Squishy Box: Fidget Toys ASMR Privacy Policy

Squishy Box: Fidget Toys ASMR (the “App”) is a game for iPhone. You open mystery packs of squishies, 900 of them in 15 series, squeeze them to hear and feel the squish, merge three of the same squishy into one with a better finish, and give each one a seat in your house. There are no accounts, no sign-in and no chat, and nothing a player writes or makes is shown to anyone else.

Unlike most of our apps, this one is free to play and shows ads, and it relies on a few outside services: Google AdMob for the ads, Apple and RevenueCat for in-app purchases, and PostHog for analytics. This policy explains what each of them receives.

The short version: your game, your coins and your settings are saved on your phone and nowhere else. We never learn your name, your email address or who you are. Players under 13, and anyone who does not give a birth year, only ever get ads that do not use personal data, and the App never asks them for permission to track.

The App does not ask for, collect or send anywhere:

• Your name, email address, phone number or any account information. There are no accounts and nothing to sign in to.
• Your date of birth. The App asks only for a birth year, and the year never leaves your phone (see “Your birth year and the ads you see” below).
• The name you give your room. It stays on your phone.
• Your location from your phone’s location services. The App never asks for location permission.
• Your photos, camera, microphone, contacts, calendar, health data or data from other apps. The App never asks for those permissions.

The first time you play, the App asks for your birth year on a wheel. Nothing is picked in advance, and you do not have to choose one. The year is saved on your phone only. It is not sent to us, to analytics or to any ad partner, and the App uses it for one thing: to decide which kind of ads you get. The App’s Settings shows the year it has saved.

To be careful, the App counts your age as if your birthday had not come yet this year, so a player born 13 years ago is treated as 12 until the next year.

If you are under 13, or did not give a birth year, the App treats you as a child. Ads come only from Google AdMob, every ad request is marked as child-directed and asks for non-personalised ads, and the App never shows Apple’s tracking prompt, so your phone’s advertising identifier is never available to the App or to any ad partner.

If you are 13 or over, the App may show Apple’s App Tracking Transparency prompt, which asks whether the App may track you across apps and websites owned by other companies. If you choose Allow, ads may be personalised using your phone’s advertising identifier. If you choose Ask App Not to Track, the identifier is not available and the App asks for non-personalised ads. You can change your answer at any time in iPhone Settings › Privacy & Security › Tracking.

The App shows three kinds of ads: reward videos, which you choose to watch in return for something in the game, such as a free bag; full-screen ads at natural breaks, such as after opening a bag or when you come back to the App; and small banners on some screens. No ads are shown during the introduction the first time you play. If you buy No ads or join Squish Club, the full-screen ads and banners stop, and reward videos stay available, always as your choice.

How often ads and offers appear is decided on your phone by simple rules. For example, new players see no full-screen ads in their first days, and players who have bought something see fewer. To do this the App puts each player in one of a few broad groups, worked out on the phone from how the game has been played, such as whether reward videos are often watched or a purchase was made. The group is not given to ad partners; it is included with analytics events, as described below.

Ads are supplied by the ad partners listed below, through their software built into the App. When the App asks for an ad, the ad partner receives what it needs to choose, show and count the ad and to prevent fraud. This can include:

• Your device model, iOS version, language and network type, and the App’s name and version.
• Your IP address, from which an approximate location, such as a country or city, can be worked out.
• How you interact with each ad: whether it was shown, watched to the end or tapped.
• Whether the request is child-directed, as described above. Ad partners never receive the birth year itself.
• Your phone’s advertising identifier, only if you are 13 or over and allowed tracking.

Ad partners use what they receive under their own privacy policies, including, where you allowed it, to personalise ads and to measure ads across apps. Ad partners do not receive your room name, your collection or anything you type. We do not receive the identifiers or the details they collect; we see only totals, such as how many ads were shown.

The App works with the ad partners below. If we add or remove one, we will update this list and the “Last updated” date before the change reaches the App.

• Google AdMob, provided by Google. Google’s privacy policy: https://policies.google.com/privacy. How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites.

If you are in the European Economic Area, the United Kingdom or Switzerland, the App shows Google’s consent message before it loads any ads. It lets you accept, refuse, or manage your choices purpose by purpose and partner by partner. If you refuse, your ads are not personalised.

