← Tiny Pocket Shenanigans

Tiny Pocket Shenanigans

Flappy Imp Privacy Policy

How information is handled when you play Flappy Imp or contact us.

Effective date:

Feature availability, 18 October 2026: The current Google Play production release, 1.2.6 (version code 43, released 17 October 2026), includes nearby Co-op and Versus, Play Games career backup, gameplay event and Game Stats reporting, and Settings → Privacy reporting controls. Features depend on the version installed; earlier builds may not include all of them. Updating this policy does not add features to an installed version.

1. Who we are

Flappy Imp is an Android game operated by António Castela, using the studio name Tiny Pocket Shenanigans, based in Portugal ("we", "us", or "our"). We are the controller responsible for the personal information whose processing we determine, as described in this policy.

Privacy contact: [email protected]

António Castela, trading as Tiny Pocket Shenanigans, is the contact point for parents and guardians with questions about information handled through Flappy Imp, including inquiries about the Google services named in section 4. We handle requests concerning information we control and help direct requests concerning information held by Google.

2. A quick summary

3. Information stored on your device

Flappy Imp saves scores, in-game currency such as Souls (called Stars in earlier versions), unlocked characters, selected cosmetics, achievements, daily challenge results, reward limits, gameplay statistics, and settings such as language, sound, music, and vibration. These records allow you to keep your progress, use your settings, and receive rewards correctly. A recovery copy of the save may also be stored locally.

Development and playtest versions may keep a limited local log containing session times, run results, and reward events. This log is not automatically sent to us. In release versions that offer the local playtest-logging setting, it is off by default and can be enabled in Settings. Debug builds may enable it automatically. Local logging is separate from Firebase reporting.

We do not operate a server that receives your saved game or local playtest log. Google Play Games receives the online records described in section 4. Versions with career backup use Google's Saved Games service. Device settings, local playtest logs, Firebase privacy choices and other accounts' platform queues are excluded from that career backup. Builds without that feature keep their career save local, apart from separate device backup or transfer services.

The local save also stores Play Games player identifiers, counters for each linked account, scores waiting to be submitted, and records of achievements already synchronized. These records keep offline progress associated with the appropriate Google player. Pending scores are removed from the queue after successful submission; account identifiers, counters, and synchronization records remain with the local save.

The game does not request access to your contacts, camera, microphone, photos, or precise device location.

In versions with the optional Firebase controls described below, a separate local privacy record stores the reporting choice and disclosure version. Recovering a gameplay save backup does not restore that choice. This is separate from any backup or transfer performed by Android or your device provider.

Device backups: Depending on the app's backup configuration, your Android version, device manufacturer, and your device settings, Android or your device provider may back up or transfer app data. This is separate from a cloud-save service operated by us. We do not receive these backup copies.

Nearby multiplayer on the same Wi-Fi

Optional nearby Co-op and Versus connect two devices directly on the same private Wi-Fi network. The host shares a join code that encodes its local IP address, and the other player uses the code to connect. The devices exchange local network addressing and connection information, temporary session and run identifiers, selected Imp skins, control input, pause and background status, and gameplay state such as positions, combat, scores and run results. This information is used to run and synchronize the match you request.

The LAN packets do not include your Google Play Games player ID or display name, email address, complete career save, Firebase privacy choice, contacts or chat messages. There is no in-game chat. We do not operate a matchmaking, relay or game server that receives these LAN packets, and this multiplayer feature does not send them to Google. The separate Google services described in section 4 may still connect independently.

Multiplayer packet buffers and temporary connection state are handled in memory for the session, and packet buffers are cleared when the local session closes. The game does not save a history of LAN packets. Ordinary local game records remain subject to the storage and retention information in this policy.

The game does not encrypt LAN traffic. Use a private network and share the join code only with the person you want to play with. Nearby multiplayer is optional; leaving the session stops its gameplay exchanges.

