PRIVACY POLICY

Last updated May 08, 2025

This Privacy Notice for OwlForge Studio ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

Download and use our mobile application (Paint Space 3D), or any other application of ours that links to this Privacy Notice
Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We define the purposes and means of processing your personal information. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at owlforge.studio@gmail.com.

1. WHAT INFORMATION DO WE COLLECT?

We collect personal information that you voluntarily provide to us in the course of using our Services or when you contact us. We collect limited personal data that is either automatically generated through your use of the game or provided by third-party services (such as analytics or advertising). This may include information about your device type, approximate location (based on IP), and in-game interactions.

1.1 Information You Provide Voluntarily

Google Account Data. If you choose to sign in with your Google account, we receive only the basic profile information you authorize (e.g., user ID, name, email address).

Support & Feedback. If you contact us via email, social media, or any other channel, you voluntarily provide your name (or username), contact information (e.g., email address), and message content.

1.2 Information Collected Automatically

We do not collect precise location (GPS). Instead, the following data is gathered by third-party SDKs integrated into our app:

Device & Usage Data. Device model, operating system and version, device identifiers (e.g., Device ID), app version, session duration, crash reports, and feature usage.

Approximate Location (IP-Based). General geographic area (city/country) derived from your IP address.

Push Notification Token. We use Firebase Cloud Messaging (FCM) to deliver push notifications. When you enable notifications, FCM generates a unique device token on its servers and provides it to the app. We receive this token solely to send you game-related notifications; we do not store it on our own servers or link it to any personal identifier. You can opt out at any time by disabling notifications in your device's settings.

Analytics & Crashlytics. Google Analytics and Firebase Crashlytics collect performance and usage metrics to help us improve the game.

Advertising Data. Unity Ads may process device information and your IP-based location to deliver personalized ads.

We do not store these raw or identifiable data points; they are processed and retained by Google and Unity under their own Privacy Policies. For a better understanding, we recommend reading their privacy policies.

For more details, please see:
• Google Privacy Policy: https://policies.google.com/privacy
• Firebase Privacy & Security: https://firebase.google.com/support/privacy
• Unity Privacy Policy: https://unity.com/legal/privacy-policy

1.3 Payment Data

In-App Purchases. Any real-money transactions are handled exclusively through Google Play Billing. We do not receive or store your payment card details or billing information. All payment data is handled and stored by Google.

For more details, please see Google Privacy Policy: https://policies.google.com/privacy

1.4 Sensitive Information

None Collected. We do not process special categories of personal data (e.g., health, religious beliefs, biometrics).

1.5 Aggregated and Anonymous Data

We may collect, analyze, store, and share aggregated or anonymized information, such as statistical or demographic data, for any lawful purpose. Once aggregated or anonymized, this information cannot be used to identify any individual user by any reasonably available means.

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. For details, please see: https://developers.google.com/terms/api-services-user-data-policy

1.6 Data Retention

We do not store personal data on our own servers. Instead, retention is determined by our third-party service providers:

Google Analytics (including Firebase Analytics). User-level and event-level data are retained for up to 14 months.
Firebase Crashlytics. Crash and error reports are retained for 90 days.
Firebase Cloud Messaging. Messages are retained up to 28 days. Device tokens are retained until they are explicitly revoked or become inactive, in accordance with Firebase's policy.
Google Play Services. Data is stored for as long as the user account exists or until the user deletes the data as described in Google's Privacy Policy: https://policies.google.com/privacy.
Google Play Billing. Transaction and subscription records are retained in your Google account as described in Google's Privacy Policy: https://policies.google.com/privacy.
Unity Ads: Data is retained by Unity for up to 12 months.

After these periods, data is automatically deleted by the provider and is no longer accessible to us.

2. HOW WE PROCESS YOUR INFORMATION?

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
To deliver ads and measure their performance. We may show ads via Unity Ads and track basic metrics such as views, clicks, and engagement.
To evaluate our user acquisition and marketing campaigns. We may analyze how effective our promotional efforts are (e.g., app store listings, external ads) in attracting and retaining users.
Comply with legal and regulatory obligations. Maintain records, respond to lawful requests, and fulfill tax or financial reporting requirements.

2.1 LEGAL BASES FOR PROCESSING (FOR USERS IN THE EU/EEA AND UK)

If you are located in the European Union (EU), European Economic Area (EEA), or the United Kingdom (UK), the General Data Protection Regulation (GDPR) and UK GDPR require us to explain the lawful bases on which we process your personal information. We rely on the following legal bases:

Consent. Where required (e.g., push notifications, personalized ads), we will ask for your explicit consent. You may withdraw your consent at any time via your device settings or by contacting us.
Performance of a Contract. Processing necessary to provide our services, such as saving your progress, processing in-app purchases, or providing support.
Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:
- Analyze how our Services are used so we can improve them to engage and retain users
- Support our marketing activities
- Diagnose problems and/or prevent fraudulent activities
- Understand how our users use our products and services so we can improve user experience
Legal Obligation. We may process or disclose your personal information when required to comply with our legal obligations, including:
- responding to valid subpoenas, court orders, or other lawful requests by public authorities (e.g., law enforcement agencies or regulatory bodies);
- cooperating with government investigations and providing information as evidence in litigation to which we are a party;
- fulfilling tax, accounting, or other statutory requirements.

