Privacy Policy

Droppy is developed and distributed by HOST CAPIXABA LTDA, referred to below as “we”. We decide which components the game uses and why, which makes us the controller of the data processed through the app.

This policy covers the Droppy app distributed on Google Play and the game's web page. It exists in eight languages, and the addresses chosen for it are:

• game page: https://hostcapixaba.com.br/droppy
• Portuguese: https://hostcapixaba.com.br/droppy/privacidade
• English: https://hostcapixaba.com.br/droppy/privacy
• Spanish: https://hostcapixaba.com.br/droppy/privacy/es
• French: https://hostcapixaba.com.br/droppy/privacy/fr
• Italian: https://hostcapixaba.com.br/droppy/privacy/it
• German: https://hostcapixaba.com.br/droppy/privacy/de
• Japanese: https://hostcapixaba.com.br/droppy/privacy/ja
• Arabic: https://hostcapixaba.com.br/droppy/privacy/ar

These nine pages are published, and they were confirmed live on 27 October 2026 at the addresses above — the same ones the app opens. The app builds them with a trailing slash (/droppy/privacy/), a form that leads to the same page. The email address in section 12 is active as well. What does not exist yet is a release of the app on Google Play: publishing these pages is not publishing the app.

The eight translations carry the same content. If they diverge, the Portuguese text prevails.

It does not cover what happens inside Google Play itself, or inside an ad you choose to open — Google's policies and the advertiser's policies govern those.

The app and this web page

Almost everything in this policy describes the app. This web page is a page of the HOST CAPIXABA LTDA website: it embeds no advertising, it does not use your device's advertising identifier, and it reads nothing from your device on the game's behalf.

What this page does is what the website does. Website audience measurement is only loaded after you accept the Analytics category in the consent notice the site shows, and your choice is kept in your own browser rather than sent to us. Declining does not prevent you from reading this policy. As of the date of this revision, the production site is published with no measurement identifier configured, so no measurement tag is loaded at all. The details are in the company's Privacy Policy and Cookie Policy, both in Portuguese.

We run no server, ask for no account or sign-in, and never receive your name, email address or phone number. The game has no cloud save and no leaderboards: both are unavailable in this version, and the game's own screens say so. Your progress stays on your device — and, through Android's automatic backup, in a copy held on your Google account, which we cannot see.

That does not mean the app collects nothing. It embeds Google components for advertising, consent and purchases, and those components collect data of their own when they are used — including your device's advertising identifier. Sections 4 through 7 describe exactly what.

The app does not ask your age. There is no year-of-birth question, no age screening and no parents' area with a challenge. The age band, when it is known, comes from a platform signal (Google Play Age Signals) and only from what that signal actually shares.

No age-signal source is integrated into the app. With no signal the band stays unknown — and an unknown band receives no ads at all: the advertising component is never even initialised. The current build is the exception: it is a test build, it is not on Google Play, and in it a test option declares the band teenager for the session so that advertising can be exercised with demo ads — so there the advertising component is initialised. Sections 4 and 9 describe that in detail.

Playing requires no account, no purchase and no consent to advertising.

The game writes the following to local device storage (the Unity engine's PlayerPrefs mechanism):

• your high score: the overall record and the records per world and per difficulty;
• your total coin count;
• the character you have equipped and which characters you have unlocked;
• your lives balance — how many free lives and how many purchased lives you hold, and the instant, in UTC, from which the next free life is counted. The refill uses the device clock in UTC; time zones and daylight saving do not generate lives. A life is credit to continue after losing: starting and restarting a run is always free, even with zero lives;
• your story progress — levels completed, best score per level and per difficulty, the last level played, which story scenes you have already seen, your trophy total, the trophies of each level and the water fragments of each world. All of it stays on the device only: there is no cloud save and no leaderboard in this version;
• the mode and the world you last chose;
• your preferences: language, sound and difficulty;
• a flag recording what the Google Play store has already confirmed as purchased, so a purchase keeps working while the device is offline;
• the list of Google Play purchase tokens that have already been credited, so that a lives pack is never credited twice. These are opaque codes issued by Google Play for that purchase: they are not payment data, they do not identify you, and the list holds at most the 64 most recent purchases;
• the age band, when there is one, and its origin. The band is a number from 0 to 3, meaning “unknown”, “under 13”, “13 to 17” or “18 or older”. That is all that is stored: we keep no age, no age range and no year of birth, and none of it is sent to us.

There is no text field anywhere in the game, no chat, no public profile and no player name. The account and sync screen shows the player as “local player”, which is the “no account” state — not a nickname of yours.

