YOUR PRIVACY

Privacy Policy

Updated 19 October 2026

Your game progress stays on your device. This policy explains purchases, support and this website, and distinguishes released version 1.2 from the upcoming 1.3 update.

Who is responsible

Alex Vaitsiakhovich, trading as Alex Cozy Games and based in Cyprus, provides Worm Garden and is responsible for personal information handled for our support service and website. Contact: support@alexcozygames.com. Studio enquiries: hello@alexcozygames.com.

Which version are you using?

Version 1.2 is publicly available and contains Harvest gameplay, Apple purchases, Google Mobile Ads with UMP, and optional AppsFlyer analytics without IDFA. Version 1.0 was the earlier puzzle game without advertising or gameplay analytics SDKs.

The upcoming version 1.3 adds optional native Firebase Analytics alongside AppsFlyer, aggregate advertising attribution, and a separate optional Apple tracking choice. The 1.3 disclosures below apply only to builds containing these features; they do not mean that 1.3 is already publicly released. Firebase Hosting for this website is separate from analytics in the app. No game account is required.

Information stored on your device

The game saves progress, ratings, active attempts, cosmetics, earned currency and supplies, tutorial progress, local activities, and sound and motion preferences. Version 1.2 also stores Harvest activities and local reward and purchase-delivery receipts. Device time is used for local activities. The game does not upload this saved profile to a developer-operated gameplay server.

The game does not request contacts, photos, camera, microphone or precise location. Version 1.2 does not request Apple tracking permission. Version 1.3 can request it only after you choose advertising attribution, as explained below. Advertising services may still process data when tracking is declined.

Purchases through Apple

Apple processes payments. StoreKit verifies transactions and permanent entitlements, restores eligible permanent purchases and responds to refunds or revocations. We do not receive your payment card details or Apple Account password. Transaction identifiers are stored locally as needed to avoid duplicate delivery; they are not sent to a developer-operated server. If you enable optional analytics, verified production purchases send product, amount, currency, quantity and transaction identifiers to AppsFlyer. Version 1.3 also logs verified Apple purchases with Firebase Analytics. We do not send payment card details, your Apple password or raw signed purchase receipts in our measurement events.

Version 1.0 offers No Ads + Extras, a non-consumable purchase. Version 1.2 also includes the consumable Gardener’s Bundle and Play On Pack. None is a subscription. Consumables do not restore a spent or deleted local balance. Apple maintains its own transaction records under the Apple Privacy Policy. See license and purchase information for version-specific benefits.

Advertising

Versions 1.2 and 1.3 integrate Google Mobile Ads and UMP. Rewarded videos are optional and grant only the displayed benefit after completion. Occasional interstitial ads appear only when continuing after a completed Story bed, with introductory protection and frequency limits. There are no banners. No Ads + Extras suppresses both formats. Story retries remain free; an unavailable ad does not block continuing Gardens. Ad availability can depend on privacy choices.

Google’s services may process IP addresses and approximate location inferred from them, device or app identifiers, ad impressions and interactions, app interactions, consent choices, crash reports, performance and diagnostic data. The purposes include delivering and measuring advertising, handling privacy choices, preventing abuse and diagnosing service performance. Advertising measurement is separate from the optional gameplay analytics described below.

The current build requests non-personalized ads and disables publisher first-party ID and publisher privacy personalization. This does not make ads anonymous or eliminate data processing. UMP requests applicable privacy choices, and Advertising privacy in Settings lets you revisit them when that option is available. UMP is separate from Apple’s tracking permission. Availability depends on region, privacy choices, connectivity and service configuration.

Google receives information directly when these services are used. See Google’s Privacy Policy, Google’s use of information from partner apps, and Google’s iOS advertising data disclosure.

Optional analytics and attribution

Analytics is off until you agree. In version 1.2, that choice covers AppsFlyer. Version 1.3 asks again before expanding an older AppsFlyer-only choice to Firebase Analytics. Declining does not limit Gardens, purchases or earned progress. In Settings you can turn analytics off at any time.

With analytics enabled, Firebase Analytics receives app sessions and screens, tutorial progress, Story and Daily attempt events (bed, outcome, moves and observed active time), first clears, supply use, offer interactions, granted rewards, account milestones, and verified production purchases. AppsFlyer receives selected attribution and progression events, purchases, and advertising revenue. Both services process installation identifiers and device, SDK and network information. AdMob can send ad impressions and revenue to linked Firebase Analytics when analytics is enabled. These are app-installation records, not anonymous statistics merely because you have no game account.

We do not send your full saved profile, board routes, name, email address, payment card details or raw purchase receipts in these events. AppsFlyer IDFV collection and Apple Ads token attribution are disabled. Firebase advertising-ID support, IDFV collection, ad personalization and on-device advertising conversion features remain disabled. AppsFlyer IP masking is enabled; network services still receive an IP address to communicate.

