Privacy Policy

Privacy at a glance

• The Game has no user accounts, social login, developer-operated cloud saves or real-money in-app purchases.
• Gameplay progress and preferences are mainly stored on your device.
• The Game is intended for people aged 16 or older. Players aged 16–17 are restricted to non-personalized advertising with additional age-related processing restrictions.
• Unity Analytics is optional. Eligible players can play without it.
• Advertising is subject to separate privacy choices. Adults can choose available personalized or contextual advertising; declining required advertising permissions leaves ordinary gameplay available. Ad-quality and consent-management services are separate from the Analytics setting.
• You can change privacy choices in the Game and contact us about access, correction or deletion of personal data.

1. Age and access to the Game

Before gameplay, the Game asks for your age and stores a group: under 16, 16–17, or 18 or older. The exact number is not retained in the Game's save or privacy preferences. We do not ask for your date of birth or include the age group in Hina's custom Analytics events.

Players under 16 cannot access gameplay, and Hina does not enable optional Analytics collection or request ads for them. Players aged 16–17 can play, choose optional Analytics separately, and receive only non-personalized ads when the required advertising permissions are available. Confirming an age group is not consent to Analytics or advertising.

For players aged 16–17, Hina communicates an age-related restriction to LevelPlay and the supported advertising services before activating advertising. It uses their restricted processing setting, also called the child-directed or COPPA setting, rather than merely switching off personalization. This is a technical protection selected for this age group; it does not mean that everyone under 18 is legally a child under COPPA. Accepting personalization in a consent form does not remove this restriction. The advertising services receive the restriction, not the exact age entered into Hina.

Restricted advertising can still involve information needed for contextual ads, frequency limits, fraud prevention and permitted service operations. It does not mean that no identifiers or connection information are processed, and fewer ads may be available. See section 4 and the providers' notices.

Some embedded Android and SDK components start when the app opens, before the age and privacy screens are completed. The age gate controls gameplay and Hina's activation of optional Analytics and ad requests; it does not mean that every embedded component starts only after those choices.

Contact us if you believe information about someone under the permitted age has been processed inappropriately.

2. Information stored on your device

The Game stores:

• progress, virtual resources, levels, jobs, skills, unlocked content, furniture and outfits;
• story choices and reading progress, goals, gameplay counters, reward records and cooldowns;
• device-clock information, timers and offline-income calculations;
• language, audio and local-reminder preferences;
• your age group, privacy choices and Analytics deletion-request status;
• records needed to prevent duplicate rewards, repeated milestones or excessive fullscreen ads.

These records support gameplay, recovery, preferences and privacy controls. Hina does not upload your complete save to an ArtLash Interactive cloud-save service. Optional Analytics may send selected gameplay information, and the services below process their own data.

Local gameplay counters continue to function when Analytics is off. Hina does not later upload the complete earlier local gameplay history as a queue of Analytics events. A local gameplay journal also records career activities and virtual reward results for local diagnostics and balancing. Hina does not upload this journal to a developer service. Turning Analytics off or requesting Unity Analytics deletion does not erase these local records; their retention and removal are described in sections 10 and 11.

Hina's gameplay features do not request your contacts, calendar, precise GPS location, camera, microphone, personal photo library, payment-card details or account credentials. This does not exclude SDK identifiers, IP-derived approximate location or information you choose to send by email. Fictional Cash, donations and subscribers are game content, not your real financial records.

3. Optional Unity Analytics

With your separate affirmative choice, we use Unity Analytics to understand gameplay and improve progression, balancing, features and reliability.

Information can include:

• gameplay, progression, virtual-economy and authored dialogue-choice events;
• level, apartment, language, app/content version, session activity and event times;
• story interactions, in-game streams, offline-income metrics and selected ad or notification events;
• installation, device, session and event identifiers used by the SDK;
• device and app characteristics, including operating system, model, screen, hardware and battery information;
• diagnostics, performance information, IP address and approximate location derived from network information.

Hina's custom events do not contain your real name, email, phone number, password, raw advertising ID, raw consent strings or user-entered free-form text. Unity also generates standard SDK events and technical fields. Installation identifiers can connect events to the same installation; this information is not necessarily anonymous.