We do not collect or process special categories of personal data as defined by GDPR (e.g., health data, biometrics, or religious beliefs), (see Section 1.4 for details).

2.2 CCPA DISCLOSURES (FOR CALIFORNIA RESIDENTS)

If you are a resident of California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, provides you with specific rights regarding your personal information (see Section 4 for details):

Categories of Personal Information We Collect

Please refer to Section 1 ("WHAT INFORMATION DO WE COLLECT?") for details on the types of personal data we collect, including device information, approximate location, crash logs, and advertising identifiers.

Sensitive Personal Information. We do not collect or process sensitive personal data (see Section 1.4 for details).

Your CCPA Rights

Under the CCPA, you have the right to (see Section 4 for details):

Access. You may request copies of the personal information we hold about you.
Please note: we do not store any personal data ourselves — all profile information (e.g., name, email), analytics logs, and token data are maintained by third-party services (Google, Firebase, Unity).

To access, export, or delete your Google account data, please use Google's Data Export tools: https://myaccount.google.com/data-and-privacy
For Firebase and Unity analytics/ad identifiers, please consult:
- Firebase: https://firebase.google.com/support/privacy
- Unity: https://unity.com/legal/privacy-policy

We will provide you with a statement confirming that we do not hold any of your personal data on our systems, but for all substantive requests please contact the relevant service provider directly.

Delete. Personal data. We do not store any personal information (e.g., name, email, identifiers) on our servers; all such data resides with Google, Firebase, or Unity. To delete or export your personal Google account data, please use Google's tools at https://myaccount.google.com/data-and-privacy.

Game progress and settings. Your in-game progress, purchases, and settings are saved in Google's cloud save (via your Google account) and locally on your device. You can delete this data at any time by using the game's "Delete All Data" button in Settings.

Note: Real-money purchases (via Google Play Billing) remain recorded in your Google Play account; to request refunds or transaction history, please refer to Google Play support.

Correction. You may ask us to correct any inaccuracies in the personal data we hold.
Please note: we do not directly manage your profile data — it is synced from your Google account. To change your name or email, update your Google account settings; these changes will propagate here upon your next sign-in.

Opt-Out. You have the right to opt out of the sale or sharing of your personal information (as defined by the CCPA). We do not "sell" your personal information as traditionally defined, but some data may be shared with third parties (such as Unity Ads) for personalized advertising.

To exercise your CCPA rights, please contact us at: owlforge.studio@gmail.com

2.3 PIPEDA DISCLOSURES (FOR CANADIAN RESIDENTS)

If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

Under Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, you have the following rights with respect to your personal information (see Section 4 for details):

Access and Portability. You may request copies of the personal information we hold about you.
Please note: we do not store any personal data ourselves — all profile information (e.g., name, email), analytics logs, and token data are maintained by third-party services (Google, Firebase, Unity).

To access, export, or delete your Google account data, please use Google's Data Export tools: https://myaccount.google.com/data-and-privacy
For Firebase and Unity analytics/ad identifiers, please consult:
- Firebase: https://firebase.google.com/support/privacy
- Unity: https://unity.com/legal/privacy-policy

We will provide you with a statement confirming that we do not hold any of your personal data on our systems, but for all substantive requests please contact the relevant service provider directly.

Note: Real-money purchases (via Google Play Billing) remain recorded in your Google Play account; to request refunds or transaction history, please refer to Google Play support.

Withdrawal of Consent. Where processing is based on consent, you may withdraw your consent at any time.

We process your information in accordance with the following legal bases under PIPEDA and provincial laws:

Consent. For the collection, use, or disclosure of your personal information, except where otherwise permitted or required by law.

Contract. When necessary to perform a contract with you (e.g., in-app purchases).

Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to: - Analyze how our Services are used so we can improve them to engage and retain users - Support our marketing activities - Diagnose problems and/or prevent fraudulent activities - Understand how our users use our products and services so we can improve user experience

Legal Requirements. To comply with our legal obligations, we may process or disclose your personal information, including:

responding to valid subpoenas, court orders, or other lawful requests by public authorities (e.g., law enforcement agencies or regulatory bodies);
cooperating with government investigations and providing information as evidence in litigation to which we are a party;
fulfilling tax, accounting, or other statutory requirements.

Sensitive Personal Information. We do not collect or process sensitive personal data (see Section 1.4 for details).

To exercise your PIPEDA rights, please contact us at: owlforge.studio@gmail.com

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work.

