Privacy Policy

This policy explains what personal information is collected when you play Glimmerhop on Android or iOS, when you visit candlewren.com, and when you join our mailing list or write to us. It also explains your choices and your rights. We have tried to keep it short and plain. If anything is unclear, email us at support@candlewren.com.

In short

• Glimmerhop has no accounts, no login, no chat and no user-generated content. Your progress is saved on your device only. We never see it.
• The game sends us anonymous play statistics: which levels you start, finish or leave and how long they take, under a random code that is not linked to you (section 4.6). We use them only to see where players get stuck, and you can turn them off in the game’s Options.
• When you buy something in the game, Google Play or Apple handles the payment. We never see your card or bank details.
• Glimmerhop offers optional rewarded video ads through Google AdMob. Ads are non-personalised unless you choose otherwise in Google’s consent form, which is shown only where the law requires a choice (the UK, the EEA and Switzerland). We also limit ads to content Google rates as suitable for teens. Google still receives some device data to show ads, count them and prevent fraud (section 4.3).
• On iPhone and iPad, Glimmerhop does not ask to track you, so your device’s advertising identifier (IDFA) is not available to us or to Google.
• On the website, we collect your email address only if you sign up for updates. The website sets no cookies of its own.
• We do not sell your personal information and we do not build profiles of players.
• Glimmerhop is meant for players aged 13 and over. It is not intended for children under 13 (section 10).

1. Who we are

Glimmerhop and candlewren.com are run by Timm Roark Garde, trading as Candlewren Games. Candlewren Games is an unregistered trade name, not a company: the business is one individual. In this policy “we”, “us” and “our” mean Timm Roark Garde. On the App Store the seller is shown as Timm Roark Garde.

We are the responsible party for your personal information under South Africa’s Protection of Personal Information Act, 2013 (“POPIA”), and the controller under the UK GDPR and the EU GDPR, except where we say that another company decides how it uses the information itself.

• Address: 68 Symmonds Lane, Howick, 3290, KwaZulu-Natal, South Africa
• Email: support@candlewren.com
• Information Officer (POPIA and PAIA): Timm Roark Garde, at the address and email above.

We have not appointed a representative in the EU or the UK; please send any request to our Information Officer at support@candlewren.com.

2. What this policy covers

• The Glimmerhop app for Android and iOS (the “game”).
• The website candlewren.com, including the signup form (the “website”).
• Emails you send us and emails we send you.

It does not cover Google Play, the App Store, Google AdMob or other companies’ services. Their own privacy policies apply to the information they collect for their own purposes; we link to them below.

3. What we do not collect

We do not ask for, and the game does not collect, your name, email address, phone number, postal address, age or date of birth, contacts, photos, microphone, camera, precise location or payment card details. There is no account to create. The game does not let you talk to other players or publish anything.

4. The game

4.1 Save data on your device

Your progress, settings, cosmetics, Glow balance and other game state are saved in the game’s private storage on your device. This data is not sent to us. We cannot see it, recover it, move it or delete it for you.

• Android backup. Glimmerhop allows Android’s automatic app-data backup. If backup is turned on for your Google account, Android may copy the game’s save file to your Google account’s backup storage and restore it when you reinstall the game on a device signed in to the same account. This backup is run by Google under your agreement with Google; we do not receive or have access to it. You can turn it off in your device’s backup settings.
• iPhone and iPad. Your save file is included in your device’s own backups (iCloud Backup or a backup to your computer), depending on your device settings. These backups are handled under Apple’s privacy policy and your agreement with Apple; we never receive them or have access to them.
• Deleting it. Uninstalling the game deletes the save data on that device. A copy may remain in a device or cloud backup until you delete that backup.

4.2 In-app purchases

You can buy Glow (in-game currency) packs, the Starter and Founders packs and cosmetic sets. These purchases are made through Google Play Billing (Android) or Apple In-App Purchase (iOS).

