PirateBeer is an independent individual developer and the data controller for the Mommy a Monster! mobile application (“the app”), based in the Netherlands and subject to the General Data Protection Regulation (GDPR, EU 2016/679) and its Dutch implementation.
Contact for all privacy-related enquiries: piratebeer2019@gmail.com
This policy describes how the app collects, uses, and stores information when you play Mommy a Monster! on Android.
This app is not designed for, marketed to, or directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information through the app, please contact us at the address above and we will delete it promptly.
When you sign in with Google Play Games (GPGS), the app receives an anonymous pseudonymous player identifier assigned by Google. This identifier is scoped to your Google Play Games account and is not your name, email address, or any other directly identifying information. The app never reads your Google account name or email.
We use this identifier to submit your score to the in-game leaderboard and to report your progress on Google Play Games achievements. Google acts as a data processor on our behalf for this service. Signing in with Google Play Games is optional — if you decline, you can still play; the leaderboard and achievements features simply are not available. Cloud save does not depend on GPGS sign-in; it is described exclusively in Section 2.2.
On first launch the app creates an anonymous Firebase account, which yields a random pseudonymous user identifier (UID) generated by Google's Firebase Authentication. This UID is not your name, email address, or any other directly identifying information, and is not linked to your Google account. It is stored on your device and persists across launches so the app can recognise the same install.
When an anonymous Firebase account exists, the app stores a copy of your game-progress data in Google's Cloud Firestore database, in a document keyed to your anonymous Firebase UID. Access is restricted so each document can be read or written only by the anonymous account that owns it. Your local on-device save is always authoritative; the cloud copy is an additive backup used to restore progress and sync across devices. Google acts as a data processor on our behalf.
The following game state is stored on your device (in Android app storage and a private save file): level progress (stars earned, highest level), currency balances (coins, diamonds, stars, cookie-jar balance), hero and monster unlock states, boost upgrade levels, total playtime (a relative counter used for save-conflict resolution), quest and reward-pass state, achievement progress and unlocks, lifetime gameplay statistics, cosmetic items owned and equipped, and one-time purchase entitlement flags. This data is held on your device and, as described in Section 2.2, backed up to Cloud Firestore keyed to your anonymous Firebase identifier. It is not shared with any third party other than Google as the cloud-save processor.
When you make a real-money purchase, payment is processed entirely by Google Play Billing — we never receive or store your payment card details, billing address, or any payment-method information.
To confirm a purchase is genuine before granting the item (fraud prevention), the app sends the Google Play purchase token to a Firebase Cloud Function we operate. That function verifies the token with the Google Play Developer API and stores a minimal validation record in Google's Cloud Firestore: the purchase token, your pseudonymous Firebase user ID, the product identifier, and a validation timestamp. This record exists solely to stop a purchase from being granted more than once; it contains no payment or contact information. If you redeem a promotional code, we likewise record that your pseudonymous Firebase user ID claimed that code, to stop the same code being claimed twice. The purchase also generates an analytics event as described in Section 2.5.
On first launch, the app shows a consent dialog. Analytics collection begins only if you actively consent. If you decline or do not respond, no analytics events are sent. You can withdraw consent at any time from the in-app Settings menu.
If you consent, we collect the following via Firebase Analytics (a Google product):
Purpose: to understand how players engage with the game so we can improve it. Processor: Firebase Analytics is operated by Google LLC; data is transmitted to and stored on Google's servers in the United States under the EU–US Data Privacy Framework. A copy of the consented analytics events is also exported once per day to Google BigQuery, our analytics warehouse, into a dataset located in the European Union. The exported data is the same pseudonymous event data described above; no additional data is collected by the export. Retention: Google Analytics retains user-level event data for 14 months, after which individual event records are deleted from Google's analytics systems. The copies exported to our BigQuery warehouse are retained for up to 24 months; exported records expire and are deleted automatically at the end of that window.
We do not collect your name, email, phone number, or postal address; precise (GPS) location; advertising identifiers (we use no advertising SDK); device identifiers such as the Android ID (the app reads the Android ID locally to derive a hashed device-binding value that protects your purchase wallet against cloned save data; that value is stored only on your device and is never transmitted to us or to anyone else); camera, microphone, contacts, or calendar data; or any information from your device's files beyond the app's own save data.
Crash and stability reporting is provided by Firebase Crashlytics (a Google product). Like analytics, crash collection is consent-gated: it is off by default and is enabled only if you actively consent via the first-launch dialog. You can withdraw consent at any time in Settings.
If you consent, when the app crashes or records a non-fatal error we collect device and OS metadata (device model, manufacturer, Android OS version, app version, and device state such as free memory and orientation), a crash stack trace, and diagnostic keys/logs the app attaches to aid debugging (e.g. the current level number). These contain no name, email, location, or other personally identifying value.
Processor: Firebase Crashlytics is operated by Google LLC; data is stored on Google's servers in the United States under the EU–US Data Privacy Framework. Retention: 90 days (the Firebase default).
