Privacy Policy

Controller and scope

The controller responsible for NOVA POP! is Cod3.io GmbH, Hegiweg 2, 4457 Diegten, Switzerland. This Privacy Policy applies to the NOVA POP! iOS and iPadOS app, novapop.app, and related support.

NOVA POP! does not require a proprietary user account. We do not run analytics servers of our own; usage statistics and crash reports are processed by Google Firebase as described below. If our data practices change, we will update this policy before or when the new processing begins, as required.

Information we process

The information processed depends on the features you choose. Core gameplay works with data stored locally on your device.

• Gameplay and settings: scores, personal bests, currencies, run history, Codex progress, streaks, pass progress, owned or equipped skins, preferences, and reward state.
• Purchase records: product identifier, transaction identifier, entitlement or subscription status, purchase date, and displayed price. We do not receive your complete payment-card details.
• Game Center data, if enabled: your Game Center identity or alias and scores submitted to daily, weekly, or all-time leaderboards.
• Advertising and consent data: your privacy choices and information the Google Mobile Ads SDK may process, as described below.
• Usage statistics and crash reports: pseudonymous events about how the game is used and technical reports when it crashes, processed by Google Firebase as described below. You can switch both off in the app settings.
• Support information: your email address, your name if you provide one, your messages, and the technical details sent with an in-app support request, as described below; for email contact also any files you voluntarily send.

Local storage and iCloud sync

NOVA POP! saves core game state as an app file on your device. It also uses device preferences for settings and operational state. This information remains under the device and backup controls provided by iOS or iPadOS.

When iCloud is available for your Apple account, NOVA POP! uses Apple’s iCloud key-value storage to mirror selected progress across your devices. This can include balances, personal bests, run count, Codex discoveries, streak and pass progress, and owned or equipped skins. Apple processes iCloud information under its own privacy terms. You can control iCloud access in your Apple device settings.

Game Center, purchases, notifications, and replays

If you sign in to Game Center, Apple authenticates you and NOVA POP! may display your alias and submit eligible scores to NOVA POP! leaderboards. Apple independently processes Game Center activity, identifiers, scores, achievements, and information you choose to share.

In-app purchases and optional subscriptions are processed through Apple StoreKit and your App Store account. NOVA POP! verifies transactions and stores enough purchase history to grant content, restore entitlements, apply an optional spending limit, and handle renewals, expiry, or refunds. Apple handles billing credentials and payment processing.

If you allow notifications, NOVA POP! schedules local alerts such as capsule-ready, daily reminder, or streak-warning notices. The schedule is maintained on your device and can be changed in the app or system settings.

The replay feature uses Apple ReplayKit to buffer and export a short gameplay clip. Microphone capture is disabled. The clip remains local unless you choose to share or save it through Apple’s share interface, in which case the destination you select applies its own privacy terms.

Advertising and consent choices

NOVA POP! uses Google AdMob to show interstitial and rewarded advertising. The Google User Messaging Platform (UMP) requests or records privacy choices where required. The app checks that advertising requests are permitted before starting the Google Mobile Ads SDK. If a privacy-options entry point is required in your region, you can reopen it from the app settings and change your choice for future processing.

According to Google, its Mobile Ads SDK may process an IP address (which can indicate approximate location), device or app identifiers, advertising data, product interactions, crash logs, diagnostics, and performance information. The exact use—including whether an ad is personalised—depends on your region, consent choice, device settings, Google’s configuration, and applicable law.

Where advertising is permitted, NOVA POP! asks for Apple’s App Tracking Transparency permission after the privacy message. Only if you allow it can the Google SDKs read your device’s advertising identifier (IDFA), for example to personalise ads or attribute an install to an ad campaign; if you decline, ads are shown without it. You can change this at any time in the iOS settings under Privacy & Security → Tracking. Google and participating advertising partners process information as independent or contracted recipients under their own notices and choices. Purchasing an applicable ad-removal product stops the in-game ad placements covered by that product, but does not erase information already lawfully processed.

Usage statistics and crash reports

Versions of NOVA POP! downloaded from the App Store use Google Analytics for Firebase to understand how the game is played and which features, offers, and advertising campaigns work. The app records events such as tutorial steps, the start and end of a run with mode and score, level and league changes, rewards opened, purchases started or completed (product, amount, and currency), ads shown, and the status of your privacy and tracking choices. We do not send your name, email address, Game Center alias, or contacts to Firebase.

Firebase links these events to a randomly generated app-instance identifier and the identifier for vendors (IDFV), and processes device model, iOS version, app version, language, and an approximate region derived from your IP address; Google states that the IP address itself is not stored. The advertising identifier is included only if you allowed tracking as described above. Your choice in the privacy message is passed to Firebase (Consent Mode): without your consent, Firebase works without persistent analytics identifiers and the data is not used for advertising purposes. Our Firebase project is linked to our Google Ads and AdMob accounts so that an install or purchase can be attributed to an ad campaign and ad revenue can be reported; with Apple’s SKAdNetwork this happens in aggregated form.

Firebase Crashlytics sends a report when the app crashes: the stack trace, device model, iOS and app version, free memory and storage, device orientation, the time of the crash, a Crashlytics installation identifier, and, while usage statistics are enabled, the last analytics events before the crash. We use these reports only to find and fix errors.

You can switch off both services at any time in the app under Settings → “Do not send usage statistics”. Event-level analytics data is deleted after 14 months and crash reports after 90 days. The provider is Google Ireland Limited; Google LLC in the United States may process the data as described under international transfers.

