Menu
Legal

Privacy Policy

Effective: 10 August 2026.

1. Scope and controller

This Privacy Policy explains how Ioannis Kagiorgis, operating under the brand Drystone Games (“Drystone Games,” “we,” “us,” or “our”) collects and uses personal data when you visit this website, contact us, or use Pirates of the Cyclades on iOS or Android (the “Game”). For European data-protection law, the controller is Ioannis Kagiorgis.

Privacy and support email: support@drystonegames.com

The Game is available on mobile. Production advertising, paid Gem purchases, purchase verification, Game Center, Google Play Games, and cloud-save services are not presently enabled. This Policy identifies those features as inactive where relevant; we will update it before enabling any feature that materially changes processing.

2. At-a-glance facts

  • No Drystone Games account is required. The Game has no chat, social feed, multiplayer, or publicly shared user content.
  • Ordinary progress and settings are stored locally on your device and are not uploaded to us merely because you play.
  • We do not ask for your name, email, contacts, photos, precise location, or payment-card details in ordinary gameplay.
  • The release build includes GameAnalytics for product analytics. You can disable analytics in the Game’s privacy settings; disabling it stops new analytics event submissions.
  • Optional rewarded ads use Google AdMob when live serving is enabled.
  • We do not sell personal data for money. Before personalized advertising or any activity treated as a “sale” or “sharing” under applicable United States state law is enabled, we will provide the required notice and choice.

3. Data stored only on your device

The Game keeps an offline-first local save, which may include your settings and privacy choices; Coins and Gems; level and progress; ships and upgrades; owned or equipped cosmetics; bounty, achievements, and statistics; and world state such as position, unsold loot, and island control. A recent local backup may be retained to recover a damaged primary save. This information remains on your device unless a separately disclosed feature transmits it.

We do not have routine access to local saves and ordinarily cannot restore them. Deleting the Game or clearing its data can delete local progress, subject to operating-system or store-platform backup behavior.

4. Personal data we process

Website visits

Our hosting and security provider, Cloudflare, automatically processes request and security data needed to deliver and protect the website, such as IP address, request time, requested URL, browser or device information, referring page, and security signals. Cloudflare Web Analytics is not currently enabled on this website. If it is enabled, this Policy will be updated as needed and the site will request consent where law requires it.

Support and other communications

If you email us, we receive your email address, message, attachments, and any information you choose to provide. To diagnose a problem, you may choose to provide your device model, operating-system and Game versions, approximate event time, screenshots, or a relevant pseudonymous identifier. Please do not send payment-card details, store credentials, complete receipts, or unrelated sensitive information.

GameAnalytics

When analytics is enabled, the Game sends GameAnalytics a randomized persistent user identifier and session, build, platform, device type/model, operating-system, locale/country, IP address, and gameplay or app-use events. Our custom events concern operation and product improvement, such as session readiness, progression, ship outcomes, shops, in-game economy changes, cosmetic transactions, and rewarded-ad lifecycle events. Controlled content identifiers may be included.

Our event design prohibits names, email addresses, advertising identifiers, precise location, free-form player text, save files, store receipts, and store transaction IDs in custom analytics fields. GameAnalytics may nevertheless process IP address and device data automatically as described in its documentation. Analytics is not used to ask Apple for advertising-tracking permission.

Optional rewarded ads

When production ad serving is enabled and you request a rewarded ad, Google AdMob / Google Mobile Ads may process IP address, general location derived from IP, device and app information, advertising or app-instance identifiers where permitted, consent signals, ad interactions, diagnostics, and fraud-prevention data to select, deliver, limit, secure, and measure the ad and to report completion. Google’s User Messaging Platform (“UMP”) processes and stores privacy choices and displays a privacy-options entry point when required.

Unity Ads is packaged as a potential mediation source but is not active and is not presently a recipient of player data through this Game. Before live ads are enabled, we will reconcile this Policy with the complete ad-partner list displayed by UMP. Declining an ad does not block ordinary gameplay; if you request but do not complete an ad, you receive no reward.

Purchases

Paid Gem packs and production receipt verification are not currently enabled. If enabled, Apple or Google will process the purchase under its own terms and privacy policy. We will not receive full payment-card details. The planned verification process would receive the platform, a random installation identifier, app/package identifier, product ID, and Apple receipt/transaction evidence or Google purchase token, and would retain an idempotent transaction and entitlement record to fulfill the purchase and prevent duplicate grants or fraud. We will name the operator, hosting provider, locations, retention period, and request procedure here before this processing goes live.

Platform game services

Apple Game Center, Google Play Games, achievements synchronization, and platform cloud saves are not currently enabled. If enabled, we will describe the platform identity, achievement and saved-game data involved, synchronization behavior, and choices before activating those services. There is no universal Drystone Games account or planned cross-platform save transfer.

5. Why we process data and our legal bases

Where the GDPR, UK GDPR, or a similar law applies, we rely on the following legal bases:

  • Provide the Services and requested support (contract): deliver the website and Game, respond to support requests, deliver a requested ad reward, and, if enabled, verify and fulfill a purchase.
  • Operate, improve, and secure the Services (legitimate interests): understand reliability and gameplay at an aggregated or pseudonymous level, fix errors, balance the Game, prevent fraud, secure the website, and establish or defend legal claims. We consider the nature of the data, your choices, and the offline-first design when balancing these interests.
  • Consent: non-essential device storage or access, analytics, personalized advertising, advertising identifiers, and similar processing where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.
  • Legal obligation: comply with tax, accounting, consumer-protection, law-enforcement, and data-protection obligations.

