Droppy data deletion

Droppy has no login. There is no account, no password, and the game never asks for your name, email address, phone number or any identity document. So there is no “your account” to delete — there are three different places, holding different things, and each one has a different route:

The Droppy privacy policy describes each of these sets in detail. This page is about deleting them.

Game progress lives in the device's local storage: completed levels, best scores, coins, the lives balance, trophies, water fragments, unlocked characters, the equipped character, your language, sound and difficulty preferences, and the flags for what the store has already confirmed as purchased. None of that needs us to be erased.

There is also a local value the game calls the purchase link. It is derived from the technical profile's identifier and is sent to Google Play when you buy something, so the receipt is attached to the right profile. It is not an account and not a personal identifier: it contains no name, email address or password. It is erased along with the other local data by either action in this section.

Clear the app's data

Under Settings › Apps › Droppy › Storage, the Clear data option (the exact wording varies by manufacturer) erases everything the game stored on the device, without uninstalling it. Droppy returns to the state of a fresh install.

Uninstall the game

Uninstalling removes the app and its data from the device. But note: uninstalling does not erase the copy Android has already sent to your Google account (section 3) and does not erase what exists on our server (section 4). That is why progress sometimes comes back on its own when you reinstall.

Your purchases are not erased by either action: they stay in your Google Play account, and non-consumable products come back with Restore purchases. For refunds, the route is Google Play, as the terms of use explain.

Droppy does not disable Android's automatic backup. The system, on its own, may include the game's local data in a copy kept in the device's Google account.

That copy is yours and Google's, not ours. We have no access to it, we do not read it and we receive no copy of it — so there is nothing on our side to be asked to erase, and we also cannot erase it for you. You are the one in control:

• to stop new copies: turn the backup off under Settings › Google › Backup, where you can disable the backup for this app or backups as a whole;
• to erase what has already been kept: delete the app's backup data in your Google account, through the Google One app or Google Drive.

The retention and behaviour of that backup are Google's, and follow Google's policies.

This is the part that depends on us, and the reason this page exists.

On startup, the game generates a random installation identifier and requests a technical profile from our server over HTTPS. This happens even if you never buy anything. It is not a login: the game does not ask for a name, email address, phone number or password, and the profile contains none of those.

The server keeps a persistent ledger, which records changes without erasing earlier entries. It holds:

• profile identifiers;
• cryptographic hashes of the installation identifier, of the technical credential and of the purchase tokens;
• the product purchased, the payment status, the grants, the expiries and the revocations.

The purchase token is processed during verification but is not stored in clear text in that ledger.

These hashes are not anonymous data. A cryptographic hash of the same identifier always yields the same result, and that is exactly what makes it possible to recognise the same installation from one time to the next — in other words, it allows correlation. We do not call them anonymous, and you should not read them as if they were.

Game progress does not go to that server: it receives no levels, coins, lives, trophies or preferences. What the server handles is your entitlement to purchased products.

The service stores no account identifier. There is no login, no link between the profile and an account of yours, and the server never receives a name, email address, phone number or password.

Server backups are kept for 14 days

Our server is backed up, and those backups are kept for 14 days. The honest consequence: even after a request has been carried out, a copy of your records may survive in the backups for up to 14 days, until the oldest snapshot falls out of the window.

That is a real limit, and we would rather state it than leave it out. It is not a retention period for the ledger — the ledger itself has no period (section 7); it is how long a safety copy takes to expire.

There are two routes, and they are not worth the same.

• with the code from the game — the route we recommend. The game issues a 10-character code under Settings › Privacy › My data; you enter that code in the form at the end of this page (or send the request from the game itself, on the same screen). The request is written to disk on our service before the answer goes out, and you get a reference to follow it with. It is the only route where we know which profile the request is about without asking you anything;
• by email — for anyone who cannot get a code: write to droppy@hostcapixaba.com.br. The mailbox is active and monitored by the publisher. That route depends on the verification described in section 6, and that verification may not be possible.

Repeating the notice at the top of this page, because it matters: tapping that address opens the email app on your device. That does not record a request in our system, does not send anything on its own, and is not a completed deletion. An email request exists once the message arrives, and the process starts when we reply.

