At a glance
- Your progress (coins, gems, heroes, upgrades, settings) lives on your phone. If you sign in with Google, the game also keeps a copy on our server (a cloud save), so it can follow you to another phone.
- To run the online leaderboard, the game creates an anonymous player on our server, identified by a random install ID and a server-assigned player ID, with a generated display name such as "Swift Kestrel 4821".
- It sends a short summary of each finished run, the app version, device model and language setting, crash reports when something goes wrong, and, if you allow notifications, a notification token.
- Signing in with Google is optional. If you do, we keep your Google account ID and email address so your player, cloud save and ad-free subscription can follow you to another phone.
- SUNTHIEF is free and shows ads from Google AdMob. Google's ads software uses your device's advertising ID, and in the EEA, the UK and Switzerland the game asks for your consent first. The game tells our server which ads it showed and what they earned.
- The optional ad-free subscription is sold through Google Play, which handles the payment. We keep a record of the purchase (its purchase token, plan, status and expiry), never your payment details.
- We use the data for the leaderboards, game balancing and statistics, fixing crashes, the cloud save, the ad-free subscription and counting ad revenue. We don't sell it, and we don't give the data on our server to advertisers.
- Delete it any time in the game (Settings > Delete my data) or by emailing procoderx786@gmail.com.
Who we are
SUNTHIEF is made by Khuram Imtiaz ("we", "us"), who is responsible for the data described here. For anything about privacy, email procoderx786@gmail.com.
What stays on your phone
SUNTHIEF plays fully offline. Your progress and settings (coins, gems, heroes, upgrades, boosts, missions, your Daily Dawn streak, your Thief Rank and your own run history) are saved in the game's private storage on your phone.
If you sign in with Google, the game also uploads a copy of your progress to our server (the cloud save) and restores it on your other phones; see the table below. If you don't sign in, your progress isn't sent to us.
The game doesn't use Android's cloud backup for its save file, so uninstalling the game removes the progress on the phone (a cloud save stays on our server until you delete your data). Uninstalling doesn't delete what is on our server: use Settings > Delete my data first, or see the deletion page.
What the game sends to our server, and why
When your phone is online, the game talks to our server at this website. This is everything it sends or that we keep:
| Data | Details | Why |
|---|---|---|
| Install ID | A random identifier the game creates once on your phone. It is not a device or advertising ID. We store only a keyed one-way hash of it, never the ID itself. | To recognise your install and give back the same player (for example after a token expires). |
| Player ID and token | A random player ID our server assigns, and a signed token the game uses to prove it is that player. | To link your runs to your player. |
| Display name | Generated by our server (for example "Swift Kestrel 4821"), or a name you choose in the game. | Shown next to your scores on the leaderboards. |
| Run summaries | For each finished run: score, distance, the world you reached and its number, difficulty mode, hero, how the run ended, how long it lasted, coins and gems collected, revives used, and the app version. | Leaderboards, game balancing and statistics (for example which worlds are too hard). |
| App and device information | App version, platform (Android), device model (for example "SM-A075F") and your phone's language and region setting (for example "en_US"). | Compatibility, fixing device-specific problems, and statistics. |
| Crash reports | When the game hits an error: the error message and technical stack trace, app version and device model. If the game has a player, the report is linked to its player ID. | Finding and fixing bugs. |
| Days active | The calendar days (UTC) on which the game contacted our server, linked to your player ID. | Counting daily and weekly players. |
| Notification token | Only if you allow notifications: the Firebase Cloud Messaging token of your install, with the platform, app version and language setting. The game also subscribes your install to a general news topic. | Sending you game news and event notices. Turning notifications off in Settings deletes the token. |
| Gifts | Coins, gems or ad-free time we give your player (for example after a support request), with an optional message, and when the game collected them. | Delivering them to the game. |
| Google account (optional) | Only if you sign in with Google: your Google account ID and, when Google has verified it, your email address, with when you linked them and last signed in. Google also sends us your name; we don't keep it. | Finding your player when you sign in on another phone, linking your cloud save and ad-free subscription to it, and helping you when you contact support. |
| Cloud save (optional) | If you sign in with Google: a copy of your progress as the game saves it (for example coins, gems, heroes, upgrades and missions), with the time the game last changed it. | Restoring your progress on another phone or after reinstalling. |
