Candy Archer — Privacy Policy
Last updated: November 10, 2026 · Applies to Candy Archer (com.nomadarcade.candyarcher on the App Store and on Google Play)
The short version. Candy Archer has no account and no sign-in, and your progress stays on your phone. The first time you open the game, it asks whether it may send us how you play, under a random Player ID. The game plays the same if you say no. If you say yes, Google's Firebase also receives analytics and crash reports. The game shows ads from Google AdMob, and AppLovin, Unity Ads, Liftoff and Mintegral can supply those ads through AdMob. RevenueCat checks your purchase under a random ID, and Apple or Google takes the payment. The iPhone version asks you once whether it may track you for ads, and the game plays the same if you say no. If you say yes to sending how you play, and where Google's consent step allows it, the game also tells Meta when it is installed, when you reach a few steps in the game, when an ad is shown and when you buy something, so we can measure our own Facebook and Instagram ads. We do not sell your data.
Who we are
Candy Archer is published by Alden Morris Enterprises LLC, a New York limited liability company trading as Nomad Arcade ("we," "us"). For anything in this policy, write to [email protected], or by post to Alden Morris Enterprises LLC, 4465 E. Genesee St, Dewitt, NY 13214, United States.
No account
Candy Archer has no account and no sign-in. Your progress (maps, levels, medals, heroes, powers, sugar, coins and settings) is saved on your phone, and deleting the game deletes it. We keep no copy of your save.
Our play log
To find stages that are unfairly hard, see where new players get stuck and judge our own changes, the game keeps a log of how it is played and sends it to a server we run at henry.business, about every 30 seconds while you play. Lines wait on your phone until they can be sent.
The first time you open the game, it asks whether it may send this. If you say no, the game plays the same, and the play log, Google Analytics, crash reports, the game's settings fetch and Meta's SDK all stay off. You can change your answer later in Settings → Privacy → Send how you play.
| What | Why |
|---|---|
| Your Player ID: a random ID the game makes on your phone the first time it runs, and again after you delete your play data. It is not built from your name, your email address, your phone number or Apple's advertising identifier. With it go a random number for each time you open the game, your side of any split test, the game's version and whether it is the iPhone or Android version | To keep one player's events together and to compare one build with another |
| What happens in play: each time you open the game, stages started, won and lost, how and where you fell, the powers you were offered and the ones you picked, how quickly you react, which part of the screen your thumb uses, coins and prizes earned and spent, the settings you change, what you started to buy and whether the purchase went through | To find what is unfair or confusing, and to balance the game |
| Your phone's model and system, and how smoothly the game draws | To find phones the game runs badly on |
The play log never holds your name, your email address, your contacts or your exact location, and we do not give it to any ad network. The game also reports some of the same steps to Firebase and to Meta, as the sections below describe.
Where it is kept. The play log is stored on a server we run, rented from Hetzner in Ashburn, Virginia, in the United States. Our server sees your network (IP) address when a batch arrives, and uses it to limit how fast one address can send. The play log does not save that address.
Your Player ID is at Settings → About → Player ID, which shows its first eight characters. Copy copies the whole ID.
Analytics, crash reports and game settings
| Service | What it receives |
|---|---|
| Google Analytics for Firebase (Google) | How the game is played: the first time you open it and each session, the tutorial and its steps, your first game, a stage started, won or lost, each fall, reaching a new level, playing again, leaving the game, which screen you are on, what you started to buy and whether the purchase went through, when the game asks for a rating, ads offered and taken, ads that played, which ad network showed each ad and what it earned us, and your side of each split test. Google also works out a rough location (country or city) from your IP address |
| Firebase Remote Config (Google) | The game's settings, such as how often ads may show, when to ask for a rating and how many players are on each side of a split test. To fetch them each time the game opens, it sends an identifier worked out from your Player ID. The settings hold nothing about you |
| Firebase Crashlytics (Google) | Crash and error reports, with the device model, system version and the state of the game when it crashed |
Split tests. We try some changes on part of our players. The game puts you on one side of each test, and your side goes to the play log and to Analytics.