You may decline Analytics and still play if eligible. Withdrawing consent through the privacy controls stops Hina accepting new events. The SDK can still transmit events buffered before deactivation. Withdrawal does not affect the lawfulness of earlier processing; it does require consent-based processing to stop. Where no other lawful ground or applicable exception permits retention, personal data must be erased without undue delay. Technical limitations do not remove these duties.

Request analytics deletion turns Analytics off and initiates deletion of Unity Analytics data associated with the installation. It sends the identifiers needed to locate the data, requires a connection and may be retried. An in-app request status does not confirm completed server erasure.

In the current version, the Analytics toggle cannot re-enable collection after that deletion request. The request does not delete game progress or separate advertising, Ad Quality or CMP records.

4. Advertising and ad quality

The Game uses Unity LevelPlay / ironSource, Unity Ads and Unity Ad Quality for rewarded ads, interstitial ads, advertising measurement and ad-quality review.

The Game also integrates Liftoff Monetize (Vungle) through Unity LevelPlay for rewarded and interstitial advertising. Depending on the applicable privacy choices and restrictions, Liftoff may process device and advertising identifiers, IP address and approximate location, device and app information, and ad delivery, interaction, measurement and security information. The advertising choices and age-related restrictions described in this Policy also apply to this integration. Further information is available in the Liftoff Privacy Policy.

The Game includes an InMobi advertising SDK and LevelPlay adapter in addition to InMobi Choice CMP. InMobi ad delivery is currently disabled in the mediation configuration while approval is pending. Including the SDK does not mean InMobi ads are currently available, and disabling ad delivery does not guarantee that every embedded component performs no processing. Any processing remains subject to the applicable privacy permissions, age-related restrictions and legal requirements. InMobi Choice CMP remains a separate consent-management service. Any activation of InMobi advertising must respect the advertising choices and age-related restrictions described here. Further information is available in the InMobi Privacy Policy. We will update this description when InMobi ad delivery is activated.

Rewarded ads follow a player-selected offer. Interstitials can appear at eligible gameplay breaks, subject to privacy checks and cooldowns. Selecting a rewarded offer is not itself consent to personalized advertising.

Advertising services can process advertising/device/service identifiers; IP address and approximate location; device, operating-system and app information; ad requests, impressions, clicks, completions and other interactions; placement and revenue metadata; privacy choices; diagnostics; and fraud-prevention or security information.

Personalized advertising can use profiles based on ad interactions, device and regional signals to select relevant ads.

Hina does not implement real-money in-app purchases and does not generate real-money purchase events. Unity's SDK disclosure includes purchase-history data among its SDK-level categories and describes app-usage-time collection when Acquire Optimization is enabled. Those provider disclosures do not mean Hina offers purchases; the absence of purchases also does not mean that advertising services process no personal data.

Ad Quality helps identify problematic ads and diagnose ad experiences. Its data can include a service identifier, ad source/format, impressions, revenue, advertiser/creative information, interaction timing and ad-exposure or user-journey information. Creative analysis can include representations of ads, playable content and end cards. This is distinct from accessing your personal photo library; Hina has no feature that uploads your camera, microphone or gallery content to Ad Quality.

Advertising choices

For eligible adults, advertising can be personalized or contextual/non-personalized, depending on your choices and the applicable permissions and restrictions. Where a TCF consent form is shown, declining personalization can still allow contextual ads if the required device-access and provider permissions remain available. Where the regional consent flow does not use TCF, Hina presents a separate advertising choice allowing adults to permit advertising with or without personalization, or decline it. Players aged 16–17 remain in the restricted mode described in section 1.

Contextual ads do not use a personalized advertising profile to select the ad. They can still involve device or service identifiers, IP-derived region, ad interactions, measurement, frequency limits and fraud-prevention information as permitted. They are not necessarily anonymous.

For applicable US regional flows, available privacy choices include opting out of sale, sharing or targeted advertising. Hina uses the saved regional preferences, including an applicable Global Privacy Control signal recorded by the CMP, to restrict personalization and communicate the opt-out to the supported advertising services. A separate permission to allow advertising does not cancel a regional opt-out. A browser signal on a separate website is not automatically a setting inside the Android Game.

