Mindset Worlds Privacy Policy
Last updated: 22 October 2026
This policy explains what information the Mindset Worlds mobile game (the "App") collects, why, who we share it with, and the choices you have. The App is published by Magicave Holdings Limited, 167-169 Great Portland Street, London, England, W1W 5PF ("we", "us"). If you have questions, contact us at support@magicave.io.
1. Summary
- You do not need to give us your name, email or phone number to play.
- The App creates an anonymous player account so that your progress and purchases are saved.
- We use analytics and crash reports to improve the game. You can turn this off in Settings → Privacy → Share usage data.
- The App shows ads from Google AdMob. Where the law requires it, we ask for your consent before showing personalised ads, and you can change your choice at any time in Settings → Privacy (Personalised ads, and Ad privacy choices where Google's consent form applies).
- To learn which of our ads bring new players, we use AppsFlyer (install attribution), but never in child-safe mode and not if you turn off Share usage data. On iPhone we only use your advertising identifier for this if you allow tracking when asked. AppsFlyer passes this data to the ad networks we advertise on, such as Meta (Facebook, Instagram) and TikTok, so they can measure and improve our ads.
- Players who told a version of the App that asks for age that they are under the digital-consent age in their country keep a child-safe experience (see section 7).
- You can delete your account and data at any time in Settings → Privacy → Delete account, or by request on our website.
2. Information we collect
2.1 Information the App creates automatically
| Information | Examples | Why |
|---|---|---|
| Player identifiers | An anonymous account id (Firebase Authentication), an install id, a friend code | To save your progress, restore it on a new device, and keep purchases with your account |
| Game progress | Levels, stars, coins, boosters, restored areas, settings, daily-reward and streak state | To run the game and back up your progress (cloud save) |
| Gameplay and usage events | Levels started and finished, boosters used, offers and ads shown, session length, app version, device model and operating system, approximate country (from your IP address) | Analytics: to balance difficulty, fix problems and measure which features players enjoy. A/B testing of game settings |
| Purchase information | Product bought, price, currency, store transaction id, subscription status | To deliver what you bought, restore purchases, handle refunds and prevent fraud. We never receive your card details; Google Play and the App Store handle payment |
| Crash and diagnostic data | Crash logs, stack traces, device state at the time of a crash, start-up time | To find and fix bugs |
| Advertising data | Your device's advertising identifier (where available and permitted), ad interactions, approximate location from your IP address | To show ads and, with consent where required, personalise them; to measure ad performance and prevent ad fraud |
| Ad attribution data (AppsFlyer) | An AppsFlyer device id, your advertising identifier (only with Personalised ads on and, on iPhone, only if you allow tracking), IP address and approximate country, device model and operating system, when you installed and which ad or store page led to the install, app opens, a few game milestones (level reached, tutorial completed), ad revenue, purchases and subscription renewals (passed on by RevenueCat), your anonymous player id | To measure which ad campaigns bring players and what they are worth, to pay ad networks correctly and to prevent ad fraud. Never collected in child-safe mode; off when Share usage data is off |
| Age and privacy choices | Your analytics and ad choices; if you used a version of the App that asked for your year of birth, that answer (stored in your game save, including its cloud backup, so the protections for younger players follow you to a new device; analytics only ever receive a coarse age band such as "adult", and only for players outside child-safe mode) and, in child-safe mode, your parental PIN (stored as a one-way hash) | To give you an age-appropriate experience and apply your privacy choices |
2.2 Information you choose to give us
- Display name (optional, only if you use friends and duels): shown to your friends and on friend leaderboards. Please do not use your real full name.
- Messages to support: if you email us, we receive your email address and whatever you include.
2.3 Information we do not collect
We do not collect your precise location, contacts, photos, camera or microphone input, or your email address or phone number through the App.
3. How we use information and our legal bases
| Purpose | Legal basis (EEA/UK) |
|---|---|
| Providing the game, saving progress, delivering purchases, restoring purchases | Performance of our contract with you (the Terms of Service) |
| Security, fraud prevention, preventing cheating (for example detecting changes to the device clock) | Our legitimate interests in keeping the game fair and secure |
| Analytics, crash reporting, A/B tests to improve the game | Our legitimate interests in improving the game; you can opt out in Settings → Privacy → Share usage data. |
| Personalised advertising | Your consent (collected through Google's consent message where required). Without consent, we show non-personalised ads only |
| Non-personalised advertising (which keeps the game free) | Our legitimate interests |
| Measuring our ad campaigns (install attribution with AppsFlyer) | Your consent where the law requires it (Google's consent message in the EEA and UK, which AppsFlyer reads, and Apple's App Tracking Transparency prompt for the advertising identifier on iPhone); otherwise our legitimate interests in measuring our marketing. You can turn it off in Settings → Privacy → Share usage data. |
| Local notifications (reminders such as "your lives are full") | Your permission on the device; you can turn them off in Settings at any time. These are scheduled on your device; no data is sent to us for them |
| Push notifications from friends and duels ("Sam challenged you to a duel") | Your permission on the device. If you are an adult player and allow notifications, we store your device's Firebase Cloud Messaging token with your player id to send them; turning notifications off in Settings or deleting your account removes it |
| Complying with law, tax and accounting obligations | Legal obligation |
We do not sell your personal information for money. Under some US state laws, sharing your advertising identifier with ad partners for personalised ads may count as "selling" or "sharing"; you can opt out by turning off Settings → Privacy → Personalised ads.
