Privacy Policy

Version 1.0 · Effective 5 October 2026

VELTRAIL is a 3v3 arcade game for iOS and Android. This policy explains in plain language which data the game, its online game server and its advertising partner Google process, why, for how long, and what choices you have. It applies to VELTRAIL 1.0.0 and later and to this website.

In short

• No account. There is no sign-in, no chat and no in-app purchases. We never ask for your real name, e-mail address, phone number or location.
• Your progress stays on your device. Your profile, progress, settings and the game's local statistics are stored only on your device. We don't receive them.
• Online play is optional. When you play online, the game server receives what it needs to run the match — your player name, your choices and inputs in the match and a temporary session token — and, like every internet service, your IP address. It keeps them only in its working memory while you play and does not write player names or IP addresses to its logs.
• The game is free and shows ads from Google AdMob. Google processes device data such as your IP address and advertising identifiers to show ads, measure them and prevent fraud. In the EEA, the UK and Switzerland you decide in Google's consent form whether ads may be personalised; on iPhone and iPad, Apple's tracking prompt decides whether your advertising identifier may be used. You can change your choice at any time in the game under Settings ▸ Ads and privacy.
• We don't sell your data. Your privacy choices never affect gameplay, progress or rewards.

Who is responsible

The controller for the game, the online game server and this website is Vasile Piciriga (individual developer). Contact: picirigavasile@icloud.com.

For the data that Google processes for its own advertising purposes (for example to personalise and measure ads and to prevent fraud), Google is an independent controller: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users in the European Economic Area (EEA) and Switzerland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for users elsewhere.

What the game stores on your device

The game saves the following in its private storage on your device:

• your profile: your player name (if you set one; otherwise the default “Courier”), level and experience, unlocked looks, chosen modules, the statistics of your matches and challenges and your tutorial progress;
• your settings (controls, sound, graphics, language, accessibility);
• local game statistics: events such as the start and end of a match, its result, tutorial steps and frame-rate samples, at most 1 MiB. They are never sent anywhere. You can delete them in Settings ▸ Data ▸ Local game metrics ▸ Clear;
• advertising counters: when and how often ads were shown and your progress towards ad rewards, so that the game can keep to its own limits. The game itself stores no advertising identifiers;
• for online play: the server address you entered and, during an online match, a short rejoin record (server, session token, room code and match) that lets you come back after a lost connection. The token is useless 20 seconds after the connection is lost;
• technical files such as the graphics shader cache;
• your ad privacy choices, saved on your device by Google's consent software so that you are not asked every time (see Advertising).

None of this is sent to us. It is deleted when you uninstall the game. Depending on your device settings, it can be part of your device backup (for example iCloud or Google backup), which Apple or Google handle for you.

Storing this data on your device is necessary for the game to work (Art. 6(1)(b) GDPR and the national rules implementing Art. 5(3) of the ePrivacy Directive, such as § 25(2) TDDDG in Germany).

Online play

Online play (quick match, creating a room or joining one by code) is optional. Practice with bots, the tutorial and the challenges work without our server.

What is exchanged. When you play online, the game connects to the VELTRAIL game server and exchanges:

• your player name (up to 16 characters; the default “Courier” if you never set one) and your language setting, which selects the default name;
• your choices in the room: module, team, ready status and room code;
• your inputs during the match (movement, aiming, actions) and the resulting game state;
• a random session token that the server issues so that it can recognise your connection and let you rejoin;
• technical connection data: your IP address and port, the game and protocol version and the connection quality (latency, lost packets). The server needs your IP address to send the match back to you.

Who sees what. The other players in your room and match see your player name, your team and module and what your courier does in the match. They do not see your IP address. The server checks names against a filter and replaces a rejected name with a default name; it can also be set to show only default names.

How long. The server keeps this data only in its working memory: while you are connected and, after a lost connection, for the 20-second rejoin window. Then your session ends. The results of online matches are sent to the players' devices and stored there. The server does not write player names, session tokens or IP addresses to disk or to its logs. Its logs contain only technical events and counters (such as starts and stops, the number of rooms and matches, and errors) and are deleted after at most 14 days. While the server is running, it also keeps a short rolling list of recent events in its memory, which can contain player names; this list is constantly overwritten, never saved, and gone when the server restarts. To protect the service, the server counts invalid messages per connection and may disconnect a connection that misbehaves; these counters are not stored either.

