Privacy policy

1. Who we are

Sugar Loop is a mobile puzzle game operated by Tal Cohen (“we”, “us”). This policy describes information used by the game and this website. It also explains the choices available to players and parents. This notice covers the released game and this website.

2. Information in the game

When the game first connects, it creates a guest account with a random identifier. A name, email address, or phone number is not required to start playing. The player name initially reads “Candy maker”; if you change it, please avoid a real name, contact details, or other identifying information.

• Account and progress: a guest identifier, player name, completed levels, stars, coins, boosters, lives, rewards, settings, and saved game state.
• Optional email recovery: if you choose My profile → Link account, we store the email address you verify with your game account. We use it to send one-time verification and recovery codes so you can sign in to that account on another installation. Linking is optional and does not subscribe you to marketing emails.
• Level activity: moves and level results, used to verify results and help prevent cheating or duplicate rewards.
• Game analytics: the release uses Google Analytics for Firebase automatically from first launch to measure app use, screens and menu actions, level starts and outcomes, tray taps, tutorials, boosters, rewards, purchases and ad interactions. Events use an app-installation identifier and a hashed game-account identifier; our event payloads do not include your email, player name, verification codes or purchase tokens. Google also processes technical app/device information and approximate location derived from network information. Analytics helps us understand retention, balance levels and diagnose problems. The game does not offer a separate gameplay-analytics switch.
• Purchase records: product identifiers, transaction identifiers, purchase status, and entitlement information needed to deliver purchases and process changes or refunds. The app store handles payment details; we do not receive payment-card details.
• Rewarded-ad records, in versions with this feature enabled: information about an ad reward request and its completion, used to deliver the correct reward once.
• Technical information: connection information, such as IP address and basic app or device information, may be processed by our service providers to operate and secure the service.
• Support messages: if you contact us, we receive the information you choose to send and your contact address. Please do not send passwords, payment-card details, or unnecessary information about a child.

3. Why information is used

Information is used to provide the game, save progress, fulfill purchases and rewards, check level results, understand game use and improve level design, protect accounts and the service, resolve support requests, and meet applicable legal obligations.

Where data-protection law requires a legal basis, that basis depends on the activity: providing the service you request, our legitimate interests in security and preventing fraud, a legal obligation, or valid consent when required. A child’s use of the game is not treated as consent to personalized advertising.

4. Ads and Google AdMob

The iOS App Store release includes Google AdMob ads between levels and optional rewarded ads, plus optional in-app purchases including Remove Ads. The current Android release has advertising, rewarded ads, and new Remove Ads sales switched off. Private development builds may use test ads.

The advertising configuration requests a general-audience ad content rating, omits the Android Advertising ID permission, and disables Google’s optional publisher first-party identifier. The game uses the same restrictive, child-directed ad treatment for every player, without asking for age, and does not request personalized ads. Consent messages and privacy choices are provided by Google’s consent service where applicable to that configuration. The game does not request Apple’s cross-app tracking permission.

Where the advertising service is enabled, Google may process IP-derived approximate location, app or device identifiers allowed by the configuration, ad views and interactions, crash information, and performance information such as launch time, hangs and energy usage for delivery, measurement, fraud prevention and SDK operation. Reward verification can associate a reward request with a guest identifier. Restrictions on personalized ads do not prevent all processing by Google.

Settings → Privacy choices appears when Google requires a way to revisit consent. See Google’s Privacy Policy and its Android SDK disclosure and iOS SDK disclosure. We will update this notice when advertising practices change.

5. Service providers and sharing

• Supabase: authentication, game servers, and database hosting. Supabase Privacy Policy.
• Resend: delivery of account verification and recovery emails. It processes the recipient address, email content and delivery information. See its Privacy Policy and email-data practices. Its sending region does not determine data storage location; Resend stores customer data in the United States.
• Google: Google Analytics for Firebase, advertising and consent-management services; Google Play also handles purchases in versions distributed through that store. Google Privacy Policy.
• Apple: purchases, transaction information, and refunds for versions distributed through the App Store. Apple Privacy Policy.
• OpenAI Sites and its hosting infrastructure: delivery and security of this website. OpenAI Privacy Policy.

We may disclose information when legally required or when necessary to protect the security and rights of players and the service. We do not sell player account data. We do not use game progress to create personalized advertising profiles.

Providers may process information in countries other than yours. Where applicable law requires safeguards for international transfers, the relevant transfer arrangements must apply.

