Privacy policy — CrumbPop

App: CrumbPop (톡톡! 부스러기), com.mallang.crumbpop
Developer: Mallang Company (말랑컴퍼니)
Effective: August 23, 2026 · Revised: September 20, 2026

This policy covers the Android and iOS/iPadOS versions of CrumbPop and explains how the app processes information when you play, view ads, make purchases or contact us.

1. Information stored on your device

Game progress, collection entries, item quantities, sound/language/vibration preferences and a purchase receipt or signed-transaction copy are stored on your device. We do not operate a separate game or payment server. In versions that support progress synchronization, game-save data is also sent to Google's or Apple's platform cloud as described in Section 3-3. Gameplay events and advertising/purchase information are sent separately to the Google and Unity services described below. If you contact us, we process your email and message to respond to the request.

The app does not create a separate CrumbPop username/password account or require you to enter a name, email address or phone number. Versions that support progress synchronization can connect to an existing platform game account (Section 3-3). In-app purchases use your Google Play account or Apple Account, depending on the platform. On iOS/iPadOS, a copy of confirmed transaction information is also stored in the device's secure Keychain for offline entitlement checks. Sections 3-1 and 5 explain this storage.

2. Advertising — Google AdMob

AdMob collects and shares advertising/device identifiers, IP-based general location, interactions with the app and ads, and technical diagnostics for advertising, analytics and fraud prevention. Diagnostics may include user-associated performance data such as startup time, hangs and energy use, and non-user-related iOS SDK crash logs. Device/app information helps deliver suitable ads. Actual processing can vary with consent and device settings. We receive the aggregate reporting provided by AdMob.

Identifiers may include the Android advertising ID and app set ID, available device- or app-scoped identifiers on iOS/iPadOS, and the iOS advertising identifier (IDFA) when permission is granted.

The one-time purchase removes the bottom banner. Optional rewarded ads remain available. Buying this product does not turn off every advertising or analytics data flow.

See the Google Privacy Policy, AdMob policies, Mobile Ads Android data disclosure and Mobile Ads iOS data disclosure.

On iOS/iPadOS, the app requests permission before IDFA access and tracking that require Apple's authorization. That IDFA access and tracking do not occur without permission. Denying tracking alone does not block gameplay or change your eligibility for rewards. Rewards still depend on their normal conditions, such as completing an optional rewarded ad; ad availability can depend on regional consent, connectivity and ad inventory. Denying tracking does not necessarily stop all ads or every form of advertising and analytics processing.

3. Usage statistics — Firebase Analytics

The Android and iOS/iPadOS versions use Firebase Analytics, provided by Google LLC. When analytics collection is enabled, it automatically sends app-instance identifiers, a randomly generated analytics user identifier created by the app, and advertising identifiers available under the platform, configuration and permission settings; device model, OS/app version, language and time zone; approximate country/region; and app activity. The app's analytics identifier is not created from a name, email address or game login account. IDFA is available only with the required permission. Activity includes level starts/ends, completion time, retries, collection unlocks, screen/session events and automatic installation/update/removal events. Google Analytics derives location from the IP address and then discards the IP address rather than storing it. We do not collect GPS location.

Analytics also includes the highest completed stage, cumulative play time, completed rewarded-ad counts and event identifiers. On iOS/iPadOS, in-app purchase events may be measured through StoreKit and include product ID, name and price.

Google may provide aggregated estimates of age, gender and interests derived from advertising identifiers. The reports do not provide these estimates for named individuals. We do not collect names, emails or telephone numbers for gameplay analytics.

We use these statistics to adjust difficulty, identify errors or drop-off points, improve the game and understand usage. Advertising use is covered in Section 2. The Google Analytics retention period for identifier-linked event/user data is currently set to 14 months. Data that reaches the end of that period is processed through Google's monthly deletion procedure. If reset on new activity is enabled, a new event can renew the retention period for the user identifier; this reset applies only to user-level data. Estimated age/gender/interest data is retained for 2 months. Reports without identifiers can be retained without a fixed expiry.

