Effective 1 October 2026

Privacy Policy

This policy explains what happens to data when you play Bus Escape: Arrow Puzzle (“the game”) on iPhone, iPad or Android, and when you visit this website. The game is published by Barbarda (“we”, “us”), which is responsible for this data (see Contact). Questions and requests: support@barbarda.com. Türkçe metin aşağıda.

• What we do not collect
• On your device
• Statistics and crash reports
• Purchases
• Ads
• This website
• Legal bases
• Retention
• Your choices and rights
• Children
• Contact

What the game does not collect

There is no sign-in, no player profile on our servers, no chat and no friends list. We do not set a user ID in any analytics or crash-reporting tool, we do not sell personal data, and the current version does not use your device’s advertising identifier (IDFA on iOS, advertising ID on Android) or ask for tracking permission.

Data stored on your device

The game saves your level progress, the state of the level you are playing, in-game balances (such as coins, lives and boosters), your settings (sound, music, haptics and language) and, where the game asks for them, your privacy choices. In versions with purchases it also remembers which purchases were already delivered. This data stays in the game’s storage on your device and is not sent to us. It may be included in your device’s own backups (for example iCloud or Google backups), which you control. Deleting the game removes it; we cannot restore it for you.

Usage statistics, crash reports and remote settings (Google Firebase)

The game uses Google Firebase, provided by Google LLC and, in the EEA and UK, Google Ireland Limited:

• Firebase Analytics receives the events Firebase records automatically, such as the first launch, sessions and time spent in the app, app updates, the app version, device model, operating system version, language, and a general location (country, region, city) that Google derives from your IP address, linked to a random app-instance identifier. The current version sends no gameplay events of its own and sets no user properties; if a later version adds simple gameplay events (such as which level was started or completed, with the level number, moves and time taken), we will update this policy first. Collection of the iOS identifier for vendors (IDFV) is switched off, and Firebase’s advertising features (ad storage, ad user data and ad personalization) are switched off, so these statistics are not used for advertising.
• Firebase Crashlytics receives a report when the game crashes or hits a serious error: the technical stack trace, device model, operating system and app version, device state at the time (such as free memory and orientation) and a random Crashlytics installation identifier.
• Firebase Remote Config lets us change game settings, including safety switches that can pause a feature, without an update. To do this it receives a Firebase installation identifier, the Analytics app-instance identifier and any Analytics user properties (the game sets none of its own), and basic app and device information (app version, platform, language, country and time zone).
• Firebase App Check (iPhone and iPad) uses Apple’s App Attest service to help confirm that requests to our Firebase project come from a genuine copy of the game. Because it protects our Firebase project rather than measuring how you play, it is set up for every player, in every region and whatever you have chosen: it exchanges short-lived tokens with Apple and Firebase, sends no gameplay or analytics data and does not identify you.

When this happens. The game decides this from your device’s region setting (on iPhone and iPad: Settings › General › Language & Region › Region), not from where you actually are; it does not look up your location. If that setting is a country in the European Economic Area, the United Kingdom or Switzerland, or cannot be read, the game sends no analytics, crash reports or Remote Config requests until you have agreed. The current version does not ask, so with such a region setting Analytics, Crashlytics and Remote Config stay off. With any other region setting, including Türkiye, they are on by default. In versions that ask, an explicit “no”, or telling the game you are a child, switches them off whatever your region setting.

Platforms. Today Firebase is active on iPhone and iPad. When the Android version launches, it will follow the same rules.

Retention. Google Analytics keeps event-level data for at most 14 months; Crashlytics keeps crash reports for 90 days. Firebase keeps the installation identifiers that Remote Config uses until we ask Firebase to delete them; Google then removes them within 180 days. Aggregated reports without identifiers may be kept longer. See Privacy and Security in Firebase and the Google Privacy Policy.

Game engine. The game is built with the Unity engine, which may send Unity Technologies anonymous technical statistics about the device’s hardware (such as model, operating system, graphics chip and screen size) to help Unity support devices. See the Unity Game Player and App User Privacy Policy.

Optional purchases (only in versions that offer them)

The current version offers no purchases. If a later version does, they will be processed by Apple (App Store) or Google (Google Play) under their own terms; Barbarda never receives your payment card details. To deliver and restore purchases, the game uses RevenueCat, Inc., which receives the store’s purchase records (product, price, currency, store country, transaction identifiers and dates) under a random, anonymous app user ID created by RevenueCat. Automatic collection of device identifiers by RevenueCat is switched off. RevenueCat keeps purchase history for as long as needed to provide restores and to meet accounting and legal duties. See RevenueCat’s privacy policy.

