Privacy Policy
Last updated 18 August 2026 · Applies to the Cursed Critters mobile game on iOS and Android
The short version. Cursed Critters has no accounts. We never ask for your name, your email, your phone number or your location, and your save file never leaves your phone. The game does send anonymous gameplay statistics, and it shows optional rewarded ads — those two things are described in full below, and both can be switched off.
This policy explains what the Cursed Critters app (“the game”, “the app”) collects, why, who else is involved, and what you can do about it. It is written by VR Holding, the company that publishes the game (“we”, “us”) — full identity in the legal notice. For the purposes of the EU General Data Protection Regulation, VR Holding is the data controller for the processing described here.
1. What stays on your phone
Everything that makes up your progress — gold, unlocked critters, Pantry upgrades, best times, sound and haptics settings, the daily chest timer — is stored in the app's own local storage on your device. It is not uploaded, not backed up to us, and not readable by us. Delete the app and it is gone; we have no copy and no way to restore it.
2. What the game sends, and to whom
| Data | Why | Who receives it |
|---|---|---|
| A random identifier generated on your device the first time you open the game | To count one player as one player instead of one player per event. It is created by the app itself with a random number generator — it is not your advertising ID, not your IDFA, and not tied to your Apple or Google account. | Amplitude |
| Gameplay events: app opened, screen viewed, run started and ended (with the critter, duration, level, kills, gold), weapon evolved, critter unlocked, upgrade bought, daily chest claimed, an ad slot shown/started/finished, a setting toggled, consent resolved | To see which critters get played, where runs end, and whether a change to the balance made the game better or worse. This is the only way a studio this small can tell. | Amplitude |
| Platform (iOS or Android), OS name, app version, session number, and the time of the event | To tell an iPhone bug from an Android bug and an old build from a current one. | Amplitude |
| Your IP address, which any internet request necessarily carries | Amplitude derives an approximate country/region from it. We do not store the IP address ourselves and never see it as such. | Amplitude |
| Advertising identifiers and ad interaction data, only if you allow it | To serve and measure the optional rewarded ads. See section 4. | Google (AdMob) |
| Advertising identifiers, the fact that the app was installed and which ad — if any — you came from, and what an ad you chose to watch earned, only if you allow it | To know whether an ad campaign brought in players who actually play, and whether it paid for itself. Without it, buying an ad is buying blind. See section 4. | Adjust |
| Purchase receipts and an anonymous purchase identifier, only if you buy something | To know that a purchase happened and to restore it on a new device. We never receive your card number, address, or Apple/Google account. | Apple, Google, RevenueCat |
Gameplay events are queued on your device and sent in batches — never during a run. If you are offline, they wait; if the queue grows past 500 events, the oldest are dropped.
What we never collect
No name, no email address, no phone number, no postal address, no date of birth, no photos, no contacts, no calendar, no files, no precise or approximate GPS location, no microphone recording, no health data, no browsing history outside the game. There is no login and no account, so there is nothing to link any of the above to even if we had it.
About the Android microphone permission. The Android build declares
RECORD_AUDIO because of the audio library the game uses to play
its music and sound effects — that library declares the permission whether or
not an app records anything. Cursed Critters contains no recording code and
never opens the microphone. Nothing is ever captured.
3. Analytics — and how to turn them off
The game uses Amplitude (Amplitude, Inc., United States) for product analytics. The app talks to Amplitude's HTTP API directly; no Amplitude SDK is embedded in the game.
Legal basis (GDPR): our legitimate interest in understanding how the game is played in order to improve it (Article 6(1)(f)), balanced by the fact that the data is pseudonymous, contains nothing about who you are, and can be turned off in one tap.
How to turn it off: open Settings → Privacy inside the game and switch analytics off. Nothing further is sent from that moment on, and the game plays exactly the same.
