Yarnwake Privacy Policy

This policy explains what information the Yarnwake game (the “Game”) collects, why, who receives it, how long it is kept, and the choices and rights you have. The Game is operated by ComboMint (“we”, “us”), which decides how your information is used (the “controller”). Questions and requests: support@combomint.com.

In short

You can play without giving us your name, email address or phone number. We never ask for them.
If you are 13 or over, the Game creates an account for you the first time it goes online. It has no name, and other players cannot see you, unless you choose a nickname — which then appears on public leaderboards.
Purchases are handled by Apple (or Google). We never see your payment details.
Ads are optional videos you choose to watch. On iPhone they use your advertising identifier only if you allow tracking; in Europe they are personalised only with your consent; and players under 18 never get personalised ads.
You can delete your account from the Game’s Settings at any time. It is hidden at once and erased after 14 days, so you have time to change your mind.

1. What we collect

Your age group

The first time you open the Game, it asks the month and year you were born. They are kept only on your device, in its secure storage, so that your age group (under 13, 13–17, or 18 and over) can be worked out — and move up on its own as you get older — without asking again. Your birth month and year are never sent to us or to anyone else. The group decides which features and ads are available to you (see Age and children). Our game statistics record only the group.

Your game account

If you are 13 or over, you get an account on our server automatically, the first time the Game goes online. It has no name: you choose a nickname only if you want one, when you first open the leaderboards. The account holds:

a random player ID, a friend code, the cat you play as and, only if you choose one, your nickname (2–12 characters);
when the account was created and when it was last active;
your progress: stages cleared, stars, your best run on each stage (including its list of moves, which we use to check the score is genuine), scores, streaks, weekly-hunt results, and the day on your device’s clock that daily rewards are counted by;
a cloud copy of your game (your progress, coins, cats, streak and chosen language), so it can be restored on another device;
your coin balance and a record of every change to it, such as “stage 12 cleared, +8” or “bought 600 coins”, with the version of the Game that made it. If our support team changes your balance, the record also keeps the reason they wrote and which team member made the change. To stop cheating, we also count how often the balance on your device and ours disagree, and how many scores our server refused;
the cats and items you own;
your friends, the players you have blocked, and reports you have filed;
reports other players filed about you: the reason they chose and the nickname you had at the time, if any;
whether the account is suspended.

The account is protected by a secret key kept on your device. On iPhone it is in the device’s secure storage (the iOS Keychain), which keeps it even if you delete the Game, so reinstalling on the same device finds your account again; if the Keychain cannot be used, the key is kept in the Game’s own storage instead. On Android it is kept in the Game’s private storage, which only the Game can read; deleting the Game removes it, unless Android’s own backup restores the Game to a device signed in to the same Google account. Our server stores only a scrambled (hashed) form of the key.

Until your account is created — for example while the Game has not yet been online — your coins and cats are kept only on your device. When your account is created, the balance and cats your device held are sent to us once and moved into the account, and we record what the device claimed.

Signing in with Apple or Google (optional)

If you sign in so your progress follows you to another device, we receive only the account identifier Apple or Google issues for the Game. We do not ask for, receive or store your email address or name from them. Google sign-in opens in a secure browser window on your device, which talks to Google directly. Signing in on a new device signs the old one out. If you sign in on a device where you had an account but had not signed in with Apple or Google, the two accounts are combined and we record that they were. The combined-away account is hidden from every board and is deleted when you delete your account.

Purchases

Purchases are made through the App Store on iPhone and Google Play on Android. The store takes the payment; we never see your card or payment details. We keep the product, the store’s transaction ID (on Google Play, the purchase token), the date and the coins credited, so we can deliver what you bought, restore it, and handle refunds. To check that a Google Play purchase is genuine, our server asks Google about that purchase token. With each App Store purchase the Game gives Apple a random-looking code made from your player ID, so that when Apple tells us about a refund we can find the right account; the code tells Apple nothing about you. When Apple tells us a purchase was refunded, reversed or revoked, we keep Apple’s message as sent. It includes the transaction details Apple holds, such as the product, date, price, currency, App Store country and the reason given.

Support messages

When you write to us from Settings → Contact support, we store your message, its category and our replies. It is sent with your player ID, your nickname if you have one, app version, coin balance and current stage, so we can help without asking; the Game shows you this before you send. If you email us instead, we receive your email address and whatever you write.

