Privacy Policy

Nova Blast is a game, not a data business. This page says plainly what we store, why, where it lives, and how to make it go away.

01Who we are

Nova Blast (“Nova Blast”, “we”, “us”) is the Nova Blast mobile game and this website, operated by Evgenii Isupov, an individual developer based in Portugal, who is the data controller for the data described here.

Contact: [email protected] — email is the fastest way to reach us and the right address for any privacy request. If you need a postal address for a formal notice, ask and we will provide one.

02What we collect

We never ask for your real name, your email or your phone number. The account is anonymous by default: on first launch the app generates a random identifier for itself and registers it with our server. You may optionally choose a leaderboard name — it is the one thing you write that other players can see, it is entirely up to you what it says, and the game works exactly the same if you never choose one.

WHAT WE DO NOT COLLECT

• No ads inside the game. There is no ad network and no ad SDK showing you anything: no banners, no interstitials, no rewarded videos. Nothing in Nova Blast is an advertisement.
• No advertising identifier on iPhone or iPad unless you allow it. Neither Meta nor Tenjin can read the IDFA before you tap Allow on Apple's tracking prompt — that is enforced by the operating system, not only by us. Meta's SDK is not started at all if you decline. In Meta's SDK and in Firebase, advertising-ID collection is switched off on Android too, along with Firebase's ad-personalisation, ad-user-data and ad-storage signals. Tenjin is the exception and it is the only one: on Android it reads the Google advertising ID, which is what makes measuring an advert possible there. You can reset or delete that ID at any time in your Android settings.
• We measure our own adverts, and nothing else. The Meta and Tenjin events listed above tell us which advert an install came from. They are not used to build a profile of you, they are never used to show you an advert anywhere, and we do not use fingerprinting or any other technique to work around the tracking prompt.
• No location, no contacts, no calendar, no photos, no microphone, no camera.
• No behavioural profiling, no cross-app tracking, and no sale or sharing of personal data for advertising.

03Playing offline

The game itself never needs the network: levels, physics, progress and purchases you already own all work with the connection off. When you are online the app signs in as an anonymous device account in the background and synchronises your save. If you never connect, nothing described above leaves your phone, apart from the purchase records the app store holds.

04Who else touches the data

We use a small number of processors, each doing only what we instruct:

• Fly.io — application hosting for our servers (United States).
• Neon — the managed Postgres database that holds your account, save, leaderboard score and purchase records (United States).
• Google Firebase Analytics — measures the gameplay events above. Google operates this globally and processes it on servers outside the European Economic Area.
• Meta Platforms — measures which of our adverts brought an install, from the six events listed above. On iPhone and iPad it receives nothing unless you allowed tracking. Meta acts as an independent controller for what it receives; its own policy is at facebook.com/privacy/policy.
• Tenjin — our advertising-measurement provider (a "mobile measurement partner"): it tells us which advertising campaign an install came from, and passes that fact back to the advertising network that showed the advert, so the network can be told which of its adverts worked. It receives the events listed above and the device identifiers described there. Tenjin is a United States company and processes the data there; its policy is at tenjin.com/privacy.
• Sentry — receives a report when the game crashes or hits an error: the stack trace, the app and operating-system version, the device model, and the recent log lines leading up to it. We have switched OFF the two things it can do by default — it does not record your screen, and it is not told your IP address or any account identifier. Sentry processes this in the European Union; its policy is at sentry.io/privacy.
• RevenueCat — validates purchases with Apple and Google and tells our server what you own.
• Apple and Google — store distribution and payments. They are independent controllers for payment data; we never receive your card details.
• Apple / Google sign-in — only if you choose to link an account, to verify who you are.
• Cloudflare — DNS for this website.

Beyond those, we disclose data only when the law requires it, or to establish or defend legal claims. If Nova Blast is ever acquired, your data may transfer with the service; you will be told before that happens.

05Where the data lives

Your account, save, leaderboard score and purchase records are on our own servers and database in the United States. Gameplay events are held by Google, which processes Firebase Analytics data across its own infrastructure and does not let us pin it to one country. The advertising-measurement events, where you allowed them, are held by Meta on the same terms — globally, on its own infrastructure. Tenjin holds its copy in the United States. If you are in the European Economic Area or the United Kingdom, both are transfers outside your region; they are covered by the European Commission's Standard Contractual Clauses with our processors.

06How long we keep it

• Save data (progress, currency ledger, unlocks) — kept while the account exists, so it is there when you come back.
• Gameplay events — held by Firebase under a 2-month event-data retention setting, then deleted by Google.
• Advertising-measurement events — held by Meta and by Tenjin under their own retention policies; we hold no copy.
• Technical logs — up to 30 days.
• Weekly leaderboard scores — kept for the season and pruned afterwards.
• Nova Trials depth scores — one row per day you played, kept for 30 days and then deleted.
• Purchase, billing and tax records — as long as tax law requires (typically up to 7 years), regardless of deletion.

07Deleting your data

Step-by-step instructions, and the full list of what is erased and what is kept, are on their own page: Delete your account. In short:

Settings → Delete account, inside the game, erases the account and everything attached to it — on your device and on our servers, immediately and without going through us. That is progress, stars, the crystal ledger, drones, cosmetics, achievements, your leaderboard entry, your leaderboard name and any Apple or Google sign-in you linked. The app confirms twice and then it is done: it cannot be undone, signing in again will not bring it back, and unspent crystals — including ones you paid for — are gone and are not refunded.

Two things deliberately survive, and only these: the purchase and tax records the law requires us to keep (detached from the deleted account, so they no longer name you), and any events already received by Firebase, Meta or Tenjin, which we cannot reach into to remove. The Firebase and Meta copies are not tied to your account at all — we never send them your account identifier. Tenjin's copy is the one exception: it does carry the account identifier, because matching an install to a save is the whole purpose of advertising measurement. It is a random identifier and nothing else — no name, no e-mail — and if you want that copy erased too, write to [email protected] and we will ask Tenjin to delete it.

Settings → Reset progress is a different, milder thing: it clears the save on this device only, leaves the account alone, and the next sync restores it. It is for starting the campaign over, not for leaving.

You can also email [email protected] if you would rather we did it, or if you want a copy of your data first. Send the request from the address you linked, or tell us the player identifier shown in Settings; we answer within 30 days.

08Your rights

If you are in the EEA or the UK you have the right to access, correct, delete, export (portability), restrict, and object to our processing, and to withdraw consent at any time (withdrawal does not affect processing already carried out). If you are in California, you have the rights to know, delete, correct, and to opt out of sale or sharing — we do not sell or share personal data, so there is nothing to opt out of.

To exercise any of these, email [email protected]. We answer within 30 days and will not charge you or degrade the game for asking. You can also complain to your local data protection authority.

09Children

Nova Blast is not directed at children under 13 (or under 16 where local law sets that age), and we do not knowingly collect their data. There is no chat, no messaging and no way for players to contact each other. The one thing a player can write that others see is an optional leaderboard name; it is never required, and it is the only free text the game accepts anywhere. If you believe a child has given us data, write to us and we will delete it.

10Security

Data is encrypted in transit (TLS) and at rest. Sign-in tokens are short-lived, refresh tokens are stored only as a hash, and access to the database is limited to our own services. No system is perfect: if a breach ever affects your data, we will notify you and the relevant authority as the law requires.

11This website

This site sets no cookies and runs no analytics or tracking. It loads fonts from Google Fonts, which means your IP address reaches Google when the page opens. Our host may keep standard server logs for security.

12Changes

If we change this policy we will update the date above, and for material changes we will say so in the game before the change takes effect.