This Privacy Policy describes how the Tiki-Tapa: Tap Soccer 2026 mobile
application (the "App") collects, uses, and shares information when you play.
By using the App, you agree to the practices described here.
We try to collect as little as we can — there's no email/password signup, no advertising profile we
build, and no personal data sold to third parties. This document explains exactly what we do collect,
why, and your choices.
1. What we collect
1.1 Account identifiers (required to play)
- Anonymous user ID issued by Firebase Authentication the first time you launch.
This is a random string with no tie to your real identity unless you sign in with Apple (see below).
- Sign in with Apple identifier, name, and email (optional, only if you link
your account). When you link, Apple sends us a pseudonymous user identifier, your name (only
on first sign-in), and your email address — either your real Apple ID email or, if you chose
to hide it, a unique Apple-managed private-relay address ending in
@privaterelay.appleid.com.
These are stored by Firebase Authentication as part of your account record so we can recover
your profile across reinstalls. We do not read your name or email anywhere in the App; you
appear to other players using only the in-App username and display name you set yourself.
1.2 Profile information (you set this yourself)
- Username (lowercase handle), display name, favorite team. You can change or clear these at any
time in the Account screen.
- Optional details: full name, contact email, and age, if you choose to enter
them on the profile screen. All three are optional — you can skip them, and you can clear them
later from the Account screen. We use them only to personalise your profile and to understand
our audience in aggregate; we do not email you, and we never share them with advertisers.
1.3 Gameplay data
- Match results: scores, opponents, formations, timestamps, country picks, tournament progress.
- Multiplayer ephemeral data: room code, real-time positions and actions during an active
head-to-head match. This is cleared after the match ends.
- Friends: a list of other users you've added.
1.4 Device identifier for advertising (only with your consent)
- If you tap Allow on Apple's App Tracking Transparency prompt, we share Apple's
IDFA (a per-device advertising ID, resettable from iOS Settings) with Google AdMob so ads shown
to you are more relevant.
- If you tap Ask App Not to Track, we don't share the IDFA. You still see
ads — they're just less targeted.
1.5 In-app purchases and subscriptions
- One-time purchases (team kit bundles, and — for players who bought them previously — Remove
Ads and Pro Pass) are processed entirely by Apple's StoreKit. We see a receipt that tells us
which product you bought; we never see your credit card or Apple Pay details.
- Club Membership is an auto-renewable subscription. Billing, the 7-day free
trial, renewal, and cancellation are all handled by Apple through your Apple ID. From StoreKit
we receive only which membership you hold and its status — for example, in a
free trial, active, or expired — which we use to grant your membership benefits and to
understand, in aggregate, how many players start a trial and keep their membership. You can
manage or cancel the subscription any time in your Apple ID settings.
1.6 Crash and diagnostic data
- We do not currently run a third-party crash reporter. If you opt into iOS-level analytics
sharing in Settings, Apple sends us anonymized crash reports through Xcode Organizer; we use
these only to fix bugs.
1.7 Push notification token
- If you grant notification permission, we store a Firebase Cloud Messaging device
token so we can deliver multiplayer match-invite pushes through Apple's Push
Notification Service. The token is generated by Apple / Firebase, rotates periodically, and
is not linked to your real identity. Turn off notifications for Tiki-Tapa in iOS Settings to
stop us from receiving it.
1.8 Analytics and measurement
- Usage events. We record in-app actions such as screens viewed, matches
started and finished, levels reached, badges unlocked, shop visits, purchase attempts, and
membership events (viewing the membership screen, starting a free trial, subscribing, and
cancelling). We use these to understand which parts of the game people enjoy and where they
get stuck.
- Analytics identifier. When you are signed in, we associate your analytics
activity with your account ID so we can understand how features are used across sessions and
devices. This identifier is internal to our analytics and is not shared with advertisers.
- Advertising performance data. When an ad is shown, we record the estimated
revenue of that impression, the ad format, and which placement it appeared in. This tells us
which parts of the App sustain the free version. It is not tied to the content of any ad you
saw.
- Aggregate characteristics. We store coarse groupings — such as an age range
like "25-34" rather than your exact age, an experience level range, whether you have made a
purchase, and your membership status (for example none, trial, or active) — so we can understand
our audience as groups rather than individuals.
Your age range is never shared with advertising networks.
We do not collect: phone number, precise location, address book contacts,
photos, microphone, camera, health data, or financial details. Name and email from Sign in
with Apple are covered above (§1.1); they are stored only by Firebase Authentication and not
read or used elsewhere in the App.