If you live in a US state with a consumer privacy law, such as California, you can opt out of the “sale” or “sharing” of your personal information, which under those laws can include ad partners using information from the App to personalise ads. Once you opt out, Google limits how it uses your information and does not show you personalised ads.

You can change these choices at any time with Privacy choices in the App’s Settings. Separately, you can turn tracking off for the App, or for every app, in iPhone Settings › Privacy & Security › Tracking. Whatever is chosen, players treated as under 13 only ever get non-personalised ads.

The App is free to play. You can also buy extras with real money: one-time purchases, such as the Starter pack, featured squishies and No ads, and Squish Club, an auto-renewing monthly subscription. Purchases are made with your Apple Account and processed by Apple through the App Store; we never see your payment details or who you are.

To validate purchases and let you restore them after reinstalling or on a new iPhone, the App uses RevenueCat, a purchase management service. RevenueCat receives an anonymous, randomly generated app user ID, your App Store purchase receipt, and basic device information (device model, OS version, App version, locale). This is the minimum needed to confirm what you have bought. RevenueCat does not receive your name, your email, your birth year or anything about your game.

RevenueCat’s privacy policy is available at https://www.revenuecat.com/privacy. Apple’s privacy policy is available at https://www.apple.com/legal/privacy/.

The App uses product analytics to tell us how the game is played: which screens players reach, how many bags are opened, where players get stuck, and which offers and ads are used, so that we can balance the game and fix what does not work. We use PostHog for this, a product analytics service.

The App creates a random install ID the first time it starts. It is stored on your phone, is not tied to your name, your Apple Account or your advertising identifier, and tells us only that two events came from the same installation. Against that ID the App records:

• Events in the game, for example a bag opened, a merge, a set completed, a room upgraded, a screen viewed, a step of the introduction, a reminder or share tapped, or a reward video watched.
• That the Shop or an offer was shown, and whether it led to a purchase or a restore. Payment details are never included.
• The player’s group used to pace ads and offers (described under “Ads”), whether ads are in under-13 mode (but not the birth year), and which version of a feature you were shown when we compare two versions in an A/B test.
• What PostHog’s software collects by default: device model, iOS version, App version, language, time zone and screen size, and the IP address of the request, from which PostHog works out an approximate location, such as a country and city.

The analytics never include your name, your birth year, your room name, your advertising identifier or anything you type. Automatic capture of taps and session recording are switched off; only named events like those above are sent.

Analytics are used only to run and improve the App. They are never used for advertising and never given to ad partners, and PostHog processes them on our behalf, not for its own purposes. PostHog’s privacy policy is at https://posthog.com/privacy.

The App may also ask PostHog for settings that let us adjust the game without an update, such as how often ads may appear, and for which version of a feature to show you in an A/B test. Those requests carry only the install ID.

Events are sent over an encrypted connection in small batches while you play, and are queued on your phone when you are offline. We keep them for as long as they are useful for improving the App, and delete them on request (see “Deleting your data”).

The App can remind you when your free bags are back, your coin jar is full, a bonus chest is ready or your streak needs you. If you turn reminders on, your phone asks for permission to show notifications. Reminders are local notifications, scheduled on your phone when you leave the App and never at night; they are not sent from a server, and the App does not register for push notifications or create a push token. You can turn them off in the App’s Settings or in your phone’s settings.

Share draws a picture card of a squishy on your phone and opens the iPhone share sheet, with a short line of text and a link to the App on the App Store. Where it goes is up to you and the app you pick: the App does not see who you send it to, and keeps no copy beyond a temporary file. If you choose Save Image, iOS may ask whether the App can add photos to your library; that add-only permission does not let the App see your library.

If you are asked to rate the App, the prompt is Apple’s own. Whether you rate, and what you write, goes to Apple under its privacy policy.

Every squishy, sound and picture is built into the App, so the game itself needs no connection. The App connects to the network for these things and no others:

• Google AdMob and Google’s consent message, to load and show ads.
• Apple’s in-app purchase system and RevenueCat, when the App starts and when you open the Shop, buy or restore.
• PostHog, in the background while you play, for the analytics and settings described above.
• Your browser, when you open this Privacy Policy or the Terms of Use from the App. The server delivering the page sees your IP address, as with any web page.

The following is stored locally, in the App’s private storage on your phone, and nowhere else. If you back up your iPhone to iCloud or a computer, the App’s data is included in that backup, which Apple and you control.

