Privacy Policy – Ninja Frenzy

Last updated: 5 November 2026

This Privacy Policy explains what information the mobile game Ninja Frenzy (the "Game") and the website ninjafrenzy.com (the "Website") process, why, on what legal basis, who receives it, how long it is kept and what rights you have. It is available to everyone, worldwide, without registration, at https://ninjafrenzy.com/privacy and from the Settings screen of the Game.

1. Who is responsible

Steven Cuti (trading as "Steven Studios")
Niederkasseler Str. 97
53225 Bonn, Germany
E-mail: support@stevencuti.com

(the "Provider", "we", "us"). For the EU General Data Protection Regulation (GDPR) and the German data-protection law, the Provider is the controller. A legal notice (Imprint) is available at https://ninjafrenzy.com/imprint.

2. The short version

• You do not need an account, and we never ask for your name, e-mail address, phone number, contacts, photos, microphone or precise location in the Game.
• Your progress (coins, weapons, skins, settings, high score) is stored on your device only.
• For the friend invitation system the Game creates an anonymous ID and a friend code and stores them on our server (Google Firebase).
• Purchases are processed by Google Play. We never see your payment details. The purchase tool we use (Unity In-App Purchasing) sends purchase and device information to Unity.
• The Game shows advertising (Google AdMob) unless you buy a product that removes it. In the EEA, the UK and Switzerland you are asked for consent first, and only non-personalised ads are requested.
• The Game is not meant for children under 13.

3. What we process, why, and on which legal basis

3.1 Data that stays on your device

Game progress, unlocked items, coins, settings, your friend code, whether you have already entered a friend code, purchase confirmations, and the last known prices from the store. This data is not sent to us. It is deleted when you uninstall the Game or clear its data. (No processing by us, no legal basis needed.)

3.2 Friend invitation system (our server at Google Firebase)

When you start the Game with an internet connection, it signs you in anonymously (Firebase Authentication). No name or e-mail is used. We store on our server (Cloud Firestore, Cloud Functions):

Legal basis: Art. 6(1)(b) GDPR (providing the feature you use) and Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse and keeping the service secure).
Recipients: Google (Firebase), as our processor.
Retention: as long as the installation is in use; deleted after 24 months without activity, or earlier on your request (section 9).
Another player who enters your friend code only increases a counter for you; you cannot see who it was, and they cannot see anything about you.

3.3 Purchases (Google Play and Unity In-App Purchasing)

In-app purchases (coin packs and one-time offers) are sold by Google Play; Google processes your payment and the tax. We do not receive your name, address or payment details. The Game receives a confirmation that a product was purchased (product, price and currency, a purchase token) so that it can deliver it, protect it from being delivered twice and restore one-time purchases after a reinstall (e.g. permanent "No Ads").

We use Unity's In-App Purchasing software. According to Unity, it processes, when a purchase flow runs and for the operation of the service: purchase and transaction information; device and application identifiers; technical device data (model, operating-system version, language, region); and an approximate location (country, derived from the IP address). Unity acts as our processor under a data-processing agreement; in limited cases Unity acts as an independent controller as described in Unity's privacy policy (https://unity.com/legal/privacy-policy). Unity keeps transaction data as long as needed to run the service for the Game and keeps service logs for 30 days.
Legal basis: Art. 6(1)(b) GDPR (fulfilling your purchase) and Art. 6(1)(f) GDPR (preventing duplicate or fraudulent deliveries).
Recipients: Google (Google Play), Unity Technologies.

3.4 Advertising (Google AdMob)

The Game shows full-screen (interstitial) advertisements provided by Google AdMob. A one-time offer that includes "No Ads" removes them for good. To request, show and measure ads, AdMob may process your advertising ID, IP address (approximate location), device and app information (for example model, operating system, app version, language) and your interaction with ads. Google acts as an independent controller for this; see https://policies.google.com/privacy and https://business.safety.google/privacy/.