We use these to find stages that are unfairly hard, to see where new players get stuck, to test changes and to fix crashes. None of it is sold to anyone. Whether Google may use Analytics data for ads follows your answer in Google's consent form (see Advertising). On iPhone, Firebase receives Apple's advertising identifier only if you allow tracking. On Android, Firebase may use the phone's advertising ID.
Advertising
Ads in the game. Candy Archer shows ads served by Google AdMob. Banners show on Home and on result cards, and never during a run. A full-screen ad can play after you clear a stage, as you leave its card. It never plays during a run or after a fall. Ads you choose to watch can double the sugar from a Jam Jar, bring you back after a fall or add a fourth power card to a pick.
No ads. The game sells No ads. It ends the banners and the full-screen ads and doubles the jar with no video. The ads you choose to watch to get back up or for a fourth card stay.
What Google receives. To choose, show and count ads, and to stop fraud, Google receives information about your phone and how you use the game: device model and settings, an approximate location worked out from your IP address, the ads shown and how you interact with them, and diagnostic data. Google handles this data under its own privacy policy.
Google's consent form. Each time the game opens it asks Google's consent service (Google's User Messaging Platform) whether a form is needed where you live. Where the law calls for one, as in the EEA, the UK and Switzerland, Google's form asks for your choices before ads load. You can change your choice in Settings → Privacy → Ad privacy choices, which shows where it is required.
Apple's tracking prompt. On iPhone, once Google's step allows ads, the game asks you once whether it may track you (Apple's App Tracking Transparency prompt). It says: "Ads keep Candy Archer free. If you allow this, Google can show you ads that suit you better. The game plays the same either way." Only if you allow it do Google and the networks below receive Apple's advertising identifier (IDFA), which they use to show you ads that suit you better and to measure them. You can change your answer at any time in the iPhone's Settings → Privacy & Security → Tracking. On Android, Google may use the phone's advertising ID, which you can reset or delete in Android's settings.
Other ad networks. AppLovin, Unity Ads, Liftoff and Mintegral can also bid through AdMob to show an ad in Candy Archer. When one of them bids for or shows an ad, it receives the same kinds of information as Google: device model and settings, an approximate location worked out from your IP address, the ads shown and how you interact with them, and diagnostic data. On iPhone it receives Apple's advertising identifier only if you allowed tracking, and on Android it may use the phone's advertising ID. Each handles this data under its own privacy policy: AppLovin, Unity, Liftoff and Mintegral.
Report an ad. If an ad looked wrong, Settings → Privacy → Report an ad writes to us with the game's version filled in.
Meta, for our own ads
We also advertise Candy Archer itself on Facebook and Instagram. To learn which of those ads lead to installs and to players who keep playing, the game includes Meta's app events SDK: on iPhone, and on Android from version 1.0.1. The SDK starts only if you said yes to sending how you play, only after Google's consent form (and on iPhone, Apple's tracking prompt) has had its turn, and only if Google's consent step allows it. Where Google's form applies, as in the EEA, the UK and Switzerland, that means you allowed storing information on your device and measuring ads. If not, the game sends Meta nothing and saves nothing to send later. A no in Settings → Privacy → Send how you play, or a choice you withdraw in Ad privacy choices, stops it the same way, and on Android it also stays off at every later launch.
Once on, it tells Meta when the app is installed and opened and when you buy something (which item and its price, never your payment details), and these steps in the game: finishing the tutorial, your first game, the end of a run, playing again, reaching a new level, opening the No ads offer and starting a purchase. On Android from version 1.0.1, and on iPhone from the first update after version 1.0.0 (build 9), it also tells Meta when you start the tutorial or a stage, the coins you spend, the goals you reach (such as a feat or the weekly big order), and each ad shown in the game with its format, the network that showed it and what it earned us.
