Privacy Policy
Effective October 13, 2026
Not Touching is a puzzle game published by Hallows Group, LLC ("we", "us"), 5900 Balcones Dr #31966, Austin, TX 78731-4257, United States. This policy explains what the app collects, why, who helps us run it, and how you can delete your data. If you have a question, write to support@nottouching.app.
The short version. Not Touching is free because it shows ads. Anyone can play, including children, so the game first learns an age range and keeps only that range. Children under 13 and teens under 16 only ever see ads that are not personalized, and they are never asked to be tracked. Adults choose: on iPhone, Apple asks whether we may track. Where a privacy law requires a choice — the EU, the UK, Switzerland, and US states — Google's consent form asks what ads may use. Settings shows Privacy choices only when that form says there is a choice to revisit. There is no separate sale-or-sharing switch. We also collect anonymous gameplay events, and crash reports that carry no name and no account — at most a random installation ID, used for nothing but keeping the app working. There are no accounts: your progress stays on your device, with a backup in your own iCloud or Google account, never on our servers. Notifications are off until you turn them on.
What we collect
Gameplay events (everyone)
When you start, finish or leave a puzzle, the app sends an anonymous event: which kind of puzzle it was, how hard it was, how long it took, which hint level you used, the level number, the mode, and how many reveals you used. Events are grouped by a random session code that changes every time you open the app and is never stored on your device. They contain no name, email, account, advertising ID or device ID. We use them to check that the puzzles are as easy or hard as intended.
Crash reports (everyone)
If the app crashes, hits an error, or freezes for more than two seconds, it sends a report so we can fix the problem. A report contains technical details — the error, your device model, its operating system, its time zone and language setting, and the app's version and build number — and which screen, level and mode you were on. It never contains screenshots, your logs, your name or your email. It also contains nothing about your network activity: the app does not report the web addresses it contacted, the details of any request or response, or anything about your connection, and the parts of a report that could carry them are emptied before it is sent.
The name you gave your phone is removed from every report the game sends, and so is any other field that could identify you or your particular device. One kind of report is not sent by the game: when a crash takes the whole app down, the report is sent by our crash-reporting provider's own iPhone and Android software, which the game's code cannot reach into, so our removal step does not run on it. Those reports instead rely on the provider's own setting for this (“sendDefaultPii”, which we set to false), which is what keeps your device name and your IP address out of them, and they carry the random installation ID described below.
Your IP address is not stored with a report. Your device connects to our crash-reporting provider to send the report, so the provider sees your address while receiving it, as any website or service you connect to would. We have the provider set to discard the address rather than store it. A provider can also work out an approximate location — a country, region or city — from an address as it arrives; we have that switched off as well, so no location is kept with a report. We never receive your IP address or any location worked out from it.
Crash reports sent directly by the provider's own crash handler carry a random installation ID — a code our crash-reporting provider creates on your device so it can tell one installation's crashes from another's and count how many sessions are crash-free. It is not linked to you, to an account, to your name or to any advertising ID.
Everything in a crash report — the installation ID and the technical details alike — is used for one thing: keeping the app working and finding out why it broke. None of it is used to choose or measure ads, to build a profile of you, or to contact you, and none of it is sold or shared for anyone else's purposes. That is also true when the player is a child under 13: US children's privacy law (COPPA) allows a persistent identifier to be kept as support for the app's internal operations, which is what this one is, and for nothing else. The installation ID is created on your device and goes when you delete the app. Reports are kept for up to 90 days and then deleted.
Game Center (iPhone, only if you use it)
If your iPhone is signed in to Apple Game Center, your total stars, Daily and Rush scores are sent to Game Center's leaderboards. Apple holds those under its own privacy policy; we do not receive them.
Notifications (only if you turn them on)
Daily reminder: a reminder scheduled on your phone each evening. Nothing about it is sent to us. News and new levels: if you turn this on, your device joins a single "news" channel with Google's Firebase Cloud Messaging, which delivers our announcements about new levels, characters and features (through Apple's notification service on iPhone). Firebase creates a random installation code and a delivery code for this on your device; we never receive or store either, and every subscriber gets the same message. Turning the setting off leaves the channel. You can also turn notifications off at any time in your phone's settings.
What stays on your device
Your progress, settings and in-progress puzzles are stored on your device. On iPhone and iPad, a copy of your progress (stars, best times, Daily history, hint and reveal balances and the board-letters setting) is also kept in your own iCloud, so it comes back when you reinstall or move to another Apple device signed in to the same Apple Account. That copy is in your iCloud, not on our servers, and we cannot see it; it is held by Apple under its own privacy policy, and you can turn it off for this app in iCloud settings. On Android, the game's save folder is included in Android's own backup to your Google account, if backup is on for your phone, so it comes back when you reinstall or set up a new phone; that copy is held by Google under its own privacy policy, we cannot see it, and you can turn it off in your phone's backup settings. Puzzle solutions never reach our servers.
