Privacy Policy — Queens

Who we are

Last updated: To confirm: confirm the date this policy is published, and show it here as both the last-updated date and the effective date.

Queens is published by FREEDOM LLP, a limited liability partnership registered in England and Wales under company number OC407608. Its address is 101 King's Cross Road, London WC1X 9LP, United Kingdom In this policy, "we" and "the studio" mean FREEDOM LLP.

FREEDOM LLP is the controller of the personal data described here, and UK GDPR applies. Queens is sold on worldwide storefronts, so players in the EU and the EEA are covered by EU GDPR as well To confirm: is Queens offered in the EEA, has an Article 27 EU representative been appointed, and who is it? General contact: [email protected].

What this policy covers

This policy covers the Queens mobile game (bundle id com.artadian.queens) as distributed on the Apple App Store and Google Play. Queens is built in Unity. What follows about the components inside the app was taken from the game's own source code, not from assumption.

A separate policy at queens.game/privacy.html covers the browser demo. That policy describes the demo rather than the app, and the store listings currently link to it as the app policy.

Apple and Google are separate companies with their own privacy policies. They handle installs, store accounts, payments and their own analytics under their own terms, and this policy does not cover what they do with your data.

• To confirm: the source read was of Queens version 2.1.0; the published version is 2.2.2. Confirm the component list below against the shipping build before this policy goes live.
• To confirm: what date does the queens.game web-demo policy currently carry?
• To confirm: does this policy replace the queens.game web demo policy, or does the web demo keep a separate policy? Confirm which policy each store listing should link to.

Data we handle

The app collects data. The categories below are what the studio has declared to Apple and to Google.

The studio's own records are pseudonymous rather than absent. The Queens backend keys its records on a player id and a user id, and no email address, nickname or other directly identifying field appears in that backend source. The app has no studio login: player identity comes from Firebase and, on Android, from Google Play Games. Game Center is enabled on iOS for achievements To confirm: does the Game Center integration also supply a player identifier the game uses? We are still confirming what Firebase, Google Play Games and Game Center hold against those ids.

The two filings do not match. Apple's lists location; Google's does not mention location at all. One of the two is wrong and must be corrected. Diagnostics is also declared to Apple in three places at once — linked to you, not linked to you, and used for tracking — which still needs clarifying.

• Declared to Apple, linked to your identity: location, identifiers, usage data, diagnostics.
• Declared to Apple, not linked to your identity: diagnostics.
• Declared to Google as data the app may collect: app activity, app info and performance, device or other IDs.
• Connections to the studio's own servers use TLS. No plaintext data endpoint appears in the client source we reviewed, which was version 2.1.0, and the studio's own analytics component sends to https://api.appanalytics.ai/v1 over TLS. Google Play declares that data is encrypted in transit. The advertising and analytics components listed under "Sharing" send over their own connections under their own terms.
• To confirm: do the third-party advertising and analytics components send Queens data over encrypted connections?
• To confirm: does the app collect location data, at what precision, and which feature needs it? Apple's and Google's filings disagree and one must be corrected.
• To confirm: which diagnostic data is linked to a user or device identifier and which is genuinely anonymous?
• To confirm: in which country are the Queens backend and api.appanalytics.ai hosted, and what protects the data once it is stored there?

Advertising and tracking

The App Store filing declares that location, identifiers, usage data and diagnostics are used to track you, and the app's contents bear that out. The build integrates Google AdMob and AppLovin MAX for advertising and ad mediation, together with the Meta SDK and the TikTok Business SDK. Components of that kind link data with data collected by other companies' apps and websites, for advertising and measurement.

The Google Play declaration says the opposite — no data is shared with third parties. That answer is wrong. It contradicts what is in the app, and it has to be corrected in the Play Console; no wording in this policy can fix it.

No consent flow written by the studio exists in the game. A search of the project for consent and tracking-permission calls returned hits only inside the vendors' own SDK code, never in the studio's scripts, and the Gley package in the build does not include its consent module. So the app carries no first-party consent screen and no in-app opt-out. Under UK law, tracking and the use of advertising identifiers generally need your consent.

