Privacy Policy

Lights On, Robots Off (Android game), developed by DobroByte Studio. Effective date: 14 November 2026.

This policy explains what information the game Lights On, Robots Off (the "Game") processes, why, who may receive it, how long it is kept, and how you can control or delete it. DobroByte Studio, an independent developer ("we"), is responsible for the processing described here. Contact: dobrobyte.studio@gmail.com.

The Game does not require an account and does not ask for your real name, email address, phone number, contacts, camera or microphone access. It does not request Android location permissions and does not collect GPS location (see section 2 about approximate location inferred by advertising services).

1. Information processed by the Game

Local game data

Your progress and settings (heroes, equipment, currency, upgrades, game settings) are stored on your device. Depending on your Android version, device maker and Android backup settings, Android may back up this local data to your Google account and restore it on another device. This is a function of the Android system, controlled in your device settings; it is separate from the Game's own cloud backup below.

Cloud backup

While the Game has internet access, it saves your game progress to our backend hosted on Supabase (project region: EU, Ireland, eu-west-1). The server stores: your current cloud save; the previous version of the cloud save (for recovery); a pseudonymous profile identifier; and a cryptographic hash of your random recovery code (not the code itself). You keep the recovery code. Anyone who knows the code can restore the backup, so keep it private.

Leaderboard

The arena leaderboard stores your best arena result, your display name, your avatar and the pseudonymous profile linked to the result. Your display name, avatar and result are visible to other players. Do not use your real name, contact details or other personal information as a display name. See section 7 for rules and reports.

Battle statistics

Under the same consent as analytics (section 3), after each finished battle the Game sends a short summary to our backend: the stage and mode, the outcome and duration, kills, the hero, the equipment worn (item, level and quality), the upgrade cards picked together with the cards offered, and the damage dealt by each weapon. It is linked only to the pseudonymous profile identifier, never to your display name, and is used to balance the Game. These summaries are deleted after 180 days.

Technical server information

When the Game contacts our backend, Supabase and its infrastructure may process technical request data (IP address, time, request metadata, security logs) so that we can operate the service, keep it secure, investigate errors and prevent abuse.

2. Advertising (Google AdMob)

The Game shows ads through Google AdMob (Google Mobile Ads SDK): rewarded video ads that you choose to watch in exchange for a reward and, when enabled, full-screen ads between battles. The optional "No Ads" purchase removes the ads between battles and gives rewards without videos. The SDK and Google may collect and use, for advertising, ad measurement, analytics, fraud prevention and security: your IP address; product interactions (such as taps and video views); diagnostic and performance information; the Android Advertising ID when available and permitted; and the App Set ID and other device or app identifiers. The Game does not request location permissions; Google may nevertheless infer approximate location from your IP address. See How Google uses information from sites or apps that use our services.

Consent

Where required (for example in the European Economic Area, the United Kingdom and Switzerland) the Game asks for your consent through Google's User Messaging Platform before requesting ads. You can change your choice at any time in the Game: Settings, Ad settings. On Android you can also reset or delete your Advertising ID in the device privacy settings. Choosing non-personalised ads limits personalisation but ads may still use some identifiers for purposes such as frequency capping and aggregated reporting.

3. Analytics (GameAnalytics and Google Analytics for Firebase)

When enabled, we use GameAnalytics as an analytics provider to understand gameplay, improve the Game, investigate unsuccessful actions and adjust balance. Analytics may include a pseudonymous installation/device identifier, gameplay events (tutorial progress, run mode, stage, outcome, duration, kills, revives and chest openings), rewarded-ad offers and outcomes, device type and operating system, and approximate country inferred from the IP address used to contact the service. We do not send your display name, cloud recovery code or profile text to GameAnalytics. Advertising ID tracking and automatic error-log reporting are disabled in this integration.

Where consent is required, analytics must start only after that consent has been obtained. You can review privacy choices through Settings, Ad settings where available. Android also lets you reset or delete your Advertising ID; this alone does not stop all analytics or delete previously collected data, especially when a separate pseudonymous identifier is used. Contact us for privacy or deletion requests. GameAnalytics retention follows the provider's applicable retention rules and our service configuration; see GameAnalytics privacy notice. Analytics data is sent to GameAnalytics servers that are located in the United States and may also be processed in the EU.

Google Analytics for Firebase

We also use Google Analytics for Firebase (Firebase SDK, provided by Google) to measure how players reach and use the Game, to measure and optimise our advertising campaigns (for example in Google Ads) and to measure ad revenue. It may collect an app instance identifier, the Advertising ID when available and permitted, a small set of game events (such as completed battles and chapters), purchase events with their amount and currency, device and app information and approximate location inferred from the IP address. We do not send your display name, cloud recovery code or profile text to Firebase. Where consent is required, Firebase follows the same consent choice as advertising. See Privacy and Security in Firebase.