If the required privacy state cannot be established, or you decline required advertising permissions, Hina blocks new ad load/show requests and removes previously loaded ads from use. Ordinary gameplay remains available, but ads and their associated rewards may be unavailable. Ads also depend on network availability and the providers' ability to serve them.

Opening advertising privacy settings suspends ad requests and removes previously loaded ads from use while choices are being updated. Some changes require an app restart so initialized advertising services can apply the new state. Hina saves the choice, blocks further ad load/show requests pending the restart, and displays a notice. Restarting does not erase your game progress or reverse your choice.

Advertising measurement and Ad Quality are separate from optional Unity Analytics. Turning Analytics off does not turn off these services where they are separately permitted. Blocking new ads does not itself shut down every initialized component or erase historical records. Consent withdrawal applies to the processing that depends on that consent; any further retention requires a valid separate ground or applicable exception.

5. Consent management

InMobi Choice CMP displays, stores and communicates advertising privacy choices and selects the applicable regional consent flow. It can operate after the age and initial Analytics choice even when you decline Analytics.

CMP information includes consent/preference selections, purpose and vendor choices, regional or jurisdictional information, app/publisher/SDK configuration, consent identifiers and records, and consent-management reporting or audit information. Network configuration and regional checks involve connection information, including IP-derived regional information.

The CMP uses applicable industry consent formats, including TCF, Google Additional Consent and GPP, to record and communicate choices to supported advertising services. Integrated SDKs can read native consent preferences. Hina does not copy the raw consent strings into its gameplay save or custom Analytics events. Regional forms and available choices can differ; a regional classification is not itself permission for optional advertising or Analytics.

Where necessary, Hina also records a separate affirmative advertising choice in its privacy preferences. This choice is independent of Analytics and does not replace regional opt-outs or change the CMP-generated consent strings. When more than one regional flow applies, their relevant restrictions are considered together.

Open Ad privacy settings in the Game to revisit available choices, including the separate advertising choice where applicable. See section 4 for changes that require a restart. A vendor appearing in the CMP list does not itself mean that the Game transmits data to that vendor. InMobi Choice is used for consent management and is separate from the InMobi advertising SDK described in section 4. The advertising SDK is included, but InMobi ad delivery is currently disabled. Hina does not use a remote-push service for its local reminders.

6. Local notifications

Optional energy and offline-income reminders are scheduled on your device. Hina does not operate a remote push-notification backend or use Firebase Cloud Messaging for these reminders. Scheduling and reminder-opening records are local and are not remote-push registration tokens.

You can disable reminders in the Game and manage Android notification permissions. If you separately enable Analytics, notification scheduling, opening, permission and preference events may be sent to Unity Analytics.

7. Support and privacy correspondence

If you email us, we receive your email address, any sender name, message, correspondence metadata and attachments. We use them to answer the enquiry, handle privacy requests and, where necessary, address disputes.

Correspondence is stored in Gmail. On the developer's side, access is limited to Artem Vasyliev; Google and your email provider also process messages to operate their services. Installing or playing the Game does not automatically give us your email address.

Please send only information relevant to the enquiry. Do not send passwords, payment-card details, identity documents or unrelated sensitive information unless specifically necessary and requested through an appropriate process.

8. Purposes and legal bases

Information comes from your choices and correspondence, gameplay and ad interactions, the device/app environment and the services described above.

For personal-data processing we control, the GDPR bases are:

The advertising consent basis above does not assign a single legal basis to every operation of an advertising provider. Where a provider acts as an independent controller, its notice explains its purposes and legal bases, including any permitted legitimate-interest basis for contextual advertising, frequency limits or fraud prevention. A refusal of personalization is not permission for profiling. For processing we control, any distinct fraud-prevention, security or legal purpose must satisfy the applicable basis described in this table; it does not provide blanket permission to continue advertising tracking after consent is withdrawn.

Optional tracking is not treated as necessary to provide gameplay. Necessary consent administration does not automatically cover additional CMP measurement or optimization. Younger users' interests must be considered when relying on legitimate interests.