2. Why we collect it
| Data | Purpose |
|---|
| Anonymous user ID | Save your match history and profile across launches |
| Sign in with Apple ID, name, email | Restore your account after reinstall or on a new device (stored by Firebase Auth only; not used elsewhere in the App) |
| Profile (username etc.) | Display you to opponents in multiplayer; show on leaderboards |
| Match results | Show your record, power the Match of the Day, drive tournament progression, populate global leaderboards |
| Multiplayer real-time state | Sync the active match between players (deleted when the match ends) |
| Friends list | Let you invite specific people to a match |
| Push notification token | Deliver match-invite pushes via Apple Push Notification Service |
| IDFA (consented only) | Show more relevant ads via Google AdMob |
| IAP receipts | Unlock the content you bought; restore purchases on a new device |
| Membership status (from StoreKit) | Grant Club Membership benefits while active; measure trial-to-paid conversion and cancellations in aggregate |
| Usage events | Understand which features are used and where players get stuck |
| Analytics identifier | Connect your activity across sessions so the above is accurate per player rather than per launch |
| Ad performance data | Measure whether the free, ad-supported version is sustainable |
| Age range and other aggregate groupings | Understand our audience as groups; never used to target ads |
3. Who we share it with
We do not sell your personal information. We share limited data with the following service providers,
and only to operate the App:
- Google Firebase (Authentication, Realtime Database, Analytics, Cloud
Messaging, Remote Config). Stores your profile, friends list, match history, and multiplayer
room state; records the usage events described in §1.8; delivers push notifications; and lets
us adjust in-app settings without shipping an update.
Google's privacy policy.
- Google AdMob (advertising). Receives the IDFA only if you allowed tracking;
otherwise receives no identifier. Used to show banner, interstitial, and rewarded ads.
AdMob & data.
- Google User Messaging Platform (consent management for GDPR users). Records
your ad-consent choices.
- Meta (Facebook) (app-install measurement). Receives a limited set of
milestone events — for example that a registration, a first completed match, a level-up, a
free-trial start, or a purchase or subscription occurred, and the amount — so we can tell which advertising campaigns bring
in players who enjoy the game. If you did not allow tracking, Meta receives these only in
aggregated, non-identifying form via Apple's SKAdNetwork. We never send Meta your age,
your profile details, or your match history.
Meta's privacy policy.
- Apple (Sign in with Apple, App Store, StoreKit, App Tracking Transparency).
Processes authentication and purchases; you interact with Apple directly.
Apple's privacy policy.
Other multiplayer users see your username, display name, country pick, and live match actions
while you are in a match together. They never see your account identifiers.
We may disclose data if compelled by law (subpoena, court order, etc.), but we'll push back where appropriate.
4. How long we keep it
- Active profile + match history: kept as long as your account exists.
- Multiplayer room state: deleted automatically minutes after the match ends.
- IAP receipts: kept for the life of your account so we can restore purchases.
- Account deletion: if you delete your account from the Account screen, your
profile, friends list, and match history are permanently removed within 30 days. Anonymous
identifiers tied only to non-personal aggregates may persist in backups for a short additional period.
5. Your choices and rights
- Stop ad tracking: iOS Settings → Privacy & Security → Tracking → toggle off
for Tiki-Tapa.
- Change or clear profile data: Account screen inside the App.
- Restore purchases: Shop → Restore Purchases.
- Manage or cancel your Club Membership: iOS Settings → your name →
Subscriptions (billing and cancellation are handled by Apple).
- Delete your account: Account screen → Delete Account. This is permanent.
- Access or export your data: email us at the address above; we'll respond
within 30 days.
- EU/UK users have the rights under GDPR (access, rectification, erasure,
restriction, portability, objection); California users have rights under CCPA
(know, delete, opt out of sale — we do not sell). Exercise any of these by emailing us.
6. Children's privacy
Tiki-Tapa is intended for users 13 and older. We do not knowingly collect personal
information from children under 13. If you believe we have, contact us and we will delete it.
7. Security
We use industry-standard transport encryption (HTTPS / TLS) for all data in transit and rely on
Google Firebase's at-rest encryption for stored data. No system is perfectly secure; if we become
aware of a breach affecting your data, we'll notify you and the relevant authorities as required
by law.
8. International transfers
Your data is processed on Google Cloud infrastructure, which may be located in the United States
or other regions. By using the App you consent to the transfer of your data to these locations.
9. Changes to this policy
We may update this policy from time to time. When we make material changes, we'll update the
"Effective date" above and, where appropriate, notify you in-app on next launch.
10. Contact us
Privacy questions, data requests, or anything else:
joe@streetcatcreative.org