Privacy policy

01Who we are

Dragon Heist is made and published by DURRANI LAB PRIVATE LIMITED, a company registered in India, with its registered office at Khori Galli, Latur, Maharashtra, India (“Durrani Lab”, “we”, “us”).

We decide why and how the personal data described here is used, so we are responsible for it. In the words of India’s Digital Personal Data Protection Act 2023 we are the data fiduciary. Under the data protection laws of the European Economic Area (EEA), the United Kingdom and Switzerland we are the controller.

For analytics, Google processes data for us and on our instructions. For ads, Google and its advertising partners also decide for themselves how they use data, under their own privacy policies.

You can reach us at contact@durranilab.com.

02What this policy covers

This policy covers the Dragon Heist mobile game on Android, and on iPhone and iPad when that version is released. The Android app’s package name is com.durranilab.dragonheist.

This website has its own short policy: website privacy. It sets no cookies and runs no trackers.

03Data that stays on your phone

The game saves your progress in a file on your phone. It includes:

• the levels you have played and your best results;
• your coins and the kit you have bought with them;
• your settings, such as sound and vibration;
• which tips you have already seen.

This file is not sent to us. We cannot see it and we cannot restore it. It is deleted when you uninstall the game or clear its data in your phone’s settings. If your phone’s own backup is turned on, the file may be part of that backup, which you and your backup provider control.

04Data processed by Google services

The game does not run any server of ours. It contains software from Google that processes some data while you play:

• Google AdMob chooses, shows and measures the ads.
• Google’s User Messaging Platform shows the consent form where it applies and remembers your choice on your phone.
• Google Analytics for Firebase tells us, in numbers, how the game is played.

Between them, these services process the following kinds of data:

The game does not collect or ask for:

• your name, email address, phone number or postal address;
• your contacts, photos, files, camera or microphone;
• your precise (GPS) location;
• any login, chat or content made by you. The game has none of these.

The game is built with the Unity engine. Unity’s own analytics and diagnostics services are switched off in the game, so the engine itself does not send us or Unity information about how you play.

Google explains how it uses this kind of data on these pages:

• How Google uses information from sites or apps that use its services
• Google Privacy Policy
• Privacy and security in Firebase

Ads can also come from advertising partners that work with Google. Where the consent form is shown (see section 9), it lists them.

05What the game measures

We use one Google Analytics for Firebase project for all of our games. Each game, and each installation of a game, has its own app instance ID. We do not set a user ID, and we do not join up data from one of our games with another.

Besides the events Google Analytics records by itself (such as the first time the game is opened, sessions and app updates), the game records:

• when a heist starts, and which level it is;
• when a heist ends: the level, whether you escaped or woke the dragon, the stars, the coins banked and the bonus coins, how many pieces you took and how long it lasted;
• when an ad is shown, and whether a reward was earned or the ad was closed early;
• when a reward is claimed, and which one.

We look at these numbers in totals, for example how many players finish a level, so we can fix problems and keep the game fair and fun.

06Why the data is used

• To show ads. The game is free because of ads: video ads you choose to watch for a reward, and ads shown after a heist has ended.
• To personalise ads, only where you have agreed or where the law allows it and you have not opted out. Otherwise the ads you see are not based on your interests.
• To measure ads, for example to count views and taps, to limit how often you see the same ad and to report results to advertisers.
• For analytics, to understand how the game is played in general, so we can fix problems, balance levels and decide what to make next.
• To prevent fraud and abuse, for example fake ad views and taps.
• To follow the law, where we must keep or hand over information.

We do not use your data to make decisions about you that have legal or similarly significant effects.

07The Privacy screen in the game

The game’s menu opens a Privacy screen. From there you can:

• read this policy and the terms of use;
• open Google’s consent form again with the Ad choices button and change your choices, where the form applies to you (see section 9);
• switch usage statistics off with the Usage stats button. The game then stops sending analytics from your phone. Ads still work, and AdMob still processes the data it needs to show and measure them;
• see your Player ID (Google Analytics’ app instance ID, tap it to copy it), to quote if you ask us to find or delete your analytics data.

08The advertising ID and your ad choices

The advertising ID is a code your phone gives to apps for advertising. It is not your name or phone number, and you control it in your phone’s settings.

On Android

• Open Settings, then Google (or Privacy), then Ads. The names differ a little between phones.
• Choose Delete advertising ID to stop apps from using it for personalised ads.
• Choose Reset advertising ID to get a new one that is not linked to the old one.
• On older versions of Android the option is called Opt out of Ads Personalisation.

On iPhone and iPad

These steps will apply when the iOS version is released.

• The game can use your device’s advertising identifier only if you tap Allow when iOS asks whether it may track you.
• You can change this at any time in Settings, then Privacy and Security, then Tracking.

Opting out does not remove ads. You still see them, but they are not based on your interests. If you use a Google Account, you can also manage ad personalisation at My Ad Center.

09Consent in the EEA, the UK and Switzerland

If you are in the EEA, the United Kingdom or Switzerland, the game shows Google’s consent form the first time you open it. You can agree, refuse, or manage your choices in detail. The game works whichever you choose. If you refuse, the ads you see are not personalised, and Google Analytics for Firebase follows the choice you make.

To change your choice later, open the Privacy screen from the game’s menu and tap the ad choices button. Where no form is used for your region, the button does not appear; you can still use your phone’s settings (section 8) and switch usage statistics off.

