Privacy Policy
Who processes the data
This game is developed and published by Verda Interactive, which is the data controller. Contact: privacy@verdainteractive.com.
What we collect
| Data | Why | Where it lives |
|---|---|---|
| Account identifier (Firebase Auth user id) | So your garden follows you to a new device | Google Firebase |
| If you sign in with Google or Apple: email address and display name | Authentication only. Playing as a guest collects neither | Google Firebase |
| Game state: the username you choose, country, pots, plants, coins, inventory, orders, achievements, ladder scores | The game itself. The server computes it, because the game is server-authoritative | Our own server |
| In-game counters: how often you watered, planted, harvested | Measuring balance — whether a plant grows too slowly, whether the economy is broken | Our own server |
| Crash reports: device model, OS version, stack trace | Fixing crashes | Firebase Crashlytics |
| Usage events (screen opens, counts of in-game actions) | Seeing where players get stuck | Firebase Analytics |
| Rewarded-ad data: which ad was shown, and the device's per-app identifier (IDFV). Not your advertising identifier (IDFA) | Showing the ad, not repeating the same one, and blocking click fraud | Google AdMob |
| Purchase record: which item you bought, the receipt the store issued, and your account identifier | Verifying that what you paid for actually reaches your garden | Adapty (receipt validation) and our own server |
| Server access logs: IP address, request time | Security and abuse prevention. Kept for at most 30 days | Our own server |
| Login records: IP address and browser/device information | Account security and abuse detection. Kept as long as your account exists; when you delete your account, these records are deleted 30 days later | Our own server |
Advertising
There is exactly one kind of ad in the game: a rewarded ad you choose to watch, which refills your watering can. No interstitials, no app-open ads, no banners — you decide when you see an ad, and choosing never to see one does not close anything off.
Ads are not personalised. Every request to Google AdMob is sent with personalisation switched off: the ad you are shown is not picked from what you have done in other apps or on other sites. This is not a setting, it is how the code builds the request — it cannot build it any other way.
The concrete consequence: your advertising identifier (IDFA) is never touched, which is why iOS shows no tracking permission prompt. AdMob still sees the device's per-app identifier (IDFV), your approximate country-level location and the moment the ad was shown — these are what frequency capping and fraud prevention need. Google processes that data under its own privacy policy.
In-app purchases
Some items in the game can be bought with real money. Your card details never reach the game: the App Store or Google Play takes the payment, and all we see is that this account bought this item.
To verify that a receipt genuinely came from the store, we use a third-party service called Adapty. What goes to Adapty: your account identifier, the product id you bought, and the receipt the store issued. Not your name, not your email, not the contents of your garden. Granting the item is still done by our own server — the client cannot unlock anything by claiming it paid.
What we do not collect
- No location, contacts, photos, microphone or health data.
- No card, bank or billing details. The store takes the payment; we never see it.
- No advertising identifier (IDFA) and no cross-app tracking.
- We do not sell your data and do not share it for ad targeting.
Why we ask for a country
The ladder has a local table as well as a global one. We do not read your country from the device — you pick it, and it stays locked for the season. Skip it and you simply appear only in the global table.
Children
The game is not directed at children and we do not knowingly collect data from anyone under 13. Write to the address above if you believe we have, and we will delete it.
Deleting your data
- From inside the game: Profile → Settings → Delete account. Confirming puts your account into a 30-day pending window; your game state and identity are permanently erased at the end of it.
- Without installing the game: use the account deletion page.
Your deletion request puts your account into a 30-day pending window; your data stays put during that time and is permanently deleted at the end of day 30. Copies inside backups are rotated out within 7 days after that, at the latest. Crash reports are not tied to your identity and so are not separately deleted.
If you sign in again within 30 days of deleting your account, the deletion request is cancelled and your account comes back with its data. Once those 30 days pass, the data is permanently deleted and cannot be recovered.
Your rights
Under GDPR and Turkey's KVKK you may request access to your data, its correction, its deletion, or a copy of it. Write to the address above; we answer within 30 days.
Changes
If this text changes, the date changes with it. If the kinds of data we collect change, we will say so in the game as well.