Privacy Policy

For the mobile game Arrow Stitch, published by Parismita Global Solutions, India. Effective 24 October 2026; last updated 29 October 2026.

This policy explains what Arrow Stitch collects, why, who else is involved, and what you can do about it. We have written it in plain language on purpose. If anything is unclear, write to us at arrowstitch.app@gmail.com.

1. The short version

You can play without an account. Signing in is optional. It is only for keeping your progress in the cloud and appearing on the leaderboard, and it is only offered to players aged 18 or over.
We never ask for your real name, phone number, photos, contacts or location.
We ask for your birth month and year once, to keep the game right for your age.
For players under 18: ads are never personalised and no gameplay analytics are collected.
For adults: we use Google's Firebase to see how the game is played, and Google's AdMob shows ads, personalised only if you agree. On iPhone and iPad, ads are never personalised for anyone, and the game never asks to track you.
For everyone: crash reports tell us when the game breaks.
We do not sell personal data.

2. Who is responsible

Parismita Global Solutions ("we", "us") publishes Arrow Stitch and is the data controller (under the GDPR and UK GDPR) and the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) for the personal data the game handles. On Google Play the game is published by Parismita Global Solutions; on the Apple App Store it is sold by its owner, Parismita Gupta, on behalf of Parismita Global Solutions. This policy applies the same way wherever you got the game. Contact details are in section 15.

3. What stays on your device

The game keeps the following in its own storage on your phone or tablet:

your finished levels, the gifts you stitched, your thread and the friends you freed;
coins, hints and items you earned or bought;
the name you gave your sewing buddy (the mascot);
sound, music, vibration and notification settings;
your birth month and year (never the day);
which version of this policy and the Terms you accepted, and when.

If you do not sign in, none of this leaves your device. Device backup is switched off, so uninstalling the game deletes it permanently. If you sign in, a copy is kept on our server (section 4).

4. If you sign in (optional, age 18 and over)

You can sign in with your Google account (or Apple ID on iPhone) from Settings → Profile & cloud save. Sign-in is only offered to players aged 18 or over. Younger players can play the whole game; their progress stays on their device.

Sign-in is handled by Google's Firebase Authentication. Firebase keeps your account's identifier, the email address and the name on the Google or Apple account you used, and when you signed in, so that you can sign in again. We do not use your email or that name for anything else (the leaderboard shows only your buddy's name), and we never email you because you signed in.
Cloud save: our own server stores a copy of your game save (everything listed in section 3, including your birth month and year), linked to your Firebase account identifier, so that your progress can be restored on another device. We do not store your email or your real name on our server. With it we note which version of the game sent it (for example 1.0.0) and on which platform (Android or iPhone), and when, so that we know which versions are still in use.
Fair leaderboard: when the game sends your cloud save from an Android phone, it may ask Google Play's Integrity service to confirm that the game was installed from Google Play, has not been modified, and runs on a genuine device. On an iPhone it uses Apple's App Attest instead: the phone makes a key that Apple vouches for, and our server keeps that key's public half and a counter, to check that later saves come from the genuine game. Our server receives only the answer to those questions (passed or not) - never a list of your apps or other personal data - and uses it only to decide whether the levels you finished count on the leaderboard. Playing is never blocked. Our server also notes when the coins in a save rise faster than playing could earn them, so that we can look into cheating; this never changes your game.
Leaderboard: our server also stores your buddy's name, how many levels you have finished and when you reached that number. Other players can see your buddy's name and level count on the leaderboard. They never see your real name or email. Please do not use your real name as your buddy's name.
Keeping names kind: the game and our server refuse buddy names with rude words or anything that looks like contact details (an email or web address, a phone number). When a player aged 18 or over changes their buddy's name, the game sends the name to our server to be checked against our current rules. It is checked and forgotten, not stored.
Reporting a name: any signed-in player can report a name on the leaderboard by choosing a reason and, if they wish, adding a short note. Our server stores the report (who reported it, the name, the reason, the note, and when) so we can review it, and a name that several players report is hidden. Please do not put personal details in a note.

5. Notifications (optional, age 18 and over)

Notifications are only offered to players aged 18 or over. If you allow them, your device gets a push token from Google's Firebase Cloud Messaging. Our server stores that token with your device type, the game's version, your language setting and, if you are signed in, your account identifier. We use it only to send news and reminders about the game. Turning notifications off in the game removes the token from our server. You can also turn them off in your phone's settings at any time.