Feedback and support

The “Feedback & Support” area in the app settings runs on Chatwoot, an open-source customer-support system that Cod3.io GmbH operates on its own installation at support.cod3.io, hosted in Frankfurt am Main, Germany. Nothing is sent until you submit the form. When you start a conversation, the app sends your email address, your name if you provide one, and your message, together with the app version, iOS version, device model, language setting, and whether Orbit Pass Premium is active. The form in the app lists the same details before you send it.

So that you can continue the conversation later, the app keeps a contact identifier and an access token for your conversation in the device keychain. While the support page is open, the app holds a live connection to the support system to show replies, and it checks for unread replies to display a badge. As with any server, the support system processes your IP address when the app connects. We use support information only to answer you, solve the problem, and improve the game.

If you prefer not to use the in-app form, you can write to us through the protected contact button on this page instead; your email then reaches us through our mail provider.

The novapop.app website

Our web server may create standard access and security logs containing IP address, timestamp, requested URL, response status, referrer, and browser or user-agent information. We use these logs to deliver, secure, and troubleshoot the site.

Only if you choose “Allow” in the privacy panel does the website load Google Analytics 4 (Google Ireland Limited; data may also be processed by Google LLC in the United States). It then sets cookies such as _ga and records page views, scrolling, clicks on App Store links, the campaign or referrer that brought you here, approximate location derived from your IP address, and device and browser details. We use this to understand which pages and advertising campaigns lead people to the game; we do not use it for remarketing or personalised advertising. If you decline, no Google Analytics code is loaded and no such cookies are set. You can change your choice at any time through “Cookie settings” in the page footer; withdrawing removes the Analytics cookies from your browser. Your choice itself is stored in your browser’s local storage.

The site is available in English and German. Our server reads the language setting your browser sends and shows the German pages to German-language browsers. If you switch language yourself, a cookie named novapop_locale remembers that choice for one year; it contains only “en” or “de” and is not used for anything else.

If you enter an email address in the TestFlight interest dialog, it is currently saved only in your browser’s local storage and is not transmitted to Cod3.io GmbH. You can remove it by clearing site data in your browser. Before connecting a live waitlist, we will update this notice and request any consent required by law.

Purposes and legal bases

We process information to provide the game and features you request, maintain and restore purchases, synchronise optional progress, operate leaderboards, deliver support, show and measure advertising, understand how the game is used, find and fix crashes, keep the service secure, meet legal duties, and improve reliability.

• Performance of a contract or steps you request before entering a contract, including gameplay, purchases, and support.
• Your consent where required, particularly for advertising choices, tracking, analytics identifiers, website measurement, and optional device or platform permissions. You may withdraw consent for future processing.
• Our legitimate interests in operating, securing, preventing fraud, diagnosing crashes, and improving NOVA POP! on the basis of pseudonymous usage statistics, provided those interests do not override your rights.
• Compliance with legal obligations, including accounting, tax, consumer-protection, and valid authority requests.

Recipients and international transfers

Information is disclosed only where needed to provide the chosen feature, comply with law, protect rights, or follow your instructions. Relevant recipients are Apple for iCloud, Game Center, App Store billing, notifications, and ReplayKit platform functions; Google and advertising partners for AdMob and privacy messaging; Google for Firebase Analytics, Firebase Crashlytics, and website measurement; hosting and security providers for delivering the website and our support system; and professional advisers where necessary.

Apple and Google may process information outside Switzerland or the European Economic Area. Where required, transfers rely on an adequacy decision, approved contractual safeguards, or another lawful mechanism. We select providers and require protection appropriate to the information and at least the level required by applicable law; provider-specific processing is also governed by the notices linked above.

We do not sell your personal information. We do not disclose gameplay or support information to data brokers.

Retention and deletion

Local game data is retained until you reset it, delete it through available controls, or remove the app, subject to your device backups. iCloud data remains subject to your iCloud settings and Apple’s retention controls. Game Center and App Store records are controlled primarily by Apple.

Purchase records are retained for as long as needed to provide entitlements, prevent duplicate grants, handle refunds, and meet legal accounting obligations. Firebase deletes event-level analytics data after 14 months and crash reports after 90 days; Google Analytics data from the website is likewise kept for 14 months. Website security logs are retained only as long as operationally and legally necessary. Support conversations are retained until the request is resolved and for a limited period thereafter where needed to document the response; you can ask us to delete your conversation and contact record earlier.

You can withdraw advertising consent from the privacy options in the app where available, and stop usage statistics and crash reports with the switch in the app settings. To request access or deletion of information held by Cod3.io GmbH, contact us below. For information held directly by Apple or Google, use that provider’s account and privacy controls.

Children

NOVA POP! is a general-audience game and is not directed specifically to children below the minimum age required to consent to digital services in their country. If you are not old enough to accept these terms or make privacy choices yourself, a parent or legal guardian must review them and supervise your use.

We do not knowingly request a child’s real name, address, contacts, precise location, or other direct profile information. If you believe a child has sent personal information to us through support without appropriate permission, contact us so we can assess and delete it where required.

Your rights and choices

Depending on your location, you may request information and access, correction, deletion, restriction, objection, or portability, and may withdraw consent for future processing. We may need to verify your identity before fulfilling a request. Statutory exceptions may apply, for example where a record must be kept for accounting or legal claims.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, your local supervisory authority. You can also manage Apple and Google information through the relevant account and device privacy controls.

Security, changes, and contact

We use safeguards appropriate to the information and service, including local-first storage, platform security, encrypted network transport supplied by Apple and Google, access controls, limited production access, and secure development practices. No system can guarantee absolute security; please protect your device and Apple account.

We may update this policy when the game, providers, or law changes. Material changes will be communicated in an appropriate way where required. The effective date and version at the top identify the current policy.

Questions and privacy requests can be sent through the protected contact option below or by post to Cod3.io GmbH, Hegiweg 2, 4457 Diegten, Switzerland.