Additional tracking choice in version 1.3

After accepting analytics, you may separately choose Advertising attribution in Settings and review Apple’s App Tracking Transparency prompt. Only if both choices allow it can AppsFlyer use the IDFA advertising identifier and share attribution and selected gameplay and purchase events with Google Ads to measure which advertising brought players to the game. Google Mobile Ads may also access the advertising identifier when Apple permission and the app’s privacy conditions permit. This cross-company advertising measurement is tracking under Apple’s rules. It does not enable personalized ads in our app.

If you decline or Apple restricts tracking, the app does not use IDFA for this measurement and blocks AppsFlyer user-level sharing with advertising partners. With analytics consent, Apple’s SKAdNetwork can still provide delayed, limited aggregate attribution, including modeled revenue bands. It does not identify an individual player or guarantee a complete count. We do not use fingerprinting as an alternative to permission. Google Ads advanced data sharing, retargeting and modeled on-device conversion features are not enabled.

Change the app choice in Settings → Advertising attribution, or Apple permission in device Settings → Privacy & Security → Tracking. On the next foreground and before app-originated measurement sends, the app checks the current permission, disables IDFA/sharing when no longer permitted and discards its pending event queue. Withdrawing analytics also disables both measurement integrations. Some advertising offers may be unavailable while privacy conditions prevent an ad request. Playing Gardens and free Retry remain available.

Withdrawal stops new app measurement; it does not automatically delete records already received by a provider or recall an in-flight request. Firebase-local analytics are reset on withdrawal. App-owned unsent events have a maximum 14-day retention and a bounded queue. Provider retention and server-side deletion are separate. Reinstalling or deleting the app does not by itself delete provider records.

For access or deletion, contact support@alexcozygames.com. Settings → Privacy request ID retains the relevant AppsFlyer and Firebase identifiers after withdrawal; include them before deleting the app. We use the providers’ supported data-subject request procedures and confirm the outcome. Records required by law and provider backups may have separate retention requirements. See AppsFlyer’s Services Privacy Policy and Google’s Privacy Policy. Consent to analytics, optional tracking, and UMP advertising choices are separate; declining one does not grant another.

Support correspondence

If you email support, we receive your email address, message, attachments and ordinary email metadata. Device or app details are supplied by you, not automatically sent by the game. We use this information to reply, investigate problems, help with purchases and handle privacy requests. It is not used for advertising or mailing lists.

Support and studio mail use Google Workspace/Gmail. Incoming messages are also copied to the developer’s private Gmail inbox, while originals remain in the work mailbox. Both are used to handle your enquiry. The private mailbox address is not a public contact address.

Our older support pages remain accessible on Google Sites. If you choose to use their existing Google Form, Google Forms stores your reply email, message and submission timestamp privately in the developer’s account, and notifications go to Gmail. Form responses are not published. The new studio website contains no embedded form.

This website and service providers

This static website is hosted on Google Firebase Hosting. Your browser sends ordinary request information, including IP address, URL, browser information and request time, to the hosting provider to deliver and protect the site. We add no analytics, advertising scripts, tracking pixels or cookies. Images and fonts are served from this site. Email links open your email app; they do not send a message automatically.

Legacy Google Sites and Forms pages may use Google cookies or other technologies. Apple operates its own App Store and TestFlight services. Google and Apple may process information outside your country; their privacy disclosures describe their safeguards and international transfer mechanisms. Information may also be disclosed where legally required or necessary for legal claims.

Why we process information

Where the GDPR or similar laws apply, we process support enquiries as necessary to provide requested assistance or perform our contract with you. We rely on legitimate interests for proportionate troubleshooting, service security and related records, subject to your rights, and on applicable legal obligations when required. Consent or opt-out choices for advertising are presented where required; Google explains the basis for its own processing in its disclosures and applicable messages. We do not make automated decisions about you with legal or similarly significant effects.

Retention and deletion

Local progress remains until app data is deleted. To remove it, use iOS Settings → General → iPhone Storage (or iPad Storage) → Worm Garden → Delete App. Offload App retains data. Deletion does not erase Apple’s purchase records. Backups may retain app data and a restored backup may restore it. We cannot remotely access or delete your local progress.

We retain support correspondence only as long as reasonably needed to resolve the request, investigate related issues, meet legal obligations or handle disputes, then delete it or remove identifying information. Deletion requests cover both the work mailbox and the support copies under our control, subject to required retention. Provider logs and backups follow provider retention practices.

Your rights

Depending on your location, you may have rights to access, correct or delete personal information, restrict or object to processing, and receive certain information in a portable format. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact support@alexcozygames.com. We may request only information reasonably needed to verify and fulfil the request and will respond within applicable time limits. You may complain to your local data-protection authority. There is no player account to delete.

Children and families

The game does not ask for a name, birth date or email to play, and has no chat or user-posting feature. Parents or guardians should handle support correspondence and purchases for children. If you believe a child sent us personal information through support, contact us so we can review and delete it where appropriate.

Security and changes

We use reasonable safeguards, including restricted access to support correspondence and protected provider accounts. No system guarantees absolute security. We will revise this policy when actual data practices change and provide any required notices or choices. Future analytics integrations are not covered as if they were already active.