Privacy Policy for Bunway

Bunway is published by Demda Studio. The data controller is sole proprietor Dmitry Aleksandrovich Demchenko (OGRNIP 314774611801152, INN 772403264050), Irkutsk, Russia.

You can reach us at [hello@demda.pro](mailto:hello@demda.pro). A postal address is provided on request by email.

Only what we need to keep the game running and to fix levels and balance.

• A random installation ID. The game creates it on first launch. It is not linked to your name, email or phone number, and it is not an advertising identifier (IDFA on iPhone, advertising ID on Android). You can see and copy it in the game: Settings → My data.
• Game events: which level or round you started and finished, how long it took, which helpers you used, which recipes are unlocked, how many times you moved, which daily tasks you finished, whether you claimed the daily reward, whether you tapped Share. We do not receive the image you share. If you turned on usage statistics, the events listed below are added.
• Purchases (iPhone, iPad and Android): a record of what was bought, Premium, a bundle or a crystal pack, with no transaction ID. We need it to restore the purchase, credit what you bought and count sales. Apple or Google handle the payment; we never see your card or store account details. Purchases are restored through the store: on iPhone with the Restore Purchases button, on Android through Google Play.
• Analytics events about offers and the in-game economy (only with your consent to statistics), by category: earning and spending in-game currency (type, amount, balance); quests and streaks; an offer being shown, tapped, dismissed or expiring (which item, step, time left), opening the "Why am I seeing this" screen and choosing "Stop showing offers"; purchase steps (item, which purchase in order, price in local currency, no card details); viewing the league and its result; the game day number; and the age group you chose ("14–17" or "18 and over").
• Age group. On the consent screen you choose "14–17" or "18 and over". The choice is stored on the device; if you allowed statistics, only the group itself is sent in analytics events.
• Technical request data: IP address, game version, operating system type and version. The server needs it to run and to protect itself from failures and abuse. Server request logs (IP address, game version) are kept for up to 30 days.

Your progress and settings are stored on your device. If you sign in, a copy of your progress is also stored on our server (see the section "Sign-in and cloud save").

If you email us, we receive your address and the text of your message. We use them only to reply.

Signing in with Apple or Google is optional. Without it the game works fully and your progress stays on the device. If you sign in, we receive and store the following.

• A sign-in token. The game gets it from Apple or Google and sends it to our server to check that the sign-in is genuine. We store only a hash of your user ID at the provider, an irreversible value. We do not receive or store your email or name.
• Cloud save: a snapshot of your progress (up to 64 KB), its revision number and the time of the last update.
• The device name reported by the system, and a session lease. They are needed for the "one active session per player" rule: when you start playing on a new device, the old one learns that the session has moved and does not overwrite your cloud progress.

We use this data only for cloud save and to protect it from loss. You can delete the account together with the cloud save at any time: Settings → My data (details in the section "Your rights and how to delete your data").

• A mandatory account: you can play without signing in. If you sign in with Apple or Google, we do not receive or store your email or name. We do not ask for a phone number.
• Ads, advertising SDKs or an advertising identifier. The game does not show the App Tracking Transparency prompt. If ads ever appear, we will update this policy first, and we will not show ads to children.
• Location data or access to your contacts.
• Sharing data with third parties for advertising. We do not sell data.
• Crash reports and stack traces: the game has no crash-reporting SDK and we do not collect them. Apple or Google may send us aggregated crash summaries from users who allowed this in their phone settings; they do not contain your installation ID.

Notifications in the game are local: they are created on your device and do not come from our server.

• To make the game work, for example to restore a Premium purchase you already made.
• To keep your progress in the cloud and bring it back on another device, if you signed in.
• To count sales and see which purchases are useful to people.
• To show offers based on days in the game and purchases, which happens on your device.
• To see where players get stuck or leave, and to fix those levels.
• To protect the server from failures and abuse.
• To answer your email.

We do not use the data for advertising or to build your profile on our server.

Legal basis. We receive the installation ID and game events only with your explicit consent (Art. 9 of Federal Law No. 152-FZ), which you give by tapping "Allow" on the "Usage statistics" screen on first launch. By tapping "Allow", you confirm that you are 14 or older. The screen has two equal buttons, "Allow" and "Don't allow". If you tap "Don't allow", the game works the same and no events are sent to the server. You can withdraw consent at any time: Settings → My data → Usage statistics, or by email to [hello@demda.pro](mailto:hello@demda.pro). After that, no new events are sent; events we already have are deleted with the "Delete my data" button. We process technical request data (IP address, game and system version) because the server cannot respond and protect itself without it (performance of the contract and our legitimate interest). We keep the purchase record to restore and credit what you bought (performance of a contract) and to count sales (our legitimate interest). The "Stop showing offers" button turns personal offers off but does not replace withdrawing consent to statistics, which is done separately as described above. You turn sign-in and cloud save on yourself: we process the data for them to provide that service (performance of a contract). If you do not want it, do not sign in.

The game has optional offers: Premium, a starter bundle and themed bundles, crystal packs with a bonus, and a paid "Rescue" after a failed attempt. The game itself decides which offers to show and at what price, on your device, using this information: how many days have passed since installation, how much you have played, your progress, whether you have made purchases and how you reacted to offers (dismissed, declined). We do not send this information to analytics, and on the device it is deleted with the game. The decision is made by a program without a human. So the number of crystals for the same price can differ between players; the offer screen shows the end date and the condition.

The Premium price does not depend on this: it goes down in time since the first launch, the same for everyone (in Russia 299 RUB, 149 RUB, 89 RUB; elsewhere the App Store price in local currency).

