Privacy Policy

Gold Rush: ASMR Gold Panning

Effective date: September 12, 2026 · What changed in this version

Gold Rush: ASMR Gold Panning (“the game”) is developed by Frutti Games (“we”, “us”). This policy explains, in plain language, what data the game handles, why, and what your choices are. It applies to the game on iOS and Android.

The short version

• No account sign-up. You never create an account with us — no email, no password, no real name. Signing in for community features happens automatically through Apple Game Center (or Google Play Games on Android) using your public player nickname.
• Anonymous analytics. We use a random identifier created on your device — not your name, not your device’s hardware ID, not your advertising ID — to understand how the game is played.
• Ads only when you choose them. The only ads in the game are optional rewarded videos you tap to watch. There are no forced ads. On iOS we always ask for tracking permission first.
• We measure our own ads, minimally. To learn whether the ads we run to promote the game work, we send an anonymous “installed” / “purchased” signal to Meta (Facebook) and use Apple’s ad-attribution service. No advertising ID is ever sent to Meta, and you can opt out of tracking at any time — see section 4.
• Payments stay with Apple / Google. We never see your card details or billing information.
• We never access your microphone, camera, contacts, photos, or precise location. All ASMR sounds are pre-recorded — the game never listens to you.
• You can delete your data in the game (Settings → “Leave the Artel and delete data”) or by emailing [email protected].

What we collect and why

1. Gameplay analytics (PostHog)

When you play, the game sends anonymous events to PostHog, our analytics provider — things like “a wash was completed”, “a bag was opened”, “a purchase succeeded”, together with the app version, platform, language, and time-zone offset. These events are tied to a random identifier generated on your device the first time you launch the game. It is not derived from your hardware, your Game Center account, or your advertising ID, and it cannot be used to identify you personally.

Purchase events include which pack you bought, its price and currency — never any payment details (see “Purchases” below).

We use this data to understand which parts of the game work, balance the economy, and fix what doesn’t. Analytics data is processed on PostHog’s servers in the United States (PostHog Cloud US, hosted on Amazon Web Services) — see “Where your data is processed” below.

2. Crash and performance reports (Sentry)

If the game crashes or misbehaves, a technical report is sent to Sentry: device model, OS version, app version, the error itself, and a short trail of recent in-game actions. These reports are scrubbed before sending — they contain no names, no contact details, and identifiers are replaced with short one-way hashes. We use them solely to find and fix bugs.

3. Advertising (Google AdMob) — rewarded videos only

The only advertising in the game is rewarded video: you choose to watch a video to earn an in-game reward. We never show forced or interstitial ads.

To show these videos we use Google AdMob. On iOS, before any ad-related data is used, the system App Tracking Transparency prompt asks for your permission:

• If you allow tracking, Google may use your device’s advertising identifier (IDFA) to show you more relevant ads, as described in Google’s privacy policy.
• If you don’t allow it, you still get the same rewarded videos — they are simply non-personalized. Nothing else in the game changes.

You can change this choice at any time in iOS Settings → Privacy & Security → Tracking. On Android, you can limit ad personalization in your device’s Google settings. Google also processes standard ad-delivery data (such as IP address and ad interactions) as an independent provider — see the links in “Third parties” below.

4. Measuring our own advertising (Meta, Apple Ads)

We buy ads to tell people about the game. To know whether those ads work, we send two kinds of measurement signals. Neither contains your name, your Game Center account, or anything you created in the game.

Meta (Facebook / Instagram) — Conversions API. Once, shortly after you first open the game, and again each time you complete an in-app purchase, our server forwards an event to Meta Platforms. The event contains:

• a random install identifier generated on your device — the same one used for analytics; it is not your advertising ID (IDFA / Google advertising ID), which we never send to Meta;
• the event type (“app installed” or “purchase”); for purchases also the product, its price and currency, and the store’s transaction number — never any payment details;
• basic device information: device model, operating-system version, app version, language, time zone, screen size and pixel density, number of processor cores;
• your IP address and the app’s network user-agent string, which our server adds to the event;
• whether you allowed tracking in the iOS “Allow tracking” prompt.