Game statistics

The Game sends us usage events, for example “stage started”, “hint used”, “coins bought” (with the product, its price and currency, and your coin balance), the answers you gave to the age, ads and tracking questions, the language you chose, and the kind of app you shared to (such as Messages, never who to). Each event carries a random install ID, a random session ID, the app version (which says whether it is the iPhone or the Android version) and the time. These statistics are pseudonymous: they are not linked to your account, and we never combine them with it. They contain no name, device model, location or advertising ID. We use them to understand how the Game is played and to improve it.

Technical logs

Our server writes a log line for each request it answers: the time, what was asked for, the IP address it came from, the player ID of the account making it (if the device has one) and the app version. We use these logs to keep the service secure, stop abuse and fix problems. IP addresses are not stored in your account.

Crash reports and diagnostics

If the Game crashes or hits an error, a report is sent to Unity (Unity Cloud Diagnostics). It contains the error, the last few lines the Game logged, and technical details of the device and its software (such as model, operating system and memory). Unity also receives basic engine and hardware statistics from the Game. On Android, Google Play also collects crash reports for the apps it distributes, under Google’s own policy. When the Game hits an error it can recover from, it also sends us one of the game statistics described above: the error message, where in the Game’s code it happened, the screen you were on and the names of the last few events (such as “stage started”, “hint used”). It contains nothing you typed and no name. We use all of these to find and fix problems.

See section 4. In short: the ad software starts shortly after you open the Game and prepares ads in the background, and in doing so our ad partners receive information about your device and its IP address even if you never watch an ad.

Things that stay on your device

Your settings, your age group, your lives and your reminders live on your device. Reminders are local notifications scheduled by the Game itself; we do not use push notifications. When you share a result or your friend code, it goes to the app you pick in your phone’s share sheet (iOS or Android). The Game can add an image to your photos only when you ask it to, and cannot read your photos.

Is any of this required? No law requires you to give us information. The account information above is needed for the online features — saving to the cloud, leaderboards, friends and purchases — and without it those features do not work. Everything else is optional or happens automatically as described.

2. What other players can see

Until you choose a nickname, other players cannot see you. Your account is on no leaderboard, is not counted in them, and cannot be added as a friend. Your scores are kept, and appear with your nickname once you choose one.
Leaderboards are public. Anyone, including people who do not play, can see the top of the global board: rank, nickname, cat and score. Once you have a nickname, other players can see where you rank. The weekly-hunt board also shows how many hunt stages you cleared.
Friends see your nickname, cat and score. Once you have a nickname, anyone you give your friend code to can add you as a friend straight away, and you appear on each other’s friends board. You can remove or block them; blocking hides you from each other everywhere in the Game.
Your sign-in accounts, purchases, coins, messages and reports are never shown to other players.

If you choose a nickname, choose one you are happy to be public. Do not use your real name.

3. Why we use your information

To run the Game — save your progress, sync it between your devices, show leaderboards and friends, deliver and restore purchases, answer support messages. Legal basis (EU/UK): performing our agreement with you.
To keep the Game fair and safe — check scores, stop cheating and fraud, moderate nicknames and handle reports. Legitimate interests.
To understand and improve the Game — pseudonymous statistics, crash reports and logs. Legitimate interests.
To show ads — see section 4. Personalised ads only with your consent; otherwise non-personalised ads. Consent / legitimate interests.
To meet legal duties — for example keeping purchase records for accounting and tax, and answering lawful requests. Legal obligation.

Where we rely on legitimate interests, those interests are: keeping leaderboards fair and the Game free of cheating, fraud and abuse; fixing problems and making the Game better; and paying for a free game with non-personalised ads. You have the right to object at any time to our use of your information on that basis — write to us and we will stop, unless we have compelling reasons to continue (for example, preventing fraud).

Automated decisions. Our server automatically refuses scores that are impossible and nicknames that contain blocked words. It does not make decisions with legal or similarly significant effects on you without a person: every suspension is decided by a person, and you can ask for a person to review any decision by writing to us.

We do not sell your personal information for money.

4. Ads and your choices

The Game shows rewarded ads only: short videos you choose to watch for a reward such as an extra life. Rewards are the same whatever you answer to any privacy question below. Ads are delivered by Unity LevelPlay (formerly ironSource) and Unity Ads, including ironSource’s ad-quality tool. When the Game opens, their software starts and loads ads in the background. They receive information about your device (such as model, operating system, language and an identifier the phone’s maker assigns to this app or its developer), its IP address, and how you interact with ads. On iPhone they receive your device’s advertising identifier only if you allow tracking. On Android they may receive Google’s advertising ID, which you can reset or delete at any time in Android Settings → Privacy → Ads; Android’s own privacy features for ads (such as ad topics and attribution) may also be used where your phone has them turned on. They use it to show, measure and protect ads against fraud, and to personalise them only where you have agreed. Apple’s SKAdNetwork may be used to measure whether an ad led to an app being installed; it does not identify you.

