Privacy Policy

Who this policy covers

This policy explains how the mobile game Weft (package identifier com.weft.game, published for Android on Google Play; an iOS version may follow) handles information. Weft is made and published by an independent developer under the name Weft. In this document, “we” and “the game” both mean that.

It does not cover the storefronts themselves. Google and Apple collect their own data when you browse, download, or pay for an app; that is governed by their policies, not this one.

What we collect

Your Weft account, described in the next section — a game name with a number, a scrambled form of a random key your phone makes for itself, and, only if you choose to sign in with Google, the identifier Google gives your account for this game — and what belongs to it: your game progress and, if you play online duels, their records and your rating. There is no sign-up form and no way to send a message from inside the game. We do not collect your real name, email address, phone number, contacts, photos, location, advertising identifier, or device identifier.

The game has no social-network integration.

Four components inside the game do send data, and none of them sends it to us: the advertising SDK (to Google), the analytics SDK (to Google), Google Play Billing (to Google), and the Unity in-app purchasing library (to Unity). Each has its own section below.

Your Weft account

On first launch the game makes a random key on your phone and uses it to sign in to our server without asking you anything. The server then keeps a small record:

• A game name and a four-digit number, such as SwiftComet#4821. The game picks a random name; you can change it in Settings → Account. Names are checked against a list of offensive words.
• A one-way hash of your phone’s key — never the key itself, which stays on your phone — with the platform (Android or iOS) and when the account was created and last seen.
• If you choose Sign in with Google: the account identifier Google issues for this game, and nothing else from Google — not your email, name, or photo. It lets you return to the same account on another phone. Signing out of Google in the game gives the phone a new anonymous account and leaves the linked one where it is.

Your progress and duels on our server

The game keeps your progress with your account, so that it is not lost with the phone:

• Your progress — levels played and won, coins and crystals, perks, skills and their charges, rewards and tasks — and the game’s own log of the events that changed it: a match finished, a reward claimed, a purchase delivered, with the time of each. The server checks these events, for example that a level could really have been won that fast, to keep the game fair.
• For each Google Play purchase: the product and the order token from the receipt, so that the server can check Google’s signature on it and the same purchase cannot be credited twice.
• For each online duel: both players’ game names, the perks and skills each side brought, the map, every move made in the match, how it ended and when; and your duel rating. Your opponent sees your game name in the match and in their match history; the leaderboard shows game names and ratings to every player.

Where the account lives, and for how long

The record is kept in our own database on a server we rent from Contabo in the European Union (France). The game reaches it through Cloudflare, which carries the encrypted connection, and encrypted backups of the database are kept in Cloudflare R2 in Europe for 14 days. Contabo and Cloudflare only host and carry the data for us; nobody else receives it. We do not sell it or use it for advertising.

How it is protected: every connection is encrypted (TLS); the server stores only a hash of your phone’s key, so a copy of the database cannot sign anyone in; backups are encrypted before they leave the server; the database is not reachable from the internet, and only the developer can sign in to the server, with a key rather than a password.

You can delete the account at any time: in the game under Settings → Account → Delete account, or — if you signed in with Google — on playweft.com/delete-data. Deletion is immediate on our server and takes your progress, its log and your rating with it; the backups that still contain it expire within 14 days. Two things stay, no longer linked to any account: the records of duels you played, which are also your opponents’ history, with your game name replaced by a random one; and the order tokens of your purchases, so that a purchase cannot be redeemed twice.

An account that was never linked to Google is reachable only with the key on your phone. If the game is uninstalled, that key is gone, so such an account is deleted automatically after 12 months without a sign-in. Accounts linked to Google are kept until you delete them.

What the game stores on your device

To remember where you left off, Weft saves a small amount of data in the app’s own private storage on your device:

• A copy of your progress, so that the game can be played offline.
• Your preference — the interface language you selected, if you changed it from the default.
• Your account key and the game name the server gave you, so that the game can sign in again.

What stays on the device

Your language preference stays on the device and is never sent anywhere. Your progress is sent to our server whenever the phone is online, as described above; the account key is sent only to sign in.

Uninstalling Weft, or clearing the app’s data in your system settings, removes everything the game stored on the device. It does not delete your account or the progress kept with it on our server — deleting the account does that.

Language detection

On first launch, Weft reads the language your device is already set to, so it can show the interface in that language, when the game has it, instead of asking you. That reading happens entirely on the device and the result is not sent anywhere.

Permissions

Weft requests no runtime permissions: it never asks for your camera, microphone, location, contacts, files, or notifications, because it does not use any of them.

The Android build declares the standard INTERNET permission, together with ACCESS_NETWORK_STATE, the advertising identifier permission com.google.android.gms.permission.AD_ID and the Privacy Sandbox permissions ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION and ACCESS_ADSERVICES_TOPICS. None of them is requested from you at runtime, and they are used for four things only: your account, the advertising, the analytics and the purchases described in this policy. The levels can be played offline; your progress is sent to our server the next time the phone is online. Online duels need a connection.

Advertising, and what Google receives

Weft shows advertising supplied by Google AdMob in three forms: a banner along the bottom of the battle screen, a full-screen ad shown occasionally after a won battle, and rewarded videos that you choose to watch for an in-game bonus. No ad interrupts a battle, and none must be watched to continue playing. A one-time purchase described below removes the banner and the full-screen ads for good.