These go together with basic device information (such as model, system version, language and time zone) and an identifier the SDK generates for this install. On iPhone, if you allow tracking, Meta also receives Apple's advertising identifier (IDFA) with these events, so it can tell us which of our ads brought you to the game. If you do not, Meta gets no IDFA and reports these results to us only in aggregate. On Android, Meta also receives the phone's advertising ID, unless you have reset or deleted it in Android's settings. Meta handles this data under its own privacy policy.
Purchases
The one thing the game sells is No ads, bought once. Payment is handled entirely by Apple (App Store) or Google (Google Play): we never see your card or payment details.
| Who | What they receive | Why |
|---|---|---|
| RevenueCat, Inc. | Your purchase history in Candy Archer (which product, when, and the store's transaction IDs), a random anonymous ID that RevenueCat creates for this install, and basic app and device details such as the app version and system version. Not your name and not your email address | To check each purchase with Apple or Google, deliver it once, and make Restore Purchases work |
| Google Analytics for Firebase and our play log | The item you started to buy and whether the purchase went through (no payment data) | To understand how the purchase is used |
| Meta, on iPhone and on Android from version 1.0.1 (see Meta, for our own ads) | Which item you bought and its price (no payment data) | To measure our own Facebook and Instagram ads |
Whether you own No ads is also kept on your phone. RevenueCat handles this data under its own privacy policy. Refunds are handled by Apple or Google under their own policies.
Reminders
On iPhone, Settings → Reminders can turn on one reminder a day at most, between 9 am and 8 pm. It stays off until you turn it on, and the phone asks for permission only then. The phone schedules it, so nothing about it goes to any server.
Children and your age
Candy Archer is not directed at children under 13.
The first time you open the game, it asks the year you were born. The answer stays on your phone: the game does not send it to us or to anyone else. A player who is under 13 gets the same game with the play log, Google Analytics, crash reports, the game's settings fetch, Meta's SDK and Apple's tracking prompt turned off. Every ad request is marked as for a child, so ads for that player are rated for all ages, are not personalized and do not use an advertising identifier.
If you believe a child under 13 has sent us data, write to [email protected] with the Player ID if you can, and we will delete it.
Deleting your data
- Remove everything on your phone: delete the game.
- Start the game over: Settings → Game data → Restart the game clears your progress. Your settings, your Player ID and No ads stay.
- Delete your play log: Settings → Game data → Delete my play data deletes it at once and gives you a new Player ID. You can also email [email protected] with your Player ID.
- Ask us about the rest: we will ask Google and Meta to delete what they hold for your install.
More detail is on the Data Deletion page.
How long we keep it
- Play log: each line is deleted automatically 13 months after it reaches us. Delete my play data deletes your lines at once.
- Analytics and crash reports: Google keeps analytics data for up to 14 months and crash reports for up to 90 days, then removes them automatically.
- Purchase records: kept by RevenueCat for as long as they are needed to restore purchases, handle refunds and meet our tax and accounting duties.
- Ads and Meta's events: under each company's own terms.
- Support email: for as long as needed to answer you and keep a record of it.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete the data we hold, and to object to how we use it. Email [email protected] with your Player ID, since the game holds no name or email address to find you by, and we will respond within 30 days. You may also complain to your local data protection authority.
Who else sees your data
We do not sell your data. It is processed on our behalf by Google (Firebase Analytics, Crashlytics, Remote Config, AdMob and its consent service), by RevenueCat for purchases, by Apple or Google Play for payments and by Meta to measure our own ad campaigns. AppLovin, Unity, Liftoff and Mintegral receive data when they bid for or show an ad through AdMob. Hetzner hosts the server that holds the play log. Those companies are bound by their own privacy terms, and may process data in the United States and other countries where they operate.
Changes
If this policy changes in a way that affects what we collect, we will update the date at the top and, where the change is significant, tell you in the game.