Privacy Policy
This policy explains how Croakdown (the "app"), operated by RedFrogBlack Ltd, handles your information. We designed the app to collect as little as possible: no accounts, no advertising, no analytics, no location, no contacts.
Global scope. This policy applies to everyone who uses Croakdown, anywhere in the world. Croakdown is distributed by Apple through the App Store in every territory where the App Store operates, and we therefore align this policy with the same principles Apple applies to its own users worldwide: collect only what is necessary, keep the user in control of their data, and hold every service provider to the same protection standard. We apply the practices described here uniformly to every player, and we hold ourselves to the stricter standard whenever your local law is stricter than ours. In particular, this policy is written to satisfy Apple's App Store Review Guideline 5.1.1, the UK GDPR, the EU GDPR, the California Consumer Privacy Act (CCPA/CPRA) and comparable US state laws, Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, Japan's APPI, South Korea's PIPA, Singapore's PDPA, and equivalent frameworks in other jurisdictions.
Who we are
RedFrogBlack Ltd, the data controller, is a company registered in England and Wales (company number 16557982). Registered office: Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA. Contact for any privacy-related question or request: info@redfrogblackart.com.
What data we collect, how we collect it, and what we use it for
The table below lists every category of data the app or its service providers touch, how it is collected, and the purpose (with the UK/EU GDPR legal basis where applicable).
| Data | How collected | Purpose & legal basis | Where it lives |
|---|---|---|---|
| Game progress, coins, gems, hearts, unlocked worlds, settings | Written locally by the app as you play | Save your progress so the game works. Legal basis: performance of contract (providing the service you use). | Your device only. Never sent to us. |
| In-app purchase record (product identifier, timestamp, Apple transaction id) | Received from Apple's StoreKit when you buy or restore | Unlock what you purchased; support "Restore Purchases" after a reinstall. Legal basis: performance of contract. | Your device only. Never sent to our servers. |
| Purchase receipt (Apple-issued token) | Passed by Apple to RevenueCat during purchase | Verify the purchase is genuine and belongs to your Apple Account. Legal basis: performance of contract. | RevenueCat servers. Never seen by us in raw form. |
| Random, temporary Duo-match session id (e.g. "host-x7f3k2") | Generated on your device only when you start a live 2-player match | Route your moves to your opponent's device in real time. Legal basis: performance of contract (only for players who choose Duo Mode). | Supabase relay for the duration of the match, then discarded. |
| Game moves (tile placements, hazards, etc.) | Sent from your device only while a Duo match is running | Relay to your opponent in real time. Legal basis: performance of contract. | Supabase relay in transit, not stored after the match ends. |
| App Store crash reports and download / usage stats | Collected by Apple in accordance with the user's own Apple device settings | App Store analytics (Apple-controlled). See Apple's own privacy policy. | Apple servers. We only see aggregate, anonymised statistics. |
What we do not collect
- No name, email address, phone number, or postal address.
- No account or sign-in. The app has no user accounts of any kind.
- No ads. In the current release, Croakdown does not show any ads. No ad SDK is initialised, no ad request is made, no ad identifier (IDFA) is collected.
- No analytics. No third-party analytics SDK is initialised in the current release. Apple's own App Analytics operates at the device / Apple ID level under the user's own Apple settings and is not accessible to us in an identified form.
- No crash reporting. No crash-reporting SDK is initialised in the current release.
- No location data.
- No access to your photos, contacts, microphone, or camera.
- No data shared with data brokers.
- No data used to train, evaluate, or fine-tune any AI or machine-learning model, by us or by any third party.
If we introduce ads or analytics in a future update we will add a Privacy Choices control to Settings (built on Apple's App Tracking Transparency and the standard EU/UK consent flow) and we will ship an updated version of this policy first, so you will always know before anything new starts being transmitted.
Third-party service providers and equal protection
Croakdown relies on three service providers. Each has a written agreement with RedFrogBlack Ltd, is a data processor acting on our instructions only, and provides the same or equivalent protection of user data as this policy and Apple's Guideline 5.1.1 require:
- Apple Inc. — App Store distribution, StoreKit payment processing, App Store analytics. See Apple's privacy policy.
- RevenueCat, Inc. — verifies your in-app purchase receipts with Apple. Does not receive your name, email, or Apple ID. See RevenueCat's privacy policy.
- Supabase Inc. — real-time relay used only while two players are actively in a live Duo match. Session ids are ephemeral and are not linked to any user identity. See Supabase's privacy policy.
None of these providers use your data for their own marketing, advertising, or AI training. None resell, share, or license your data. All are contractually required to protect the data with the same standards set out in this policy and Apple's Guideline 5.1.1.
International data transfers
Croakdown is a global service. RedFrogBlack Ltd is based in the United Kingdom, Apple operates the App Store from the United States and Ireland, RevenueCat is based in the United States, and Supabase is based in the United States with regional data centres. Depending on where you are, the data described in this policy may be transferred to and processed in countries other than your own.
Wherever the data goes, it is protected by the safeguards this policy describes. Where the transfer leaves the UK, EU or EEA, we rely on the Standard Contractual Clauses (SCCs) approved by the UK ICO and the European Commission, or on an adequacy decision, or on your explicit consent, as the law requires. Because the only data that can leave your device is either ephemeral (Duo match) or a purchase receipt that carries no personal identifier, the risk to you is minimal.