Advertising (only in versions that show ads)

The current version shows no ads, does not start the advertising SDK and, on iPhone and iPad, never shows the App Tracking Transparency prompt. If a later version shows ads, it will use Unity LevelPlay (Unity Technologies and its ironSource platform) together with the ad networks connected through it. Before the first ad, the game will ask for your choices: whether you are an adult or a child, and whether you allow personalized ads. If you choose non-personalized ads, or say you are a child, ads are shown without personalization and the child answer is passed to the ad providers as a child-directed (COPPA) request. Only if you allow personalized ads on iPhone or iPad will iOS ask whether the game may track you (App Tracking Transparency); the IDFA is used only if you tap “Allow”. On Android, the advertising ID is only requested in versions with ads. Ad providers may process device and app information, an IP-derived approximate location, ad requests, impressions, clicks and rewards for delivering, measuring and protecting ads. You can change your choices in the game’s settings, and tracking permission in iOS Settings › Privacy & Security › Tracking. See the Unity privacy policy.

This website

This website (busescape.barbarda.com) is hosted by Cloudflare, Inc. on Cloudflare Pages. When you open a page, your browser sends the usual request data, such as your IP address, browser and device type, the page requested and the page you came from. Cloudflare uses this data to deliver the site and protect it from abuse, and processes it on our behalf as described in the Cloudflare Privacy Policy. We do not receive individual visitor logs; Cloudflare shows us only totals, such as the number of requests per page and country. The site sets no cookies, stores nothing in your browser and loads no analytics, advertising or other third-party scripts; its fonts and images come from this site itself. Short links such as /ig or /ad/… only add the name of the link (for example “instagram”) to the App Store or Google Play address, so that we can see which posts bring visitors; they do not identify you. If you email us, we receive what you write and your email address.

Legal bases and international transfers

Under the GDPR and UK GDPR we rely on your consent for analytics, crash reports and Remote Config where your device’s region setting is in the EEA, UK or Switzerland, and for personalized ads; on contract to deliver purchases; and on legitimate interests for keeping the game secure and stable (App Check), for running this website and, with other region settings, for usage statistics and crash reports that carry no advertising identifier.

Under Türkiye’s Personal Data Protection Law No. 6698 (KVKK), the data described above is collected by automated means through the Firebase software built into the game (and, in versions that offer them, the purchase and advertising software) and through this website. The current version does not ask players in Türkiye for consent: usage statistics, crash reports and Remote Config are processed because this is necessary for our legitimate interest in keeping the game stable and working well (Article 5(2)(f)), as are App Check and this website; purchases, in versions that offer them, because this is necessary to perform our contract with you (Article 5(2)(c)); and personalized ads, in versions that show them, only with your explicit consent.

Google, Cloudflare, Unity and, in versions that use them, RevenueCat and the ad networks connected through Unity LevelPlay may process data in the United States and other countries. Transfers from the EEA, UK and Switzerland rely on an adequacy decision where one applies, otherwise on the providers’ standard contractual clauses. Personal data from players in Türkiye is also transferred abroad to these providers, for the purposes described in this policy.

Retention

On-device data stays until you delete the game. Firebase data follows the periods above: analytics events and crash reports are deleted when their period ends, while installation identifiers stay until we delete them. Because the game has no account and sends no user ID, we cannot match analytics or crash records to a person. Emails you send us are kept for as long as needed to answer you and then deleted, normally within 24 months.

Your choices and rights

• Delete the game to erase all on-device data and reset its identifiers. More on the Delete data page.
• On iPhone and iPad you can turn off tracking for all apps in Settings › Privacy & Security › Tracking. On Android you can delete or reset your advertising ID in Settings › Privacy › Ads (or Google › Ads).
• The current version does not yet have an in-game switch for usage statistics and crash reports. Until it does, the only way to stop them on your device is to stop playing and delete the game. You can still object by email; because the game has no account we may not be able to find records about you, and we will tell you what we can do.
• Depending on where you live, you may have the right to access, correct, delete, restrict or object to the use of your data, to data portability and to withdraw consent. Email support@barbarda.com; we answer within 30 days. Because we hold no account data, we may not be able to find records about you. You can also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority, KVKK).

Children

Bus Escape is made for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children. The current version does not ask your age; it collects no contact details from anyone and shows no ads. If you believe a child has sent us personal information, for example by email, contact us and we will delete it.

Security

Data sent by the game travels over encrypted connections (HTTPS). Our providers protect the data they store under their own security programmes.

Changes

We update this policy when the game changes, for example before ads or purchases are switched on. The date at the top shows the latest version; for significant changes we will also tell you in the app’s update notes.

Who is responsible and how to contact us

The data controller for the game and this website is Barbarda, the publisher of Bus Escape: Arrow Puzzle. Email: support@barbarda.com. Send any privacy question or request to this address, including requests under the GDPR or Article 11 of KVKK.