4. Google advertising, privacy, game, and Firebase services

Flappy Imp uses Google AdMob for rewarded ads and Google's User Messaging Platform (UMP) to check advertising privacy status. These Google services involve Google LLC and, where applicable, Google Ireland Limited.

Watching an ad is optional. Ads are shown only after you select an available rewarded-ad option. You can play and retry without watching ads.

Google's services may connect to the internet when the game starts and while preparing ads. Ads may be downloaded before you choose to watch them. Declining an ad does not stop these connections.

Depending on the service, device, and privacy configuration, Google may receive:

This information supports ad delivery, limited reporting and measurement, privacy administration, diagnostics, security, and fraud prevention.

App set ID restrictions: Where an app set ID is processed through the game, we permit its use only for appropriate non-advertising purposes, such as analytics and fraud prevention. We do not permit its use for ad personalization or ad measurement, or its association with Android identifiers or personal and sensitive information for advertising purposes. Legally valid consent must be obtained where required.

The game's advertising configuration requests child-directed, non-personalized ads for all players and uses a general-audience ad-content restriction. We configure the advertising services to prevent transmission of the Android advertising ID. These restrictions do not eliminate all identifiers or other technical data processing. Test versions may use Google demo ads; the privacy restrictions apply to both test and production advertising.

Privacy checks and consent

We configure Google's privacy service to treat every player as below the age of consent. Under this configuration, UMP does not present an advertising-consent form. The game starts the advertising service only when Google's privacy service reports that ads may be requested. If a privacy update fails, Google may still permit ads using a previously stored privacy state. When ads are not permitted, they remain unavailable while the game retries.

The game has no in-game advertising-consent form or verified parental-consent mechanism. The version-specific Firebase reporting choice described below is separate from advertising eligibility. Google's privacy status is not parental consent or a determination of every applicable legal requirement. Playing the game or choosing a rewarded ad is not treated as consent to processing that requires it.

For Google's own practices, see its Privacy Policy, information about apps that use Google services, and Mobile Ads SDK data disclosures.

Google Analytics for Firebase in earlier versions

Some earlier distributed versions include Google Analytics for Firebase and can send automatically collected app-usage events and technical information to Google. Examples include app launches, sessions, screen views, engagement, app updates and ad impressions or rewards. Depending on the SDK and device, this can include app-instance or installation identifiers, device and operating-system details, language, app version and approximate location derived from an IP address. This is not anonymous information, and choosing not to watch an ad does not stop Analytics collection.

We use Analytics to understand app usage, ad performance and reliability. Analytics is linked to our AdMob app for combined usage and advertising reports. The Settings → Privacy controls below do not exist in those earlier versions and do not retrospectively change information already received. If your version does not offer that setting, contact us for access, deletion or an objection concerning earlier reporting. You can stop further app activity by closing or uninstalling the game; clearing local storage alone does not erase Google's records or prevent collection if you launch an earlier version again.

Optional Firebase reports in versions with privacy controls

Versions that include Settings → Privacy provide optional Google Analytics for Firebase gameplay reports and Firebase Crashlytics crash diagnostics. Reporting is off by default. A local age-group check has no preselected answer and is followed by a separate explanation with Allow Reports and Keep Off choices. Under-18 and unspecified-age choices leave reporting off. Selecting an adult age group alone does not enable it. The age answer is not sent to Google or stored as a birth date or account attribute.

If an adult chooses Allow Reports, Google receives limited gameplay events such as run results, boss encounters, cosmetic unlocks and rewarded-ad outcomes, together with automatically collected Analytics events, app/device details and installation identifiers. Crash reports can include stack traces, error details, app version, device and operating-system information, crash timestamps, service-generated identifiers and recent approved gameplay context. These services are not anonymous. Our custom gameplay events do not include your name, email, Google Play Games identity, complete save, local playtest file, daily seed or our run/session identifiers. Google's SDKs can generate their own identifiers.