• Your game: your collection, merges, coins, level, quests, streak, the house you are filling and the name you give your room.
• Your birth year, if you chose one.
• Your settings: sound effects, rain in the Lab, haptics and reminders.
• Timers and daily counts that keep the game fair, such as when your free bags refill and how many reward videos you have watched today, and the group used to pace ads and offers.
• The random install ID used for analytics and A/B tests, and any analytics events waiting to be sent.
• Your purchase status, cached by RevenueCat so that what you bought keeps working offline, and the anonymous ID RevenueCat assigned to the installation.
• Your answers to Google’s consent message and Privacy choices, kept by Google’s software so that you are not asked again.
• When the App last asked you for a rating.

Deleting the App removes everything it stores on your phone, including your game, your birth year, the install ID and your settings, and cancels any reminders it scheduled. There is no copy of your game anywhere else, so once the App is deleted it cannot be recovered, unless you restore your whole iPhone from a backup made earlier. Your purchases stay with your Apple Account and can be restored after reinstalling.

Outside your phone, information about an installation is held in three places, none of it tied to your name: the analytics events at PostHog, the purchase record at RevenueCat, and what ad partners hold. Email us and we will delete the PostHog events and the RevenueCat record. Because they are keyed to random IDs, tell us roughly when you installed the App, which iPhone model you use and, if you bought something, the date of the purchase, so that we can find the right records. Turning tracking off in iPhone Settings stops your advertising identifier being shared from then on; for what Google holds, see Google’s privacy policy, or ask us and we will help.

The App is a game for a general audience, and we know children enjoy squishies too. It is built so that a child can play it safely: there are no accounts, no sign-in, no chat, no way to send messages or show anything to other players, and no way for a player to give us a name or contact details.

Players under 13, and anyone who does not give a birth year, are treated as children, as described in “Your birth year and the ads you see”: ads come only from Google AdMob, every ad request is marked as child-directed and non-personalised, the App never shows Apple’s tracking prompt and never uses the advertising identifier, and limited-time purchase deals are never offered. If we add ad partners in the future, players treated as under 13 will still get ads only from Google AdMob in this mode.

For every player, analytics are recorded only under a random install ID and used only to run and improve the game, never for advertising (see “Analytics”). We do not knowingly collect personal information such as a name, email address, photo or exact location from children, and the App gives them no way to provide it.

Purchases are made with the Apple Account signed in on the iPhone. Parents can require approval for every purchase with Ask to Buy, or turn off in-app purchases in iPhone Settings › Screen Time › Content & Privacy Restrictions. If a child made a purchase without permission, you can ask Apple for a refund at https://reportaproblem.apple.com.

Parents and guardians can email us at any time with questions about how the App treats children, or to ask us to delete information about their child held by PostHog, RevenueCat or Google. See “Deleting your data” for the details that help us find the right records.

We hold no account, name, email or profile for you, and most of your data is on your phone, where you control it. The data held by services we use is keyed to random IDs; email us and we will find it with the details described under “Deleting your data”, and delete it or send you a copy.

Where GDPR, the UK GDPR or similar laws apply, ads that use personal data, and storing or reading information on your phone for ads, rely on your consent through Google’s consent message, which you can change at any time with Privacy choices. Analytics and non-personalised ads rely on our legitimate interest in running, improving and funding a free game, and purchases on the contract you enter when you buy. You can also complain to your local data protection authority.

We do not sell personal information for money. When a player 13 or over allows tracking, ad partners may use information from the App to personalise ads, which California and some other US states treat as a “sale” or “sharing” of personal information. You can opt out at any time with Privacy choices in the App’s Settings (see “Your privacy choices”). We do not sell or share the personal information of players we treat as under 13.

Your game and settings are stored in the App’s private container, protected by iOS sandboxing and your iPhone’s passcode and encryption. Connections to Google, Apple, RevenueCat and PostHog use TLS.

No app, device or transmission can be made perfectly secure. We keep the risk low by holding as little as possible and keeping the rest on your device, but we cannot guarantee absolute security, and you are responsible for keeping your device updated and locked with a passcode.

If we change how the App handles data, including adding or removing an ad partner or changing the analytics service, we will update this page and the “Last updated” date. Material changes will also be described in the App Store release notes for the update that introduces them.

Appcelerator Studio is the data controller for Squishy Box: Fidget Toys ASMR. For any privacy question or request, email team@appcelerator.studio.