6. Analytics and crash reports

Gameplay analytics (adults only): if you have told the game you are 18 or over, Google Analytics for Firebase records how the game is played. This includes screens opened, levels started and finished, hints and coins used, and purchases made. It also records device information (model, system version, language, approximate country) and a Firebase installation ID. We use it to fix confusing parts of the game and to balance it. It never includes your name, your email or your buddy's name. For players under 18, and before the age question is answered, it is switched off.
Crash reports (everyone): if the game crashes or hits an error, Firebase Crashlytics sends us a technical report. The report contains what went wrong, the device model, system version, app version and a Firebase installation ID. It is used only to fix bugs.

7. The services we use

Some parts of the game rely on other companies, which process data under their own policies as well as this one.

Service	What for	What it may collect
Google AdMob, with Google's consent tool	Showing ads, including optional videos you choose to watch for rewards, and asking for ad consent where the law requires it	Device advertising ID, IP address (for approximate location), device and app information, ad interactions. How Google uses data
Google Firebase (Analytics, Crashlytics, Authentication, Cloud Messaging)	Analytics (adults only), crash reports, optional sign-in and optional notifications	As described in sections 4 to 6, plus a Firebase installation ID. Firebase and privacy
Google Play / Apple App Store	Purchases and the No ads subscription	Payment is handled entirely by the store. We only learn what was bought and whether it succeeded, never your card or bank details. Our server asks the store (Google on Android, Apple on an iPhone) to confirm each purchase before it is delivered, and keeps a record of it - the item, the store's order or transaction number and purchase reference, the time, whether it was a test purchase, whether it was later refunded, and your account identifier if you were signed in - to stop fake and repeated purchases and to handle refunds. Google · Apple
Our server (hosted by Hostinger)	Cloud save, leaderboard and notification tokens (sections 4 and 5), downloading new levels, the game's settings (such as coin prices and rewards), and checking for a newer version of the game	What sections 4 and 5 describe. Like every website, our host keeps standard server logs (IP address, time and address of the request) for security. To stop abuse, our server counts requests per minute; it stores only a scrambled (hashed) form of the IP address, and deletes those counts within minutes.

8. Why we use it, and our legal basis

Purpose	Data	Legal basis
Running the game and saving your progress	On-device game data	Performing our agreement with you (the Terms)
Cloud save and leaderboard	Sign-in identifier, game save, buddy name, level count	Your request when you choose to sign in (our agreement with you); your consent
Keeping leaderboard names kind	Names checked as they are typed (not stored); reported names, who reported them, the reason, any note, and when	Our legitimate interest, and the app stores' rules, in keeping the game safe for everyone
Notifications	Push token and the details in section 5	Your consent, given when you allow notifications
Age-appropriate ads and features	Birth month and year	Legal obligation to protect minors; your consent
Personalised ads (adults only)	Advertising ID and ad data, collected by Google	Your consent, which you can withdraw at any time
Gameplay analytics (adults only)	Gameplay events, device information, installation ID	Our legitimate interest in improving the game; your consent where the law requires it
Crash reports, non-personalised ads, level downloads, update checks, security	Device information, installation ID, IP address	Our legitimate interest in running a free game safely and reliably
Purchases	Purchase confirmation	Performing the purchase you asked for

Where we ask for consent (for example on the consent prompt shown in the European Economic Area, the UK and Switzerland), you can withdraw it at any time without affecting anything done before, and without losing access to the game.

9. Children and young people

Arrow Stitch is a calm puzzle game suitable for everyone. The first time it opens, it asks for your birth month and year. If you are under 18:

we tell the advertising service to show only non-personalised, age-appropriate ads (rated for general audiences), and players under 13 are treated as children under Google's rules for ads;
gameplay analytics are switched off: we do not track or monitor your behaviour, or build a profile of you;
crash reports still work, because they describe a crash, not you;
you cannot sign in or turn on notifications, so nothing about you is stored on our server (apart from the standard logs every website keeps) and your progress stays on your device. India counts everyone under 18 as a child, and we apply that everywhere;
purchases need the store's own approval, which parents can control with Google Family Link or Apple Screen Time / Ask to Buy.

This is how we meet the US Children's Online Privacy Protection Act (COPPA), the GDPR and the UK Age Appropriate Design Code, and section 9 of India's DPDP Act, which forbids tracking, behavioural monitoring and targeted advertising directed at children. If you believe a child has given us personal data they should not have, write to arrowstitch.app@gmail.com and we will delete it.

