Down Deep · Privacy policy
Down Deep privacy policy
What the game collects, why, who else is involved, how long we keep it, and how to get it deleted.
Last updated
In short
- You can play without signing in. Signing in with Apple lets us keep your progress and put you on the leaderboards.
- We keep your game profile on our server: a player ID, the name and country you choose, your progress and records of your runs.
- Ads appear only when you choose to watch one for a reward. They are shown by Google AdMob, which does not track you across apps unless you allow it.
- We do not sell your data, and we do not use it for advertising profiles.
- You can ask us for a copy of your data or have your account deleted at any time.
1. Who we are
Down Deep is made by Jakub Tuzinowski, trading as Pipkiln (“Pipkiln”, “we”, “us”). We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: hello@pipkiln.com.
2. What we collect and why
If you sign in with Apple
Apple gives us a stable identifier that is unique to our apps. It does not reveal your Apple Account. If you choose to share them, Apple also passes your name and an email address, which may be a private relay address that forwards to you. We use the identifier to find your game profile on our server.
Your game profile (on our server)
- a random player ID and your Apple identifier;
- the display name you choose (up to 16 characters) and, if you set it, your country;
- your progress: coins, gems, upgrades, items and best depth;
- whether your account is restricted for cheating.
We need this to run the game for you: keep your progress, sell you upgrades with in-game currency and show the leaderboards.
Your runs
When a run ends, the game sends what happened: depth reached, coins and gems found, continues and power-ups used, and the timing between your taps. Our server uses this to check the run was played by a person and not a bot, an auto-clicker or a modified app, and only then credits it. The tap timing of honest runs may later be used to show a “ghost” of a friend's run.
Game events
The game may send short gameplay events (for example that a run started, a layer was reached or a shop item was viewed) linked to your player ID. We use them to find bugs and balance the game. They are not used for advertising.
Technical data
Like any internet service, our server sees your IP address when the game connects. We use it only to limit the number of requests (to stop abuse) and keep it in a short-lived counter that resets within minutes. Apple's DeviceCheck may give the game a one-time token that proves a request comes from a real iPhone running Down Deep. It does not identify you.
Messages you send us
If you email us, we keep your email and our reply so we can help you.
3. Apple services the game uses
These features run on Apple's services. Apple processes the data under its own terms andprivacy policy.
- Game Center. If you are signed in to Game Center, your best depth is submitted to the Down Deep leaderboard and your Game Center friends can see it. We read your friends' scores to show them in the game. Your Game Center nickname is shown to other players by Apple.
- iCloud key-value storage. The game can save your progress in your own iCloud account so it follows you to a new iPhone. This lives in your iCloud. We cannot read it.
- iCloud (CloudKit) public leaderboard. If you are signed in to iCloud, your best depth, display name and country are saved to a public leaderboard that every Down Deep player can see. The record is linked to an identifier Apple creates for this app, not to your Apple Account details.
- In-app purchases. Apple takes payment and handles refunds. We never see your card details. We receive a record of the purchase (what was bought and when) so we can deliver it to your account and keep tax records.
4. Rewarded ads (Google AdMob)
Down Deep shows an ad only when you choose to watch one, for example to continue a run. Ads are provided by Google AdMob. To show an ad, measure it and prevent ad fraud, Google receives information such as your IP address, device type, operating system, app version and how you interact with the ad.
We request non-personalised ads. Google does not use your activity in other apps to choose them. If iOS asks whether Down Deep may track you and you choose “Allow”, Google may also use your device's advertising identifier. You can change this any time in Settings → Privacy & Security → Tracking. Google's use of data is described inHow Google uses information from sites or apps that use its services.
5. Other services we rely on
- Cloudflare runs our game server and database (Cloudflare Workers and D1). Cloudflare processes the data on our behalf. Cloudflare privacy policy.
- Expo (650 Industries) delivers game updates. When the game starts it may check Expo's servers for an update, which shares your IP address and basic device and app information with Expo.Expo privacy policy.
- Google AdMob, as described in section 4.
- Apple, as described in section 3.
We do not sell personal data and we do not share it with data brokers.
6. Our lawful bases
| What we do | Lawful basis (UK GDPR art. 6) |
|---|---|
| Keep your profile and progress, deliver purchases, show leaderboards | Contract: it is needed to provide the game you asked for |
| Check runs for cheating, restrict cheaters, rate-limit requests | Legitimate interests: keeping the game fair and secure for every player |
| Gameplay events to fix bugs and balance the game | Legitimate interests: improving the game |
| Personalised ads and the advertising identifier, if you allow tracking | Consent, which you can withdraw at any time |
| Purchase records | Legal obligation: tax and accounting law |
| Answering your emails | Legitimate interests: helping you |
7. How long we keep it
- Game profile: while your account exists. If you delete it, within 30 days. If you do not play for 3 years, we may delete it.
- Run records, tap timing and game events: 12 months.
- Anti-cheat restrictions: as long as the restriction applies, and no longer than 3 years.
- IP addresses for rate limiting: minutes.
- Purchase records: 6 years, as UK tax law requires.
- Emails with us: 2 years after the conversation ends.
- Public CloudKit leaderboard entry: until you delete your account or ask us to remove it.
8. Deleting your account
You can delete your Down Deep account in the game (Settings → Delete account) or by emailing us. This removes your game profile, runs and events from our server and your entry on the public leaderboard, and revokes the game's Sign in with Apple link. Purchases you have used cannot be refunded by us; Apple handles refunds.
9. International transfers
Apple, Google, Cloudflare and Expo may process data outside the UK, including in the United States. Where they do, the transfer is protected by the UK's adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the International Data Transfer Agreement or Addendum in their data processing terms.
10. Children
Down Deep is a general-audience game. It is not aimed at children under 13 and we do not knowingly collect personal data from them. Ads are non-personalised for every player. If you believe a child under 13 has given us personal data, email us and we will delete it.
11. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct it if it is wrong;
- delete it;
- restrict or object to how we use it, including any use based on legitimate interests;
- give you your data in a portable format;
- and you can withdraw consent at any time, without affecting what we did before.
Email hello@pipkiln.com. We reply within one month. If you are not happy with our answer, you can complain to the Information Commissioner's Office atico.org.uk.
12. Security
Connections to our server are encrypted (HTTPS). Sessions are signed tokens, and administrative access to the server is protected by a secret only we hold. No system is perfectly secure, but we will tell you and the ICO about a breach where the law requires.
13. Changes to this policy
If we change how we use your data, we will update this page and the date at the top. For significant changes we will also tell you in the game.