Under 18. Players who told the Game they are under 18 never get personalised ads and are never shown Apple’s tracking prompt. Players under 13 are marked to our ad partners as children, which rules out targeted advertising.
Apple’s tracking prompt. For players 18 and over on iPhone, the Game asks for tracking permission only when you first choose to watch an ad. If you decline, your advertising identifier is not shared. You can change it any time in iOS Settings → Privacy & Security → Tracking.
Android. There is no tracking prompt on Android: Google’s advertising ID is controlled in Android Settings → Privacy → Ads. Everything else in this section applies on Android exactly as on iPhone.
EEA, UK and Switzerland. Before any ad software starts, players 18 and over are asked whether they allow personalised ads. You can change your answer in Settings → Personalised ads.
United States. Settings → “Do not sell or share my info” tells our ad partners not to use your information for cross-context behavioural advertising.
Everywhere else (including the US, unless you have agreed in the Game), we tell our ad partners that consent to personalised ads has not been given.

Which of these applies is decided by the region set on your device (an unknown region is treated like the EEA), not by tracking where you are. Changes you make in Settings take effect the next time you open the Game.

We share information only with these companies, and only what they need:

Amazon Web Services — hosts our server, database and website (United States). It processes information only on our instructions.
Apple and Google — sign-in, purchases, refunds and app distribution, under their own privacy policies.
Unity (Unity LevelPlay/ironSource, Unity Ads, Unity Cloud Diagnostics) — ads and crash reports. For their ad services Unity and ironSource decide themselves how they use the information they collect for ads, fraud prevention and measurement, and are responsible for it as independent controllers. Information collected through Unity’s services is handled as described in the Unity privacy policy.
Google and Meta — on our website only, and only if you accept them in the cookie banner: analytics and advertising measurement, including, for Meta, a hashed form of your waitlist email address sent by our server (see section 13).

The companies that work for us must protect your information at least as well as this policy does and may use it only to provide their service. We may also disclose information when the law requires it, to protect players or the Game from fraud or harm, or as part of a sale or reorganisation of the business — in which case we will tell you before your information becomes subject to a different policy.

6. Where your information is stored

We operate from Israel, which the European Commission and the United Kingdom recognise as protecting personal data adequately. Our server is in the United States (Amazon Web Services, Virginia). For transfers there we rely on the EU–US Data Privacy Framework and its UK extension where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses. Write to us for more information.

7. How long we keep it

Your game account (everything in “Your game account” above, including support messages and reports about you) — until you delete the account, and then for 14 more days, hidden, in case you change your mind (see section 8).
Game statistics — 365 days, then deleted automatically.
Technical logs — 30 days, then deleted automatically.
Server backups — made nightly and before updates, and deleted after 14 days.
Emails to us — as long as needed to answer you, and no longer than 12 months after the conversation ends.
Crash reports — for the period Unity keeps them under its own policy.
Purchase records, the coin history and refund notices — as long as accounting and tax law require (up to 7 years from the purchase), and to prevent fraud and handle refunds. When you delete your account they are disconnected from it.
Records of moderation and support actions — up to 3 years, for our accountability; disconnected from your account when you delete it.

8. Deleting your account

In the Game: Settings → Delete my account. If your account is linked to Apple or Google, you confirm by signing in with Apple or Google again; otherwise you type a confirmation word. Your deletion is then scheduled: your account is hidden from every leaderboard and friends list and can no longer be played from that moment, and after 14 days we permanently erase from our server your account, your nickname if you had one, sign-in links, progress, scores, cloud copy, coins (including coins you bought), cats, items, friends, blocks, reports and support messages, together with any account that was combined into it. The Game shows you the date. Once erased, it cannot be undone, and coins and items cannot be restored or refunded. Copies in our backups are gone within 14 days of the erasure. The records we must keep (section 7) are disconnected from you. If your account is linked to Apple, we also revoke the Game’s Sign in with Apple access when you confirm.

Changing your mind: until the date shown, you can keep your account by opening the Game on that phone and choosing Keep my account, or by signing in with Apple or Google if your account is linked.

Without the Game, or if your account is suspended: email support@combomint.com with the subject “Delete my account” and your friend code (shown at the bottom of Settings). If you no longer have it, tell us your nickname, if you chose one, and the order ID of a purchase from Apple’s receipt email, if you made one. Because friend codes and nicknames can be seen by others, we will ask you to show the account is yours before deleting it. We delete it within 30 days and confirm when it is done. More details: yarnwake.combomint.com/delete.

