Privacy Policy
This Policy explains how the iOS app “English Vocab Runner” (the “App”) handles information. It reflects the current implementation based on code audit, Privacy Manifest, and internal documentation.
1. Scope
This Policy applies to the App and this public website hosted on Firebase Hosting. Apple services such as Sign in with Apple, Game Center, and the App Store are also governed by Apple’s own policies.
2. Information we collect
Depending on use of the App, we may process:
- Profile information (display name)
- User identifiers (Firebase Authentication UID; identifiers used for in-app Game Center binding)
- Gameplay progress, rank, trophies, characters, chests, tutorial, login bonus
- Vocabulary study progress
- Wallet balances and purchase-related transaction records
- Product interaction related to battles, shop, and similar features
- Crash and diagnostic data (via Firebase Crashlytics)
- On-device local cache (such as UserDefaults)
- Advertising identifiers and advertising data via Google AdMob (may include IDFA when you allow tracking via ATT)
In the current design, Sign in with Apple does not request or store email.
3. Purposes
- Authentication and session management
- Saving and syncing study / battle / progression state
- In-app purchase fulfillment, anti-replay, unfinished purchase recovery
- Game Center multiplayer coordination
- Security and abuse prevention
- Reliability and crash investigation (Crashlytics)
- Serving rewarded ads and shortening chest unlock timers after a completed view
- Support responses
4. Sign in with Apple
Sign in with Apple is required. Authentication data received via Apple is used with Firebase Authentication. The current design does not request the email scope.
5. Game Center
Game Center is used for multiplayer features. A verified Game Center identity may be bound to your in-app account. Your Game Center account itself is managed by Apple.
6. Firebase Authentication
We use Firebase Authentication for sign-in and UID management.
7. Cloud Firestore / Cloud Functions
We use Cloud Firestore and Cloud Functions for profile, progression, rank, wallet, battle settlement, purchase claims, and related server-side integrity checks.
8. Firebase App Check
We use Firebase App Check (such as App Attest / DeviceCheck) to help reduce unauthorized client calls.
9. Firebase Crashlytics
We use Firebase Crashlytics for crash and diagnostic data to improve stability.
10. StoreKit and in-app purchases
The App offers StoreKit consumable purchases. We retain purchase-related records for fulfillment and double-credit prevention. Refunds follow Apple’s process.
11. Gameplay, rank, and study history
Rank, trophies, vocabulary progress, characters, chests, tutorial state, and login bonus data are stored to operate the Service.
12. Tracking and advertising
The App uses Google AdMob rewarded ads. Completing a rewarded ad can shorten chest unlock wait time. We may present App Tracking Transparency (ATT) so personalized ads can use IDFA when you allow it. You can decline tracking and still use the App (ad personalization may be limited). Firebase Analytics is disabled (no Analytics event logging).
13. Third-party services
- Apple (Sign in with Apple, Game Center, StoreKit / App Store, ATT)
- Google Firebase (Authentication, Firestore, Cloud Functions, App Check, Crashlytics, and related infrastructure)
- Google AdMob (rewarded ads)
Please also review those providers’ policies.
14. Sharing
We do not sell user information. We share information with processors only as needed to provide the Service, or when required by law. Advertising-related data may be provided to AdMob (Google) for ad delivery.
15. Retention
We retain information for as long as needed to fulfill the purposes described in this Policy. We do not invent a fixed retention period that is not implemented. After account deletion, minimal records described below may remain.
16. Account deletion
You can delete your account from Profile in the App. See Account Deletion. Deletion covers profile, wallet, rank, characters, chests, login bonus, tutorial, vocabulary progress, in-app Game Center binding, IAP account token, and local cache, among other in-app data. Your Apple Account and Game Center Account are not deleted by this process.
17. Minimal data that may remain after deletion
After deletion, the following may remain. We do not claim these are fully anonymous:
- Anonymized or hashed IAP transaction records
- Double-credit / anti-replay prevention records
- Account deletion tombstone
- Game Center signature replay digests
- Human settlement audit records
- Security / abuse prevention logs
18. International processing
Information may be processed outside your country or region through cloud providers such as Firebase, as needed to operate the Service.
19. Children
The App is not designed solely for children. Parents or guardians should decide whether use is appropriate. Age rating answers in App Store Connect control store presentation.
20. Security
We use reasonable safeguards such as encrypted transport, authentication, App Check, and server-side validation. No method of transmission or storage is completely secure.
21. Changes to this Policy
We may update this Policy. Material changes will be reflected on this page.
22. Contact
handworks.contact@gmail.com
For privacy questions, email the address above.