Your age range (everyone, once)
Before ads start, the game needs to know whether a player is a child (under 13), a teen (13 to 15) or an adult (16 or older). It asks your device first: on iPhone, Apple's age range feature, and on Android, Google Play's age signals, which answer only when you (or a parent) allow it or where the law requires it. If your device cannot say, the game asks for your birth year once. Either way it keeps only the range, never the year, and it never leaves your device.
Ads
Ads are chosen by our ad mediation partner, Unity LevelPlay, from ad networks including Google AdMob and Unity Ads. LevelPlay also includes ironSource Ad Quality, which monitors the ads that are shown. To show and count ads, these partners receive technical information from your device, such as its model, operating system, IP address, language, the app's details, and how you interact with ads.
- Children and teens (under 16): ads are not personalized. We tell every ad partner the player is under the age of consent, and children under 13 are treated as child-directed under COPPA. No advertising identifier is used to profile them, and they never see Apple's tracking prompt.
- Adults: ads may be personalized only as you allow. If you allow it, ad partners may collect information about your activity in this app and in other apps and websites over time, to choose ads for you. On iPhone, the advertising identifier is used only if you allow tracking when Apple asks. Where Google's form is required — the EU, the UK, Switzerland, and US states — that form records your choices, including whether information may be sold or shared. Settings › Privacy › Privacy choices opens the form again, and only when Google says you have a choice to revisit.
Some ads let you earn a hint, a reveal or one more heart by choosing to watch them. Watching is always optional.
Why we use it
- Showing ads: where the law requires consent (the EU, the UK and Switzerland), your consent in Google's form; elsewhere, our legitimate interest in keeping the game free.
- Gameplay events and crash reports: our legitimate interest in keeping the game working and as hard as it says it is.
- News and new levels: your consent, given when you turn the setting on.
- Your age range: to meet our legal duties to protect children. It stays on your device.
Who helps us run the app
| Provider | What they do | What they receive |
|---|---|---|
| Cloudflare, Inc. | Hosts our servers for gameplay events, game settings and new levels | Gameplay events |
| Functional Software, Inc. (Sentry) | Crash and error reporting, stored in the EU | Crash reports |
| Apple Inc. | Delivering notifications on iPhone; Game Center leaderboards; iCloud backup | The notification we send; your Game Center scores, if you use Game Center; your iCloud copy of your progress, held in your account |
| Unity Technologies (LevelPlay, Unity Ads, ironSource Ad Quality) | Choosing, showing and monitoring ads | Device and ad information, as described under Ads |
| Google LLC (AdMob, consent form) | Showing ads; recording consent where the form is required, including US states | Device and ad information, and your consent choices |
| Google LLC (Firebase Cloud Messaging) | Delivering notifications on iPhone and Android | The notification we send, and a Firebase installation code, if you turn on news |
Cloudflare, Sentry and Google (for Firebase Cloud Messaging) process data only on our behalf. The ad partners act under their own privacy policies for the ads they serve, within the choices you make here. Some providers are based in the United States, so your data may be processed there. When we transfer personal data from the EU, the UK or Switzerland to the United States, we rely on the safeguards in our providers' data processing terms, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
How long we keep it
- Gameplay events: kept for three months, then deleted; after that we keep only anonymous daily totals.
- Crash reports: kept for up to 90 days, then deleted.
- Your progress: we keep none. It stays on your device and in your own iCloud or Google backup, under your control.
Deleting your data
There is no account to delete, and we hold no progress or profile of yours. Progress on your phone goes when you delete the app; its iCloud copy is managed in your iPhone's iCloud settings, and its Android backup in your Google account's backup settings. Game Center scores are held by Apple; you can manage them in your iPhone's Game Center settings. Gameplay events and crash reports carry no name or account, so we cannot pick out yours; they are deleted on the schedule above. You can also email support@nottouching.app to ask us to delete your data or to tell you what we hold about you.
Your rights
Depending on where you live, you may have the right to access, correct, delete or move your personal data, and to object to how we use it. To use any of these rights, email support@nottouching.app. Where Google's form applies, including the EU, the UK and US states, you can change your ad choices at any time in Settings › Privacy › Privacy choices. If you are in the EU or UK, you can also complain to your local data protection authority. Under California and similar US state laws, sharing information with ad partners for personalized ads can count as a "sale" or "sharing". Adults opt out in Google's form, not with a switch of our own, and we never sell or share the information of anyone under 16.
Children
Not Touching is for everyone, including children. We learn only an age range, as described above, and a child under 13 gets child-directed ads that are not personalized, with no tracking prompt and no sale or sharing of information. We do not ask a child for personal information to play, and the game has no accounts and no leaderboards of its own. A crash report from a child's device carries the random installation ID described under Crash reports, which is kept only to support the app's internal operations — keeping the game working — as COPPA allows, and is used for nothing else. If a parent wants to know what we hold, email support@nottouching.app and we will help.
Do Not Track
Our website sets no cookies and loads no tracking or third-party scripts, so there is nothing for a browser's Do Not Track signal to turn off, and the site does not respond to it differently. The app does not receive Do Not Track signals; use the choices described above instead.
Changes
If this policy changes, we will update it here and change the effective date above.