Deleting also starts the Game over on your device at once, when you confirm: its progress, coins and cats are cleared, and only your settings (language, sound, notifications) and your age answer stay. If you keep your account within the 14 days, the Game loads it back from our server. Once your account has been erased you can keep playing; if you do, the Game creates a new, empty account for you the next time it goes online, with no name and nothing from the account you deleted.

9. Your rights

Depending on where you live (for example the European Union, the United Kingdom, Israel or a US state with a privacy law), you have the right to:

know what information we hold about you and get a copy of it;
have it corrected, or deleted;
receive it in a format you can take elsewhere;
object to, or ask us to restrict, how we use it;
withdraw consent at any time, without affecting what was done before;
not be treated differently for using these rights.

To use any of them, write to support@combomint.com, or use Settings → Contact support if you have an account. Tell us your friend code so we can find your account; we may ask you to prove it is yours. We answer within one month (45 days in the US), and can extend this where the law allows. Someone you authorise may make a request for you, with your signed permission.

Complaints. You can complain to us first; we acknowledge complaints within 30 days. You can also complain to a data-protection authority: in Israel, the Privacy Protection Authority; in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority where you live or work. If you live in a US state and we refuse your request, you can appeal by replying “Appeal” to our answer; we respond within 60 days, and you can then contact your state’s Attorney General.

10. Notice for California and other US states

In the last 12 months we collected these categories of personal information: identifiers (player ID, install ID, IP address, and the advertising identifier if you allowed tracking); commercial information (purchases and the coin history); internet or other electronic network activity (gameplay events, ad interactions, crash reports); account login credentials (the secret key that authenticates your device); and inferences our ad partners may draw for personalised ads where you allowed them. We collected it from you, your device, Apple and Google, and our ad partners, for the purposes in section 3, and keep it as set out in section 7.

We disclose identifiers, commercial information and activity to service providers (Amazon Web Services, Apple, Google, Unity) for business purposes. Letting our ad partners use device identifiers and ad interactions for personalised ads may count as “sharing” or “selling” under US state laws; you can opt out with Settings → “Do not sell or share my info” or by writing to us. We do not sell or share the personal information of players we know are under 16, and we do not use sensitive personal information to infer anything about you. You have the rights set out in section 9, including to know, delete and correct your information and to opt out of targeted advertising.

11. Age and children

The Game is meant for players aged 13 and over. It asks your birth month and year when you first open it, and treats you according to your age group:

Under 13: you can play every stage, but you cannot choose a public nickname, use leaderboards or friends, sign in, or make purchases, and the Game creates no account for you on our server. Ads are requested as child-directed, without personalisation.
13 to 17: every feature, including an account created automatically the first time the Game goes online (with no name unless you choose one), but never personalised ads and never Apple’s tracking prompt, and we do not sell or share your information.

From players who tell us they are under 13 we collect only what is needed to run the Game: the pseudonymous statistics, crash reports and technical logs described in section 1. We create no account or public profile for them. The question is asked once: the answer cannot be changed in the Game, even by reinstalling it, and because it stays on your device we cannot see or change it either. If you believe a child under 13 has given us other information, contact us and we will delete it.

12. Our website and the launch waitlist

This section covers our website, yarnwake.combomint.com, and the list you can join there to hear when the Game launches. Everything else in this policy is about the Game itself.

What we collect when you join the waitlist:

your email address;
a record of your consent: the exact words of the box you ticked, the version of that wording, the time you ticked it, and that you confirmed you are 16 or older;
the time you confirmed your address, by tapping the link in our confirmation email;
the campaign that brought you to the site, if any (the “utm” parameters in the link you followed, such as the ad campaign’s name) and the address of the page you came from;
the country your request came from, as our hosting provider reports it;
a scrambled (hashed) form of your IP address, used only to stop abuse such as someone signing up many addresses. We do not store the IP address itself with your sign-up;
for the Founder cat offer (below): your personal invite code, the code of the friend whose link you used (if any), how many friends who used your link have confirmed, and whether and when you earned the reward;
whether you accepted marketing cookies in our cookie banner when you signed up and, only if you did, Meta’s cookies (_fbp, _fbc) and a random identifier for the sign-up, used as described in section 13.

Why, and on what basis. We use your email address to tell you when Yarnwake launches and, occasionally, to send you news about it, and the campaign details to see which of our ads work. Our legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the box. The hashed IP address and the consent record are kept for our legitimate interests in preventing abuse and in being able to prove your consent.