| Ad-free subscription (optional) | If you buy it: the purchase token Google Play gives the game and the product, and, when our server checks it with Google Play, the plan (monthly or yearly), its status, expiry and renewal setting, the order ID and when we last checked it. | Checking the purchase with Google Play and keeping your player ad-free on your other phones. |
| Ad records | For each ad the game shows: when, the kind (between runs or rewarded), where in the game, the ad network, and the estimated amount it earned with its currency, linked to your player ID. Not your advertising ID. | Counting ad revenue and tuning how often ads appear. |
| Network information | Your IP address reaches our hosting provider with every request. We don't store it: rate limiting keeps a keyed one-way hash of it in counters that are deleted within a day. Our hosting provider may keep standard request logs, including IP addresses, for a short time. | Delivering the service and protecting it from abuse. |
Our server never receives your advertising ID, phone number, contacts, photos, location or payment details, and it receives your email address only if you sign in with Google. The game includes Google's ads software (the Google Mobile Ads SDK, with the User Messaging Platform for consent), which collects data itself as described under "Ads" below; it contains no third-party analytics SDK. Notifications use Google's Firebase Cloud Messaging, purchases Google Play Billing, and sign-in Google's Credential Manager.
If you use the deletion form on this website, we receive the email address, display name and message you enter, only to handle that request.
Signing in with Google (optional)
The game works fully without signing in. If you choose to sign in, Google (through Credential Manager on your phone) gives the game a signed token that our server checks with Google. From it we keep your Google account ID and, if Google has verified it, your email address; Google also includes your name, which we don't keep.
With the same Google account on another phone, the game reaches the same player: your display name and leaderboard scores, your cloud save and your ad-free subscription come with it. If that phone had already started a player of its own, that player's ad-free subscription records move to your account; its runs and leaderboard entries stay with it.
Signing out in the game starts a new anonymous player on that phone; the link stays with your player until you delete your data.
Ads
SUNTHIEF is free and shows ads from Google AdMob: a full-screen ad between some runs, and rewarded videos you choose to watch for a bonus, such as a revive or extra coins. The optional ad-free subscription removes the ads between runs; the rewarded videos stay, and only play when you choose one.
The Google Mobile Ads SDK in the game collects information directly from your phone to show and measure ads, prevent fraud and, where you allow it, personalise them: your device's advertising ID, your IP address (from which an approximate location can be worked out), information about your device and the app, and how you interact with the ads. Google uses it under its own privacy policy; see "How Google uses information from sites or apps that use our services" at policies.google.com/technologies/partner-sites.
In the European Economic Area, the United Kingdom and Switzerland, the game shows Google's consent message (the User Messaging Platform) before it requests ads, and you can change your choice later from the game's settings. If you don't consent, Google limits how it uses your data, for example by showing ads that aren't personalised.
Wherever you live, you can reset or delete your advertising ID, or opt out of personalised ads, in your phone's Google settings (Ads).
The game tells our server which ads it showed (see "Ad records" above); it doesn't send your advertising ID, and we don't give AdMob anything from our server.
The ad-free subscription (optional)
You can buy an optional ad-free subscription in the game, monthly or yearly. Google Play sells it and processes the payment under its own terms and privacy policy; we never receive your card or payment details.
When you buy it, and later when the game checks it again, the game sends our server the purchase token Google Play gave it. Our server can check the token with Google Play's developer API; it then keeps the plan, status, expiry, renewal setting and order ID that Google Play reports, as of that check.
Deleting your data doesn't cancel the subscription: cancel it in Google Play (Play Store > Payments & subscriptions > Subscriptions).
Leaderboards are public
Your display name, hero, best score, distance and the world you reached are shown to other players on the in-game leaderboards (all-time and weekly, per difficulty mode). Don't use your real name or any personal information as your display name.
In the Daily Race, your best result of the day (display name, hero, score and distance) is shown on that day's board. If your run is among the day's best, its recorded path (a "ghost": where your runner was on the track, second by second, with no personal information) can be replayed by other players racing that day. Ghosts outside each day's top 20 are deleted once the day's race is over.