We use these optional reports to understand gameplay and diagnose faults. Firebase Advertising ID collection is disabled. In versions with these controls, Analytics ad storage, ad user data and ad personalization consent remain denied when gameplay Analytics is enabled. Optional reporting does not affect play, sign-in, rewards or the advertising restrictions.

You can withdraw your choice in Settings → Privacy. Analytics collection and custom event forwarding stop, local Analytics data is reset, and deletion of pending unsent crash reports is requested. Crashlytics can capture crash information locally while uploading is disabled. Automatic crash uploading remains disabled: pending reports are submitted at a later app startup only when a valid saved opt-in exists. A new opt-in discards pending reports rather than submitting pre-choice reports. Withdrawal cannot recall information already sent or a transmission already in progress.

Your saved choice applies to this installation and is stored separately from the gameplay save. Missing, invalid or obsolete privacy records default to off. The age-group response is self-declared; it is not Google account age, verified identity or verified parental consent. We do not offer parental authorization for optional Firebase reporting.

See Firebase privacy and security, Analytics data collection controls and Analytics data-sharing settings. In our Analytics account, sharing for Google's products and services is off. Aggregated, de-identified measurement contributions are enabled; Google technical support may access data when necessary to provide support. Business recommendations are enabled for account usage and configuration information. These account settings do not themselves disable the AdMob link or override the separate reporting choice in versions with privacy controls.

Google Play Games

Flappy Imp uses Google Play Games Services for online achievements and leaderboards. Available boards depend on your game version and include Endless Sky, Boss Gauntlet, Clean Streak, Bat Buster and Pure Flight. You can play, earn local rewards, and retry without a Play Games profile or a successful sign-in.

The Play Games service starts with the game and checks for an existing profile. If your Google settings allow it, an existing profile may sign in automatically. Players without a profile can continue playing locally and use Settings → Achievements & Leaderboards → Sign In to begin Google's sign-in or profile-creation flow.

When connected, the game receives your Play Games player ID and gamer display name. Depending on the available boards, it sends Google eligible endless-run distance scores, bosses defeated, longest clean-gate streaks, bats defeated and earned achievement results. Pure Flight uses distance before the first death. Daily Sky scores and boss practice runs are excluded from the leaderboards. The game does not request your Google password, email address, or friends list.

Eligible progress is recorded locally while offline and synchronized when connected. Progress earned before the first sign-in is assigned to the first linked player. Later offline progress remains associated with the last linked player; a run keeps the account associated with it when it began. Switching accounts does not transfer another player's queued records.

Career backup: When connected, Google's Saved Games service receives the linked player's career: Souls, owned and equipped characters, scores, gameplay counters and play time, milestones, Daily Sky records and reward claims, mastery and discovery progress, and that account's pending Play Games records and synchronization state. The backup includes the Play Games player ID to keep it associated with the correct account. Google also receives a short summary of best score, Souls and unlocked Imps, together with played time. The game does not upload a screenshot or cover image. Device settings, local playtest logs, Firebase privacy choices and other accounts' platform queues remain local.

Versions with career backup check for the linked account's cloud progress after authentication and on return to the foreground. Changed careers are checked for backup periodically in menus, and Sync Progress requests a check. Offline play remains available; a queued backup may wait for a connection.

If device and cloud careers differ, or a different account is connected, the game may ask which complete career to keep. The choices show Best, Souls and Imps and explain that the selection replaces the complete career on this device and in the cloud. The game does not add balances or combine reward claims from different careers. Device settings and the Firebase privacy choice are preserved.

Play Games progress statistics: For connected players, the game sends cumulative counts of eligible endless-run starts and finishes, selected boss encounters and victories, gates passed, Souls credited and spent, successful prize draws, newly unlocked Imps and rewarded revives. It also sends Game Stats records containing eligible endless-run results and progress: score, gates, clean gates, bats defeated, bosses defeated, endless mode and the account's best distance. These records support Play Games progress and aggregate game activity statistics. Daily Sky, practice run and development simulation results are excluded from the endless-run and boss submissions. General career counters can also include committed menu actions, such as reward claims and prize draws.

