Privacy Policy

Nodilo has no user account, sign-in, chat, or cloud progress synchronization provided by Cerit Apps. The core game works offline. Level progress, completions, hint usage, game states, and theme choices are stored in the game save on your device; Cerit Apps does not upload this save to its server.

Clearing app data or uninstalling the app removes the local save. Android’s own backup or device transfer service may restore the game save according to your device settings. Nodilo’s analytics consent, measurement identity, and analytics queue are excluded from these backups.

Gameplay analytics is off on first launch. Until you enable it, no measurement identity is created, no gameplay events are queued, and no analytics requests are sent to Cerit Apps. Playing and using purchased entitlements do not require this permission. You can change your choice using Anonymous gameplay analytics in the menu.

After consent, the app creates a random installation identifier. Measurement includes session and event identifiers, event time, app version, play duration, level number and campaign/replay mode, tutorial completion, hint and ad interactions, product views, and consented purchase conversion information. We use this information to improve the game’s clarity, difficulty, and store flow.

This analytics system does not collect your name, email, precise location, advertising ID, hardware ID, or device fingerprint. Purchase tokens are not written to analytics events. The random identifier distinguishes events from the same consented installation; it does not guarantee absolute anonymity. Reinstallation, clearing app data, or withdrawing and granting consent again creates a new measurement identity; these identities are not combined.

The planned Android release may use Google Mobile Ads (AdMob) for optional rewarded hints and full-screen ads at suitable level endings. Google User Messaging Platform (UMP) manages advertising privacy choices required for your region. Ads are requested when UMP permits them. When required, Privacy options appears in the menu.

Your advertising privacy choice is separate from Cerit Apps gameplay analytics consent. Changing one does not grant consent to the other.

Google’s advertising service may process IP addresses and approximate location inferred from them, ad interactions, diagnostics, and identifiers such as the advertising ID or App Set ID. Transfers use TLS encryption. Google’s retention and deletion practices follow its own policies. See the Google advertising SDK data disclosure and Google Privacy Policy.

Google Play processes purchases; Cerit Apps does not receive payment card details. The “Remove Ads” product planned for the first release removes automatic full-screen ads; it does not remove optional rewarded ads. Paid theme sales are planned for a later phase.

Purchase tokens, product identifiers, verified entitlement status, and transaction time are processed to verify purchases, provide and restore entitlements, and reconcile cancellations or refunds. Tokens are kept in protected device storage and encrypted on the server, separately from analytics data. These payment and entitlement records are retained to support restoration and currently have no fixed automatic deletion period. Disabling measurement or deleting analytics data does not cancel a purchased entitlement.

Analytics and purchase verification requests to Cerit Apps use HTTPS. Analytics identifiers, consent state, secrets, pending deletion requests, and the event queue are kept in encrypted device storage protected by Android Keystore and excluded from Android backup and device transfer. Unsent analytics events are kept for up to seven days, within a limit of 500 events or 1 MiB; the oldest events are dropped when limits are exceeded.

Google Play, Google Mobile Ads, and hosting or security providers may process relevant data to operate the service. Network infrastructure may process IP addresses, request times, and limited technical logs to deliver the service and prevent abuse. Cerit Apps does not use gameplay measurement data for ad targeting.

Under the retention rules set for release, raw analytics events and measurement-linked purchase attribution records are cleaned up after 90 days. Measurement identities inactive for 90 days are revoked and their related analytics data is removed. Aggregate daily reports without installation identifiers are kept for 13 months; measurements for small groups are hidden.

For deletion requests received and verified by the server, the target is to remove active analytics data within 24 hours. Server backups are planned to follow a maximum 30-day retention cycle. A separate deletion record prevents deleted measurement identities from returning through a backup restore or delayed requests. It contains limited information such as the measurement identifier, a one-way hash of deletion proof, and deletion time; it contains no gameplay events. Deletion records are retained for at least 35 days and the current implementation has no fixed automatic deletion period for them.

Turning off Menu → Anonymous gameplay analytics stops new measurement events and clears the active measurement identity and event queue on the device. The app retains the old measurement identifier and deletion secret solely to finish server-side deletion; it retries when connected and removes this pending record after a successful response.

An offline request does not mean server data has been deleted until it reaches the server. Uninstalling the app or clearing its data before completion may prevent delivery. Granting consent again creates a new identity; the old deletion task completes separately. Contact support for help. Do not send purchase tokens, deletion secrets, or other secret keys by email.