An offer shows its end as a date and time and never restarts. If you have not bought anything for a long time, the bonus on packs may grow in steps up to a fixed ceiling; after any purchase it resets.

Next to an offer there is a "Why am I seeing this" link explaining what offers are based on. You can turn personal offers off at any time: Settings → "Stop showing offers". This is not withdrawal of consent to statistics.

If you chose "14–17" or did not answer the age question, the game shows no timers, no growing bonuses and no paid "Rescue". Premium in steps and the regular shop remain.

The difficulty of the game does not depend on purchases or offers.

If you allowed statistics, we receive only the fact that an offer was shown, tapped, dismissed, expired or bought (which item and which step), with no data about other players. Without your consent these events are not sent to the server, and offers work the same.

This game has no ranking and no comparison with other players. It does not use Game Center or Google Play Games and sends nothing to them.

The database with game events and cloud saves is on a server in Russia (Timeweb Cloud). An encrypted backup of the database is stored on a server in the Netherlands (a party to Council of Europe Convention 108). This is a cross-border transfer of data.

Data is sent over an encrypted connection (HTTPS). Access to the database and the backups is restricted.

We keep game events for no longer than 24 months; after that they are deleted automatically. Only daily totals without an identifier remain.

Server request logs (IP address, game version) are kept for up to 30 days.

We keep the cloud save, the hash of the user ID and the device name for 24 months after the last sync, then delete them automatically. Sooner, if you delete the account.

We keep support emails for 24 months after the last message, to answer you and to come back to your request if you write again; then we delete them.

You can ask us to delete your data sooner.

You can ask what data about you we process, ask us to correct, block or delete it, and withdraw your consent. If you are in the EU or UK, you may have additional rights under local law; write to us and we will answer.

How to delete:

1. In the game: Settings → My data → "Delete my data". The game deletes all events of your installation on our server and creates a new ID. If you are offline, it tries again on the next launch.
2. If you signed in: on the same My data screen, delete the account together with the cloud save. We delete the hash of the user ID, the progress snapshot and the device data on our server. Progress on the device itself stays.
3. By email to hello@demda.pro with the subject "Data deletion — Bunway". So that we can find your records, copy the installation ID on the My data screen and paste it into your email; if you signed in, say that the account and the cloud save should be deleted too. Use this if the button did not work.

We will reply within 10 business days. If we need more time, we will tell you why; the term may be extended by up to 5 business days. Backups of the database are kept for 30 days; after that the deleted data disappears from them too.

If you delete the game from your device, local progress and the information about offers are gone. The cloud save stays until you delete it or its retention period ends. What you bought stays on your App Store or Google Play account and is restored through the store (on iPhone, with the Restore Purchases button).

If you believe we have broken the law, you can complain to the Russian data protection authority (Roskomnadzor) or to your local authority.

The privacy policy and the support page open from the game's Settings.

The game is not directed at children. We do not knowingly collect data from users under 14 in Russia, under 13 elsewhere, or under any higher age that applies by law in your country. We receive statistics only if Usage statistics is on; by turning it on, you confirm that you are 14 or older. There are no ads or profiles. We ask about age separately: the consent screen has two equal buttons, "14–17" and "18 and over". If you choose "14–17" or do not answer, the game shows no timers, no growing bonuses and no paid "Rescue". If you find that a child has sent us data, write to [hello@demda.pro](mailto:hello@demda.pro) and we will delete it.

Controller: sole proprietor Dmitry Aleksandrovich Demchenko (OGRNIP 314774611801152, INN 772403264050), Irkutsk, Russia; [hello@demda.pro](mailto:hello@demda.pro). We have not appointed a representative in the EU.

Purposes and legal bases.

1. Usage statistics (installation ID and game events): your consent, Art. 6(1)(a) GDPR. You give it on the first-launch screen and can withdraw it any time in Settings → My data → Usage statistics. The game works the same without it.
2. Technical request data (IP address, game and system version): our legitimate interest in running and protecting the server, Art. 6(1)(f).
3. Purchase record (a mark with no transaction ID): restoring and crediting what you bought is performance of a contract, Art. 6(1)(b); sales statistics are our legitimate interest, Art. 6(1)(f).
4. Offers in the game: they are chosen on your device using information that stays only on it and is not sent to us, so we do not process that information. If you allowed statistics, we receive that an offer was shown, tapped, dismissed, expired or bought (which item and step): the basis is the same consent, Art. 6(1)(a). You can turn personal offers off with the "Stop showing offers" button; consent to statistics is withdrawn separately.
5. Sign-in and cloud save (hash of the user ID, progress snapshot, device name): performance of a contract, Art. 6(1)(b); you turn it on yourself by signing in.
6. Support emails: our legitimate interest in answering you, Art. 6(1)(f).

Retention: as in the section "How long we keep the data".

Your rights: access, correction, deletion, restriction, portability, objection, and withdrawal of consent. Use the in-app button or write to [hello@demda.pro](mailto:hello@demda.pro). You may also complain to your local data protection authority.

Where the data goes. Servers are in Russia (Timeweb Cloud); an encrypted backup is in the Netherlands. The European Commission has not recognized Russia as providing an adequate level of protection. We collect the data directly from you, and you can decline the statistics on the first launch. We do not sell data, do not use it for advertising The only thing the game chooses automatically, on your device, is in-game offers; this has no legal effect on you, and you can turn it off at any time.

Data is processed in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" and, for users in the EEA and the UK, with the GDPR provisions described above.

We publish the new version on this page and change the date at the top. If the change is significant, for example new kinds of data, we will say so in the release notes of the game update.