Google associates these Play Games records with the signed-in player. The game does not add a name, email address, contact information or separate player identifier to the Game Stats properties. Play Games synchronization and statistics are separate from optional Firebase reports. The Firebase reporting choice does not turn off Play Games features or Google's own SDK diagnostics.

Google may display your gamer identity, scores, and achievements to other players according to your profile visibility settings and its service rules. Google's SDK also collects analytics and diagnostic information for service reliability and improvement. Some service connections and technical processing can occur without a successful sign-in.

See Google's Play Games data disclosures and profile privacy and account settings. Our child-directed advertising and UMP settings apply to advertising services; they do not configure Play Games account permissions.

Where the General Data Protection Regulation (GDPR) applies to processing for which we are responsible, our purposes and legal grounds are as follows.

Local game functionality: To the extent local game records constitute personal information for which we are responsible, we rely on our legitimate interests in providing the gameplay, nearby multiplayer sessions, settings, progress, and rewards you request, without requiring an account.

Online game functionality: For processing we control, we rely on our legitimate interests in providing achievements, leaderboards, account-linked career backups and gameplay progress statistics where supported, and keeping connected players' account-specific progress accurate. This is limited to necessary and proportionate processing and does not replace a requirement for consent, including parental consent where applicable.

Support and troubleshooting: We rely on our legitimate interests in answering requests and maintaining a working game when handling ordinary support correspondence or diagnostic material you voluntarily send.

Security, fraud prevention, and necessary reliability checks: We rely on our legitimate interests in protecting the game and its advertising services and investigating faults, limited to processing that is necessary and proportionate.

Restricted contextual advertising and basic reporting: For limited processing that can lawfully take place without consent, we rely on our legitimate interests in funding the game through non-personalized ads and understanding whether those ads were delivered. This does not authorize non-essential access to device storage or other processing for which consent is required.

Consent: Optional Firebase gameplay analysis and crash reporting in versions with privacy controls rely on your consent under GDPR Article 6(1)(a), where applicable. You may decline or withdraw without losing gameplay or rewards. The game does not collect advertising consent or verify parental consent. Child-directed settings and Google's privacy checks do not replace a legal requirement to obtain consent, including parental consent where required. We do not ask children to consent to personalized advertising. This policy update does not create consent for earlier collection.

Privacy requests and required compliance records: We rely on legal obligations when processing is necessary to handle statutory privacy rights, respect applicable privacy requirements, or comply with a binding legal duty.

We rely on GDPR Article 6(1)(f) for the legitimate interests described above and Article 6(1)(c) for legal obligations. Legitimate interests do not override your rights, particularly children's rights, or a legal requirement to obtain consent.

Google may also process information for purposes it determines under its own policies and applicable terms. That does not remove our responsibility for processing we control.

6. Children and families

Flappy Imp's declared Google Play target audience is ages 13 and over, including teenagers and adults. Some teenagers may be considered children under the laws where they live. We apply child-directed advertising restrictions and under-age advertising privacy settings to every player. The optional Firebase reporting controls, where available, keep reports off for under-18 and unspecified-age choices.

The game has no chat or player-submitted photos, videos, or messages. Google Play Games profiles and leaderboard records may be visible to other players as described in section 4. We do not ask children to provide their real name, birth date, contact details, photographs, or precise location to play.

Google manages Play Games profile eligibility and any supervised-account approval through its own services. Parents can review Google's guidance for children's Play Games profiles. Availability may depend on the account and device. Flappy Imp does not independently verify a player's age or a parent's approval for Play Games, and local gameplay remains available when online features cannot be used.

The restricted advertising settings described above are used to limit identifier-based processing to permitted service operations, such as contextual ad delivery, limited reporting, reliability, security, and fraud prevention. We do not use children's information for behavioural advertising, build cross-app advertising profiles, or contact children for marketing. We do not send your saved gameplay records to Google as advertising-profile data.