4. In-app purchases (Google Play)

The Game offers optional purchases for real money (for example crystal packs, bundles, a 30-day card and "No Ads"). Payments are processed by Google Play under Google's terms and privacy policy; we never receive your card or bank details, your name or your email address.

To deliver, restore and protect purchases, the Game sends the purchase receipt to our backend, which checks it with Google Play. Our backend stores: the order number, the product, a cryptographic hash of the purchase token (not the token itself), the pseudonymous profile identifier that received the purchase, the store country, the time, whether it was a test purchase and whether it was refunded. Once a day the backend asks Google Play for refunded or cancelled purchases; the Game then removes the refunded benefit (for example "No Ads" or the remaining days of a card). The purchase amount and currency are also sent to GameAnalytics and Google Analytics for Firebase as analytics events, without the order number.

These records are processed to provide the purchased content (contract), to prevent fraud and abuse and to keep records of sales (legitimate interests and legal obligations).

5. Legal bases (GDPR / UK GDPR)

• Cloud backup, restore and leaderboard: necessary to provide the features you request, and our legitimate interest in operating them.
• Security and technical logs: our legitimate interests in security, reliability and abuse prevention.
• Advertising identifiers, ad-related storage and optional analytics: your consent where consent is required by law.
• Purchases: performing the purchase you made, our legitimate interest in preventing fraud, and legal obligations to keep sales records.
• Support and privacy requests: responding to your request, exercising or defending legal claims, and legal compliance.

6. Who receives data

Supabase hosts the backend (cloud saves, leaderboard, technical logs). Data is stored in the EU (Ireland); Supabase may use subprocessors and, where required, relies on contractual safeguards such as Standard Contractual Clauses. Google (AdMob) and participating advertising providers receive the advertising data described in section 2 and may process it in other countries under Google's safeguards. GameAnalytics receives the analytics information described above as our analytics provider. Google also receives Firebase analytics data and processes payments and purchase checks through Google Play. It is sent to servers in the United States and may also be processed in the EU, under applicable transfer safeguards. We do not sell your personal data.

7. Leaderboard names, reports and moderation

Display names are visible to other players. Names that are offensive, hateful, sexual, impersonate others or contain personal or contact information are not allowed. You can report a name from the leaderboard screen; we review reports and may change or hide a name and remove the related leaderboard entry. Players who repeatedly break these rules may be removed from the leaderboard. Contact us at dobrobyte.studio@gmail.com to report a name outside the Game.

8. Retention

• Cloud saves (current and previous version) and the pseudonymous profile are kept while the cloud backup exists or until you delete it.
• Leaderboard records are kept while the cloud profile exists, unless removed earlier.
• Server and security logs are kept for the period set by our hosting provider and only as long as reasonably necessary.
• Advertising data is kept by Google and its partners under their own policies.
• Purchase records are kept as long as needed to deliver and restore purchases, handle refunds and prevent fraud, and as long as sales records must be kept by law. Deleting the cloud backup does not delete purchase records.
• Analytics data is retained under GameAnalytics retention rules and our service configuration; withdrawing consent does not itself erase earlier data.
• Emails you send us are kept only as long as needed to answer and document the request, or as required by law.

9. Deleting your data

In the Game open Settings, Cloud backup, Delete copy: this deletes your current and previous cloud saves, the cloud profile and the linked leaderboard records. You can also ask for deletion at dobrobyte.studio@gmail.com; if you cannot use the in-game function, we may need your recovery code to identify the cloud profile. If you email a recovery code, your email provider processes that message; we use the code only to process the request. Copies in routine infrastructure logs or provider backups may remain for a limited time until they expire. The Game has no accounts, so there is no separate account to close. Local data is removed when you uninstall the Game or clear its data, but data restored or kept by Android's own backup is controlled in your device and Google account settings.

10. Security and international transfers

The Game connects to our backend over encrypted HTTPS. No method of transmission or storage is completely secure. We use providers such as Supabase, Google (AdMob, Firebase, Google Play) and GameAnalytics, so information may be processed in countries other than yours; where the law requires, safeguards such as contractual clauses are used.

11. Your rights

Depending on the law that applies to you (for example the GDPR) you may have the right to information, access, correction, deletion, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time (withdrawal does not affect earlier lawful processing). Because the Game has no accounts, we may be unable to link data to you without your recovery code. You can use the in-game controls or contact us. If the GDPR applies you may lodge a complaint with the data protection authority in the country where you live or work.

12. Children

The Game is not designed or marketed primarily to children, and we do not ask for a child's real name, email, phone, precise location, photos, contacts, camera or microphone data. If you believe personal data of a child was processed without a required parental consent, contact us and we will delete it.

13. Changes

We may update this policy if the Game, our providers, the law or our practices change. The effective date above shows the latest revision. Where a change materially affects how personal data is processed, we will give additional notice where required, for example in the Game or on its store page.

14. Contact

DobroByte Studio, independent game developer.
Privacy, support and data-deletion requests: dobrobyte.studio@gmail.com