• Google or Apple takes the payment under your account agreement with them and decides for itself how it uses the payment information (it is an independent responsible party and controller). We never receive your card details, billing address or account password.
• To deliver and restore what you bought, the game receives from the store, on your device, the product identifier, a purchase token or transaction identifier, and the purchase state. The game uses these on the device to unlock your items. No purchase receipt or token is sent to any server of ours: purchases are verified on your device through Google Play or the App Store.
• Google and Apple give us sales reports and, for some orders, an order or transaction number, the product, the price, the currency, the country or region, the date and refund status. These reports do not include your name or email address. We use them for accounting, tax, refunds and fraud prevention, and to answer you if you contact us about a purchase.

Google’s privacy policy: https://policies.google.com/privacy\ Apple’s privacy policy: https://www.apple.com/legal/privacy/

4.3 Ads (Google AdMob)

Glimmerhop offers optional rewarded video ads: you choose to watch an ad in return for an in-game reward. Ads are provided by Google AdMob, using the Google Mobile Ads SDK built into the game. The game does not show ads you have not chosen to watch.

How we have set ads up.

• Non-personalised by default, for everyone. The game asks Google for non-personalised ads unless you have accepted personalised ads yourself in Google’s consent form. That form is shown only in the UK, the EEA and Switzerland. Everywhere else the game never asks, and every ad request is for non-personalised ads.
• Teen-rated ads only. We tell Google to show only ads rated as suitable for teens or younger (Google’s “T” ad content rating or lower).
• No profiling by us. We do not build profiles of players, we do not receive information about individual ad views, and we do not combine ad data with anything else.

What Google collects through the SDK. Even for non-personalised ads, Google’s data disclosure for the Google Mobile Ads SDK says the SDK automatically collects and shares with Google:

• IP address, which Google may use to estimate your general (not precise) location;
• Device identifiers: on Android, the Android advertising ID and the app set ID; on iOS, an identifier that is limited to apps from the same developer (the IDFV), and not the IDFA, because the game does not ask for tracking permission;
• Ad and product interaction: for example app launches, taps, ad views and video views;
• Diagnostic information: crash logs and performance data about the game and the SDK, such as launch time, hang rate and energy use.

For non-personalised ads, Google says it uses this information to choose ads from context (such as the app and your general location), to limit how often you see an ad, to count and report ad views in aggregate, and to detect and prevent fraud and abuse, not to target ads based on your interests. If you accept personalised ads in the consent form, Google may also use it to show ads based on your interests. Google says this information is encrypted in transit.

Who decides how it is used. Google acts as an independent responsible party and controller for the personal information it collects through AdMob, under the Google Ads Controller-Controller Data Protection Terms. We receive only aggregated reports (for example, numbers of ads shown and earnings by country); these do not identify you.

Your choices.

• Changing your choice. In the game, open the Shop and tap Ad privacy choices. The button appears in regions where Google’s consent or opt-out message applies (the UK, the EEA, Switzerland and US states with privacy laws). Elsewhere there is nothing to change: ads are always non-personalised.
• Device settings. On Android you can delete or reset your advertising ID (Settings → Privacy → Ads, or Settings → Google → Ads, depending on the device). On iOS, the game never asks to track you, and you can stop all apps from asking under Settings → Privacy & Security → Tracking.
• Google’s own controls. https://myadcenter.google.com/
• Not watching ads. Ads are always optional. Refusing consent or opting out never removes a game feature or a reward you would otherwise get.

How Google uses information from apps that use its services:
https://policies.google.com/technologies/partner-sites\ Google’s privacy policy: https://policies.google.com/privacy\ Google’s advertising page: https://policies.google.com/technologies/ads

4.4 Gamepads

If you connect a game controller, the game reads its button and stick input on the device to let you play. This input is not stored or sent anywhere.

4.5 Crash reports from Google and Apple

If you have chosen in your device settings to share diagnostics with Google or Apple, they may give us crash reports and statistics about the game (for example the device model, operating system version and the point in the code where a crash happened). These reports do not include your name or contact details. We use them only to fix bugs. You control this sharing in your device settings.

