Privacy policy
Last updated:
This policy explains what NOVUS LLC (“we”, “us”) does with personal data when you use the Cave Smash mobile game and the website cavesmash.com.
Who is responsible
The data controller is:
NOVUS LLC 8206 Louisiana Blvd NE Ste A, Albuquerque, NM 87113-1738, United States Email: contact@cavesmash.com
Write to that address for anything in this policy, including requests to use your rights.
The short version
- The website has no advertising, no analytics and no tracking cookies.
- The game needs an account (an email address) and stores your game progress on our servers.
- The game shows ads only when you choose to watch one for a reward. Those ads are served by Google AdMob, which may use your device’s advertising identifier if you allow it.
- Payments are handled by Apple or Google. We never see your card number.
- You can delete your account and its data from inside the game at any time.
Data we collect on the website
| Data | When | Why |
|---|---|---|
| Email address, the language of the page, the page you signed up from, date and time, a confirmation token | When you pre-register | To send you one message when Cave Smash is released |
| IP address, browser type, requested page, date and time | On every visit, in the server logs of our host | To deliver the pages, keep the site secure and stop abuse |
The website does not set cookies for tracking or advertising and loads no third-party analytics, pixels or fonts. The pre-registration form sends your email address to our own database and to nobody else. A hidden field protects the form against automated sign-ups; it stores nothing about you.
Data we collect in the game
| Data | Why |
|---|---|
| Account: email address, and the identifier given by Apple or Google if you sign in with them | To create your account and let you sign in |
| Profile: tribe name, emblem and avatar chosen from presets; names and looks of your cavemen | To run the game; these are visible to other players |
| Game data: cavemen, levels, items, fights and their results, trophies, tournament entries, currencies, rewards claimed, referral code | To run the game, leaderboards and tournaments |
| Country (two letters, derived from your network address) and app language | To apply rules that differ by country and to show the right language |
| Purchases: product bought, store transaction identifier, date, whether it was a test purchase | To deliver what you bought, handle refunds and keep accounts |
| Rewarded ads: the placement, the time, and the ad network’s verification identifier for each ad you chose to watch | To give you the reward once and prevent fraud |
| Notification token, if you turn notifications on | To tell you when a tournament has been played or a reward is ready |
| Diagnostics: error message, screen, app version, device model and operating system version when the app crashes or fails | To find and fix bugs |
We do not collect your real name, phone number, contacts, photos, microphone, camera or precise location. The game has no chat.
Advertising data collected by Google
When you choose to watch a rewarded ad, the ad is provided by Google AdMob. To serve and measure ads, Google may collect your device’s advertising identifier (IDFA on iOS, advertising ID on Android), IP address, device information and your interaction with the ad.
- In the European Economic Area, the United Kingdom and Switzerland, the game shows Google’s consent form before the first ad. You choose whether ads may be personalised, and you can change that choice later in the game’s settings.
- On iPhone and iPad, the system asks whether the app may track you (App Tracking Transparency) before any advertising identifier is used. If you refuse, the identifier is not available to the app.
- You can also reset or disable the advertising identifier in your device settings.
Google explains its use of data at policies.google.com/technologies/partner-sites.
If you never watch an ad, no ad is loaded.
What other players can see
Your tribe name, emblem and avatar, and the names, looks, levels, trophies and fights of your cavemen appear in opponent lists, replays, leaderboards and tournament brackets. Your email address is never shown to anyone.
Why we are allowed to use this data (legal bases)
Where the GDPR or UK GDPR applies, we rely on:
- Performance of a contract with you: your account, game data, purchases, and support.
- Your consent: pre-registration emails, personalised advertising, the advertising identifier, and notifications. You can withdraw consent at any time.
- Our legitimate interests: keeping the game and site secure, preventing cheating and fraud, verifying ad rewards, and fixing errors.
- Legal obligations: keeping purchase records for tax and accounting.
Who receives data
We use service providers that process data on our behalf:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and server functions of the game; pre-registration list | Singapore and United States |
| Cloudflare | Hosting of the website and its form | Worldwide network |
| Apple (App Store) and Google (Google Play) | Payments and app distribution | United States and worldwide |
| RevenueCat | Confirming purchases made through the stores | United States |
| Google AdMob | Rewarded ads and their consent form | United States and worldwide |
| Sentry | Error and crash reports | United States |
| Expo | App updates and push notification delivery | United States |
We do not sell personal data. We do not share it with anyone else, except when the law requires it or to protect our rights, our players or the public.
Transfers outside your country
We are based in the United States and our providers operate in the United States, Singapore and other countries. When data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the transfer relies on the European Commission’s standard contractual clauses or an equivalent mechanism offered by the provider.
How long we keep data
| Data | Kept for |
|---|---|
| Pre-registration email | Until 90 days after the launch message has been sent, or until you ask us to remove it |
| Account and game data | As long as your account exists |
| Fight replays (the move-by-move record) | 3 days; the result and rewards stay in your history |
| Purchase records | As long as tax and accounting rules require, without your email address once the account is deleted |
| Error reports | Up to 90 days |
| Website server logs | According to our host’s standard retention, a few days at most for request logs |
Deleting your account
In the game: Settings → Delete my account. Deletion is immediate and permanent: your email address, tribe, cavemen, items, currencies and history are erased. Cavemen that other players have already fought remain only as anonymous, renamed opponents with no link to you. Full instructions, including how to ask by email, are on the account deletion page.
Your rights
Depending on where you live, you have the right to:
- know whether we hold data about you and get a copy of it;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to certain uses;
- receive your data in a portable format;
- withdraw a consent you gave;
- complain to your data protection authority.
California residents have the right to know, delete and correct their personal information and not to be discriminated against for using these rights. We do not sell personal information. If personalised advertising through Google AdMob counts as “sharing” under California law, you can opt out at any time by refusing tracking on your device or changing your ad choices in the game’s settings.
To use any of these rights, write to contact@cavesmash.com from the email address of your account. We answer within one month. We may ask for information to confirm that the request comes from you.
Children
Cave Smash is intended for players aged 13 and over and is not directed at children. If the minimum age to consent to data processing is higher in your country (up to 16 in parts of Europe), that age applies. We do not knowingly collect data from children below it. If you believe a child has given us data, write to us and we will delete it.
Security
Data travels encrypted between the app, the website and our servers. Access to the database is restricted: players can only read their own rows, and every change to game state is made by our server, not by the app. No system is perfectly secure; if a breach affects you, we will inform you and the authorities as the law requires.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change is significant, we also announce it in the game or by email.
Contact
NOVUS LLC, 8206 Louisiana Blvd NE Ste A, Albuquerque, NM 87113-1738, United States contact@cavesmash.com