What to write, if you go by email

• say that this is a Droppy data deletion request, and what you want erased;
• your device model and Android version;
• if you have bought anything in the game, the Google Play order number (GPA.…, in Google's confirmation email). It is the single most useful piece of information for locating your profile;
• if you only want to know what exists about you, say so — an access request and a deletion request are different things, and the first erases nothing.

Do not send card numbers, passwords or verification codes. We do not ask for them and we do not need them.

Before asking us, remember that the data on your device and the copy in your Google account are in your hands (sections 2 and 3): you can erase both without depending on us, and faster.

Droppy has no login. The server-side profile is tied to a random installation identifier, not to an email address — so we never receive your address through the game, and an email address by itself does not prove that a given profile is yours.

That has an honest consequence: verification may require additional information. So that we do not erase someone else's profile at the request of whoever wrote first, we may need something that ties you to the installation — typically the number of a Google Play order made on it.

And a more uncomfortable consequence, which we are also writing down: if there was never a purchase on that installation, there may not be enough information to tie you to the profile with any confidence. In that case we will say so in our reply, rather than erase something at random or promise a result we cannot guarantee.

What does exist, and solves this: the possession code from the game. It is issued inside the app, which is already authenticated, lasts 15 minutes, can be presented 5 times, and only one is active per profile. When that code goes into the form, the service knows which profile the request is about without you telling us anything — no email address, no order number, no device identifier.

The app's own credential, by contrast, never leaves it: not in a form, not in a page address, not in an email, not in an access log, not through support. The short code exists precisely so that the credential does not have to travel — it is single-use, it expires, and the worst a leak of it causes is a deletion you had already asked for.

What still does not exist is a link between a profile and an email address, and we will not describe one that does not exist. A request sent without the code is recorded for a person to look at, and erases no profile.

Stated plainly, because this is what you need in order to decide:

• there is no deletion through disuse. The server ledger does not erase itself after a period without use: deletion happens when you ask for it, and not before;
• there is no promised turnaround for a request. We will not publish a number that has not been decided — and while there is none, the form and the game say so instead of showing a deadline;
• server backups are kept for 14 days, so a copy may survive in the snapshots for up to 14 days after a request has been carried out (section 4);
• a request with the code reaches the purchase profile (section 4), and nothing else. It does not erase what is on your device or the copy in your Google account — those two are in your hands, per sections 2 and 3 — nor what Google and Unity hold (section 8);
• tracking is by reference, and the reference is shown once, in the answer to the request. It is not derived from your profile, on purpose; if you lose it we cannot recover it for you, and what is left is email;
• a request without the code erases nothing. It is recorded for a person to look at, and without proof of possession there is no way to tell which profile it is about;
• uninstalling the game does not erase the server ledger, the data held by our providers, or necessarily the Android backup;
• some records may have to be kept because of a legal obligation or the need to defend a claim — the history of a disputed purchase, for example. Where that applies, we will say what was erased and what was kept, and why.

None of this is a promise that it will stay this way: it is a description of the state of things today, 10 November 2026. When it changes, this page changes, with the date at the top.

Part of the game's data is neither with you nor with us, and we cannot erase it:

• Google Play — your account's purchase history, the payment and the refund. It lives in your Google account, under Google's policies;
• Google Mobile Ads and UMP — what the advertising and consent components process, including the device's advertising identifier. You can reset or delete that identifier under Settings › Google › All services › Ads, and review your account's ad preferences at adssettings.google.com;
• the Android backup — the copy of your progress in your Google account, described in section 3;
• Unity IAP — purchase events and details, device, installation and session identifiers, technical information and the approximate country derived from the IP address, processed by Unity.

Requests about that data go to whoever processes it: the Google privacy policy, the Unity game-player and app-user privacy policy and the Unity IAP privacy documentation. If you write to us, we will point you the right way.

The self-service deletion route, with proof of possession and tracking by reference, is live: it is the form in section 10. What does not exist yet, said so that nobody assumes otherwise:

• a published turnaround. The field exists on the service and the form shows it if there is a number; while the turnaround has not been decided, the screen says there is none;
• an automatic completion notice. We do not email you when a request finishes — we do not have your address. Whoever wants to know checks the reference;
• a link between a profile and an email address, which is why no request can be handled on an email address alone (section 6).

When any of those changes, the change will be described on this page and in the privacy policy, with the update date at the top — not before.

This page also exists in Portuguese. Where the two versions disagree, the Portuguese text prevails.