• On iOS you can turn off "Allow Apps to Request to Track" for all apps, under Settings, then Privacy & Security, then Tracking. A per-app entry appears in that list only once an app has asked for tracking permission.
• On Android: in your device settings, under Google and then Ads (the exact path varies by device), you can reset or delete your advertising ID.
• To confirm: does the shipping 2.2.2 build present Apple's App Tracking Transparency prompt, so that Queens appears in the per-app Tracking list — and if it does not, on what basis is tracking declared to Apple?
• To confirm: is AppLovin MAX's consent platform switched on from the AppLovin dashboard? It can be enabled without any code change, so the absence of consent code is strong evidence but not proof. If nothing is running, the tracking described above has no consent to rest on.
• To confirm: does the game still work normally if a player refuses tracking, declines consent, or resets the advertising identifier?

In-app purchases

The app offers in-app purchases. Payment is taken by Apple or Google inside their own stores. They receive your payment details, act as controllers of that data, and their privacy policies apply to it.

RevenueCat, a purchase and entitlement service, is built into the app. Apple's filing declares that in-app purchases are offered, yet neither store filing declares purchase, payment or financial data as collected by the studio. That gap looks like an under-declaration. It must be reviewed and, if confirmed, corrected in App Store Connect and in the Play Console.

• To confirm: confirm that no card numbers, billing details or other payment data reach FREEDOM LLP from either store.
• To confirm: what does RevenueCat receive and keep for a Queens player — receipts, transaction identifiers, entitlement records — is any of it held against the player id, and does any of it reach the studio's own servers?

Data stored on your device

We cannot yet describe what the mobile app keeps on your device. Neither store filing covers on-device storage, and the source review did not settle it either. Under UK law, storing or reading information on your device needs your consent unless it is strictly necessary to provide the game.

The advertising and analytics components in the build read and write identifiers on your device. That is not strictly necessary to provide the game, so it needs your consent — and, as set out under "Advertising and tracking", the game contains no consent mechanism written by the studio.

For the queens.game browser demo, the separate web policy describes a few entries kept in your browser: your language, theme and helper preferences, whether you dismissed the tutorial, and your current puzzle level and timer. That policy states this information stays in the browser.

• To confirm: what exactly does the mobile app store locally on the device (progress, settings, timers, identifiers cached by the advertising and analytics components), can a player clear it inside the app or only by deleting the app, and does any of it survive uninstall?

Why we may process data

UK GDPR requires a legal basis for every use of personal data. The likely bases for the declared categories are set out below, and the studio must confirm each one before this policy is final.

Consent is the weak point today. Advertising, cross-app tracking and the analytics access described above can rest only on consent, and no consent mechanism written by the studio exists in the game. Unless a consent platform is switched on outside the code, that processing is currently running without a basis. Where consent is the basis, you can withdraw it at any time, and withdrawing it does not affect anything done before you withdrew.

• Running the game, fixing crashes and keeping the app stable (app info and performance, diagnostics): our legitimate interests. Diagnostics is also declared to Apple as used for tracking, and that use relies on consent, not legitimate interests.
• Understanding how the game is played (app activity, usage data): consent, because our analytics components read and write identifiers on your device, which UK law treats as needing consent. Where analysis is done on data we already hold and no device access is involved, we rely on our legitimate interests.
• Tracking across other apps and websites, advertising identifiers and location: consent.
• To confirm: confirm the purpose and the lawful basis for each declared category, taking each of the components listed under "Sharing" in turn.

Sharing

Data does go to other companies. The list below is taken from the components built into the game itself. This is why the Google Play answer "no data shared with third parties" cannot stand.

Apple and Google also handle installs and purchases under their own terms; the iOS version uses Apple's Game Center for achievements, and the Android version integrates Google Play Games. We will also disclose data where the law requires it of us.

Data goes outside the United Kingdom. Apple, Google and Game Center all process outside the UK, so transfers happen as a matter of course, and where the other companies listed below process is not yet confirmed. UK GDPR requires us to name the safeguard relied on for each transfer — an adequacy decision, the IDTA, or the UK Addendum to the EU standard contractual clauses — and that has not yet been settled for Queens. Once it is, you will be able to ask for a copy by writing to [email protected].