6. Recipients and their roles

  • GameAnalytics ApS / GameAnalytics Limited: analytics processor for pseudonymous gameplay, device, and session data when analytics is enabled.
  • Google: independent controller for AdMob advertising and UMP consent services when production ads are enabled, and for Google Play purchase processing if purchases are enabled.
  • Apple: independent controller for App Store purchase processing if purchases are enabled.
  • Cloudflare: provider of website hosting, delivery, and security.
  • Professional advisers, authorities, and transaction parties: where reasonably necessary to comply with law, protect rights and safety, establish or defend claims, or complete a lawful business reorganization or transfer with appropriate safeguards.

We do not permit providers acting as our processors to use personal data for their own unrelated purposes. Providers acting as independent controllers determine their own processing under their privacy notices.

7. Advertising and analytics choices

You can disable GameAnalytics collection through the Game’s saved privacy setting. This stops new event submissions but does not automatically erase data already processed. Where UMP requires it, the Game’s Settings menu provides a “Privacy choices” entry point through which you can review or change available advertising choices. Your operating system may also provide advertising-identifier or tracking controls. On iOS, the Game will not request App Tracking Transparency permission unless the final production practices require it and the request is implemented before tracking occurs.

Consent withdrawal may affect future personalized advertising or measurement but does not make optional rewarded ads or past lawful processing disappear. Where available, non-personalized or limited ads may still use contextual information and process data for delivery, frequency, security, and fraud prevention.

8. Retention

  • Local save: retained on your device until overwritten or deleted by you, the Game, or the platform’s data-management behavior.
  • GameAnalytics: under its current data-processing terms, raw and annotated data is retained for one month, Player Warehouse data for one year, and player lookups used to calculate retention for eighteen months; some aggregated, non-identifying statistics may remain longer. We may request earlier deletion where appropriate.
  • Support: retained while we handle your request and afterward only as reasonably necessary for follow-up, security, disputes, and legal obligations.
  • Website and ad-provider data: retained under our provider configuration and the provider’s applicable retention rules for only as long as needed for delivery, security, measurement, fraud prevention, consent records, and legal compliance.
  • Purchase records: not presently collected by us. A specific schedule will be published before verification goes live, taking account of entitlement, anti-fraud, tax, accounting, refund, and legal-recordkeeping needs.

9. International transfers

Some providers process data outside your country. GameAnalytics states that mobile-game data may be hosted in the United States (AWS us-east-1) and that it uses the European Commission’s Standard Contractual Clauses, the UK addendum or International Data Transfer Agreement, and supplementary measures where required. Google and Cloudflare operate globally and describe their transfer safeguards in their privacy documentation. Where we are responsible for a restricted transfer, we use an adequacy decision, approved contractual clauses, or another lawful safeguard and assess supplementary measures as required. You may contact us for information about applicable safeguards.

10. Your privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to access, correct, delete, or obtain a copy of personal data; restrict or object to processing; withdraw consent; and complain to a data-protection authority. Where processing is based on consent or contract and carried out by automated means, you may have a right to data portability. You also have the right not to be discriminated against for exercising applicable privacy rights.

Email support@drystonegames.com to exercise a right. Because there is no Game account, tell us the relevant platform, approximate dates, and the feature involved, and provide only a randomized analytics or installation identifier shown by the Game if one is available. Do not send a complete store receipt or government ID unless we specifically and lawfully request information needed to verify your request. We may be unable to link analytics data to you if you cannot provide the relevant pseudonymous identifier, and reinstalling or clearing app data may change it.

If you are in the EEA, you may complain to your local supervisory authority or the Hellenic Data Protection Authority. UK residents may contact the Information Commissioner’s Office. We encourage you to contact us first so we can try to resolve the concern.

11. Children

The Services are offered as a general-audience product and are not directed to children under 13 or placed in Apple’s Kids Category. We do not knowingly collect a child’s name, contact details, or account profile through the Game. A parent or guardian who believes a child has provided personal data without the authorization required by applicable law should contact us; we will investigate and delete or restrict the data where required.

Age thresholds and advertising rules differ by country and platform. Before release, we will finalize and document the intended audience and configure analytics, ads, consent, and store declarations accordingly. If the Game is later directed to children, used with actual knowledge of children, or offered as a mixed-audience service, we will conduct a separate child-privacy review and update the experience and this Policy before that change.

12. Security

We use reasonable technical and organizational measures appropriate to the nature and risk of the data, including minimizing custom analytics fields, randomized identifiers, transport security for network services, access controls, and provider diligence. No service or storage method is completely secure, so we cannot guarantee absolute security.

13. Automated decisions

We do not use personal data to make decisions that produce legal or similarly significant effects about you. Automated systems may detect invalid traffic, fraud, duplicate purchase fulfillment, or ad eligibility, subject to provider controls and your applicable rights.

14. Changes to this Policy

We may update this Policy to reflect changes in the Game, providers, law, or our practices. We will post the revised version with a new effective date and provide additional in-app or other notice where a change is material or law requires it. Where consent is required for a new purpose, we will request it before that processing begins.

15. Contact

Privacy questions and requests should be sent to support@drystonegames.com.