We do not send any of it anywhere, because we have no server to send it to. But this data does not stay on your device alone: the app does not switch off Android's automatic backup, so Android includes this file in Android Auto Backup and copies it to the Google Drive of the device's Google account. That is why, when you reinstall the game or move to a new device, your progress usually comes back on its own — high score, coins, lives, story progress, trophies, equipped character and unlocks intact.

That backup is managed by Android and Google, not by us: we have no access to it, we never read it, and we receive no copy. You are the one who controls it, through your Google account — section 8 explains how to switch it off and how to delete what has already been stored.

The game uses no usage-analytics tooling. The Unity services — Analytics, Crash Reporting, Performance Reporting and Unity Ads — are disabled in the project and are never initialised.

The app embeds three Google components. They run inside the app, but the data processing is done by Google, under Google's policies.

The table above describes what these components collect when they are used. They are not used in every situation — the block below explains when they are not.

When advertising is never initialised

There are four cases in which the advertising component is never initialised and therefore collects nothing — not even the advertising identifier:

• when the age band is unknown, as section 9 explains. No ad request is made, no rewarded ad is offered, and the device advertising identifier is not read;
• when the known age band is child, under the same rule;
• when you buy the ad removal;
• when a published version of the game ships with advertising disabled in its configuration. That is a condition of a particular release, not a general rule.

Outside those cases — that is, with a known teenager or adult band, in a release where advertising is active and without the removal purchase — everything in the table above applies in full.

The consent component (UMP) deals with consent to advertising, and with nothing else. It is never a condition for playing: a round of the game happens with no consent at all, in every band. And where the advertising component is never initialised, no choice made there results in an ad request.

State today: there is no published release. The current build of Droppy is a test build that is not on Google Play. In it, advertising uses our account's application identifier but with Google's demo ad units: the ads that appear are test ads and no monetised impression is generated. So that advertising could be tested, that build declares the band teenager through a test option — not through a platform signal, only for the duration of the session, and without writing anything to the device. As a result, in that build the advertising component is initialised, the device advertising identifier can be read by it, and the consent form is requested where the rules of the region require it. A demo ad uses the real component: the ad unit being a test one does not remove the data handling described in the table above. The Privacy screen identifies that band as coming from test configuration, never as a platform signal, and the check that precedes a store submission refuses any store build with that option on. Once there is a published release, this section describes the state of that release, and the text is updated along with the dates at the top of the page.

These permissions are present because the libraries above require them. None of them grants access to your camera, microphone, contacts, files or precise GPS location.

• INTERNET and ACCESS_NETWORK_STATE — fetching ads and talking to Google Play.
• com.android.vending.BILLING — opening the Google Play purchase flow.
• com.google.android.gms.permission.AD_ID — reading the device advertising identifier. Android 13 and later require this permission from apps that use that identifier. A declared permission is a possibility, not a use: with an unknown or child age band, and after the ad removal purchase, the identifier is never read, because the advertising component is never initialised. In the current test build, where the teenager band comes from a test option, the component is initialised and may read that identifier in order to serve the demo ads.
• ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION and ACCESS_ADSERVICES_TOPICS — Android Privacy Sandbox interfaces, used by the advertising component to measure and select ads through the operating system's own APIs.
• WAKE_LOCK and FOREGROUND_SERVICE — declared by Android support libraries used by the SDKs above. They do not grant access to any personal data.

There is no account, identity, precise-location or contacts permission, and no age-related permission of any kind: the app has no way of looking up the age of whoever is playing.

The data described in section 4 goes to Google, acting as the provider of the advertising, consent and billing services. We do not sell data and we send it to no other recipient.

No ad mediation network is configured in this app, so no other advertising network receives data through it. There is also no game server, no cloud save and no leaderboard active — so there is no other destination data could go to.

Google operates globally, so this data may be processed outside your country. Google's rules for that are in the documents below:

• Google Privacy Policy
• How Google uses information from sites or apps that use its services
• Google Play Terms of Service

The game offers three kinds of paid product, all processed entirely by Google Play:

• the ad removal — a one-off, non-consumable, restorable purchase;
• two characters — one-off, non-consumable, restorable purchases;
• a pack of 10 lives (lives_pack_10) — a consumable product, which can be bought more than once. Like every consumable, it is not returned by “Restore purchases”: what you receive is the lives balance described in section 3.

Until these products are registered on Google Play, the in-game store reports them as unavailable and no purchase is possible. The app invents no price: the amount shown is always what Google Play answers, in your account's currency.

Payment happens in Google Play's native sheet, not in our interface. Tapping to buy opens that sheet directly, in every age band, with no arithmetic challenge and no age question: it is Google Play that authenticates the purchase, asks for family approval where the account requires it, and applies the account's rules. The app has no way of verifying the age of whoever is buying, and it claims otherwise nowhere.