• Google AdMob and AppLovin MAX — advertising and ad mediation.
• Meta SDK and TikTok Business SDK — advertising, attribution and measurement.
• Amplitude and GameAnalytics — analytics.
• Firebase (Google) — analytics, and the player identity the app is keyed to.
• RevenueCat — purchases and entitlements.
• Google Play Games — Google's player services on Android.
• FreedomAnalytics — the studio's own analytics platform, which receives data at https://api.appanalytics.ai/v1.
• The build also contains the Gley package, but only its About, Common and Localization parts. Its consent module is not included.
• To confirm: for each company listed above, what data does it receive, is it acting only on our instructions or for its own purposes, and in which country does it process?
• To confirm: what identifier does Firebase issue and retain for a Queens player?
• To confirm: which transfer safeguard is relied on for each recipient (the IDTA or the UK Addendum), where are api.appanalytics.ai and the Queens backend hosted, and where can a copy of the safeguard be obtained?
• To confirm: what does the Game Center integration send — player identifier, nickname, achievement records — and is it enabled for players under the 4+ rating?

Retention

We have not yet set a fixed period for each category, so the criteria we apply are these. Records in the studio's own systems are held against a player id, and are kept while that id is in use in the game and while they are still needed for the purpose they were collected for. Diagnostic and crash data is kept while it is needed to find and fix the fault it reports. Anything held on either basis is deleted once a request under "Your rights" is met.

The companies listed under "Sharing" keep data under their own retention schedules, which the studio does not set.

The Google Play filing states that collected data cannot be deleted. That is a product decision, not a technical limit: the studio's records are keyed to a player id, so they can be found and removed. The Play answer needs correcting alongside this policy.

• To confirm: set and confirm an actual period for each declared category — usage data, identifiers, diagnostics, location, purchase records — and what triggers deletion, both at the studio and at each company listed under "Sharing".

Your rights

Under UK GDPR you have the rights listed below. To use any of them, including deletion, write to the studio at [email protected]. UK GDPR sets a one-month time limit for responding to these requests.

The studio's current Google Play answer states that collected data cannot be deleted. That answer is wrong — records are keyed to a player id and can be located and removed — and it is being corrected. The erasure route has not been built yet. This policy must not go live before that route is working and the Play answer is fixed.

There is no studio account to look you up by, so records are matched on the player id. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO). Players in the EU or the EEA can also complain to their own supervisory authority.

• Ask what data we hold about you and get a copy.
• Ask us to correct data that is wrong.
• Ask us to delete data, or to restrict how we use it.
• Object to processing based on our legitimate interests, including profiling.
• Ask for your data in a portable form.
• Withdraw consent for tracking, advertising or location at any time. The game has no in-app control for this; the device settings available today are described under "Advertising and tracking".
• To confirm: how does a player read their player id, so they can supply it with a request?
• To confirm: when will the erasure route be built and live, and how is a deletion request passed on to AdMob, AppLovin MAX, TikTok, Meta, Amplitude, Firebase, GameAnalytics and RevenueCat?
• To confirm: who at FREEDOM LLP handles rights requests, and can the one-month deadline be met?

Children

Queens is rated 4+ on the App Store, so it is offered to young children. At the same time, the App Store filing declares that identifiers, usage data, diagnostics and location are linked to the user and used to track them.

The advertising components in the build are not set up for a child audience. No child-directed or age-restricted flag is set for AdMob or for AppLovin MAX anywhere in the project. Tracking children and profiling them for advertising carries specific obligations in the UK, and this combination has to be fixed in the product or in the store filings — it cannot be drafted around.

Because the app is offered to children, consent is not available as a basis in the ordinary way. A child under 13 cannot give it, and parental authorisation would be required. Switching on a consent platform would not on its own make the declared tracking lawful for this audience.

• To confirm: does the app use an age screen, will tracking and personalised advertising be switched off for children, or will the 4+ rating and the tracking labels be changed instead? Confirm which target-audience answer is filed for Queens in the Play Console.

Changes

This page is the privacy policy for the Queens mobile game.

When we change this policy, we update the last-updated date shown at the top of this page. Where a change would require your consent, this policy alone cannot obtain it: the game carries no consent screen today, so the consent would have to be asked for through a mechanism that does not yet exist.

• To confirm: will a consent platform be built or enabled before any change that requires fresh consent?

Contact

FREEDOM LLP, 101 King's Cross Road, London WC1X 9LP, United Kingdom. Company number OC407608.

General contact: [email protected]. The previously published policy gave [email protected] as the address for privacy questions, and it is not clear whether it is still read.

• To confirm: is [email protected] still monitored, should it be redirected to [email protected], and which address is the confirmed channel for data-rights requests?