4.6 Play statistics

To learn where players get stuck, the game sends us a small record of how it is played. This is the only information the game itself sends to us.

What is sent. Each record carries:

• a random code that the game makes the first time it runs (the install code), and a second random code for each launch. They are random numbers, not your name, email address, phone number, account or advertising ID. We cannot work out who a code belongs to, and the game never shows it to you.
• the platform (Android or iOS) and the version of the game;
• play events: when a level or boss fight starts and how it ends (cleared, failed or left), how long it took, stars earned and lives lost, which ability was used, visits to the home screen and what was done there, which story scenes have played, how many days since you last played, whether the shop was opened, whether a rewarded ad was watched, and whether an in-game purchase was started or completed (the product’s name, never the price paid or any payment details).

It does not include your save file, your name, email address, contacts, precise location, device model or any identifier from your device.

Where it goes. The records travel over an encrypted connection to a server we run with Cloudflare and are stored in a database in Western Europe. Cloudflare handles the connection as our operator (processor); the server does not record your IP address with the events, and no one else receives them.

Why. To see which levels players stop at, which boards are too hard and whether people come back, so that we can improve the game (legitimate interests, section 7). We do not use these statistics for advertising, we do not share or sell them, and we do not combine them with anything that could identify you.

Your choices. You can turn these statistics off at any time in the game under Options → Play statistics. The game then sends nothing, and anything it had not yet sent is discarded. Uninstalling the game also ends the collection, and if you reinstall, the game makes a new code, so old records cannot be joined to new ones. Because nothing in the records identifies you, we cannot find or delete one particular player’s records on request; we delete all records on the schedule in section 9.

5. The website

5.1 Visiting candlewren.com

The website is hosted and delivered by Cloudflare, Inc. When you visit, Cloudflare processes technical information needed to deliver and protect the site, such as your IP address, browser type, the pages requested and the time. We use this only to run and secure the website.

Links from our social media profiles. Addresses that begin with candlewren.com/go/ send you on to the App Store, Google Play or the game’s page. Each time one is used we add one to a count for that link, the hour, the country (which Cloudflare works out from your IP address; the address itself is not kept), the kind of device and where it led. We keep no IP address, browser details, cookie or identifier with the count, so it cannot be tied to a person.

Apart from these counts, we do not run any analytics on the website. If that changes, this policy will say what is measured before it starts.

Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

5.2 The mailing list

The mailing list is for people aged 18 and over. If you join it using the form on candlewren.com, we collect:

• your email address (required);
• any optional choices you tick, such as Android, iOS or beta testing;
• a tag showing that you signed up on the website, and the date and time you signed up and confirmed.

Giving us your email address is voluntary; without it we cannot send you updates. The list is run by Kit (Kit.com, formerly ConvertKit), which processes it for us as our operator (processor). Kit also records technical information about the signup (such as the IP address used to confirm it). Emails sent through Kit include a small tracking image and rewritten links, so Kit can tell us whether an email was opened and which links were clicked. We use this only to see what readers find useful. Most mail apps let you block remote images, which stops the open tracking.

We use your email address to send you a confirmation email (double opt-in), news about Glimmerhop and future Candlewren games and, if you asked, beta test invitations. Because these emails are direct marketing, we send them only with the consent you give by confirming your signup. We do not use your address for anything else and never give it to other companies for their marketing.

You can unsubscribe at any time with the link at the bottom of every email, or by emailing us.

Kit’s privacy policy: https://kit.com/privacy

5.3 Cookies

The website sets no cookies of its own and does not use advertising or social-media cookies. Cloudflare may set a strictly necessary security cookie (for example to tell people from bots) if its protection features are triggered; that cookie is not used to track you. Because the website sets no cookies of its own and uses no analytics or advertising cookies, no cookie banner is shown.