Our relationship with these providers is governed by their publicly available Terms of Service and Privacy Policies, which include data protection and confidentiality obligations. We only share data with third parties to the extent necessary to deliver or improve our Services, and we rely on their commitments under those standard agreements to safeguard your personal information.

The categories of third parties we may share personal information with include:

Ad Networks (Unity Ads)
Privacy Policy: https://unity.com/legal/privacy-policy
Google Service Providers (Google Analytics, including Firebase Analytics; Firebase Crashlytics, Firebase Cloud Messaging, Google Play Services, Google Play Billing)
General Google Privacy Policy: https://policies.google.com/privacy
Firebase Privacy & Security: https://firebase.google.com/support/privacy

These third parties are bound by their own Data Processing Agreements and Privacy Policies, which include rigorous data protection and confidentiality obligations.

We may also need to share your personal information in the following situations:

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. WHAT ARE YOUR PRIVACY RIGHTS?

We do not directly collect or store any personal data on our own servers. All personal data (e.g., account name, email, device ID, analytics) is processed and stored by third-party providers such as Google, Firebase, and Unity. We only have access to anonymized or aggregated data where applicable.

4.1 General Rights (All Users)

Right of Access. You can request confirmation of whether we hold any personal data about you and obtain copies of it.
Note: We do not store any personal data ourselves. All data is managed by third-party services.
Right to Correction. You can ask us to correct any inaccuracies in data we hold.
Note: To change your Google account data (e.g., name, email), please update it via your Google account settings.
Right to Deletion. You can request deletion of your personal data that we hold.
Note: We do not store personal data. For Google-hosted data, use Google's deletion tools. To remove in-game progress, use the "Delete All Data" button in Settings.
Right to Data Portability. You can request a machine-readable copy of the personal data you have provided to us.
Note: We do not store any personal data on our own servers. Your personal Google account information can be exported via Google Takeout (https://takeout.google.com/). Game progress and settings are not included in Google Takeout and cannot be exported in a machine-readable format—they can only be removed via the "Delete All Data" button or by uninstalling the app.
Right to Object. You may object to processing based on our legitimate interests (e.g., anonymized analytics).
Note: To prevent further collection of analytics data, you can uninstall the app.
Right to Withdraw Consent. You may withdraw any consent you provided (e.g., for push notifications or personalized ads) at any time via your device settings or by contacting us.

Right to Restrict Processing. You can ask us to limit how we use your data (e.g., pause analytics) under Article 18 GDPR.
Note: To stop all data collection, please uninstall the app.
Right to Lodge a Complaint. You have the right to file a complaint with your local data protection authority.

4.3 Additional Rights for California Residents (CCPA/CPRA)

Right to Opt-Out of Sale or Sharing. You may opt out of the sale or sharing of your personal information.
Note: "Sale" or "sharing" includes transfer to third parties for advertising (e.g., Unity Ads). You can opt out of personalized ads in the Unity Ads settings, via the ad banner, under "Data Privacy".
Right to Non-Discrimination. You will not be discriminated against for exercising your CCPA rights.
Right to Lodge a Complaint. You have the right to lodge a complaint with the California Privacy Protection Agency or the Attorney General's office

4.4 Additional Rights for Canadian Residents (PIPEDA)

Right to Withdraw Implied or Express Consent. You may withdraw any consent you provided, subject to legal or contractual restrictions.
Note: To withdraw consent and stop all data collection, please uninstall the app or use the "Delete All Data" button in Settings.
Right to Lodge a Complaint. You have the right to file a complaint with Canada's Privacy Commissioner if you believe your rights under PIPEDA have been violated.

4.5 How to Exercise Your Rights

To exercise any of these rights, please contact us at owlforge.studio@gmail.com.

We will respond within the timeframes required by applicable law (e.g., 30 days under GDPR, 45 days under CCPA).
If we do not hold your personal data, we will inform you and direct you to the appropriate third-party service (Google, Firebase, Unity) for further assistance.

5. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

6. INTERNATIONAL DATA TRANSFERS

By using the Game, you understand and consent to the transfer of your personal information to countries outside of the country where you reside, including the United States and other countries that may have different data protection rules than your country.

7. CHILDREN'S PRIVACY

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers. If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

8. SECURITY OF YOUR PERSONAL DATA

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

When we use your personal information with your consent, you can withdraw the consent you previously provided for the collection, use, and disclosure of your personal information, but this must comply with contractual or legal restrictions. To withdraw such consent, you can contact us at owlforge.studio@gmail.com. However, please be aware that this may affect the services we provide to you.

10. UPDATES OF THIS PRIVACY POLICY

We might update this privacy policy from time to time to adapt to new technologies, industry practices, regulations, or for other purposes. All changes will be shown on this page. Please review this page regularly to check any changes made to this privacy policy. If you continue to access or use applications including our services after these changes have taken effect, you agree to this updated privacy policy. Please note, if we need to adapt to legal requirements, the new privacy policy may take effect immediately or as per requirements.

11. CONTACT US

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at owlforge.studio@gmail.com.