Separate rules can require permission to store or read information on your device. A GDPR basis does not replace that permission; any strictly necessary exception applies only to operations meeting its conditions.

An age choice is needed to establish gameplay eligibility. Analytics consent and email correspondence are optional. Particular optional features may be unavailable if their required permissions are denied. Reading this Policy or continuing to play is not consent to optional Analytics or personalized advertising.

9. Recipients and providers

Depending on your choices and the active services, information is received by:

Providers may process information on our behalf or for purposes for which they have their own controller responsibilities. Liftoff's published Monetize terms describe Liftoff and the developer as independent controllers for their respective processing. We remain responsible for processing we control; links to provider policies do not replace our obligations or your ability to contact us.

Further provider information:

• Unity Game Player and App User Privacy Policy.
• Unity Analytics privacy overview and roles, and data and deletion information.
• Unity Ads Android SDK disclosure.
• LevelPlay data disclosure.
• Liftoff Privacy Policy, Monetize data-protection terms and SDK data disclosure.
• InMobi CMP information, InMobi privacy information and privacy-request information.
• Google Privacy Policy.

These documents may describe additional products that Hina does not use. InMobi's general advertising disclosures should not be read as proof that every listed practice applies to its CMP.

10. Retention

Local data. Progress and preferences generally remain until overwritten, reset or removed through Android app-data controls or uninstallation, subject to platform behavior. Recovery copies and installation-level preferences may outlast a game run. The local career journal rotates when its current file exceeds approximately 1 MB and retains one previous file; it has no separate calendar-based expiry. Starting a New Game or requesting Unity Analytics deletion does not itself remove this journal. Android app-data removal generally removes it with other app-managed files.

Unity Analytics. Unity documents a 13-month raw-event retention period. Dashboard metrics and user-profile data remain until deletion is requested by the player or initiated by the developer. These service defaults do not override a right to earlier erasure or permit retaining personal data after its lawful purpose ends. See Unity's retention information.

Advertising, Ad Quality and CMP records. Retention differs by service and record. Applicable criteria include the period needed to deliver and measure advertising, reconcile records, investigate a particular quality/security issue, apply current privacy choices, demonstrate consent compliance, or meet a specific legal obligation or claim. Limited evidence of past choices may remain after choices change. A dashboard's reporting window is not necessarily the provider's full retention period. Provider-specific information is available through the links above and our privacy contact; no single fixed period covers all these records.

Support and privacy correspondence. We keep correspondence while handling an enquiry and delete ordinary resolved correspondence, including attachments and developer-controlled mailbox copies, within 30 calendar days after resolution. If the enquiry is reopened, the period runs from its subsequent resolution. Archiving is not deletion; this rule includes recoverable mailbox Trash copies.

A limited record may be retained longer where necessary for a specific legal duty, evidence of our handling of a privacy request, or a legal claim. Retention is limited to the information and time necessary for that reason; it does not automatically justify keeping the full conversation. Google's infrastructure backup/deletion processes are separate from removal of our mailbox copies.

You may request earlier erasure, subject to applicable conditions and exceptions.

11. Your controls and deletion requests

These technical controls do not limit your legal rights. A separate deletion button is not a condition for erasure already required by law, including after withdrawal where no other lawful ground or applicable exception permits retention.

Where possible, use the in-app Analytics deletion control before clearing app data or uninstalling, because those actions may remove identifiers needed to associate earlier records with your installation. You can still contact us afterwards.

For advertising, CMP or Ad Quality records, contact us or the relevant provider. We will handle requests concerning processing we control and help identify the appropriate route for other records. The lack of a Hina account is not itself a reason to reject a request.

12. International processing and security

Service providers may process information outside Romania and the European Economic Area, including in the United States. Transfers subject to GDPR must use an applicable mechanism, such as an adequacy decision or appropriate safeguards. Unity describes adequacy decisions and Standard Contractual Clauses in its linked privacy policy. Liftoff's linked privacy notice and applicable Monetize terms describe its international processing and transfer safeguards, including Standard Contractual Clauses where applicable. The linked InMobi notices describe its international processing and safeguards. The applicable mechanism depends on the service, transfer and relevant law.