Hosting. The public game server is not online yet. It will run on rented servers of a hosting provider that processes the data only on our behalf and on our instructions (Art. 28 GDPR). Before the server goes online, we will name the provider and the server location here. The hosting provider may briefly process connection data such as IP addresses in its network to protect it against attacks.

Encryption. Online match traffic is currently not encrypted. In principle, someone with access to the network between your device and the server could read it. Don't use your real name or other personal information as your player name.

Other servers. If you enter the address of a server that we do not operate, its operator receives the data described above and is responsible for it.

Legal basis: providing the online play you asked for (Art. 6(1)(b) GDPR); protecting the server against abuse and keeping it running (our legitimate interest, Art. 6(1)(f) GDPR).

Advertising (Google AdMob)

VELTRAIL is free and financed by advertising. The game uses Google AdMob (the Google Mobile Ads SDK) to show ads and Google's User Messaging Platform (UMP) to ask for and store your consent. You see banner ads on menu screens, occasional full-screen ads at breaks between matches or when you open the game, and rewarded ads that you can choose to watch for an in-game bonus. Watching a rewarded ad is always your choice.

What Google processes

When the game requests and shows ads, Google's software in the game sends data to Google. According to Google, this includes:

• your IP address, which may be used to estimate your approximate location;
• device identifiers: on Android the advertising ID and the app set ID; on iPhone and iPad the advertising identifier (IDFA) only if you allow tracking, otherwise identifiers that are limited to this app or its developer;
• information about your device and the app, such as the device type, operating system, language and app version;
• advertising data and interactions: which ads were shown, taps, video views and app launches;
• diagnostic data: crashes of Google's software and performance data such as the app launch time.

Google's consent software also sends device and app information, including your IP address, to Google to find out whether a consent form is required where you are and to show it.

Google uses this data to deliver ads, to limit how often you see the same ad, to measure and report on ads, to detect and prevent fraud and invalid traffic and — only if you allow it — to personalise ads to your interests. Google and its advertising partners may store and read cookies or similar identifiers on your device and use your IP address for these purposes. Details: How Google uses information from sites or apps that use its services and the Google Privacy Policy.

We do not receive your identifiers or any data that would let us recognise you: AdMob gives us only aggregated reports (for example the number of ads shown and the earnings per ad slot and country). The game sends no advertising data to our game server, and the game server has nothing to do with advertising.

Your choices

• EEA, UK and Switzerland. Before the game requests ads for the first time, Google's consent form asks for your choice. You can consent, refuse (“Do not consent”) or choose purposes and partners individually. Ads are shown in every case. Without your consent they are not personalised: Google shows non-personalised ads, which are based on context such as the game and your approximate location, or, if you have not allowed information to be stored on or read from your device, limited ads, for which Google does not use identifiers to select ads.
• Change or withdraw your consent at any time in the game under Settings ▸ Ads and privacy ▸ Ad privacy settings. This option is shown where Google requires a privacy choice, for example in the EEA, the UK and Switzerland. Withdrawing consent does not affect processing that took place before.
• iPhone and iPad (App Tracking Transparency). The game may ask whether it may track you across apps and websites of other companies. Only if you allow it can Google use your advertising identifier (IDFA). If you don't, you still see ads, just less relevant ones. You can change this at any time in Settings ▸ Privacy & Security ▸ Tracking on your device.
• Android. You can reset or delete your advertising ID in your device settings (usually Settings ▸ Privacy ▸ Ads or Settings ▸ Google ▸ Ads). After you delete it, apps receive no advertising ID.
• Google's settings. You can manage how Google personalises ads in My Ad Center.
• Your choices never affect gameplay, progress or rewards, and the game gives no reward for consenting or for allowing tracking.

Ad content and reporting

The game asks Google only for ads suitable for general audiences (content rating G). If you see an inappropriate ad, use Settings ▸ Ads and privacy ▸ Report an ad: it opens an e-mail to us with a reference to the last ad shown (its format, Google's response ID, the time, the game version, the platform and the language) and no device identifiers. You see the e-mail before you send it.

