Draft for approval — 19 October 2026. Not final and not yet used for UMP consent.
This notice describes development version 0.9.3 of POLAR SHIFT. The game is not yet published on Google Play. Ads are Google demo ads; Google sign-in and the distributed build’s online connection are disabled pending credentials. Online sections describe implemented code and staging, rather than a service already available to everyone. An approved notice will be published before activation.
1. Who operates the game
The controller is Davide Di Tonto, publishing under the brand Novaryn Labs, Italy. Privacy, support and parental enquiries: novaryn.labs.dev@gmail.com.
Required before approval: the operator’s public postal address and telephone number for the US children’s notice. Novaryn Labs is a brand and is not represented as an incorporated company.
2. On-device play and age selection
The game stores Story progress, local scores, hints and recharge timing, sound preferences and settings on the device. It does not request a camera, microphone, contacts, precise location or a Novaryn Labs password.
The initial age question has no preselected answer. Once confirmed, the code keeps only the 0–12, 13–17 or 18+ band, separately from progress: it does not retain the exact age or date of birth. This declaration does not verify identity or age. Preferences also include adults’ advertising choices and any age-correction timing. An unknown age or invalid settings block the game’s ad requests and online functions.
The Story remains playable offline without Google authentication. Clearing app data can remove local progress and choices; copies managed by Android are separate from our server data.
3. Children and teenagers
The intended audience includes children. In the reviewed build, Play Games, Saved Games and Cloudflare functions are disabled for everyone under 18. This path does not create a competitive profile or publish a nickname on a leaderboard. Progress remains local.
Requests for ages 0–12 are tagged as child-directed; requests for ages 13–17 receive under-age-of-consent protection. Both bands use non-personalized requests, a maximum G ad content rating and ad units separate from adult units. Minors are not offered personalization. Only Google Mobile Ads and UMP are included; external mediation network SDKs are excluded from the current APK/AAB.
Contextual advertising does not mean no data is processed: network and technical information and permitted identifiers may still be used for delivery, frequency limits, security and fraud prevention. Google restrictions are set before explicit initialization. We do not use the minors’ path for behavioural advertising or to create competitive profiles.
A parent can contact us to understand processing, request access to or deletion of information relating to their child, and refuse further collection where applicable. Identify the game and the issue; do not send identity documents, passwords or unnecessary information about the child. Google tools may also be needed for data held directly by Google. No signed parental form is required for offline play.
Open before launch: technical settings alone do not establish compliance in every country. The provider’s actual processing of minors’ data and applicable conditions must be confirmed before real ads are enabled. We do not claim verified worldwide compliance.
4. Adult advertising choices
Google AdMob supplies interstitials and voluntarily requested rewarded ads. The current build exclusively uses official Google demo units. Google UMP manages consent status and any messages required for the user’s region.
An adult chooses whether to allow personalization. Declining forces non-personalized requests; local agreement does not replace UMP consent. Choices can be changed in Settings, including through Google’s control when available. Cached ads are invalidated when preferences change. Real ads are not enabled when the game detects that a required UMP message is not configured.
Google’s service may process IP addresses, ad interactions, diagnostic information and device or account identifiers depending on configuration, age, choices and its notices. We do not receive a list of the player’s personal interests. There are no additional behavioural analytics tools or chat. The prepared external mediation groups are paused; enabling another network would require a notice and consent review.
5. Google Play Games and Saved Games — prepared functions
For adults, once configured, Google Play Games may provide a platform profile and Saved Games. Google Story saves are separate from Cloudflare leaderboards. Code handles progress and synchronization conflicts within the profile authenticated by the Google SDK.
Competitive identity requests OpenID authorization within the same Google flow. The email scope is not requested. The server exchanges the authorization code with Google and validates the OpenID token before using its sub identifier. It stores a cryptographic fingerprint linked to an internal profile, rather than trusting an identity sent by the device. The Play Games display name may be used to propose a checked nickname. There are no Novaryn Labs passwords or manual recovery codes. Refusing online authorization does not prevent offline Story play.
