1. About this policy

This policy explains what information is collected when you use the app, and how it is handled. The app has no account registration, and there is no screen where you are asked to enter your name or email address.

2. Who we are

3. Information we collect

The app automatically collects the following. None of it identifies you directly. “Notification data” is collected only if you choose to receive notifications.

4. Information we do not collect

The app does not collect any of the following.

• Name, phone number, postal address, or date of birth
• Email address (except when you send us one yourself in order to contact us)
• Precise location data (GPS)
• Contacts or address book
• Photos, camera, or microphone
• Social media account connections

The app has no sign-in feature and no form for entering personal information.

5. How we use it

We use the information collected only for the following purposes.

• Finding and fixing problems, and making the game easier to play
• Understanding which features are used and how often
• Serving advertisements and measuring their performance
• Sending notifications to players who chose to receive them
• Replying to your enquiries

6. Data stored on your device

Your progress (the board, coin balance, cities visited, and the stamps, postcards and trivia you have collected) and your settings are stored only on your device. There is no synchronisation between devices.

If you choose to receive notifications, the “Notification data” described in “3. Information we collect” is sent to the server we use (Cloudflare) so that we can decide what each notification says and when to send it. Your progress itself (such as the board or your coin balance) is not sent.

This also means that deleting the app deletes this data along with it.

7. How we keep information secure

Everything sent from your device is transmitted over an encrypted connection (HTTPS / TLS). Data held on the device is kept in the app’s own storage area provided by the operating system, where other apps cannot read it.

We handle the information we collect only to the extent needed to improve the app, serve advertisements, send notifications and answer enquiries. Information held by the services listed below is secured according to the standards each of those companies sets.

8. Third parties

The information described above is collected and processed by the following services. We do not sell information to third parties for the purpose of identifying you.

Each of these third parties is bound by its own privacy policy and terms to protect your information to a standard equal to or greater than the one described in this policy, and we reviewed those terms before adopting their services.

• Google LLC (Firebase Analytics, Firebase Authentication, Firebase Cloud Messaging, Google AdMob) — Privacy Policy / Firebase data handling / How Google uses information from partner sites and apps
• Cloudflare, Inc. (the server that decides when to send notifications and what they say; only if you choose to receive notifications) — Privacy Policy

9. Ad personalisation and your choices

The app shows advertisements served by Google AdMob. A consent screen is presented inside the app, and the ads you are shown depend on the answer you give there.

You can change your choice at any time.

• In the app: open Ad settings on the settings screen to change your advertising consent (shown if you live in a region where consent is required)
• iOS: Settings → Privacy & Security → Tracking, then turn tracking on or off per app
• Android: Settings → Privacy → Ads, then reset or delete your advertising ID
• Turn off personalised ads in your Google account’s Ad settings

10. If you live in the EEA, the UK or Switzerland

If you live in the European Economic Area (EEA), the United Kingdom or Switzerland, we handle your information in line with the EU General Data Protection Regulation (GDPR) and the equivalent national laws. The controller for the purposes of this section is oneWheat, named in “2. Who we are” above.

Legal bases for processing

• Serving and personalising advertisements — your consent (GDPR Article 6(1)(a)), obtained through the consent screen shown inside the app
• Sending notifications, and collecting the notification data needed for them — your consent (Article 6(1)(a)), obtained through the in-app question (or the Notifications switch on the settings screen) and your device’s notification permission
• Improving the app, understanding how it is used, and finding and fixing problems — our legitimate interests (Article 6(1)(f)) in keeping the app working well, without identifying you
• Replying to your enquiries — our legitimate interests (Article 6(1)(f))

Your rights

You have the right to access your personal data and to ask us to rectify or erase it, to restrict or object to its processing, and to receive it in a portable form. To exercise any of these rights, email us at the address above.

Withdrawing consent

You can withdraw your advertising consent at any time through Ad settings on the app’s settings screen, as described in “9. Ad personalisation and your choices”. You can withdraw your consent to notifications by turning off Notifications on the app’s settings screen. Withdrawal takes effect going forward and does not affect the lawfulness of processing carried out before it.

Transfers outside your region

The information collected is stored and processed in countries such as Japan and the United States, which are outside the EEA, the UK and Switzerland. These transfers are covered by the safeguards each service provider has put in place, such as standard contractual clauses.

Complaints

You have the right to lodge a complaint with the data protection authority in your country. We would appreciate the chance to address your concern first, so please do contact us at the address above.

11. Children’s privacy

The app is not directed at children, and we do not knowingly collect information from children under 13. If you believe a child’s information has been sent to us, please contact us at the address above and we will verify and delete it.

12. Retention and deletion requests

Event data collected through Firebase Analytics is retained for 14 months from collection and deleted once that period has passed. Where this data is exported to BigQuery for analysis, it is deleted on the same schedule. Data stored on your device is erased when you delete the app.

Notification data is deleted as soon as you turn off Notifications on the app’s settings screen. Even if you do not, it is deleted 30 days after you last used the app. Records of the notifications we sent are deleted 30 days after sending.

If you would like your data deleted, please email us at the address above. We may ask for details about your device so that we can identify the right records.

13. International transfers

The services listed above operate servers outside Japan, so the information collected may be stored and processed outside Japan.

14. Changes to this policy

If we change this policy, we will update this page and revise the “Last updated” date shown at the top.