1. Scope and controller
This policy explains how Aguastrea Games ("Aguastrea Games", "we", "us") processes information when you use The Crimson Thesis: Match & Mystery on Android or iOS, contact player support, or visit this website.
The data controller is Aguastrea Games, an independent game developer based in Spain. Privacy questions and requests can be sent toprivacy@aguastreagames.com.
2. Summary
- The game uses an automatically created, pseudonymous Unity Player ID. It does not require your name, email address or social login.
- Core cloud services store progression, lives, virtual currency, inventory, attempt evidence and purchase-grant status so the game can operate securely.
- Optional Unity Analytics is disabled until you make an affirmative choice. Declining analytics does not disable gameplay or purchases.
- The current game contains no advertising SDK and we do not sell personal data or use it for cross-app behavioural advertising.
- Payment card and bank details are handled by Google Play or Apple. Aguastrea Games does not receive them.
- You can withdraw analytics consent in the game and request access to or deletion of cloud player data.
3. Data we process
| Category | Examples | How it is collected |
|---|---|---|
| Account and service identifiers | Pseudonymous Unity Player ID, project/environment identifiers, scoped support or analytics identifiers and authentication state. | Created automatically when the game connects to Unity Gaming Services. |
| Gameplay and progression | Unlocked and completed levels, stars, objectives, scores, lives, virtual currencies, power-ups, inventory, rewards, attempt state, deterministic commands/hashes and bounded replay evidence used to verify results. | Generated when you play and synchronized between the device and our cloud services. |
| Purchase and entitlement information | Product ID, store, transaction or purchase token, receipt evidence, validation status, grant, recovery, refund or reconciliation status and timestamps. | Provided by Google Play or Apple after you start a purchase and sent to protected services for validation. |
| Device, app and network information | Platform, operating-system and app version, language, device capabilities, approximate country derived from IP, IP address and service request or security logs. | Collected automatically by the app stores, Unity services and hosting infrastructure when their services are used. |
| Optional analytics | Pseudonymous session context, app lifecycle, level funnel, progression, economy and store interaction events, content/ruleset versions, performance tier and supported device context. | Collected by Unity Analytics only after consent is granted in the game. |
| Support communications | Your email address, the content of your request, attachments you choose to send and the information needed to investigate it. | Provided directly by you when contacting us. |
| Website request information | IP address, browser/user-agent, requested URL, time and security diagnostics. | Processed automatically by Cloudflare when this website is requested. |
The game does not request access to contacts, precise location, photos, camera, microphone, health data or the inventory of other installed apps. Project-authored analytics rejects names, email addresses, free text, full receipts, authentication tokens and raw player/device identifiers.
4. Purposes and legal bases
Provide the game
Authenticate a pseudonymous player, save progress, operate lives and inventory, load content and restore play across sessions. Where applicable, this is necessary to perform our contract with you.
Protect game integrity
Verify level outcomes, prevent duplicate grants, recover interrupted purchases and detect fraud or abuse. We rely on performance of the service and our legitimate interests in security and fair operation.
Fulfil purchases
Validate store evidence, grant purchased items, support recovery and maintain the records required for accounting, fraud prevention and legal obligations.
Improve the game
Measure play funnels, balance, technical quality and store interactions through optional analytics. This processing is based on your consent where consent is required.
Respond to you
Investigate support and privacy requests based on your request, our service obligations and legitimate interests in customer support.
5. Optional analytics and consent
Unity Analytics collection begins only after you select the affirmative analytics option in the game's Privacy Choices screen. Before that decision, or after a refusal or withdrawal, project analytics does not record or queue events.
You can change the decision at any time from the Privacy action on the Levels screen. Withdrawal stops future optional collection and clears project data waiting to be sent. It does not automatically erase data already received; use the deletion process below for that. Core authentication, progression, economy, security and purchase processing are separate from optional analytics and remain necessary to provide the connected game.
6. In-app purchases
Purchases are initiated and billed by Google Play on Android or Apple on iOS under the terms and privacy policy of the relevant store. We receive product and transaction evidence required to validate the order and deliver the correct virtual items. We do not receive your payment-card or bank-account details.
Full receipt evidence may be held temporarily on the device while a pending purchase is recovered and transmitted only to the approved validation service. After confirmation, permanent game records use minimized identifiers, hashes and grant/audit status where possible. Store purchase history may continue to exist in your Google or Apple account independently of a game-data deletion request.
7. Service providers and disclosure
We disclose only the information needed for the purposes above to service providers acting under their own terms and data-protection obligations:
- Unity Technologies: Services Core, Authentication, Cloud Save, Cloud Code, Economy, Remote Config and, only after consent, Analytics. Unity player privacy policy.
- Google: Google Play distribution, billing, purchase status and platform security on Android. Google privacy policy.
- Apple: App Store distribution, billing, purchase status and platform security on iOS. Apple privacy policy.
- Cloudflare: delivery, availability and security of this public website. Cloudflare privacy policy.
We may also disclose information where legally required, to protect players or our rights, investigate abuse, or as part of a business transfer subject to appropriate safeguards. We do not sell personal information, share it for cross-context behavioural advertising, or permit third-party advertising in the current game.
Providers may process information outside your country, including outside the European Economic Area. Where required, transfers are protected through adequacy decisions, standard contractual clauses or another lawful transfer mechanism.
8. Retention and deletion
- Local game data: retained on your device until removed by the game, a profile reset, clearing app data or uninstalling. A local reset does not by itself delete cloud records.
- Cloud player and progression data: retained while needed to provide and secure the player profile, normally until a verified deletion request is completed.
- Purchase, security and audit records: retained for as long as necessary to provide grants, prevent duplicate or fraudulent transactions, resolve disputes and meet legal/accounting obligations. Some minimized records may therefore survive account deletion.
- Optional analytics: retained according to the configured Unity Analytics retention and deletion controls. Withdrawal stops future collection; a deletion request covers data already associated with the player identifier where it can be located.
- Support messages: retained while resolving the request and afterwards only as reasonably needed for follow-up, security or legal obligations.
- Backups: deleted data may remain temporarily in restricted backups until those backups rotate, unless longer retention is legally required.
We periodically review retained data and delete or de-identify it when it is no longer needed for the stated purpose.
9. Your rights and privacy choices
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, withdraw consent and receive a portable copy of information you provided. You may also complain to your local data-protection authority. We will not discriminate against you for exercising applicable privacy rights.
Visit Privacy Choices for in-game consent instructions and the external process to request access or deletion. We may ask for a player/support identifier and limited information to verify that a request relates to the correct pseudonymous profile. Do not send passwords, full receipts or payment card details.
10. Children
The game is designed for a broad teen and adult audience and is not directed to children under 13. It does not knowingly request a child's name, email address, precise location or other direct contact details. Where local law requires parental authorization for optional analytics at a higher age, a parent or guardian must provide that authorization. Contact us if you believe a child has provided personal information without appropriate permission.
11. Security
We use measures appropriate to the nature of the data, including encrypted network transport, access controls, environment separation, server-side purchase and progression authority, idempotent grants, bounded audit histories and minimization of receipts and identifiers. No method of storage or transmission is completely secure, so absolute security cannot be guaranteed.
This website is static and does not currently use advertising or analytics cookies. Cloudflare may use strictly necessary security and delivery mechanisms when serving it.
12. Changes and contact
We may update this policy when the game, service providers or legal requirements change. The effective date and version at the top identify the current text. Material changes will be communicated in the game or through another appropriate channel when required.