10. Sharing and selling

We do not sell personal data. We share data only with the services in section 7, which act for us or collect data directly, and we show your buddy's name and level count to other players on the leaderboard if you sign in. Under some US state laws (such as California's CCPA/CPRA), personalised advertising can count as "sharing". You can opt out using the settings in section 12 or by writing to us. We will disclose information to anyone else only if the law requires it.

11. International transfers

We are based in India. Our server and the services in section 7 may process data in other countries, including the United States. Where the GDPR or UK GDPR applies, these companies rely on approved safeguards such as the European Commission's Standard Contractual Clauses. We do not transfer data to any country restricted by the Government of India under the DPDP Act.

12. Your advertising choices

In the game: Settings → Ad privacy choices lets you review or change your ad consent (where the consent prompt applies).
Android: Settings → Google → Ads (delete or reset your advertising ID).
iPhone and iPad: the game never asks to track you and its ads are never personalised there. You can also turn off "Allow Apps to Request to Track" for all apps in Settings → Privacy & Security → Tracking.
"Do Not Track": the game and its website do not follow you across other companies' apps or websites, so a browser's "Do Not Track" signal has nothing to switch off.

13. Deleting your data

In the game: Settings → Profile & cloud save → Delete account. This deletes your cloud save, your leaderboard entry and any name reports you made or received from our server, and deletes your sign-in account, straight away. Records of purchases you made are kept (we need them to handle refunds and for our accounts), but are no longer linked to you.
Without the game: email arrowstitch.app@gmail.com with the subject "Delete my Arrow Stitch data". Tell us your buddy's name and the Google or Apple account you signed in with, so we can find your account. We delete your cloud save, your leaderboard entry and your sign-in account within 30 days, and tell you when it is done.
Notifications: turning them off in the game removes your device's token from our server.
On your device: uninstalling the game deletes everything stored on it.
Analytics and crash data are not linked to your name or email. They are deleted automatically (see section 16). If you would like us to ask Google to delete them sooner, write to us.

14. Your rights

Wherever you live, you can ask us to:

access — tell you what personal data we hold about you and how it is used;
correct or update it;
erase it (section 13);
withdraw consent or object to a use of it, including personalised ads and analytics;
restrict its use or receive a portable copy (GDPR / UK GDPR);
nominate another person to exercise your rights if you die or become unable to (India, DPDP Act section 14).

Write to the Grievance Officer below. We will not treat you differently for using these rights. If you are unhappy with our answer you can complain to your data protection authority: in India the Data Protection Board of India, in the EU your national supervisory authority, in the UK the Information Commissioner's Office (ico.org.uk). Under the DPDP Act you should first use our grievance process below.

15. Grievance Officer and contact

As required by India's DPDP Act, 2023 and the DPDP Rules, 2025:

Grievance Officer, Parismita Global Solutions
Email: arrowstitch.app@gmail.com
155 Thakor Vas, Chaklawalo Vas,
Saijpur Gopalpur, Pirana Road,
Ahmedabad, Gujarat 382405, India

We acknowledge every request within 7 days and answer it within 30 days (and never later than the 90 days the DPDP Rules allow). We may need to ask a question to confirm the request is genuinely yours.

16. How long we keep data, and security

Cloud save and leaderboard entry: until you delete your account or ask us to.
Reports of names: until the account of the player who reported, or of the player reported, is deleted.
Notification token: until you turn notifications off or ask us to delete it.
Purchase records: as long as we need them to handle refunds and keep our accounts as the law requires; unlinked from your account when you delete it.
Gameplay analytics: kept by Google for no more than 14 months.
Crash reports: kept by Firebase for up to 90 days.
Server logs: kept by our host for a limited time, for security.
Request counts: deleted within minutes.

Everything the game sends travels over encrypted HTTPS connections. Our server only accepts saves from a signed-in player, checked with Google's own sign-in tokens, and each player can only read and change their own save. Its password files are kept outside the public website. No system is perfectly secure, but we collect as little as possible so there is as little as possible to protect. If a breach ever affected your personal data, we would inform you and the authorities as the law requires.

Found a security problem? Please tell us privately at arrowstitch.app@gmail.com (subject "Security report") instead of sharing it publicly, so we can fix it first. Do not access or change other players' data while looking.

17. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and ask you to accept the new version inside the game before it applies to you.