Privacy policy
Water Sort Color: Potion Lab
- No account is needed. We never ask for your name, email address or phone number.
- Your game progress is stored on your device.
- Ads are provided by Google AdMob. You decide whether ads may be personalized.
- Google Firebase helps us fix crashes and balance levels. You can switch off usage data at any time.
- We never see your payment details.
- Settings → Privacy in the game lets you change your choices or delete your data.
1. Who we are
Water Sort Color: Potion Lab (the "App") is published by Candeo Games LLC ("we", "us"). Candeo Games LLC is the data controller for the processing described in this policy.
Email: support@candeogames.com
2. What the App does not collect
The App has no user accounts, chat or user-generated content. It does not collect your name, email address, phone number, contacts, photos, files, microphone or camera input, or precise (GPS) location.
3. Data stored only on your device
Your level progress, coins, boosters, cosmetic items, daily reward calendar, settings and the status of permanent purchases (such as the ad-free purchase) are saved locally on your device. We do not upload this game data to our own servers, and we do not operate any servers of our own. Your operating system may include this data in your personal device backups (for example Android backup or iCloud device backup), depending on your device settings; we have no access to those backups. Uninstalling the App deletes the game data stored on the device.
4. Data processed by third-party services
The App uses the following services provided by Google LLC and by the app stores. The table shows what is processed, why, and on which legal basis (for users in the EEA, the UK and Switzerland).
| Service | Data | Purpose | Legal basis |
|---|---|---|---|
| Google AdMob (advertising) | Resettable advertising identifier (Android advertising ID; on iOS the IDFA only if you allow tracking) and other device identifiers; IP address and the approximate location derived from it; device information (model, operating system, language, screen size); ad interactions (ads shown, taps, completed rewarded videos); ad-related diagnostics. | Showing ads, limiting how often you see them, measuring ad performance, preventing fraud and abuse; personalized ads only where you have allowed them. | Consent for personalized ads and for storing or reading information on your device where required (GDPR Art. 6(1)(a)); legitimate interests for non-personalized ads, fraud prevention and security (Art. 6(1)(f)). |
| Firebase Analytics | Gameplay events (for example tutorial steps, level started, completed or restarted, boosters used, offers shown, ads watched, purchases by product ID and price, never payment details), session and screen information, app version, device model, operating system, language, approximate country or region; a pseudonymous app-instance identifier and, only where your choices allow it, the device's advertising identifier. | Understanding which levels are too hard or too easy, balancing rewards, improving the game. | Consent in the EEA, UK and Switzerland (via the consent form and Google Consent Mode) and explicit consent in Türkiye (KVKK Art. 5(1)); elsewhere legitimate interests. Everywhere, an in-app switch turns it off. |
| Firebase Crashlytics | Crash and error reports: stack trace, app version, device model, operating system, free memory and storage, time of the crash; a pseudonymous installation identifier. | Finding and fixing crashes and bugs. | Legitimate interests in a stable, secure App (Art. 6(1)(f)). |
| Firebase Remote Config | A pseudonymous Firebase installation identifier, app version, platform, language and country. | Delivering game settings without an app update (for example reward amounts, ad frequency limits, or which version of a feature you see in a test). | Legitimate interests (Art. 6(1)(f)). |
| Google Play / Apple App Store (purchases) | Purchase confirmation: product ID, transaction or purchase token, status and time. | Delivering your purchase and restoring permanent purchases. | Performance of a contract (Art. 6(1)(b)). |
| Email support | Your email address, your message and anything you choose to send us. | Answering your question or request. | Legitimate interests; performance of a contract where your request concerns a purchase. |
Advertising and consent
- EEA, UK and Switzerland: before ads are personalized, Google's User Messaging Platform (UMP) shows a consent form based on the IAB Transparency and Consent Framework (TCF v2.3). Without your consent, ads are not personalized and analytics stays off.
- United States: where state privacy laws apply, you can opt out of the "sale" or "sharing" of personal information and of targeted advertising through the privacy message and the controls described in section 7.