Data retention and deletion
We keep the minimum data for the shortest time possible.
| Data | Retention |
|---|---|
| Game progress, coins, gems, hearts, settings on your device | Kept on your device until you delete the app. Never sent to us. |
| In-app purchase record on your device | Kept on your device until you delete the app. |
| Purchase receipt on RevenueCat | Kept by RevenueCat for as long as we need to honour restores and comply with tax record-keeping (typically 7 years). See RevenueCat's policy. |
| Duo match session id and moves on Supabase | Kept only for the length of the live match, then discarded. Not backed up. |
Your rights (including how to revoke consent and request deletion)
Depending on where you live, some or all of the following rights apply to you. We honour each of them for every player worldwide, regardless of whether your local law formally grants them, because doing so is simpler and fairer:
- Right to know / access the data we hold about you.
- Right to correct inaccurate data.
- Right to delete your data ("right to be forgotten", "right to erasure").
- Right to portability — obtain a machine-readable copy.
- Right to restrict or object to processing.
- Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
- Right to opt out of the "sale" or "sharing" of personal data (CCPA/CPRA). We do not sell or share your data as those terms are defined, so this right is honoured by default.
- Right to non-discrimination for exercising your privacy rights — you get the same game either way.
- Right to lodge a complaint with your local data-protection authority (see the Regional supplements below).
You can exercise these rights directly inside the app. Open Settings from the home screen and use the controls below.
Delete all your data (right to erasure)
Tap DELETE. This erases every level unlock, coin, gem, heart, saved game, skin, setting, and locally-stored purchase record from this device. This cannot be undone. There is no server-side account to delete because Croakdown does not hold one.
To also have your purchase receipt removed from RevenueCat, email info@redfrogblackart.com after you tap Delete Account. We will action verified requests within 30 days.
Export a copy of your data (right of access & portability)
Tap EXPORT. The app writes a JSON file containing every piece of data it holds about you on this device (game progress, coins, settings, purchase record) and offers it to the iOS share sheet so you can save or send it wherever you like.
Reset just your game progress (partial erase)
Tap RESET MY PROGRESS. This returns the device to a brand-new-install state (every level, pass and unlock is cleared) without also removing the app. Same effect as Delete Account for the local data.
Other ways to exercise your rights:
- Delete the app entirely. iOS erases all locally-stored data (progress, coins, settings, purchase record) when you remove the app.
- Stop the Duo relay. Stay in Solo Mode. Supabase is only used while you have chosen to play a live 2-player match.
- Any other data-protection request (access, correction, restriction, portability, complaint about how we have handled a request): email info@redfrogblackart.com. We will action verified requests within 30 days.
- You have the right to lodge a complaint with your local data-protection authority — see the Regional supplements below for links.
Regional supplements
For players in the United Kingdom, the European Union and the EEA
RedFrogBlack Ltd is the data controller. The legal bases we rely on are listed in the data table above (mostly performance of a contract, i.e. the contract to provide the game you are using). You may lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or with your national data-protection authority in the EU/EEA (a directory is maintained by the European Data Protection Board at edpb.europa.eu).
For players in California and other US states
Croakdown does not "sell" personal information for money, and does not "share" it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA and by similar laws in Virginia, Colorado, Connecticut, Utah, Texas and other US states. No opt-out is required because no such sharing takes place. You still have the right to know, delete, correct, and receive a portable copy — use the in-app controls described in the previous section, or email us. We do not use "sensitive personal information" as defined by the CCPA. If a US state privacy regulator would like to contact us, please write to the same email address.
For players in Brazil
The Lei Geral de Proteção de Dados (LGPD) grants you rights equivalent to those listed above. RedFrogBlack Ltd acts as controller. The legal basis for our processing is the execution of the contract to provide the app you use. You may contact the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.
For players in Canada
The Personal Information Protection and Electronic Documents Act (PIPEDA) and equivalent provincial laws grant you rights equivalent to those listed above. You may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
For players in Australia, Japan, South Korea, Singapore and elsewhere
Australia's Privacy Act 1988, Japan's APPI, South Korea's PIPA, Singapore's PDPA, and equivalent laws in other jurisdictions grant you rights broadly similar to those listed above. Use the in-app controls or email us, and we will action verified requests in accordance with your local law. You may also contact your local data-protection authority.
Children
Croakdown is suitable for all ages. We do not knowingly collect personal information from children below the minimum age that applies where they live. That minimum age is 13 in the United States (Children's Online Privacy Protection Act, COPPA), the United Kingdom, Canada, Australia, and most other countries; 16 in most European Union member states (with some setting it as low as 13); and the age set by local law elsewhere. Because the app collects no name, email, sign-in or contact information from anyone, no child-specific data is transmitted to us in the ordinary course of using the app.
If you are a parent or guardian and believe a child has provided us with personal information, contact us at info@redfrogblackart.com and we will delete it promptly.
Security
Because we hold no personal identifiers server-side, there is very little we could lose. Data in transit between your device and Supabase during a Duo match is encrypted with TLS. Local data on your device is protected by iOS storage encryption.
Changes to this policy
If we materially change this policy we will update the effective date and version number at the top of this page. Continued use of the app after the effective date constitutes acceptance of the updated policy. Where your local law requires fresh consent for material changes, we will additionally seek that consent inside the app before applying those changes to you.
Contact and data protection representative
Data controller: RedFrogBlack Ltd, Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA, United Kingdom.
- All privacy, data-protection, access, and general support requests: info@redfrogblackart.com (also reachable from Settings → Contact Support).