Meta uses these events to tell which installs and purchases came from our ads, to measure and optimize our campaigns and, only if you allowed tracking, to build audiences of people similar to our players. Meta may also use this information as described in its own privacy policy (see “Third parties”).

Your choice. If you do not allow tracking (iOS prompt, or later in iOS Settings → Privacy & Security → Tracking), the event is sent with a “tracking not allowed” flag, and Meta states that it restricts its use of such events; because we never send your advertising ID, Meta cannot match the event to your Facebook or Instagram account by that route either. On Android the “tracking not allowed” flag is currently always set, because the game does not read the advertising ID. To stop these events entirely, email [email protected].

How long. Our server keeps the event body (including the IP address) for up to 30 days, after which only a short de-duplication key remains; Meta keeps event data for up to two years under its Business Tools Terms.

Apple Ads attribution (iOS). Once, after installation, the game asks Apple’s AdServices framework for an attribution token and passes it to our server, which asks Apple whether the install came from one of our App Store ads. Apple answers only with campaign-level information (campaign, ad group, keyword, conversion type). No device or personal identifier is involved, it works the same whether or not you allow tracking, and the result is stored with the same random analytics identifier described in section 1.

5. Purchases (Apple App Store / Google Play)

All purchases are processed entirely by Apple (StoreKit) or Google (Play Billing). We never receive or store your payment card, billing address, or any financial details, and purchase receipts do not leave your device. For analytics we record only that a purchase happened: the product, its price and currency, tied to the same random analytics identifier described above.

6. Community features — the Artel

The game includes an opt-out community layer called the Artel: a daily tournament, a feed of notable finds, and trading. When these features are active, a game profile is created automatically using your Game Center player identifier and public nickname (on Android: Google Play Games). Your nickname, avatar choice, and gameplay results — grams of gold washed, finds — are stored on our server and are visible to other players in the tournament and the finds feed. That is the entire extent of it: there is no chat and no free-text input anywhere in the game.

You are in control:

• Settings → “Participate in the Artel” — a toggle that immediately stops publishing your name and results (your existing server data is hidden, not deleted).
• Settings → “Leave the Artel and delete data” — permanently deletes your server profile, tournament entries, and feed records. This cannot be undone. Your local game progress, collections, and purchases stay on your device.
• You can also block any player from the feed.

7. Notifications

The game schedules local reminders (for example, “your bag is ready”) directly on your device — these never travel over the internet, and you control them in the game’s Settings and in your system notification settings. If and when online notifications are enabled (for example, tournament results), a push token — a random address issued by your device for delivering notifications — is registered with Google Firebase Cloud Messaging. It is used for nothing else.

8. Technical data

Like every internet service, our providers receive your IP address as a technical part of each connection. We use it only for approximate, country-level statistics (for example, to place you in the right daily tournament window) and abuse prevention — never to identify you; our server stores only a one-way hash of the network prefix, not the address itself. The one exception is the ad-measurement event described in section 4, which includes your IP address and is kept for up to 30 days. Your time-zone offset is used to avoid sending reminders at night; it is not your location, and we never collect precise geolocation.

What we never collect

• Real name, email address, phone number (you can choose to email us — see Contact)
• Contacts, photos, files
• Microphone or camera access — never requested, never used
• Precise location (we never ask for location permissions)
• Payment details of any kind
• Free-form messages or chat — the game has none
• Health, biometric, or any other sensitive data

We do not sell your data. The only advertising-related sharing is with Google AdMob, to show you the rewarded videos you choose to watch (section 3), and with Meta, to measure the ads we run to promote the game (section 4). Under some U.S. state privacy laws, sending install and purchase events to an advertising platform can count as “sharing” for cross-context behavioral advertising; you can opt out by not allowing tracking (iOS prompt or Settings) or by emailing [email protected].