Legal basis

• Personalised ads, and storing or reading information on your device for advertising: your consent (Art. 6(1)(a) GDPR and the national rules implementing Art. 5(3) of the ePrivacy Directive).
• Non-personalised and limited ads, with the related measurement and fraud prevention: our legitimate interest in financing a free game (Art. 6(1)(f) GDPR). Where storing or reading information on your device requires consent, Google's form asks for it.
• Showing the consent form and saving your choice: our legal obligation to obtain and document consent (Art. 6(1)(c) and Art. 7(1) GDPR).

Children

VELTRAIL is not directed at children under 13, and we do not knowingly collect personal data from them. The game asks Google only for ads suitable for general audiences. In the EEA, only people who have reached the age of digital consent in their country (between 13 and 16, often 16) can consent to personalised ads themselves; if you are younger, please choose “Do not consent” or ask a parent — you will still see non-personalised ads. If you believe that a child has sent us personal data, for example by e-mail, please contact us and we will delete it.

This website

This website is hosted by Cloudflare (Cloudflare Pages). To deliver the pages and protect them against attacks, Cloudflare processes your IP address and technical request data (such as the time, the requested page and your browser). The website uses no cookies, no analytics, no scripts and no external resources. Cloudflare processes this data on our behalf. Legal basis: our legitimate interest in a secure website (Art. 6(1)(f) GDPR).

E-mails to us

If you write to us — for support, a privacy request or an ad report — we receive your e-mail address and the contents of your message and use them only to answer you. Our e-mail is hosted by Apple (iCloud Mail). We delete the conversation when it is no longer needed, at the latest 12 months after your request has been dealt with, unless the law requires us to keep it longer. Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR) or, if your request concerns one of your rights under the GDPR, our legal obligation (Art. 6(1)(c) GDPR).

App stores

You download VELTRAIL from Apple's App Store or Google Play. Apple and Google process the related data (such as your account and the download) under their own privacy policies. If you have allowed it in your device settings, Apple or Google may give us anonymous crash reports and aggregated usage statistics; these come from the platform, not from the game.

Recipients and international transfers

We share data only as described in this policy:

• Google (advertising; independent controller) and the advertising partners listed in Google's consent form;
• the hosting provider of the game server (processor; we will name it here before the server goes online);
• Cloudflare (this website; processor);
• Apple (our e-mail; processor).

Google LLC, Cloudflare, Inc. and Apple Inc. are based in the USA. Transfers to the USA are covered by the EU–U.S. Data Privacy Framework where the recipient is certified under it, and otherwise by the European Commission's standard contractual clauses.

How long data is kept

• On your device: until you delete it (for example the local statistics in Settings) or uninstall the game.
• Online play: in the server's working memory while you play and for the 20-second rejoin window; technical server logs without names or IP addresses: at most 14 days.
• Advertising: Google keeps data under its own policies (how Google retains data); your consent choice stays on your device until you change it or uninstall the game.
• This website: we keep no logs; Cloudflare processes request data only for delivery and security.
• E-mails: at most 12 months after your request has been dealt with.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing and data portability, the right to object to processing based on our legitimate interests, and the right to withdraw your consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

To exercise a right, write to picirigavasile@icloud.com. The game has no accounts and the server keeps nothing after a match, so we usually hold no data that we could link to you; in that case we will tell you (Art. 11 GDPR). The data on your device is under your control: you can delete it in the game or by uninstalling it. For advertising data, use the choices described under Your choices or contact Google.

Users in the United States

Some US state laws treat letting advertising partners collect identifiers for personalised advertising as a “sale” or “sharing” of personal information. You can opt out at any time: on iPhone and iPad by not allowing tracking, on Android by deleting your advertising ID, and in the game under Settings ▸ Ads and privacy ▸ Ad privacy settings where it is shown. You can also write to us. We do not knowingly sell or share the personal information of consumers under 16. The game and this website do not respond to “Do Not Track” browser signals: this website does not track you, and the game is not a browser.

Security

The data on your device is protected by your operating system's app sandbox. Google's software sends advertising data over encrypted connections (TLS). Online match traffic is currently not encrypted (see Online play); the server receives only what it needs for the match and keeps nothing after it.

Changes to this policy

If VELTRAIL changes how it handles data — for example when the public game server goes online — we will update this policy, its version and its date before the change takes effect. If a change needs your consent, the game will ask you again.

• Version 1.0, 5 October 2026: first published version (VELTRAIL 1.0.0 with online play and Google AdMob ads).

Contact

Vasile Piciriga

E-mail: picirigavasile@icloud.com