Double opt-in. Nothing is sent to you until you confirm. After you submit the form we send one email with a confirmation link; if you do not tap it, you are never added to the list and we send you nothing more.

The emails we send. Besides the confirmation email: once you confirm, a welcome email with your invite link and a link to your progress page; if you earn the Founder cat, one reward email telling you so; and, as described above, word of the launch and occasional news.

The Founder cat offer (inviting friends). After you confirm, you get a personal invite link that carries your invite code. When a friend joins through it, we record your code with their sign-up, and once they confirm their own address we add one to your count. At 3 we record that you earned the reward, so that we can send you its code when the Game launches. We use this information only to run the offer: to count confirmed friends, to stop abuse (we compare the hashed IP addresses of you and your friend, so that someone inviting themselves does not count), and to deliver the reward. Our legal basis is performing the offer you chose to take part in (Art. 6(1)(b) GDPR), under the terms of the offer, and your consent to join the list. Your progress page shows your code, your link and your count — never your email address, and never who your friends are. Your friends see nothing about you, and you see nothing about them. This information is kept, and erased, together with your sign-up.

Who sends the emails. Our emails are sent through Amazon Web Services (Amazon Simple Email Service), which processes your address only on our instructions, as our processor.

How long we keep it. Until you unsubscribe, or at most 24 months after the Game launches, whichever comes first. After you unsubscribe we keep your address only marked as unsubscribed, with the consent record, so that we can prove your choice and never email you by mistake; ask us and we will erase it.

Unsubscribing and erasure. Every email we send has an unsubscribe link that takes you off the list in one tap. To have your sign-up erased completely, write to support@combomint.com from the address you signed up with. You have all the rights in section 9, including withdrawing your consent at any time, without affecting what was done before.

13. Cookies and advertising tools on our website

Our website uses one cookie that is strictly necessary: cc_cookie, which remembers the choices you made in our cookie banner, so we do not ask you again on every page. It is kept for 6 months. The site also keeps the campaign details described in section 12 in your browser’s session storage, which is deleted when you close the tab.

Only with your consent, given in the cookie banner, the website also uses:

Google Analytics 4 (Google Ireland Limited / Google LLC) — to count visits and understand which parts of the site are used. It sets cookies such as _ga.
Google Ads (Google Ireland Limited / Google LLC) — to measure whether our Google ads lead to sign-ups (conversion measurement) and to show our ads to people likely to enjoy the Game. It sets cookies such as _gcl_au.
The Meta Pixel (Meta Platforms Ireland Limited) — to measure whether our ads on Facebook and Instagram lead to sign-ups, and to show our ads to people likely to enjoy the Game. It sets cookies such as _fbp.

These tools receive information about your visit, such as the pages you view, your browser and device, your IP address and, when you join the waitlist or confirm your sign-up, the fact that it happened (these tools never receive your email address; the hashed form our server sends to Meta is described below). Google and Meta may transfer this information outside the European Union, including to the United States; they rely on the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. For their own use of the information they are responsible under their own privacy policies (Google, Meta).

We use Google Consent Mode: until you agree, Google’s tags are not loaded at all. If you reject or ignore the banner, none of these tools is loaded. The full list of cookies, with their durations, is on our cookie page.

Meta Conversions API. Only if you accepted marketing cookies, our server also tells Meta directly when you join the waitlist and when you confirm, so that we can measure whether our ads work even when a browser blocks the Meta Pixel. With each of these two events it sends a scrambled (hashed) form of your email address — never the address itself — your IP address and browser details (user agent) from that visit, Meta’s cookies (_fbp, _fbc) and an identifier that lets Meta recognise the same event reported by the Pixel, so it is counted once. Meta uses this to match the sign-up to an ad, as described above. If you did not accept marketing cookies, nothing is sent. Our legal basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time with Cookie settings; after that, nothing more is sent.

Changing your mind. You can withdraw or change your consent at any time with Cookie settings at the bottom of every page of the website. Withdrawing is as easy as giving consent, and it does not affect what was done before.

14. Everything else

Security. Connections from the Game to our network are encrypted, account keys are stored hashed, and access to our systems is limited to the people who run them. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the authorities as the law requires.

Changes. If we change this policy, we will update the date at the top. If a change is significant, we will tell you in the Game or on this page before it takes effect.

Contact. ComboMint — support@combomint.com, or Settings → Contact support in the Game. Our Terms of Use also apply to your use of the Game.