10Legal bases

If you are in the EEA, the UK or Switzerland, we rely on these legal bases:

• Your consent, for storing or reading information on your device (such as the advertising ID) for ads and analytics, and for personalised ads. You can withdraw consent at any time on the Privacy screen. Withdrawing does not affect what happened before.
• Our legitimate interests, for keeping the game and its ads safe from fraud and abuse, fixing problems, and basic measurement where the law allows it without consent. You can object, as section 15 describes.
• Legal obligations, where a law requires us to keep or disclose information.

In India, personal data is processed for the purposes in section 6. You can withdraw your consent at any time on the Privacy screen or by writing to us, and we will stop the processing that relies on it.

11Who data is shared with

• Google (Google LLC and its affiliates, including Google Ireland Limited), as the provider of AdMob, the User Messaging Platform and Google Analytics for Firebase.
• Google’s advertising partners, such as advertisers and ad technology companies, when they take part in showing or measuring an ad.
• App stores. Google Play (and later the Apple App Store) handles downloads and updates under its own privacy policy.
• Authorities and advisers, where the law requires it or where it is needed to protect our rights or the safety of others.
• A new owner, if the game or our business is sold or merged. This policy would continue to apply to your data.

We do not sell your personal data for money, and we do not share it with anyone else.

Ads may link to other websites and apps. Other companies run those, under their own privacy policies.

12Data processed outside your country

We are based in India. Google processes data on servers in many countries, including the United States, so your data may be handled outside the country where you live.

For data from the EEA, the UK and Switzerland, Google relies on recognised safeguards such as the EU-U.S. Data Privacy Framework, with its UK and Swiss extensions, and standard contractual clauses. Google describes them on its page about data transfer frameworks.

13How long data is kept

• Progress on your phone: until you uninstall the game or clear its data.
• Analytics data: Google Analytics keeps event data linked to an app instance ID for 2 months. After that only totals that identify nobody remain in our reports.
• Advertising data: Google keeps it under its own rules. See how Google retains data.
• Emails you send us: as long as we need them to answer you and to keep a record of how we handled your request, unless the law requires longer.

14Children

Dragon Heist is made for a general audience aged 13 and over. It is not directed to children under 13, and we do not knowingly collect personal data from them. The game does not ask for a name, an age or contact details.

In some places the age at which you can agree to data processing yourself is higher: up to 16 in parts of the EEA, and 18 in India. If you are younger than that where you live, please play only with a parent or guardian who makes the choices on the Privacy screen for you.

If you are a parent or guardian and believe your child has played the game, write to us at contact@durranilab.com. We will help and delete any data we are able to find. You can also uninstall the game and reset or delete the advertising ID on the phone (section 8).

15Your rights and how to use them

Depending on where you live, you may have the right to:

• access the personal data held about you, or a summary of it, and get a copy;
• correct, complete or update data that is wrong;
• have your data deleted;
• restrict or object to some uses of your data, including personalised ads;
• withdraw consent at any time, as easily as you gave it;
• receive your data in a portable format;
• nominate another person to use these rights for you if you die or become unable to;
• complain to a data protection authority.

What you can do yourself, right now

• Change your ad choices or switch usage statistics off on the Privacy screen (section 7).
• Reset or delete your advertising ID (section 8).
• Delete your progress by uninstalling the game.

How to ask us

Email contact@durranilab.com and tell us what you would like. It is free. Because the game has no accounts, we do not know who you are: please include the Player ID shown on the Privacy screen, so we can find the data that belongs to your installation. We answer within one month. To delete analytics data, we use Google Analytics’ own deletion tool for that ID.

For data that Google holds as an advertising company, you can also use Google’s own tools and the settings in section 8.

Complaints

Please contact us first so we can put things right. You also have the right to complain to an authority:

• India: the Data Protection Board of India (see section 16);
• EEA: your national data protection authority;
• United Kingdom: the Information Commissioner’s Office;
• Switzerland: the Federal Data Protection and Information Commissioner.

16Players in India and the Grievance Officer

We follow India’s Information Technology Act 2000 and its rules on personal information, and we are preparing for the duties of the Digital Personal Data Protection Act 2023 and its Rules as they come into force.

Questions, requests and complaints about your personal data go to our Grievance Officer:

We acknowledge a grievance within 48 hours and resolve it within one month. If you are not satisfied with our answer, you may complain to the Data Protection Board of India once its procedures apply to your complaint.

17Players in US states with privacy laws

Some US states, such as California, give residents extra privacy rights. This section applies if you live in one of them.

• What is collected: identifiers (such as the advertising ID and IP address), app activity (your interactions with the game and its ads) and approximate location worked out from your IP address. No sensitive personal information.
• No sale for money. We do not sell your personal information for money.
• Sharing for personalised ads. Letting advertising partners use your identifiers for personalised ads may count as sharing, selling or targeted advertising under some state laws.
• How to opt out: use the ad choices on the Privacy screen where they are offered, delete your advertising ID or refuse tracking in your phone’s settings (section 8), or email us.
• Your other rights: to know what is collected, to get a copy, to correct it and to delete it. Email contact@durranilab.com. An authorised agent can ask for you.
• No penalty for using these rights. If we refuse a request, reply with the word Appeal and we will look at it again.

18Security

The game’s ad and analytics software sends data encrypted in transit. We run no server that stores your personal data, and your progress stays on your phone, protected by its own security. No method of sending or storing data is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

19Changes to this policy

We may update this policy, for example when we add a feature or when the law changes. We will post the new version on this page and change the date at the top. If a change is important, we will also tell you in the game or on its store page.

20Contact