The game itself does not use browser cookies. The Google Mobile Ads SDK uses identifiers and storage on your device in a similar way to cookies; this is covered in section 4.3.

6. When you email us

If you email support@candlewren.com, we receive your email address, your name if you include it, and whatever you write, including any screenshots or purchase details you choose to send. We use this only to answer you and to keep a record of the request.

Mail to candlewren.com addresses is received by Cloudflare Email Routing and forwarded to our mailbox at Google (Gmail); our replies are sent through Gmail. Cloudflare and Google process these emails for us.

Please do not send us passwords or card numbers. We will never ask for them.

7. Why we use your information (lawful grounds)

What	Why	POPIA (section 11)	UK GDPR / EU GDPR (Article 6)
Delivering and restoring purchases; sales reports	To give you what you bought and keep the accounts	Performance of a contract; compliance with a legal obligation (tax records)	Contract (6(1)(b)); legal obligation (6(1)(c))
Personalised ads (UK, EEA and Switzerland only, and only if you accept)	To fund the game	Your consent	Consent (6(1)(a)), given in Google’s consent form; you can withdraw it in Ad privacy choices
Non-personalised ads, frequency capping, fraud prevention, ad measurement	To fund the game and keep ads honest	Legitimate interests	Legitimate interests (6(1)(f)) or consent, as set out in Google’s consent form
Crash reports from Google and Apple	To fix bugs	Legitimate interests	Legitimate interests
Play statistics (section 4.6)	To see where players get stuck and improve the game	Legitimate interests	Legitimate interests (6(1)(f))
Website delivery and security (Cloudflare)	To run the site safely	Legitimate interests	Legitimate interests
Cookieless website statistics	To know which pages help people	Legitimate interests	Legitimate interests
Mailing list (Kit)	To send you what you asked for	Your consent to direct marketing (section 69), confirmed by double opt-in	Consent (6(1)(a)), confirmed by double opt-in
Answering your emails	To help you	Legitimate interests, or performance of a contract if it is about a purchase	Legitimate interests, or steps towards a contract

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can object at any time (section 11).

8. Who receives your information

We do not sell personal information, and we share it only as described here:

• Google (Google Play, AdMob, Android backup) and Apple (App Store, iOS backup): independent responsible parties and controllers for their own services, as described in section 4.
• Kit: our operator (processor) for the mailing list.
• Cloudflare: our operator for website hosting, website statistics, email routing and the play-statistics server and database (section 4.6).
• Google (Gmail): our operator for the support mailbox.
• Professional advisers and authorities: for example an accountant or the South African Revenue Service, where needed for our legal obligations, or where the law requires us to disclose information.
• A buyer of the game or studio: if Glimmerhop or Candlewren Games is ever sold or transferred, the information we hold would pass to the new owner, who would be bound by this policy or would tell you about any change.

9. How long we keep information

Information	How long
Save data on your device	Until you uninstall the game or clear its data (backups: until you delete them)
Play statistics (section 4.6)	12 months from the day each record is received, then deleted; totals with no codes in them may be kept longer
Purchase and sales records from Google and Apple	5 years from the date the tax return they support is submitted, as South African tax law requires (Tax Administration Act, 2011, section 29); longer only while an audit or dispute is open
Mailing-list record	Until you unsubscribe, then deleted within 30 days, except a minimal record that you unsubscribed so that we do not email you again
Unconfirmed signups (double opt-in not completed)	Deleted after 30 days
Support emails	24 months after the conversation ends, unless needed for a purchase dispute or legal claim
Website logs and statistics	As set by Cloudflare; we see only aggregates
Counts of link use (section 5.1)	Kept as totals; they hold nothing that identifies anyone
Information Google collects through AdMob	As set out in Google’s privacy policy

10. Children and teenagers

Glimmerhop is a general-audience game for players aged 13 and over. It is not intended for children under 13 and is not designed for or directed at them. We do not knowingly collect personal information from children under 13. The game does not ask for anyone’s age, name or contact details (section 3), so we have set it up to protect younger players without needing to know how old you are:

• Ads are non-personalised unless you accept personalised ads yourself in Google’s consent form (shown only in the UK, the EEA and Switzerland). Everywhere else, every ad is non-personalised.
• Ads are limited to content Google rates as suitable for teens (“T”) or younger.
• We do not build profiles of players or use ad data ourselves.
• Watching ads and buying things are always optional. Purchases go through Google Play or the App Store, where parents and guardians can require approval for purchases (Google Play’s purchase approval and parental controls; Apple’s Family Sharing and Ask to Buy).