• European Economic Area, United Kingdom, Switzerland: before ads are requested, a consent form (Google's User Messaging Platform) asks for your choice. In these regions the Game requests only non-personalised ads, whatever you choose.
• Elsewhere: ads may be personalised. You can reset or delete your advertising ID or switch off ad personalisation in your Android settings (Settings → Google → All services → Ads).
  Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) where the law requires it; otherwise our legitimate interest in financing the Game (Art. 6(1)(f) GDPR). You can change your choice at any time in the Game's ad-consent settings, and withdraw consent without affecting what happened before.
  Recipients: Google (AdMob).

3.5 Technical information from Google Play

If you allow it in your Android settings, Google Play shows us aggregated information such as crash reports, performance data and device models ("Android vitals"). We cannot identify you from it. We do not use Firebase Analytics, Crashlytics or any other analytics or crash-reporting software inside the Game.

3.6 Website (ninjafrenzy.com)

The Website is hosted by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden ("Lovable"), which acts as our processor. When you visit the Website, Lovable's servers automatically process technical data (IP address, date and time of the request, requested page, browser and device type) in order to deliver the pages and to keep the service secure. We do not receive or evaluate these server logs ourselves.
Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and working Website).
Retention: the hosting provider keeps operational and security logs for as long as needed to run and secure its services and does not state a fixed period in its public privacy policy. Details and sub-processors: https://lovable.dev/privacy and https://trust.lovable.dev.
Cookies and analytics: the Website itself uses no tracking, advertising or analytics cookies and does not use any analytics tool. Contacting us is by e-mail only (section 3.7).

3.7 Support and contact

If you write to support@stevencuti.com, we process your e-mail address, your message and, if you give it, your friend code, to answer you.
Legal basis: Art. 6(1)(b) or (f) GDPR. Retention: deleted 12 months after the matter is closed, unless the law requires us to keep it longer.

3.8 What we do not do

We do not sell your data, we do not build advertising profiles ourselves, we do not make automated decisions that affect you legally, and the Game contains no chat or user-generated content.

4. Recipients and service providers

We pass data on only as described here, to comply with a legal obligation, or if you ask us to.

5. International transfers

Our server data is stored in the EU (Cloud Firestore: multi-region Europe; Cloud Functions: Belgium). Firebase Authentication is operated globally, and Google, Unity, Lovable and their sub-processors may process data in countries outside the EU/EEA, in particular the USA. Such transfers rely on an adequacy decision (for example the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses.

6. Children

The Game is not directed at children under 13 and we do not knowingly collect personal information from them. If you are a parent and believe your child has used the Game, contact us and we will delete the related data. In some countries (e.g. in the EU up to age 16) additional age limits for consent apply; where they do, advertising consent is not valid without a parent, and the Game requests only non-personalised ads in the EEA, the UK and Switzerland.

7. Permissions

The Game uses the internet (friend system, purchases, ads), Google Play billing (purchases) and the advertising ID (ads, section 3.4).

8. Security

Data is transmitted encrypted (HTTPS/TLS). The database cannot be read or changed directly from the Game; every access runs through our own server functions, which check each request. No system is perfectly secure. If a breach affects you, we will inform you and the authorities as the law requires.

9. How long we keep data, and how to have it deleted

• Local data: until you uninstall the Game or delete its data.
• Friend-system data: until 24 months after your last activity, then it is deleted.
• Support e-mails: 12 months after the matter is closed.
• Website logs: see section 3.6.

To have your server data deleted or to get a copy: write to support@stevencuti.com and tell us your friend code (shown at the bottom of the Settings screen). Because the Game uses an anonymous ID instead of an account, the friend code is how we find your record. We will answer within one month. Requests that concern data Unity or Google process as controller can be addressed to those companies, and we will help forward them.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you can withdraw it at any time (Art. 7(3)) with effect for the future. You also have the right to complain to a data-protection authority (Art. 77), for example the authority of your country or, for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (https://www.ldi.nrw.de). Contact: support@stevencuti.com.

11. Changes

We may update this policy, for example when we add features or services. The current version is always at https://ninjafrenzy.com/privacy; the date at the top shows when it last changed. If a change affects your rights substantially, we will point it out in the Game.

12. Contact

Steven Cuti, Niederkasseler Str. 97, 53225 Bonn, Germany · support@stevencuti.com