Android Firebase usage statistics are configured for daily export to Google Cloud BigQuery in the United States region. The iOS/iPadOS stream is currently excluded from this export. The options to include mobile advertising IDs and to create a separate user-data export are off, but event exports may still contain the app's analytics user identifier and event information. Exported copies follow BigQuery dataset/table expiration and deletion settings separately from the Google Analytics retention setting; their actual retention depends on those settings and processing status. For a deletion request, we also check for identifiable related export copies and explain and carry out any necessary separate deletion procedure. A deletion request to Google Analytics is not a guarantee that exported copies are automatically deleted.

Google processes Firebase statistics on our behalf. The recipient is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data is transmitted as events occur over encrypted connections and may be processed in the United States and other countries where Google operates infrastructure. See Firebase privacy and security, the Google Privacy Policy and Google's privacy enquiry form. This service-provider description is specific to Firebase; it does not override the separate advertising and purchasing disclosures.

Android: analytics collection starts when the app runs, and there is no in-app analytics opt-out. Uninstalling stops subsequent app transmissions; it does not remove data already sent.

iOS/iPadOS: the app is configured to use Firebase analytics when Google's consent result indicates that analytics is granted or that consent mode does not apply. When analytics denial is recorded, the app applies it by turning off subsequent Firebase analytics collection. Where Google's privacy options are available, you can reopen them in the game settings and change the choices offered, including analytics. Users to whom consent mode does not apply may have analytics collected without an analytics consent form; there is no separate analytics on/off switch available in every region. Apple's tracking permission is a separate choice. Denying analytics does not block gameplay and does not disable all Apple, Google Play or Unity IAP purchase processing. Changing a choice does not delete previously transmitted records.

You can request deletion using Section 7. We may need the app-instance ID to locate the relevant installation. Uninstalling stops subsequent app transmissions but does not remove data already sent.

3-1. Purchases and restoration — Google Play, Apple App Store and Unity IAP

The one-time banner-removal and offline-play product uses Google Play or Apple App Store billing, depending on the platform, through Unity In-App Purchasing (Unity IAP). The app handles product/purchase status, product and transaction identifiers, and receipts/signatures or signed transaction information to confirm ownership and restore purchases. Neither the app nor the developer directly receives or stores card numbers, bank account numbers or Google/Apple Account passwords. This product does not remove optional rewarded ads.

Android: the app verifies the Google Play receipt locally and keeps a receipt copy for restoration and offline entitlement checks.

iOS/iPadOS: before granting access, the app checks current ownership verified by Apple StoreKit and the matching product and transaction identifiers. A copy of confirmed signed-transaction information is kept in that device's Keychain and app storage for offline checks. The Keychain item is not synchronized to other devices, and the app-storage copy alone cannot grant entitlement. Choosing Restore Purchases requests transaction synchronization with Apple and may require Apple Account authentication.

Google Play or Apple processes checkout and purchase-history queries. Separately, the installed Unity IAP SDK transmits purchase attempts/outcomes, product and transaction identifiers, available receipt content/signatures or signed transactions, error details, timestamps, app/device information and available installation/session identifiers to Unity. These support purchasing operations and purchase-service analytics. Transport is encrypted. Local entitlement verification and Keychain storage do not prevent this separate SDK transmission. Firebase purchase-event processing is described in Section 3.

Purchasing is optional, but the app automatically queries existing purchases at startup and has no independent switch to disable purchase-SDK transmission. On iOS/iPadOS, explicit transaction resynchronization that may require Apple Account authentication is requested through Restore Purchases. After reinstalling, changing devices or clearing app data, you may need an internet connection and the same Google Play or Apple Account to confirm ownership again.

Google, Apple and Unity process information under their respective policies, potentially outside your country. Unity's role can be a processor for the developer or an independent controller, depending on the processing. Google Play and Apple purchase records and Unity service records are separate from your local app data. See the Google Privacy Policy, Apple Privacy Policy, Unity Privacy Policy and Unity IAP privacy overview. Retention and requests are explained in Sections 5 and 7.