6. Leaderboards, friends and Challenges — prepared backend
The backend uses Cloudflare Workers and D1. It can store an internal ID, nickname, friend code, pseudonymized Google link, hashed access sessions, scores, completed levels and competitive results. Challenge records include period, level, attempt status, hints used and second-attempt state.
Submitted moves are processed to validate the result; full replays are not kept in the application database. For online rewarded second attempts, the server checks Google’s signed confirmation, including a transaction ID and game code, to prevent reward reuse.
Nicknames, scores and completed-level counts may appear on leaderboards. Friend rankings use reciprocal links. The server also holds blocks and nickname reports with their reason and status. There is no chat. Do not put your real name or other personal information in a nickname.
Cloudflare receives request IP addresses and technical metadata. The application also derives a daily-changing IP fingerprint to limit abuse; this is not anonymous information. Controls can reject results, limit requests or suspend a profile. Contact the operator to challenge an error. The game does not award monetary prizes.
7. Purposes and legal grounds — subject to operator confirmation
The proposed grounds for the controller’s processing are: performance of the requested service for gameplay, saves, optional profiles and competition; consent where required for personalized ads and storage/access to non-essential identifiers; legitimate interests in security and abuse prevention following assessment of users’ rights; and legal obligations for legally required responses. Information needed for individual online features is optional in relation to offline play; without it, the relevant online feature does not operate.
These grounds are a proposal for approval, not a completed legal assessment. Conditions and exceptions for children’s identifiers used solely for internal operations/contextual ads must be checked against actual processing. We do not assume that a minor’s agreement authorizes personalized advertising.
8. Recipients and international transfers
The current or prepared providers are Google (AdMob, UMP, Play Games and Saved Games) and Cloudflare (website hosting, Workers and D1). The operator and authorized personnel, if any, can handle support and requests. Other players see only the public competitive information described above. Contact email uses Gmail; emailing transmits your address and message to that service.
These providers’ infrastructure may process data outside Italy or the European Economic Area. A Western Europe D1 location preference does not guarantee exclusively EU processing. Before finalization, the contracting entities, roles, processing agreements and applicable transfer safeguards must be confirmed. A free plan alone does not settle these matters.
9. Retention
Local information remains on the device until removed. Profiles, online Story results, friendships, blocks and reports remain linked to the profile until deletion; no inactivity expiry is implemented.
Cloudflare access sessions expire after 24 hours. Abuse-prevention counters normally expire within about two hours of the start of their window. In staging, hourly maintenance removes expired items and makes competitive attempts, associated rewarded transactions and daily/weekly results eligible for removal after 35 days. Cleanup is bounded per execution and can take subsequent runs: 35 days is not a guarantee of instant erasure. This maintenance is not enabled for a production environment that has not yet been configured.
Data held independently by Google and Cloudflare follows their services and agreements. Before launch, durations must be set for manual backups, support enquiries and any retention for legal obligations or disputes. Active-database deletion does not immediately erase earlier copies; a restoration must honour previous deletion requests.
10. Deletion, rights and contact
When the online profile is active, “Elimina dati Cloudflare” in Settings sends an authenticated deletion request. It removes the application-database profile and related results, sessions, social links and transactions. Local progress, Saved Games and the Google account are separate; manage those through device and Google Play Games settings. Uninstalling the app alone does not request server-profile deletion.
The data deletion request page is available without installing the game. Contact the operator for access, correction, erasure, restriction, objection or portability where applicable. Proportionate ownership verification may be needed; do not send passwords, tokens or Google codes. Consent choices can be changed without affecting processing already lawfully performed. For GDPR requests, statutory response periods apply, normally one month with justified extensions where permitted. You may complain to the Italian Data Protection Authority or the competent authority.
11. The Novaryn Labs website
The static website is hosted on Cloudflare Pages. Its code contains no accounts, collection forms, ads, analytics tools or cookies, and assets are hosted on the same site. Cloudflare processes network data for delivery and security; we do not claim that the provider keeps no metadata. Email links open your email application and do not send messages automatically. External websites have their own notices.
12. Updates and provider information
The approved notice will identify its date and material changes. Additional ad networks or processing require review before activation. This draft is not a statement of worldwide compliance.