Third parties

We share data only with the providers and partners below, only as described in this policy. Each of them is required to protect your data to at least the same standard as this policy:

Where your data is processed

Analytics data is processed in the United States by PostHog, Inc. (PostHog Cloud US, hosted on Amazon Web Services). Crash reports, ad-related data and ad-measurement events are also processed in the United States, by Sentry, Google and Meta respectively. Apple and Google process sign-in and purchase data under their own policies wherever you are.

If you are in the EEA, the United Kingdom or Switzerland, this means your data is transferred outside your region. For PostHog we rely on two safeguards: PostHog, Inc. is self-certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and our data processing agreement with PostHog (posthog.com/dpa) incorporates the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss adaptations). For Meta, players in the EEA are served by Meta Platforms Ireland Ltd (players in the UK by Meta Platforms, Inc. under Meta’s UK terms), and Meta and we act as joint controllers for the measurement events under Meta’s Business Tools Terms; Meta Ireland’s transfers to the United States rely on the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback. Our other providers likewise participate in recognized international data-transfer frameworks or use Standard Contractual Clauses, and all of them are bound to protect your data as described above.

How long we keep data, and how to delete it

• Analytics events are kept under a random identifier that cannot identify you; we retain them only as long as needed to operate and improve the game.
• Crash reports are automatically deleted by Sentry after at most 90 days.
• Artel (community) data is kept until you delete it — instantly, in the game: Settings → “Leave the Artel and delete data”.
• Ad data is handled by Google under its own retention rules (see the links above).
• Ad-measurement events (section 4): the event body, including the IP address, is deleted from our server after at most 30 days; Meta retains event data for up to two years under its Business Tools Terms.

You can also email [email protected] to request deletion of any data we hold, or to withdraw any consent you have given. If you have used the Artel, include the support ID shown at the bottom of the game’s Settings screen so we can locate your records. We respond within 30 days.

To revoke specific permissions at any time: tracking — iOS Settings → Privacy & Security → Tracking; notifications — system notification settings; community participation — the Artel toggle in the game’s Settings.

Your rights

Depending on where you live, you have the right to access the personal information we hold about you, to have it corrected, to have it deleted, and to object to or restrict its processing. To exercise any of these rights, email [email protected] — it works the same for everyone, everywhere.

• New Zealand: we handle personal information in accordance with the Privacy Act 2020. You may complain to the Office of the Privacy Commissioner (privacy.org.nz) if you are not satisfied with our response.
• Philippines: we process personal data in accordance with the Data Privacy Act of 2012 (RA 10173) and its principles of transparency, legitimate purpose, and proportionality. You may lodge a complaint with the National Privacy Commission (privacy.gov.ph).
• EEA / UK: where the GDPR applies, our legal bases are performance of a contract (running the game you asked for), legitimate interests (analytics, crash fixing, fraud prevention, aggregate measurement of our own advertising), and consent (tracking for personalized ads and for ad measurement linked to your device when you allow tracking). You can withdraw consent at any time in iOS Settings → Privacy & Security → Tracking. You also have the right to complain to your local supervisory authority.
• United States: depending on your state, you may have the right to opt out of the “sale” or “sharing” of personal information and of targeted advertising. We do not sell personal information; to opt out of sharing for ad measurement, decline tracking in the iOS prompt or email us. We do not discriminate against you for exercising any right.

Children

The game is rated for players 13 and up and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at [email protected] and we will delete it.

Security

All data leaves your device over encrypted connections (HTTPS) only. We collect the minimum we need, strip identifying details before sending diagnostics, and use random identifiers instead of personal ones wherever possible.

Changes to this policy

If we change this policy, we will post the new version at this address and update the effective date above. Material changes (for example, a new category of collected data) will be announced in the game.

September 12, 2026: added section 4 — anonymous install and purchase events sent to Meta to measure our own ads (no advertising ID; opt out via the iOS tracking setting or by email), and Apple Ads attribution; Meta added to the third-party list; IP-address handling, retention and U.S. opt-out details updated.

August 30, 2026: analytics moved to PostHog Cloud US (DPF and SCC safeguards).

Contact

Frutti Games
Email: [email protected]
Website: goldrushasmr.com