The store age ratings (for example 9+ on the App Store) describe the game’s content. They do not change who the game is meant for.

Under 18. South African law (POPIA) treats everyone under 18 as a child, and processing a child’s personal information needs the consent of a parent or guardian unless an exception applies. If you are under 18, please play with your parent’s or guardian’s knowledge, and ask them before you buy anything, watch ads for rewards or write to us. The mailing list is for adults aged 18 and over. A parent or guardian is welcome to contact us on a child’s behalf.

If you believe a child under 13, or a child under 18 without a parent’s or guardian’s consent, has given us personal information (for example by signing up to the mailing list or emailing us), contact us and we will delete it, unless we must keep it to resolve a purchase or a legal claim.

11. Your rights

11.1 Everyone

Wherever you live, you can ask us to tell you what personal information we hold about you, give you a copy, correct it or delete it, and you can object to our using it or withdraw your consent. Email support@candlewren.com. We reply within 30 days and do not charge for a simple request. We may ask for information to confirm the request is yours, such as the email address you signed up with or a purchase’s order number.

• Game data: we do not hold your save data, so we cannot access or delete it for you. Uninstalling the game deletes it from that device; delete any device or cloud backup to remove copies.
• Ad data: use Shop → Ad privacy choices in the game where it appears, your device’s ad settings, and https://myadcenter.google.com/. For information Google holds as a controller, you can also contact Google directly: https://policies.google.com/privacy
• Mailing list: use the unsubscribe link in any email, or email us to have your record deleted.

11.2 South Africa (POPIA)

Under POPIA you have the right to:

• be told that your personal information is being collected, and by whom;
• access it: ask whether we hold personal information about you and for a copy of it (section 23);
• ask us to correct, delete or destroy it if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or if we are no longer allowed to keep it (section 24);
• object to our processing it on the ground of legitimate interests, and object at any time to direct marketing (section 11(3));
• not be subject to decisions based only on automated processing that significantly affect you (we make none) (section 71);
• complain to the Information Regulator, and go to court (section 99).

An email to support@candlewren.com is enough. If you prefer the formal route, you may use the forms prescribed in the POPIA Regulations (Form 1 to object, Form 2 to ask for correction or deletion), and you may ask for access to records under the Promotion of Access to Information Act, 2000 (“PAIA”) using the prescribed request form. Our PAIA manual (https://candlewren.com/paia/) explains how to make a request, what records we hold and what fees apply; requests go to the Information Officer at support@candlewren.com. Formal PAIA requests may be subject to the fees PAIA prescribes; we will tell you before any fee is due.

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Phone: 010 023 5200
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
Website: https://inforegulator.org.za/

11.3 UK, EEA and Switzerland

Under the UK GDPR and the EU GDPR you also have the right to restrict our use of your information, and to data portability for information you gave us on the basis of consent or a contract. We reply within one month.

Complaints. If you live in the UK, you can complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/. If you live in the EEA, you can complain to the data protection authority in your own country: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In Switzerland, to the Federal Data Protection and Information Commissioner: https://www.edoeb.admin.ch/. We would be grateful for the chance to sort it out first.

12. US state privacy rights

This section applies to residents of US states with comprehensive privacy laws, such as California (CCPA as amended by the CPRA), Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others. Many of these laws apply only to businesses above revenue or volume thresholds; we give these rights to everyone in those states regardless.