6. Visiting this website

Website analytics is optional. If you choose Allow analytics, Google Analytics measures page visits, campaign source tags and clicks to the App Store, using analytics cookies and technical browser/device information. Advertising storage, advertising user data, personalization and Google signals are disabled. We do not load the Google Analytics script before you opt in. You can change your choice through Analytics settings in the footer; declining stops future collection and removes our analytics cookies. Our analytics cookies expire after 60 days. Campaign tags are kept for the browser tab session only after consent, and your analytics choice is stored in your browser until you clear it. We remove unrelated query parameters and URL fragments from the page address sent to Analytics and send only the origin of a referring website. Do not put personal information into campaign tags. Website clicks are not download counts and are not joined to your game-account identity. The website has no mailing-list form or player-account system. Fonts and artwork are served with the website. External providers have their own privacy practices.

The hosting service may process IP addresses, request metadata, and essential security or access cookies to deliver and protect the website. Any sign-in required to access a private version of the website is managed by the hosting provider, separately from your Sugar Loop guest account.

7. Retention and deletion

Game account and progress: we retain the account, any optional linked email address, cloud progress, verification records and purchase entitlements while the account remains open, so returning players can continue their game and purchases are not granted twice. Inactive guest accounts are not automatically deleted. Refund reconciliation also keeps order identifiers and hashed purchase tokens to prevent duplicate or revoked grants; account-linked records are removed with the account. If an Apple Remove Ads purchase has also been restored to another active game account, its original Apple account token, hashed transaction reference and refund state remain only to maintain that restored entitlement; the deleted game-account link is removed. That shared state is removed when the last associated account is deleted. Unmatched Google Play refund records are cleared by the reconciliation job after 30 days from detection. You can delete your account at any time; uninstalling alone does not request server deletion.

Deletion: a successful in-game deletion removes the login and its linked game records from the active database. An outside-app request is handled after proportionate ownership verification. Device settings may remain on your device; clearing the app’s data removes them. The game does not collect age or date of birth.

Analytics: deleting the game account resets this device’s analytics identity. Historical analytics held by Google are separate from the game database and are subject to the Analytics property’s retention settings. Contact us to request access to or deletion of identifiable analytics; we will explain what can be located and processed. Aggregated reports may remain. Analytics is not used for personalized advertising, and the integration disables advertising identifiers and ad-personalization consent.

Support: correspondence is kept for the time needed to resolve and document the request, handle related purchase or security disputes, and meet applicable legal requirements. You can ask us to delete support correspondence; we will explain any information that must be retained and why.

Infrastructure: hosting, database and email-delivery providers control their operational log and backup retention. Deleting active game records does not immediately erase provider logs or existing backup copies; those expire through the provider’s retention process. Any retained copy is limited to security, recovery or legal needs. Contact us for information about a specific request.

Google and Apple manage their own payment records under their own policies. Deleting a Sugar Loop account does not delete store records or automatically request a refund. Sugar Loop has no subscriptions.

8. Your choices and requests

To delete your account in the game, open My profile → Delete account and confirm. Deletion is permanent and removes your game progress. If you are offline, reconnect so the request can reach the server. You can also start a request through our account and data deletion page, including when you cannot open the game.

In Settings, you can open this policy, our Terms of use, and Support. A Privacy choices button appears when Google’s consent service requires it.

Depending on your location, you may have rights to access, correct, obtain a copy of, restrict, object to processing of, or delete your personal information, and to withdraw consent where processing relies on it. You may also contact your local data-protection authority. We respond within the period required by applicable law and may need proportionate verification to protect the account.

support@playsugarloop.com

9. Age eligibility and parents

Sugar Loop is intended for teenagers and adults aged 13 and above. It is not directed to children under 13. The game opens directly to its home screen and does not ask for or store your age or date of birth. Guest play does not require registration.

Versions with advertising use the same restrictive ad treatment for everyone rather than an age-based advertising profile. Where local law or a store rating requires a higher age or a parent’s involvement, that requirement also applies. An ad-consent setting is not parental privacy consent.

A real name, email address and phone number are not required to begin guest play. Use a pretend player name without identifying information. If we learn that we have information from a child under 13, a parent or guardian can ask us to locate and delete it through our deletion page. Please do not send a child’s real name, school, address, identity documents, passwords or payment-card details in the initial message.

Privacy contact: support@playsugarloop.com

10. Security

The game uses encrypted connections to its online services and account-based access controls. No method of storage or transmission can guarantee absolute security. Avoid sharing access to your device or sending sensitive information in support messages.

11. Updates to this policy

We will update this page and its date when our practices change. Material changes will be communicated as required by applicable law, with new consent obtained where necessary. The date above identifies the current notice.