4. Advertising
Cursed Critters shows rewarded ads only, and only where you press a button to ask for one: a second chance after dying, doubled gold at the end of a run, or a tripled daily chest. There are no banners, no interstitials, nothing that interrupts a run, and no ad at all during your first two runs. Refusing every ad costs you nothing that cannot be earned by playing.
Ads are served by Google AdMob (how Google uses data from apps that use its services). Google may process device identifiers and ad interaction data to select and measure ads.
Where installs come from
Adjust (Adjust GmbH, Berlin, Germany) measures which campaign, if any, brought you to the game, and what the ads you chose to watch earned. It receives device and advertising identifiers, the install itself, and the revenue of an ad impression — never your name, your email, nor anything you do inside a run. Nothing reaches Adjust until the consent step described below has run. Until then the measurement is held in the app’s own memory; if you are shown the consent form and refuse it, that measurement is dropped and never sent — not even an anonymous install.
In the EEA, the UK and Switzerland
Before any ad request is made, the game shows Google's certified consent form (the UMP consent management platform, built on the IAB Transparency & Consent Framework). Nothing is requested from Google until you have answered it. If you refuse, no ad is ever requested, the ad buttons simply do not appear, and the game works normally. You can reopen the form at any time from Settings → Privacy in the game to change your mind.
On iOS
If — and only if — you have consented above, iOS then asks you the App Tracking Transparency question (“Allow Cursed Critters to track your activity across other companies' apps and websites?”). Answering Ask App Not to Track means your IDFA is never shared; ads still work, they are simply not personalised. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
Legal basis
Consent (Article 6(1)(a) GDPR), collected through the form described above. Outside the EEA/UK/Switzerland, our legitimate interest in funding a free game, subject to the platform-level controls Apple and Google provide.
5. Purchases
If you buy anything in the game, the transaction is handled entirely by the App Store or Google Play. We never see and never receive your payment details. RevenueCat (RevenueCat, Inc., United States) validates the receipt and tells the app what you own, using an anonymous identifier that is not linked to your name or email. This is necessary to perform the contract you enter into when you buy (Article 6(1)(b) GDPR).
6. Children
Cursed Critters is not directed at children under 13 (under 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe a child has provided us with data, write to us at the address in section 11 and we will delete it.
7. Where the data goes
Amplitude and RevenueCat process data on servers in the United States. Adjust GmbH is established in Germany, in the European Union. Google operates globally. Transfers of personal data outside the European Economic Area rely on the European Commission's Standard Contractual Clauses and, where applicable, on the EU–US Data Privacy Framework. Copies of the relevant safeguards are available on request.
8. How long it is kept
Gameplay events are retained by Amplitude for as long as the project exists and are deleted at the latest 25 months after collection. Purchase records are kept for as long as required by accounting and tax law (10 years in France). Data held by Google for advertising follows Google's own retention rules, and attribution data held by Adjust follows Adjust’s. Your save file lives on your device until you delete the app.
9. Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to data portability. Where processing is based on consent, you may withdraw that consent at any time — the in-game switches described above are the fastest way to do it.
If you are a California resident, you have the right to know what personal information is collected and to request its deletion, and the right to opt out of its “sale” or “sharing”. We do not sell personal information. Turning off personalised ads as described in section 4 is the opt-out for “sharing” for cross-context behavioural advertising. We will never discriminate against you for exercising any of these rights.
To exercise any right, email us at the address in section 11. Because the game has no account, we may ask you for the random identifier the app generated on your device — the game shows it under Settings → Privacy, and it is the only way we can find your rows. Without it we genuinely cannot identify you, which is by design.
You also have the right to lodge a complaint with a supervisory authority. In France, that is the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).
10. Changes to this policy
If we change what the game collects, we update this page and change the date at the top. Material changes will also be announced inside the game before they take effect.
11. Contact
Email support@cursedcritters.app, or write to VR Holding, 14 rue Charles V, 75004 Paris, France. We answer privacy requests within one month.