Privacy Policy

• You never need to sign in to play. Your spa is saved on your phone.
• The game also keeps a backup of your spa in the cloud, under an anonymous account it makes for you (a random ID, no name or email). Sign in with Apple or Google in Settings and you can bring your spa back on a new phone.
• We see how the game is played and when it crashes, using Google Firebase. That data uses random IDs, never your name.
• Ads only play when you choose to watch one for a reward. On iPhone they’re personalized only if you allow tracking.
• We don’t sell your personal information for money. You can delete your cloud save and account in Settings at any time.

Your game:

• Your save: your spa, progress, coins, items and settings, and the store’s transaction IDs for coin packs you bought (so a pack is never given twice). It’s kept on your phone, and a copy is kept in the cloud (see “Cloud save”).
• Purchases: which products you own, read from the App Store or Google Play when you buy or restore. We never see your card or payment details.
• Messages you send us, for example a support email, and the support code you include.

Your account, for cloud save:

• An anonymous account: the first time the game starts, it makes a random user ID for you. It has no name, email or password.
• If you sign in with Apple or Google: the email address Apple or Google gives us (Apple may give a private relay address instead of your real one), the ID Apple or Google uses for you, and your name and profile picture if that account shares them. We use these only to sign you in and to find your account if you ask us for help.
• With each cloud save: a few details about it (stars, coins, when it was saved, the game version, iPhone or Android) and a random ID the game makes for your phone when it’s installed (not an advertising ID), so two phones don’t overwrite each other’s spa.

Collected automatically:

• Game activity (Firebase Analytics): for example opening the game, tutorial steps, visits to the shop, purchases (product and price), reward videos offered and watched (and what Google estimates they earned), and cloud save steps such as signing in or loading a spa. Each event comes with a random app ID, device model, operating system, game version, language, and country or region (worked out from your IP address, which isn’t kept). Firebase Analytics doesn’t use your advertising ID unless you’ve allowed tracking on iPhone.
• Crash reports (Firebase Crashlytics): when the game crashes or hits an error, what went wrong and where, the last few game events before it, a random installation ID, device model, operating system, game version, and details such as free memory and storage.
• Advertising data (Google AdMob): when an ad is loaded or shown, your device’s advertising ID (on iPhone only if you allow tracking; the advertising ID on Android), your IP address and the rough location it suggests, how you interact with the ad, and device and app details.

We don’t collect your precise location, contacts, photos, microphone or health information.

Your spa is saved on your phone, and the phone’s copy is always the one you play. To keep it safe, the game also copies it to Google Cloud Firestore when you leave the game and right after a purchase, over an encrypted connection.

• We keep the latest copy and one copy for each of the last 7 days, so a spa that something went wrong with can be brought back. Each daily copy is deleted after 7 days.
• Sign in with Apple or Google in Settings and you can load your spa on another phone, or after reinstalling the game.
• Your save is never shared with other players and never used for ads.
• Settings shows a short support code made from your account ID. Include it when you email us, so we can find your save.

• To run Tiny Spa: save your spa, back it up, and bring it back when you ask.
• To deliver what you buy, restore it, and make sure a coin pack is never given twice.
• To show the optional reward videos, and to measure them.
• To understand how the game is played and what to improve, for example where new players get stuck or which offers are useful, and to find and fix crashes.
• To answer you when you contact us.
• To keep the game working, prevent abuse and follow the law.

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects.

The companies that help us run Tiny Spa:

• Google (Firebase Authentication and Cloud Firestore): your account, sign-in with Apple or Google, and your cloud save. Google stores them for us and doesn’t use them for its own purposes.
• Google (Firebase Analytics and Firebase Crashlytics): game activity and crash reports, processed for us.
• Google AdMob: the optional reward videos, Google’s consent message where the law requires one, and ad measurement. Google uses this data as described in its privacy policy (policies.google.com/privacy) and at policies.google.com/technologies/partner-sites.
• Apple and Google: sign-in, if you choose it, and payments through the App Store and Google Play. They handle your payment; we only learn which products you own.

We may also share information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business (we’ll tell you first if this policy would change).

We don’t sell your personal information for money. But like most free games, Tiny Spa lets Google AdMob use your device’s advertising ID to show and measure ads. Some US state laws call this “selling” or “sharing” personal information for targeted advertising. You can turn it off anytime (see “Your choices about ads”).

Ads in Tiny Spa only play when you tap to watch one for a reward. There are no banner ads and no ads between screens.