Because of that, the game never sees and never stores card details, name, address, identity documents or any other billing data. What the app receives is Google Play's answer about which products your account owns and, for the consumable, the token of that purchase. All it keeps from that is what section 3 describes: the local confirmed-purchase flag and the list of tokens already credited.

Refund requests and your full purchase history live in your Google Play account.

• The Privacy screen inside the game. Under Settings › Privacy you will find, in one place, the link to this policy, the advertising options and the age-band control. Nothing there requires a purchase, a sign-in or a challenge: the policy and consent are rights of whoever uses the app, not a reward.
• Advertising options. Where consent rules require it — today, the European Economic Area, the United Kingdom and Switzerland — the game shows a Google consent form before requesting ads, and the Privacy screen reopens that form so you can review or withdraw your choice at any time. In regions where the form is not required, the button does not appear. Consent is never a condition for playing — and where the advertising component is never initialised, no choice made in that form causes the game to request an ad.
• Erasing the stored age band. The same Privacy screen has a control that erases the band stored on the device and returns it to the unknown state. It requires no purchase, no sign-in and no challenge, and erasing is always more restrictive than keeping: an unknown band receives no ads.
• Advertising identifier. On Android, under Settings › Google › All services › Ads, you can reset the identifier — which breaks the link to earlier activity — or delete it, which stops apps receiving an identifier from this device at all. Your Google account's ad preferences live at adssettings.google.com.
• Advertising by purchase. Buying the ad removal turns off the game's advertising permanently, and the advertising component stops being initialised.
• Your progress and Android's backup. Uninstalling the app removes the high score, coins, lives, story progress, trophies, unlocks and purchase flags from the device — but it does not remove the copy Android has already sent to your Google account, which is why your progress returns when you reinstall. To stop that backup, turn it off in Android under Settings › Google › Backup, where you can disable the backup for this app or backup as a whole. To erase what has already been stored, delete the app's backup data from your Google account, through the Google One app or Google Drive. We have no access to that copy, so there is nothing on our side to request deletion of. Purchases do persist on your Google Play account, and the non-consumable ones come back with the Restore purchases button.
• Your legal rights. Depending on where you live, you may have the right to request access to, correction of, portability of or deletion of your personal data, and to object to certain processing. Write to the address in section 12. Since we keep no identifiable database, most such requests in practice have to be directed to Google, and we will point you to the right place.

Droppy's intended audience is children, teenagers and adults. A child may play, and this section describes exactly what happens to a child's data.

The age groups to be declared on the Google Play listing are 9–12, 13–15, 16–17 and 18 and over. The listing has not been filled in yet — the app is not published — and those groups are a store declaration rather than a concept that exists inside the game: the app knows only the bands described below.

Playing requires nothing. A round of the game is reachable with no account, no purchase and no consent to advertising. There is no registration, no chat, no public profile and no field anywhere in the game where a player can type anything about themselves.

The app does not ask your age

Droppy does not ask for a year of birth, does not ask for an age and has no age screening. The age question that existed in earlier versions has been removed, and with it the parents' area behind a multiplication sum: there is no parental gate anywhere in the game, and nothing replaces it. The app opens and lets you play without asking anything.

The age band, when it is known, comes from a single origin: a platform signal — the Google Play Age Signals API — and only what that signal actually shares. Of what arrives, the app keeps only the resulting band and its origin, as section 3 describes. It keeps no age, no received range and no date or year of birth.

When the signal brings an age range, the band is decided by the most protective end — the lower bound of the range. A range that crosses a threshold never produces the more permissive treatment.

This is not age verification. The app does not prove anyone's age: it asks for no document, asks for no email address, checks no answer against any database, and infers no age from a sign-in, from purchase authentication or from family approval. We do not claim anywhere that Droppy verifies age. Even a signal saying “18 or older” may be information the person declared to the platform themselves — and the game claims nothing to the contrary.

Unknown band: the most restrictive case

The integration with the age-signals API is not in the app, so the query always answers “unavailable”. The practical consequence, stated plainly:

• the band of a new installation stays unknown, except in the test build described just below;
• an unknown band is treated as the most restrictive case and receives no ads at all: no full-screen ad and no rewarded ad;
• the advertising component is never initialised. Since there is no initialisation, the device advertising identifier is neither read nor sent, and the operating system's advertising interfaces are not invoked by the game;
• the absence of a signal does not become adult. Unknown means unknown, and the treatment is the most protective one.

In that state, all that exists about the player is what section 3 lists: progress written to the device itself. There is no processing of data for advertising.