3-2. Connectivity checks

Unless offline entitlement is confirmed, the app checks internet access when entering the app and starting a stage through Google's HTTPS connectivity service. The service receives network information such as your IP address. The check does not attach a game save, receipt or account information.

3-3. Platform accounts and game-save synchronization

Availability depends on the app version and platform settings. Supported versions use Google Play Games Saved Games on Android, or Game Center and iCloud on iOS/iPadOS. When a platform account is already signed in and the service is available, the app automatically attempts connection and backup at startup. If connection is needed, Account Connection in the game settings starts the platform sign-in process. The app currently has no separate switch to disable cloud synchronization or disconnect the account. Progress is still saved locally when the platform account is unavailable; existing gameplay access conditions continue to apply.

The synchronized save contains cleared-level progress, collection counts and viewed status, item quantities, roulette and pending-reward state, duplicate-reward markers, and introductory reward usage. Save timestamps and identifiers that distinguish save revisions are also transmitted. This supports backup, restoration after reinstalling, and continuation on another device using the same account on the same platform. Transfers between Android and iOS are not supported. Game Center and iCloud Drive must be available on iOS/iPadOS. Synchronization can be delayed or fail depending on connectivity and service availability.

The app uses the platform-provided player identifier and profile display name to distinguish accounts and show connection status. On iOS/iPadOS, a hash derived from the player identifier is also used in the cloud save name to separate accounts' records. This remains an account-linked identifier, not anonymous data. You do not provide platform passwords or verification codes directly to the app.

We do not operate a separate game-save server. Saves are sent to the relevant Google or Apple platform service. This gameplay upload excludes payment receipts and purchase entitlements, Firebase analytics records, and sound, language and haptics preferences. Platform sign-in and storage services process information for functionality and account management; the Google Play Games SDK also processes gamer identity, service-use and diagnostic information. Providers may process information on infrastructure in and outside your country under their policies and account settings. This does not stop the separate advertising, analytics or purchase-service processing.

See the Google Play Games data disclosure, Google Privacy Policy, Apple Privacy Policy and iCloud app-data guidance.

You can manage platform sign-in and app-specific iCloud use through platform settings. Signing out or disabling synchronization does not erase existing cloud saves. The app currently has no dedicated cloud-save deletion button. Platform-specific management and deletion instructions are in Section 7.

4. Your choices

You can reset/delete the advertising ID or adjust personalised ads in Android Settings > Google > Ads (the path varies by device). This can change ad personalisation without removing all ads or all SDK processing. Uninstalling stops future transmissions by the app. Previously transmitted information is subject to the retention and request procedures below.

iOS/iPadOS: manage the app's tracking permission in Settings → Privacy & Security → Tracking. You can decline or later revoke permission. Tracking permission is not a condition of gameplay or reward eligibility, and ads may still appear without it.

Google consent messages may be shown depending on your region and applicable consent requirements. When advertising privacy options are required, an entry in the game settings lets you reopen them and change your choices. On iOS/iPadOS, any analytics choice offered in the form is also applied to Firebase analytics collection as described in Section 3. Denying ATT alone is different from denying analytics, and these choices do not disable all purchasing-service processing. Android analytics collection and its opt-out limitations are described in Section 3.

5. Retention and removal

On Android, clearing app storage in settings or uninstalling removes local progress, settings and receipt copies. On iOS/iPadOS, deleting the app removes its ordinary app-storage data; offloading the app can leave data behind and is different from deleting it. Device backup settings may restore some app data on reinstallation. Deleting local data does not automatically remove Google Play or Apple ownership or service records held by Google, Apple or Unity.

Uninstalling or clearing device data does not delete saves held by Google Play Games or iCloud. A retained cloud save may be restored after reinstalling with the same account. Cloud saves follow each platform's policies, account settings and deletion procedures; Firebase's 14-month analytics retention does not apply to them. If local progress remains, synchronizing later may upload it again. See Section 7 for management and deletion.