To keep the boards fair and friendly we may reset a display name that breaks the rules, keep a player or a run off the leaderboards, and automatically hold back runs that look impossible until we have checked them.
How we use the data
- To run the leaderboards and show your rank.
- To balance and improve the game, using statistics such as how far runs go, which worlds are reached, how runs end, which heroes and modes are played, and which app versions are in use.
- To find and fix crashes and compatibility problems.
- To keep the service secure and fair (rate limiting, spotting cheating).
- If you sign in with Google: to find your player on your other phones and keep your cloud save there.
- If you buy the ad-free subscription: to check it (with Google Play, when our server can) and keep your player ad-free on every phone you sign in on.
- To count the ads shown and the revenue they earned, and to tune how often ads appear.
Our legal basis is our legitimate interest in providing a working, fair online leaderboard, a stable game and a free game paid for by ads, which you can always opt out of by deleting your data. For the cloud save and the ad-free subscription it is providing what you asked for (our agreement with you). Personalised ads in the EEA, the UK and Switzerland rely on your consent, which Google's consent message asks for. We don't use the data on our server for advertising, profiling or automated decisions about you, and we don't sell it.
How long we keep it
- Run summaries: up to 18 months, then deleted automatically. Your best score per mode stays on the leaderboard for as long as your player exists.
- Crash reports: 90 days.
- Days active: up to 18 months.
- Ad records: 13 months.
- Ad-free subscription records: while the subscription runs, and 18 months after it ends (a purchase our server couldn't check: 18 months after the game last reported it).
- Your Google account link and cloud save: as long as your player exists.
- Rate-limit counters (with hashed IP addresses): about a day.
- Notification tokens: until you turn notifications off or delete your data, or 9 months after the game last refreshed them.
- Deletion requests sent with the website form: 12 months after we handle them, as a record that we did.
- Your player (display name, device and app information): until you delete it. A player whose game hasn't contacted our server for 24 months is deleted automatically with everything linked to it.
- When you delete your data, everything above that is linked to your player is deleted at once.
Deleting your data
In the game, open Settings > Delete my data and confirm. This immediately deletes your player, display name, run summaries, leaderboard entries, linked crash reports, gifts, notification tokens, days active, Google account link, cloud save, subscription records and ad records from our server, and resets your progress on the phone. Your phone needs to be online for this.
Deleting your data doesn't cancel an ad-free subscription: cancel it in Google Play.
If you no longer have the game, use the form on the deletion page or email procoderx786@gmail.com with your display name (shown in the game under Legends > World), and we will delete your player within 30 days and confirm.
Copies in our database provider's short-term backups expire on their own within 30 days. We keep a record that a deletion happened (the random player ID, the date, how many runs, crash reports, subscription records and ad records were removed, and whether a Google account or a cloud save was linked), without your display name or email address.
Where the data is stored
Our server and database run in the United States (Virginia). If you play from elsewhere, for example the EU or the UK, the data the game sends us is transferred there, under appropriate safeguards such as the EU Standard Contractual Clauses in our providers' data processing terms.
Security
All traffic between the game and our server is encrypted (HTTPS). Install IDs and IP addresses are stored only as keyed hashes, player tokens are signed, Google sign-in tokens are checked with Google before we rely on them (purchases too, when our server can check them with Google Play), and access to our dashboard is limited to the developer's allowlisted Google accounts and recorded in an audit log.
Children
SUNTHIEF's target audience on Google Play is 13 and over. Playing needs no personal information: players are identified by a random install ID and a generated name, chosen names are filtered, and signing in with Google is optional. If you believe a child has given us personal information (for example in a display name or by signing in), email procoderx786@gmail.com and we will delete it.
Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or California law), you can ask to access, correct or delete your data, or object to how we use it, and you can withdraw consent to personalised ads at any time in the game's settings. The quickest way to delete is in the game. For anything else email procoderx786@gmail.com with your display name (or your Google account's email address, if you signed in) so we can find your player; we answer within 30 days. You can also complain to your local data protection authority.
Changes to this policy
We will update this page when the game or this service changes what it collects, and change the date at the top. If a change is significant, we will also mention it in the game or on this website.
Contact
Khuram Imtiaz, developer of SUNTHIEF. Privacy: procoderx786@gmail.com. Support: procoderx786@gmail.com.