The test option in the current build

The current build of Droppy is a test build and is not on Google Play. It carries a configuration option, used only to test advertising, that declares the teenager band when no band exists yet. Precisely what that means:

• it is not a platform signal and says nothing about the age of whoever is playing. The Privacy screen identifies it as test configuration;
• it lasts only for the session: nothing is written to the device, and closing the game undoes the band;
• it only works in builds that use Google's demo ad units — there is no way to turn it on in a build that serves real ads;
• the check that precedes a store submission refuses the build if that option is on, so no distributed release can ship with it;
• while it applies, the app treats the player as a teenager, with everything that implies in the table below: the advertising component is initialised, demo ads are requested, and the device advertising identifier may be read.

A band declared in an earlier version

An installation coming from an earlier version of the game may hold a band that the player declared themselves in the screening that existed back then. That band remains valid — it is data the person provided, and discarding it silently would take away features the product already offered. In the app it is identified as a declaration by the player, never as a platform signal, and the Privacy screen says so in those words. It can be erased at any time with the control described in section 8.

What each band receives, when it is known

While the distribution territories are not settled, the app uses the most protective thresholds that hold anywhere: under 13 is a child; 13 to 17 is a teenager; 18 and over is an adult. If any market requires more than that, the thresholds are revised, and the dates at the top of the page change with them.

• Child — no ads and no rewarded ads, exactly as with the unknown band. The advertising component is never initialised.
• Teenager — a teenager is not an adult, and the app does not treat one as an adult. In many countries the minimum age for consenting to the use of personal data for advertising is higher than the age at which the game may be installed. A teenager's ad requests are therefore tagged with teen age treatment, which according to Google's documentation disables personalised ads and remarketing and applies the ad-serving protections defined for that group. The maximum content rating for the ads received is T, for teen.
• Adult — where consent rules apply, an adult player sees the Google consent form before the game requests ads, and can review or withdraw that choice at any time through the Privacy screen. An adult's ad requests carry no under-age tag, and the maximum content rating stays at T, for teen.

These rules are in force in the app. With no known band, the most restrictive case applies — no ads for anyone. In the current test build the teenager band comes from the test option described above, and what this table describes for a teenager applies to it, with demo ads.

Purchases, lives and the rest of the game

The age band decides advertising, and nothing else. It locks no content and locks no store:

• the in-game coin store works for everyone: coins are earned by playing and stay on the device, as described in section 3, and the coin skins remain unlockable;
• real-money purchases lead straight to Google Play's native sheet, in every band, as section 7 describes. It is Google Play that applies the account's rules, the authentication and family approval;
• continuing after a loss comes from the lives wallet described in section 3, the same for every band. The rewarded ad is only an additional source of continues, offered solely to those who may receive ads. Starting and restarting a run is always free, even with zero lives;
• no free content is locked away because of the age band.

What this policy does not claim

We do not claim that Droppy takes part in the Google Play Families programme, that it has been approved for any age group, or that it has a content rating. Those declarations are made in the Play Console, which has not been filled in — the app is not published. When they are made, this section is revisited.

We also do not claim that the game verifies age, that it has leaderboards, that it has a cloud save or that it requires an account: none of those is active, and the game's own screens say they are not.

If the app's intended audience changes, this section and the advertising configuration change with it, and the dates at the top of the page are updated.

If something went wrong

If you are the parent or guardian of a child or a teenager and believe their data was collected through the app when it should not have been, write to us using section 12. Since we keep no identifiable database, there is no record of ours to erase; whatever exists will be with Google, and we will point you to the right place. You can also, at any time, erase the stored band from the Privacy screen and control advertising at device level through the settings in section 8 — including deleting the advertising identifier.

• On the device: for as long as the app is installed. Uninstalling removes everything described in section 3 from the device. The list of purchase tokens holds at most the 64 most recent purchases: once that limit is passed, the oldest ones drop out.
• On your Google account: for as long as Android's automatic backup keeps the copy of your progress. Google discards an app's backup after a period without use, and you can delete it sooner through your account, as described in section 8. That copy is yours and Google's — it is not ours, and we have no access to it.
• At Google: for the periods set out in the Google policies listed in section 6. We have no control over those periods and no access to those records.
• With us: nothing, other than the emails you send us, which we keep for as long as it takes to answer and resolve the matter.

When this policy changes, the new text is published on these same eight pages and the dates at the top are updated. If a change is significant — for example a new component that collects new data, or the arrival of an age-signal source — it will also be announced in the app's release notes on Google Play.

Continuing to use the app after the effective date means the updated version applies to you.

Questions, personal-data requests or complaints:

droppy@hostcapixaba.com.br

This mailbox exists and is active: delivery to it was confirmed on 27 October 2026. It is the address for anything concerning Droppy.

Responsible owner: HOST CAPIXABA LTDA