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| Local game progress storage | 6(1)(b) — performance of a contract (saving your progress). |
| GPGS leaderboard and achievements | 6(1)(b) — performance of a contract (features you opt into). |
| Firebase anonymous identity + Firestore cloud save | 6(1)(b) — performance of a contract (cloud backup and cross-device restore). |
| Consent-gated analytics | 6(1)(a) — your freely given, specific, informed, unambiguous consent. |
| Consent-gated crash reporting | 6(1)(a) — your freely given, specific, informed, unambiguous consent. |
| Processing of purchase receipts | 6(1)(b) — performance of a contract (fulfilling a purchase you initiated). |
We do not sell your data. We do not share your data with advertisers or data brokers. The third-party services we use as data processors are all Google products governed by Google's standard Data Processing Addendum:
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC (Google Play Games Services) | Leaderboard, achievements, anonymous player identity | United States | EU–US Data Privacy Framework |
| Google LLC (Firebase Authentication) | Anonymous pseudonymous account identity (UID) | United States | EU–US Data Privacy Framework |
| Google LLC (Cloud Firestore) | Cloud backup/sync of game-progress save data | United States | EU–US Data Privacy Framework |
| Google LLC (Firebase Analytics) | Consent-gated gameplay analytics | United States | EU–US Data Privacy Framework |
| Google LLC (BigQuery) | Analytics warehouse: daily export of the consented analytics events | European Union | Stored in the EU; no third-country transfer for the stored copies |
| Google LLC (Firebase Crashlytics) | Consent-gated crash and stability reporting | United States | EU–US Data Privacy Framework |
| Google LLC (Google Play Billing) | In-app purchase processing | United States | EU–US Data Privacy Framework |
The EU–US Data Privacy Framework adequacy decision (adopted 10 July 2023) provides a lawful transfer mechanism for personal data from the EU to certified US recipients; Google LLC is certified under it.
| Data category | Retention period |
|---|---|
| Local game progress (device storage) | Until you uninstall the app, which deletes the app's private storage. |
| GPGS achievements | Until you reset them via Google's tools or request deletion from us. |
| Firebase anonymous UID + Firestore cloud save | Until you request deletion from us. Persists while the install exists so progress can be restored. |
| Firebase Analytics event data | 14 months in Google Analytics (user-level event data). Copies exported daily to our BigQuery warehouse (EU): up to 24 months, then deleted automatically. |
| Firebase Crashlytics crash reports | 90 days (Firebase default), then deleted. |
| Leaderboard score | Until the leaderboard is deleted or you request deletion from us. |
Purchase-validation records (Firestore validatedPurchases) | Retained until you request deletion (see Section 6); a fixed retention window is under review. Holds the purchase token, pseudonymous Firebase UID, product ID, and validation timestamp — no payment or contact data. |
Promo-code redemption records (Firestore redemptions) | Retained until you request deletion (see Section 6). Records that your pseudonymous Firebase UID claimed a given code, to prevent double-claims. |
If you are located in the European Economic Area, you have the rights to: access a copy of your personal data; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; objection to processing; withdrawal of consent (for analytics and crash reporting, at any time via in-app Settings — withdrawal does not affect the lawfulness of processing before withdrawal); and data portability.
For erasure: uninstalling the app removes the local copy of your game progress. To delete the
Firestore cloud save, your anonymous Firebase account, and the purchase-validation and
promo-redemption records, contact us at the address below and we will run our account-deletion
routine — the steps are described on our
account & data deletion page. For analytics data, we will process
a deletion request for your app_instance_id if you can provide it, or by deleting the
relevant event stream, and we will delete the rows keyed to that same identifier from our BigQuery
warehouse.
You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), at autoriteitpersoonsgegevens.nl.
To exercise any of these rights, contact piratebeer2019@gmail.com. We will respond to verified requests within 30 days and may need to verify your identity first.
The only personal data we hold on servers we operate lives in Google's Cloud Firestore: your game-progress cloud save (Section 2.2) and the minimal purchase-validation and promo-redemption records described in Section 2.4. Firestore security rules restrict your cloud save so it can be read or written only by the anonymous Firebase account that owns it, and deny clients any direct access to the purchase-validation and promo-redemption records — those are written only by authenticated Firebase Cloud Functions we control. Game progress is also stored on your device (under Android's private app storage, inaccessible to other apps). All data is transmitted to Firebase over HTTPS (TLS 1.2+); we do not transmit raw personal data over unencrypted connections.
If we make material changes, we will update the “last updated” date and version number at the top of this page. For significant changes affecting your rights or the categories of data collected, we will provide an in-app notification on the next launch after the policy is updated.
PirateBeer — independent individual developer, Netherlands.
Email: piratebeer2019@gmail.com
(A postal contact address can be provided to data-protection authorities on request.)
For EU data protection matters, the supervisory authority is the Autoriteit Persoonsgegevens (AP), Hoge Nieuwstraat 8, 2514 EL Den Haag, Netherlands — autoriteitpersoonsgegevens.nl.