Parents or guardians can contact us to ask what information we hold, request access or deletion where applicable, and refuse further collection or use of their child's information. We may request limited information to verify their authority. We will address information we control and assist with requests concerning the Google services used in the game. We cannot remotely access a save stored only on a device.

Children should ask a parent or guardian to contact us. Please do not send a child's personal details unless necessary for the request. If we identify a one-time support request as coming directly from a child, we use the contact information only to answer that request and promptly delete the child's correspondence and contact information after responding, unless a separate lawful requirement applies. Further support should be handled through a parent or guardian.

7. When you contact us

If you email us, we receive your email address, message, and any information or attachments you send. We use this information to answer you, investigate reported problems, and handle privacy requests. Providing it is voluntary, but we may not be able to resolve a request without the information needed to understand or verify it.

Our contact mailbox is hosted by Google Gmail, which processes correspondence to provide the email service. We do not use support correspondence for advertising or mailing lists.

Please do not send passwords or unnecessary personal information. Check screenshots and diagnostic logs before sending them. You do not need an in-game account to contact us.

8. Sharing and international processing

Google receives technical information through its advertising, privacy, Play Games and Firebase services, and receives scores and achievement results through Play Games when connected. In versions with these features, Google also receives the linked career backup and Play Games progress statistics described in section 4. Analytics receives usage events; Crashlytics receives crash reports when enabled in versions with the optional reporting feature, as described in section 4. Other players may see game records according to Google's profile visibility settings. Google also handles correspondence through our email service. Its policies explain its use of affiliated companies and service providers.

For Firebase services, we generally determine the purposes of processing and Google processes information on our behalf under the applicable service and data-processing terms. Google Analytics is governed by its separate terms, and Google may also act independently for processing it determines. See Firebase's data-processing information.

We may disclose information we hold when required by a binding legal obligation. We limit such disclosure to the information required.

We do not sell your saved game or support correspondence to data brokers.

Google may process information outside your country, including outside the European Economic Area. Its data-transfer information explains the mechanisms it uses where applicable, including adequacy decisions and standard contractual clauses. You may contact us for information about, or a copy of, safeguards relevant to processing for which we are responsible.

9. Retention, deletion, and security

Local game data

Local saves remain in the app's storage until that data is cleared or otherwise removed. To delete the current installation's app data, use Android settings, typically Apps → Flappy Imp → Storage → Clear data or Clear storage. The wording varies by device.

This deletes progress, settings, local logs, SDK preferences and any separate Firebase privacy choice stored within that app installation. It does not delete data in separate device backups, reset device-wide identifiers, or erase information already received by Google. Starting the game again may create new local records and trigger the processing described in this policy; versions with reporting controls start with reporting off when no valid saved choice exists.

In test builds, Reset Save resets progress but does not remove the separate playtest log or change the separate Firebase privacy choice. Android's clear-storage control removes these from the current installation.

We cannot restore a local-only save for you. In versions with the Saved Games feature, reconnecting to a Play Games account with a synchronized career backup can restore that career through Google. Clearing local storage alone does not delete the cloud backup. A device backup or transfer service may independently restore app data. Use Google account and device-provider controls to manage these separate copies.

Support correspondence

We permanently delete ordinary support correspondence and related attachments from the mailbox and other working copies we control within 90 days after resolving the request, and sooner when no longer needed. This includes permanently deleting relevant copies from the mailbox's Trash.

Unnecessary personal information about children is removed promptly. The shorter rule for one-time requests directly from children in section 6 takes priority over the ordinary 90-day support period.

Where a specific legal duty requires retention, we keep only the necessary information for that duty and delete it when the required retention ends. Our email provider may take additional time to remove residual backup copies through its own deletion process.

Information held by Google

Google Analytics: Our property is configured to retain event data for 2 months and user-level data for 14 months. The user-level retention period restarts when new activity is received from that user. Google processes expired-data deletion on its retention schedule, rather than immediately at the end of a session. These controls apply to retained event and user data used in reports such as explorations; most standard aggregated reports are not governed by these periods. See Analytics retention and deletion.