Categories of personal information collected in the last 12 months, and where they come from:

Category	Examples	Source	Disclosed to
Identifiers	Android advertising ID, app set ID, iOS IDFV, IP address; the game’s random install code (section 4.6); email address (mailing list and support only)	Your device (through the Google Mobile Ads SDK and the game); you	Google (ads); Kit, Cloudflare and Google (Gmail) as service providers
Commercial information	Products bought, order or transaction numbers	Google Play, Apple	Kept by us; Google and Apple already hold it
Internet or other electronic activity	Ad views, taps and video views; app launches; levels played and other play events (section 4.6); website pages viewed (aggregated)	Your device; your browser	Google (ads); Cloudflare (service provider)
Approximate geolocation	Country or region inferred from IP address (not precise location)	Your device	Google (ads)

We do not collect sensitive personal information as defined by these laws, and we do not draw inferences about you.

“Sale”, “sharing” and targeted advertising. We do not sell personal information for money. In the US the game requests only non-personalised ads, so we do not use AdMob for targeted advertising or cross-context behavioural advertising. Google still receives the identifiers and ad interactions above to deliver and count ads and to prevent fraud. Because some state laws define “sale” and “sharing” very broadly, we honour opt-out requests anyway:

• In the game, open Shop → Ad privacy choices and choose to opt out; this also tells Google to restrict how it processes your information.
• On Android, delete your advertising ID in your device settings. On iOS, the game never accesses the IDFA.
• Email support@candlewren.com with the subject “Do not sell or share”.
• The website does not sell or share personal information, so a Global Privacy Control signal sent to it has nothing to switch off; the game does not receive browser signals, so use the in-game choice.

We do not knowingly sell or share the personal information of anyone under 16.

Your other rights: to know and access the personal information we hold about you, to correct it, to delete it, and not to be treated differently for using your rights (you will never lose a game feature or reward for opting out). You may use an authorised agent; we may ask the agent for proof of authority and ask you to confirm your identity. We will respond within 45 days. If we decline your request, you may appeal by replying to our answer with the word “Appeal”; we will answer the appeal within 60 days, and if you are not satisfied you may contact your state attorney general.

Retention: see section 9.

13. International transfers

We are based in South Africa. Google, Apple, Cloudflare and Kit process information in the United States and other countries. The play-statistics database (section 4.6) is kept by Cloudflare in Western Europe.

• From South Africa. POPIA (section 72) allows personal information to be sent outside South Africa only where it stays adequately protected or another ground applies. We use providers bound by data processing terms that give protection substantially similar to POPIA’s, and some transfers are needed to give you what you asked for (for example delivering a purchase or answering your email).
• From the UK, the EEA and Switzerland. When you email us or use the game, your information comes to us in South Africa, which does not have an adequacy decision from the UK, the EU or Switzerland. We protect it as this policy and POPIA require. Our providers’ onward transfers rely on an adequacy decision where one exists (for example the EU-US Data Privacy Framework and its UK Extension, for certified companies) or on the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum, as set out in each provider’s data processing terms.

You can ask us for more information about these safeguards.

14. Security

We keep the information we hold to a minimum. The game stores your progress only on your device; purchase information passes between your device and the store over encrypted connections; Google says information collected by its ads SDK is encrypted in transit. Our accounts with Google, Apple, Kit and Cloudflare are protected with strong passwords and two-factor authentication. No method is perfectly secure. If a security compromise affects your personal information, we will notify the Information Regulator and you as POPIA (section 22) requires, and any other regulator where the law requires it.

15. Changes to this policy

If we change this policy, we will update the “Last updated” date at the top. If a change is significant (for example a new kind of information or a new provider), we will also say so in the game’s update notes or on this page before it takes effect, and ask for your consent again where the law requires it.

16. Contact

Timm Roark Garde, trading as Candlewren Games
68 Symmonds Lane, Howick, 3290, KwaZulu-Natal, South Africa
Email: support@candlewren.com
Information Officer: Timm Roark Garde