You can contact us for information about the safeguards applicable to your data and how to obtain a copy or access their published location. Provider notices also explain their international arrangements. This does not remove our responsibilities for transfers we control.

The Game uses Android app storage, save-integrity checks and privacy controls. Integrity checks detect damaged or altered saves; they are not encryption, and Hina does not separately encrypt all local saves and preferences. The integrated Unity services document encrypted transmission, and CMP configuration requests use HTTPS. Developer access to support correspondence is restricted as described above. No storage or transmission system can guarantee absolute security.

13. Your privacy rights

GDPR applies to our personal-data processing in the context of our establishment in Romania. Subject to the conditions for each right, you may request access and a copy, correction, erasure, restriction, and portability of qualifying data processed by automated means on the basis of consent or a contract.

Withdraw consent: use the Game's Analytics and advertising privacy controls. Withdrawal is free and must be as easy as giving consent. It does not affect the lawfulness of earlier processing.

Object: you may object, for reasons relating to your situation, to processing based on legitimate interests, including associated profiling. That processing must stop unless overriding compelling grounds or legal-claim needs justify it. If data is used for direct marketing, you can object at any time and that use, including related profiling, must stop.

GDPR also provides protection concerning solely automated decisions with legal or similarly significant effects. The Game applies the age rules and automated advertising selection described above. Contact us if you believe eligibility information is inaccurate or wish to contest its application.

Email artlashinteractive@gmail.com, identify the Game and describe your request. We may ask for proportionate information to locate records or, where there are reasonable doubts, verify identity. We will explain if we cannot associate records with you and what information or provider route may help.

Requests are normally free. Where GDPR permits, a manifestly unfounded or excessive request may be declined or subject to a reasonable administrative fee, with an explanation.

We provide information about action taken without undue delay and within one month of receiving a GDPR request. If necessary because of the complexity or number of requests, this may be extended by up to two further months, with an explanation within the first month. If we do not act, we explain why and identify complaint and court-remedy options. Erasure, where required, must occur without undue delay; referring a request to a provider is not itself completion.

You may complain to a competent supervisory authority, including where you habitually live or work in the EEA or where the alleged infringement occurred. Romania's authority is ANSPDCP: complaint information. You may also seek a judicial remedy, without having to contact us first. Other applicable laws may provide additional rights.

Additional regional rights and advertising opt-outs

Depending on where you live and which laws apply, you may also have rights to confirm whether data is processed, access or obtain a copy, correct or delete it, and opt out of sale, sharing, targeted advertising or certain profiling. The categories, sources, purposes, recipients and retention of information are described in sections 1–10. Advertising disclosures to independent providers can fall within legal definitions of sale or sharing even when no money is paid for the information; they should not be treated as absent merely because Hina has no purchases.

Use Ad privacy settings for available advertising opt-outs, or email our privacy contact for assistance and other rights requests. We apply the relevant in-app restrictions without requiring a Hina account. Opting out can still permit limited contextual advertising and processing necessary for allowed service operations; it does not itself erase earlier records. You can separately request erasure.

Where applicable law permits, an authorized representative may make a request for you, subject to proportionate verification of authority and identity. We do not penalize you for exercising privacy rights; optional advertising rewards still require a completed, permitted ad. If we decline a request, you may ask us to review the decision by replying to our privacy contact with the subject Privacy request appeal. We will explain the decision, any applicable appeal process, deadlines and regulatory complaint options.

These regional rights are subject to the scope and conditions of the applicable law. They do not limit the GDPR rights arising from our processing in the context of our Romanian establishment.

14. External links and changes

When you open an external website, store page or advertiser link, that service and your browser may process connection/device information under their own notices. This Policy does not cover every practice of separately visited services.

We may update this Policy as the Game, processing or legal requirements change. We update the date and provide additional notice where required. Publishing a revised Policy does not replace new consent where it is necessary.

15. Contact

Controller / developer: Artem Vasyliev
Brand: ArtLash Interactive
Country: Romania
Game: Hina: Going Live!
Android package: com.artlashinteractive.hinagoinglive
Privacy and support: artlashinteractive@gmail.com
Policy URL: artlashinteractive.com/privacy-policy