Firebase Crashlytics: When reports are submitted, Google retains crash stack traces, extracted minidump data and associated installation identifiers for 90 days before starting removal from live and backup systems. This is separate from our support-mailbox retention period. See Firebase retention information.

Google determines retention for information it holds under its applicable policies and service terms. Our 90-day support rule is not a retention promise for Google's advertising or Play Games records. See Google's retention information. Contact us for help identifying the appropriate route for a privacy request.

Turning optional reports off stops further reporting through those controls, but is not a server-side deletion request. To request access to or deletion of Analytics or Crashlytics information, email our privacy contact and describe the app version, approximate period and activity concerned. We may need an app-instance or installation identifier where available to locate records. Do not send passwords or unnecessary personal information. If we cannot reasonably identify your records, we will explain that limitation and the available Google controls. We handle valid requests subject to applicable law and Google's service deletion processes; we do not promise immediate removal of every backup or aggregate report.

Use Google's Play Games deletion controls to request deletion of Flappy Imp's game data, including a Saved Games career backup where that feature is available, from your Play Games account. This does not erase the app's local save or separate Google records such as Play History. Deleting local storage does not delete Google's records. If you reconnect with local progress or continue playing, scores, achievements and, in versions with those features, career backups and progress statistics may be sent again; review the sign-in settings and local-storage controls as well.

Security

Local records use Android's app-storage protections. Nearby multiplayer traffic between devices is not encrypted by the game. Google states that data collected by its Mobile Ads SDK, Play Games Services SDK and Firebase services is encrypted during transmission. We limit access to support correspondence and reporting consoles to administering the service, handling requests and investigating faults. No method of storage or transmission is completely secure.

10. Your privacy rights and choices

Firebase reporting choices: In versions with reporting controls, use Settings → Privacy to keep reports off or withdraw a previous choice. This controls optional Firebase reporting independently of advertising and Play Games. Versions distributed before these controls may not have this setting; see section 4. For access or deletion of information already sent, contact us using the privacy contact above.

Depending on your location and the applicable conditions, you may have rights to access, correct, delete, or obtain a portable copy of personal information, restrict processing, object to processing based on legitimate interests, or withdraw consent. Withdrawal does not affect processing that was lawful before it occurred.

Send requests to [email protected]. Explain the information or activity concerned. We may ask for information reasonably necessary to verify the request, but do not require an in-game account. Where we cannot identify information relating to you, we will explain the limitation rather than collect unnecessary information just to identify you.

Play Games choices: Manage the account used for Flappy Imp and profile visibility through Google's Play Games settings. The game has no separate Play Games sign-out or synchronization-off switch. Closing the achievements screen does not disconnect an existing session. Google controls account changes, and the game checks the connection again when it returns to the foreground. These choices do not switch off the separate advertising and UMP services.

Advertising choices: There is no in-game advertising-consent or advertising privacy-choice screen and no setting that switches off all Google service connections. The separate Firebase reporting control does not change ad eligibility. You may decline every rewarded-ad offer and continue playing, but this does not stop startup advertising privacy checks or ad preparation.

Use the privacy contact above to raise an objection, make a privacy request, or withdraw any consent you separately gave us. We will explain what we can act on and any steps needed through the relevant Google service. Sending an email or clearing the app's storage does not by itself erase Google's records or change all of Google's settings.

We respond to GDPR requests without undue delay and normally within one month. Where a permitted extension is necessary because of complexity or the number of requests, we may take up to two additional months and will explain the extension within the first month. Requests are ordinarily free of charge, subject to exceptions allowed by law.

You may complain to your local data-protection authority without first contacting us. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

We do not use your personal information to make automated decisions that produce legal or similarly significant effects on you.

11. Changes to this policy

We will update this policy when the game's information-handling practices change and revise the effective date. Where required, we will provide additional notice and obtain the necessary consent before introducing a new use of personal information.

For questions about this policy, contact [email protected].