The iOS/iPadOS entitlement Keychain item may remain on the same device after uninstalling, so uninstalling does not guarantee its removal. It is not synchronized off the device. The app clears its local entitlement when a store query confirms that the product is no longer owned. We cannot remotely delete the device's Keychain. You can contact us about device-storage requests using Section 7.

Firebase retention is described in Section 3. That Analytics retention setting does not apply to Google Play, Apple or Unity IAP records. Those providers retain records under their policies and transaction, security or legal requirements; some records may be exempt from deletion. We keep support messages for the time needed to handle the request and any legally required retention period.

6. Children

The game is not directed at children under 14. We do not knowingly collect their personal information and will take prompt deletion action if we learn that such information has been collected.

7. Request data deletion or exercise your rights

CrumbPop, provided by Mallang Company, does not create a separate CrumbPop username/password account; supported versions use existing platform game accounts. You can contact us about access, correction, deletion or suspension of processing for game saves, Firebase statistics, purchase-related information or support messages without creating a separate account.

1. Email alsk1597@gmail.com with the subject “CrumbPop data deletion request” and state which information you want deleted.
2. Include the app name, platform (Android or iOS/iPadOS), device and approximate period of use. For a purchase request, you may include a Google Play order ID or Apple transaction identifier and purchase date. If additional identifiers are needed to locate installation-specific Firebase records, we will review what information can be established. The app currently has no analytics-identifier display, so we may be unable to identify a particular installation's records; we will explain the verified limitations and any available next steps.
3. Provide only the minimum necessary information. Do not send card/bank details, passwords or authentication codes. Redact unrelated personal information from any receipt you attach.

After reviewing your request, we will process it within the timeframe required by applicable law or explain progress and any additional steps needed. If a provider must act on the request, we will explain that process and relay the result.

• Local app data: clear app storage on Android or delete the app on iOS/iPadOS to remove ordinary app-storage progress, settings and receipt/transaction copies. See Section 5 for iOS Keychain and device-backup limitations. We cannot remotely delete files from your device.
• Android cloud game data: follow Google's Play Games deletion instructions and select CrumbPop under individual game data. You can also access these controls through your Play Games profile. This concerns Google-held game data; it does not remove every local copy, separate Play History record or purchase record.
• iOS/iPadOS cloud game data: follow Apple's iCloud app-data guidance to manage or delete CrumbPop data in iCloud storage settings where the app's data is listed. App data can be stored even when files are not visible in iCloud Drive; labels and available controls vary by OS. See Apple's app-specific iCloud settings to manage synchronization. Turning off synchronization or deleting the installed app does not itself delete cloud data.
• Firebase: after identifying the app instance, we use Google Analytics' user-deletion procedure. We will explain limitations if the identifier cannot be found or reports are already aggregated without identifiers.
• Unity IAP: we forward applicable requests for information processed on our behalf through Unity's privacy-request procedure. Information Unity processes independently may require a request directly to Unity; we will provide guidance.
• Google Play and advertising: Google manages orders, refunds and payment profiles. A deletion request to us does not cancel a purchase or automatically erase Google's transaction records. You can also use Google's privacy controls and request procedures.
• Apple App Store: Apple Accounts, purchase ownership, payment and refund records follow Apple's procedures. A data-deletion request to us is not a purchase cancellation or refund and does not automatically delete Apple's records. For information managed directly by Apple, use Apple's privacy controls and request procedures.

Platform cloud data may require Google's or Apple's management procedures. We do not promise direct access to your platform account or remote deletion from your cloud storage. Contact us if you cannot locate the relevant controls. Sign-out, disabling sync, local-copy deletion and cloud-copy deletion are different actions; a surviving local copy may be uploaded again later.

If deletion is restricted by retention obligations or necessary transaction/security records, we will explain the affected information and reason as far as we can establish them. We retain request-handling records only as necessary. For privacy complaints in Korea, you may contact the Privacy Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Protection Commission (pipc.go.kr).

8. Changes and contact

Changes are announced on this page and apply from publication. Contact: alsk1597@gmail.com.