Where the law requires it, the game asks for your consent before showing personalised ads, using Google’s consent form; you can change that choice later from the game’s settings screen.

The advertising is Google’s, not ours. We do not choose which ad you see, we receive no data about you from it, and no information about you passes through any system of ours.

To select and measure ads, and to keep advertising honest, the Google Mobile Ads SDK inside the game may collect and send to Google your device’s advertising identifier and app set ID (and, where applicable, identifiers of accounts signed in on the device), technical information about the device and the app, your IP address, from which an approximate location may be estimated, information about how you interacted with an ad — app launches, taps, video views — and diagnostic figures about how the app itself runs — how long it takes to start, how often it hangs, how much energy it uses. Google encrypts this data in transit and uses it for advertising, for analytics, and to detect fraud. On Android the game therefore declares the com.google.android.gms.permission.AD_ID permission, and the Privacy Sandbox permissions the SDK brings with it. What Google does with all of this is covered by the Google Privacy & Terms — how Google uses information from sites or apps that use our services.

You can limit this yourself, on the device and without us: Android has Settings → Privacy → Ads, where the advertising ID can be reset or deleted entirely, and iOS has Settings → Privacy & Security → Tracking. Deleting the identifier does not remove the banner; it removes the personalisation.

Analytics, and what Google receives

To learn where players get stuck or stop playing, Weft uses Google Analytics for Firebase. The game reports when a level starts and how it ends — won, lost, or abandoned — with the level number and how long it took, which features have been unlocked, and whether a rewarded video was watched. None of these records carries your game name, your account, or anything you typed.

Alongside our events the Analytics SDK collects, according to Google’s own disclosure: a random app-instance identifier it assigns to this installation, your device’s advertising identifier, your IP address in masked form (used only for a coarse location), in-app purchase events, and app lifecycle events such as sessions and screen views. The data is encrypted in transit and stored by Google; we see it only as aggregated reports and keep no copy of our own. What Google does with it is covered by the Google Privacy & Terms — how Google uses information from sites or apps that use our services.

Where the law requires consent, analytics honours the same consent form as the advertising, and no analytics data is collected before you have answered it. The advertising identifier can be reset or deleted in your device settings, as described above; that also breaks the link between past and future analytics records.

Purchases

Weft is free to play in full. It offers optional in-app purchases — packs of crystals, a starter bundle, and a one-time “remove ads” option — sold through Google Play Billing on Android.

The payment is handled entirely by Google. We never receive your card details, your name, your email, or your billing address; Google’s own privacy policy governs that. What the game receives from Google Play is a purchase receipt — the product bought and an order token — which the game sends to our server: the server checks Google’s signature on it and records the order token with your account, so that the purchase is delivered once and cannot be credited to two accounts. The receipt is also kept in the app’s private storage so that the purchase can be restored.

Purchases are tied to the Google account that made them. If you reinstall the game or change phones, the “remove ads” purchase can be restored through Google Play on the same account. Refunds are handled by Google Play under its own rules.

The purchase flow inside the game is run by Unity In-App Purchasing, a library made by Unity Technologies, the maker of the engine Weft is built on. According to Unity’s own disclosure, that library collects and sends to Unity: an installation identifier and other device identifiers, device information, session identifiers, your country, your purchase history in the game, and crash and diagnostic data about the app. It does not collect your name or email, and Weft passes it no account of yours. Unity uses this to operate the purchasing service and for its own analytics; the data is encrypted in transit and is not shared by Unity with third parties. Unity’s handling of it is described in the Unity Privacy Policy.

Children

Weft is not directed to children. Its target age group on Google Play is 13 and over. We do not knowingly collect personal information from anyone, children included. The only thing a player can type is a game name of up to 16 characters, and the account holds no real name or contact details.

The advertising described above is served by Google AdMob under the settings we have chosen for this app in Google’s console. If you believe a child has used the game on your device, resetting or deleting the device’s advertising identifier — as described in that section — removes the history the personalisation was built on.

Your rights

Privacy laws such as the GDPR (European Economic Area, United Kingdom, Switzerland) and the CCPA (California) give you rights to access, correct, export, or delete the personal data a company holds about you.

What we hold is your Weft account with its progress and duels, described above. You can see and change its name in the game, and delete it yourself in the game or on playweft.com/delete-data; for anything else — a copy of the record, a correction — write to us at the address below. We keep it in the European Union and do not sell it.

Four other kinds of data are not held by us: whatever the advertising SDK and the analytics SDK send to Google, the record of your purchases on Google Play, and what the Unity purchasing library sends to Unity. For the first, the advertising identifier can be reset or deleted in your device settings; the second is your Google Play order history, managed with Google; for the third, Unity states that its purchasing library offers no in-app way to request deletion — requests go to Unity under the Unity Privacy Policy. Rights over any of these are exercised with Google or Unity directly. You are welcome to write to us at the address below to confirm any of this.

Changes to this policy

If the game changes in a way that affects this document, we will update this page and move the effective date at the top. The page you are reading is always the current version; there is no separate archive of older ones.

Contact

Questions about this policy, or about anything Weft does with data, go to contact@playweft.com. One inbox, read by the person who builds the game.