4. Who we share information with
We use the following service providers. They process data for us under their terms and data-processing agreements:
| Provider | Service | More information |
|---|---|---|
| Google (Firebase) | Authentication, Cloud Firestore database, Cloud Functions, Google Analytics for Firebase, Crashlytics, Cloud Messaging (push notifications) | https://firebase.google.com/support/privacy |
| RevenueCat, Inc. | Purchase and subscription management | https://www.revenuecat.com/privacy |
| Google (AdMob and User Messaging Platform) | Advertising and consent management. Google may use data for its own purposes as described in its policy | https://policies.google.com/technologies/partner-sites |
| AppsFlyer Ltd. | Install attribution and ad campaign measurement. AppsFlyer shares install and in-game event data with the ad networks whose ads you saw or tapped (for example Meta, Google, Unity and Apple Search Ads) so that they can measure their campaigns | https://www.appsflyer.com/legal/services-privacy-policy/ |
| Meta (Meta Platforms Ireland Limited and Meta Platforms, Inc.) and TikTok (TikTok Technology Limited in the EU, EEA and Switzerland; TikTok Information Technologies UK Limited in the UK; elsewhere the TikTok company that serves your region) | Ad networks we use to advertise the App. Through AppsFlyer they receive the ad attribution data in section 2.1, including: that the App was installed and which ad, if any, led to it, app opens, the game milestones listed there, and purchases and renewals (product, price and currency), with device model, operating system and IP address. Your advertising identifier is included only with Personalised ads on (and, on iPhone, only if you allow tracking). AppsFlyer may send this for every measured player, not only players who saw one of our ads. Nothing is sent in child-safe mode or with Share usage data off. They use it to measure our ads and show them to people more likely to enjoy the App, and also for their own purposes under their own policies |
https://www.facebook.com/privacy/policy/ https://www.tiktok.com/legal/privacy-policy |
| Google Play and Apple App Store | Payments, app distribution, in-app reviews | Their own privacy policies |
We may also disclose information if required by law, to protect our rights or the safety of players, or as part of a sale or reorganisation of our business (with notice to you).
Other players. If you use friends or duels, your display name, friend code, level and duel results are visible to your friends.
5. International transfers
Our servers are run by Google Cloud in the United States. Our providers may process data in other countries. Where data leaves the EEA or UK, we rely on the European Commission's Standard Contractual Clauses, the UK addendum, or the EU–US Data Privacy Framework where the provider is certified.
6. How long we keep information
| Data | Kept for |
|---|---|
| Account, game progress, cloud save, social data | Until you delete your account. Accounts inactive for 24 months may be deleted |
| Analytics events | 14 months (Google Analytics retention setting) |
| Crash reports | 90 days |
| Purchase records | As long as required by tax and accounting law (6 years in the UK). After you delete your account they are kept without your player id |
| Support emails | 24 months after the conversation ends |
7. Children and younger players
The App is a general-audience game and is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Some versions of the App ask for your year of birth on first launch, in a neutral way; others do not ask for your age at all. If you told one of those versions that you are under the age at which you can consent to data processing in your country (13 in the United States, Canada, Australia, New Zealand and the United Kingdom, and between 13 and 16 in EU/EEA countries; we use 16 if we cannot tell your country), your answer stays in your game save and the App keeps you in a child-safe mode:
- only non-personalised ads (and, under 13, ads treated as child-directed);
- analytics collection is turned off for players under 13;
- friends, duels and other social features are hidden;
- no install attribution (AppsFlyer is never started);
- every purchase needs a parental PIN, which a parent sets up behind a parental check.
If you are a parent and believe your child has given us personal information without your consent, contact support@magicave.io and we will delete it.
8. Your choices and rights
- Analytics: Settings → Privacy → Share usage data (on/off). Crash reports stay on so that we can fix crashes. Turning it off also stops install attribution (AppsFlyer). On iPhone you can also turn off tracking in Settings → Privacy & Security → Tracking.
- Ad networks (Meta, TikTok and others): turning off Share usage data stops the App sending them anything through AppsFlyer; turning off Personalised ads keeps your advertising identifier out of it. On iPhone you can also turn off tracking in Settings → Privacy & Security → Tracking; on Android you can delete your advertising ID in your device's Google or Privacy settings (Ads). Meta and TikTok also let you control the ads they show you in their own ad settings.
- Ads: Settings → Privacy → Personalised ads (on/off), and Ad privacy choices where Google's consent form applies. You can also reset or delete your advertising id in your device settings.
- Notifications: Settings → Notifications, or your device settings.
- Delete your account: Settings → Privacy → Delete account deletes your account, cloud save, social data, server records linked to your player id and our purchase provider's (RevenueCat) customer record straight away; purchase records are kept without your player id (section 6). You can also request deletion at https://mindset-next-legal.web.app/delete-account; we complete web requests within 30 days. Uninstalling the App removes the data stored on your device.
- Access, correction, portability, objection, restriction: depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA, PIPEDA, the Australian Privacy Act or the New Zealand Privacy Act 2020), you may have these rights. Email support@magicave.io with the player ID shown in Settings → Privacy. We will respond within the time the law requires (usually one month).
- Complaints: you can complain to your local data-protection authority, for example the UK ICO, an EU supervisory authority, the Office of the Privacy Commissioner of Canada, the OAIC (Australia) or the Office of the Privacy Commissioner (New Zealand).
9. Security
Data is encrypted in transit (HTTPS). Our database only accepts writes from our own server code, and each player can only read their own records. No system is completely secure; we will notify you and the authorities of a breach where the law requires.
10. Changes to this policy
We will post changes on this page and update the date above. If a change is significant, we will tell you in the App.
11. Contact
Magicave Holdings Limited, 167-169 Great Portland Street, London, England, W1W 5PF. Email: support@magicave.io.