- iOS: Apple's App Tracking Transparency prompt asks whether the App may track you. If you decline, the IDFA is not used and ads are not personalized based on tracking.
- Rewarded videos are always optional. The optional ad-free purchase removes interstitial ads.
- At launch, ads are served only by Google AdMob. If we add other ad networks, we will list them here before they are used.
More information: Google Privacy Policy · How Google uses information from sites or apps that use its services · Privacy and security in Firebase.
Purchases
In-app purchases are processed entirely by Google Play or the Apple App Store. We never receive your card number, bank details or billing address.
5. Sharing and "sale" of personal data
We do not sell your personal data for money. We share data only as described above: with Google (AdMob and Firebase) and with the app store that processes your purchase. We may also disclose data if required by law, or to a company that takes over the App (for example an affiliate or a buyer), in which case this policy continues to apply or you will be informed.
Under some US state laws, allowing an ad network to use identifiers for personalized advertising may count as a "sale" or "sharing" of personal information. You can opt out at any time as described in section 7. We do not collect sensitive personal information.
6. International transfers
Google may process data in the United States and other countries. For transfers from the EEA, the UK and Switzerland, Google relies on the EU–US Data Privacy Framework and its extensions, and on the European Commission's Standard Contractual Clauses. For users in Türkiye, transfers abroad take place on the basis of the safeguards provided for in Article 9 of Law No. 6698 (KVKK).
7. Your choices and controls
- In the App: Settings → Privacy contains this policy, a personalized ads switch, a usage data switch, Privacy options (reopens the consent form where it applies) and Delete my data.
- Delete my data: removes the analytics and diagnostic identifiers linked to this installation of the App and asks Google to delete the associated data. Uninstalling the App deletes all game data on the device.
- On your device: you can reset or delete your advertising ID (Android) or turn off "Allow Apps to Request to Track" (iOS Settings → Privacy & Security → Tracking).
8. How long we keep data
| Data | Retention |
|---|---|
| Firebase Analytics event data | Up to 14 months, then deleted automatically. |
| Crashlytics crash reports | 90 days. |
| Firebase installation identifiers (Remote Config, Crashlytics) | Until deleted with Delete my data or no longer needed; Google completes deletion from its systems within 180 days. |
| AdMob data | According to Google's retention policies. |
| Purchase records | Kept by Google Play or the App Store; the ad-free status on your device until you uninstall the App. |
| Support emails | Up to 24 months after the conversation ends, unless the law requires longer. |
| Game data on your device | Until you uninstall the App or clear its data. |
9. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, Türkiye's KVKK or US state privacy laws), you may have the right to: know whether we process your data and access it; correct it; delete it; restrict or object to processing; data portability; withdraw consent at any time (without affecting earlier processing); opt out of the sale or sharing of personal information and of targeted advertising; appeal our decision on your request; and lodge a complaint with a data protection authority (in Türkiye, the Personal Data Protection Authority). We will not treat you differently for exercising your rights.
Use the in-app controls above, or email support@candeogames.com with the subject "Privacy request". We reply within 30 days (the period may be extended where the law allows, and we will tell you why). Because the App has no accounts, we may ask for an identifier from your device, such as your advertising ID, to find any data related to you. To appeal a decision, reply to our answer with the subject "Appeal". An authorized agent may submit a request on your behalf where the law allows.
10. Children
The App is intended for a general audience aged 13 and over and is not directed at children under 13. We do not knowingly collect personal data from children under 13. In the EEA and the UK, users under the age of digital consent in their country should ask a parent or guardian before agreeing to personalized ads or analytics. If you believe a child has used the App and data about them has been collected, contact us and we will delete it.
11. Security
Data sent by the App to Google is encrypted in transit (TLS). We do not run our own servers, and access to the Firebase and AdMob consoles is limited to authorized staff.
12. Changes to this policy
We may update this policy, for example when we add features or services. The current version and its effective date are always published on this page. If a change is significant, we will also tell you in the App.
13. Contact
Candeo Games LLC
Email: support@candeogames.com