• On iPhone, the first time you tap to watch an ad, the game explains why and then asks for permission to track (App Tracking Transparency). If you say no, ads are still shown but aren’t personalized. You can change this anytime in Settings → Privacy & Security → Tracking.
• On Android, you can delete your advertising ID in your phone’s settings (Settings → Privacy → Ads, or Settings → Google → Ads). Without it, ads aren’t personalized.
• In the EEA, the UK and Switzerland, Google’s consent message is shown the first time you tap to watch an ad. You can change your answer anytime in Tiny Spa: Settings → Ad privacy choices.
• In the US, these settings are how you opt out of the “sale” or “sharing” of your information for targeted ads.

• Your save on your phone: until you delete the game. It may also be in your phone’s own backup (iCloud or Google), which you control.
• Your account and cloud save: until you delete them in Settings or ask us to. Daily copies: 7 days.
• Game activity (Firebase Analytics): 14 months.
• Crash reports (Firebase Crashlytics): 90 days.
• Support emails: as long as we need them to help you, and no longer than 3 years.
• Advertising data: Google keeps it as described in its privacy policy.

In the game: Settings → Cloud save → delete your cloud save. This deletes your cloud save, its daily copies and your account right away, and on iPhone it also ends Tiny Spa’s access to your Sign in with Apple account. The spa on your phone stays, and you can keep playing; the game stops backing it up until you sign in again.

No longer have the game? Email support@miuustudio.com with the subject “Delete my Tiny Spa data”, and the email address of the Apple or Google account you signed in with, or your support code. We’ll delete your account and cloud save within 30 days and tell you when it’s done.

Game activity and crash reports are tied to random IDs, not to your account, so we can’t look them up by your email; they’re deleted on the schedule above. Deleting the game from your phone deletes the save on it, and the game gets new random IDs if you install it again.

Deleting your data doesn’t cancel or refund purchases. One-time purchases stay with your App Store or Google Play account and can be restored again.

Depending on where you live, you may have the right to access, correct, download or delete your personal information, to object to or limit some uses, and to withdraw consent. Email support@miuustudio.com and we’ll help. We’ll answer within one month, or sooner where your local law requires (for example, 10 days in Korea and 15 days in Brazil), and we may extend this where the law allows. We may need to confirm it’s you first. We won’t treat you differently for using these rights.

EEA, UK and Switzerland. Here’s the legal basis for each way we use your information:

• Saving and backing up your spa, your account, purchases and the optional reward videos: to provide the game you asked for (contract).
• Crash reports, keeping the game safe, answering your messages, and non-personalized ads: our legitimate interests, which we’ve weighed against yours. You can object anytime by emailing us.
• Game analytics and personalized ads: your consent, given in Google’s consent message. You can withdraw it anytime in Settings → Ad privacy choices. Withdrawing doesn’t affect what happened before.

You can also ask for a copy of your information in a portable format, and you can complain to your local data protection authority.

United States. Depending on your state, you can ask what personal information we collect, use and disclose; get a copy; correct or delete it; and opt out of “sale”, “sharing” and targeted advertising (see “Your choices about ads”). You can use an authorized agent. If we turn down your request, you can appeal by replying to our answer with “Appeal”, and if you’re still not happy you can contact your state attorney general.

Canada. We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, Quebec’s private-sector privacy law. If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information (cai.gouv.qc.ca).

Korea. The Korean version of this policy (한국어) sets out what Korea’s Personal Information Protection Act asks for, and applies if you live in Korea.

Japan. Your information is stored in the United States. Our providers are bound by contract to protect it to the standard of Japanese law, and we’ll give you details on request.

Brazil. Our data protection contact (encarregado) is our Privacy Officer (see below).

Tiny Spa isn’t directed at children under 13 (under 14 in Korea), and we don’t knowingly collect personal information from them. If you think a child has signed in or sent us personal information, email us and we’ll delete it.

Your account, cloud save, game activity and crash reports are stored by Google in the United States. They’re encrypted in transit, and Google encrypts them at rest. Only the people at Miuu Studio who need it can see them. No system is perfectly secure, so please keep your Apple or Google account safe.

We’re based in Canada. If you live in Canada, this means your information is stored and used outside your province and outside Canada, and it may be accessed there by courts, law enforcement and national security authorities under US law. Where the law requires, we use safeguards such as standard contractual clauses for transfers.

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll also tell you in the game.

The owner of Miuu Studio is responsible for protecting personal information at Tiny Spa (in Quebec: the person in charge of the protection of personal information; in Brazil: the encarregado). Contact: support@miuustudio.com.

Miuu Studio, a sole proprietorship in Ontario, Canada. Email support@miuustudio.com. We’re happy to help. Our mailing address is available on request.