIVE_BOOT_COMPLETED) — no prompt; it only re-arms a reminder you set after the phone restarts. Without it a restart would silently cancel it. - Billing (
com.android.vending.BILLING) — lets the game ask the Play Store about a purchase. - Internet and network state — what carries everything described in section 3 and the sign-in. Nothing else in the game uses them. The one exception is a message you write and send us yourself (section 13).
- Audio settings (Android
MODIFY_AUDIO_SETTINGS) — declared by the component that plays the game's sound. It moves no data off the device. - Vibration (
android.permission.VIBRATE) — declared by the component that shows the daily gift reminder, so that notification can vibrate like any other. It reads nothing and sends nothing. - Keep awake (
android.permission.WAKE_LOCK) — declared by Google Analytics so a batch of events already queued can finish sending. It never keeps the screen on. - Install referrer (
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE) — declared by Google Analytics to read from Google Play which campaign, if any, led to the installation. - Google services configuration (
com.google.android.providers.gsf.permission.READ_GSERVICES) — declared by Google's reCAPTCHA library, which Firebase Authentication includes to protect sign-in from abuse. It reads Google Play services settings, not your data, and matters only if you sign in to cloud save.
10. Permissions the app never asks for
The game requests no access to your camera, microphone, contacts, location, photos, files, notifications, health platform or physical activity. A picture you attach to a message is chosen in the system's own photo picker, which hands the app only that picture and needs no permission (section 13).
11. Children
Cinder is not directed to children. Signing in requires an account with Google or Apple, which set their own age rules, and a guest account holds no name or email address. We do not knowingly collect personal information from children; if you believe a child has made an account, write to us and we will delete it.
12. Your rights
Depending on where you live you may have the right to access, correct, export or erase the personal data we hold about you, and to object to or restrict its use. For Cinder that data is your account, your cloud save and the records of your purchases, and you can exercise every one of those rights by writing to brotheraicompany@gmail.com from the address you signed in with. Data stored only on your phone is already in your hands. Messages you send from Contact support, with their pictures, are held too, and deleted when you ask.
13. Messages you send us
In Settings → Contact support you can write to us from inside the app and attach up to three pictures. Nothing is sent until you tap Send. Then this goes over an encrypted connection to our server:
- What you wrote, the kind you picked (bug, idea or other) and the pictures you attached. Pictures are chosen in the system's own photo picker, which hands the app only the ones you pick; they are made smaller and stripped of their metadata (location included) before they are sent.
- The app's version, whether the device runs Android or iOS, the language the app is showing, the app's random install identifier, and the store transaction codes of your most recent purchases, so we can find a purchase you ask about.
- If you are signed in to an account (Google, Apple or a guest): your account identifier and the email address Google or Apple verified, so we can answer you.
A copy goes to the team's private channel on Discord, the chat service the team works in, where reports from the team's other apps arrive too. That copy carries the message, its pictures, the app's version, Android or iOS, the language, your recent purchase codes and whether you were signed in, but not your email address or account identifier. Your network address is used to limit how many messages can be sent in a short time, and is not kept with the message. We keep messages to answer them and to improve the app, and delete yours when you ask (write to the address below).
14. Changes to this policy
If a future version of Cinder sends anything new off the device — a leaderboard, for example — we will update this page and the store listing before that version ships. The "Last updated" date above always reflects the current text.