Privacy Policy

Controller and scope

The controller responsible for NOVA POP! is Cod3.io GmbH, Hegiweg 2, 4457 Diegten, Switzerland. This Privacy Policy applies to the NOVA POP! iOS and iPadOS app, novapop.app, and related support.

NOVA POP! does not currently require a proprietary user account and does not operate its own production analytics backend. If our data practices change, we will update this policy before or when the new processing begins, as required.

Information we process

The information processed depends on the features you choose. Core gameplay works with data stored locally on your device.

• Gameplay and settings: scores, personal bests, currencies, run history, Codex progress, streaks, pass progress, owned or equipped skins, preferences, and reward state.
• Purchase records: product identifier, transaction identifier, entitlement or subscription status, purchase date, and displayed price. We do not receive your complete payment-card details.
• Game Center data, if enabled: your Game Center identity or alias and scores submitted to daily, weekly, or all-time leaderboards.
• Advertising and consent data: your privacy choices and information the Google Mobile Ads SDK may process, as described below.
• Support information: your email address, message, and any files you voluntarily send when contacting us.

Local storage and iCloud sync

NOVA POP! saves core game state as an app file on your device. It also uses device preferences for settings and operational state. This information remains under the device and backup controls provided by iOS or iPadOS.

When iCloud is available for your Apple account, NOVA POP! uses Apple’s iCloud key-value storage to mirror selected progress across your devices. This can include balances, personal bests, run count, Codex discoveries, streak and pass progress, and owned or equipped skins. Apple processes iCloud information under its own privacy terms. You can control iCloud access in your Apple device settings.

Game Center, purchases, notifications, and replays

If you sign in to Game Center, Apple authenticates you and NOVA POP! may display your alias and submit eligible scores to NOVA POP! leaderboards. Apple independently processes Game Center activity, identifiers, scores, achievements, and information you choose to share.

In-app purchases and optional subscriptions are processed through Apple StoreKit and your App Store account. NOVA POP! verifies transactions and stores enough purchase history to grant content, restore entitlements, apply an optional spending limit, and handle renewals, expiry, or refunds. Apple handles billing credentials and payment processing.

If you allow notifications, NOVA POP! schedules local alerts such as capsule-ready, daily reminder, or streak-warning notices. The schedule is maintained on your device and can be changed in the app or system settings.

The replay feature uses Apple ReplayKit to buffer and export a short gameplay clip. Microphone capture is disabled. The clip remains local unless you choose to share or save it through Apple’s share interface, in which case the destination you select applies its own privacy terms.

Advertising and consent choices

NOVA POP! uses Google AdMob to show interstitial and rewarded advertising. The Google User Messaging Platform (UMP) requests or records privacy choices where required. The app checks that advertising requests are permitted before starting the Google Mobile Ads SDK. If a privacy-options entry point is required in your region, you can reopen it from the app settings and change your choice for future processing.

According to Google, its Mobile Ads SDK may process an IP address (which can indicate approximate location), device or app identifiers, advertising data, product interactions, crash logs, diagnostics, and performance information. The exact use—including whether an ad is personalised—depends on your region, consent choice, device settings, Google’s configuration, and applicable law.

NOVA POP! does not request Apple’s App Tracking Transparency permission and does not itself access the IDFA for cross-app tracking. Google and participating advertising partners process information as independent or contracted recipients under their own notices and choices. Purchasing an applicable ad-removal product stops the in-game ad placements covered by that product, but does not erase information already lawfully processed.

The novapop.app website

The website does not currently load advertising or analytics trackers. Our web server may create standard access and security logs containing IP address, timestamp, requested URL, response status, referrer, and browser or user-agent information. We use these logs to deliver, secure, and troubleshoot the site.

If you enter an email address in the TestFlight interest dialog, it is currently saved only in your browser’s local storage and is not transmitted to Cod3.io GmbH. You can remove it by clearing site data in your browser. Before connecting a live waitlist or adding measurement technology, we will update this notice and request any consent required by law.

Purposes and legal bases

We process information to provide the game and features you request, maintain and restore purchases, synchronise optional progress, operate leaderboards, deliver support, show and measure advertising, keep the service secure, meet legal duties, and improve reliability.

• Performance of a contract or steps you request before entering a contract, including gameplay, purchases, and support.
• Your consent where required, particularly for advertising choices and optional device or platform permissions. You may withdraw consent for future processing.
• Our legitimate interests in operating, securing, preventing fraud, and improving NOVA POP!, provided those interests do not override your rights.
• Compliance with legal obligations, including accounting, tax, consumer-protection, and valid authority requests.

Recipients and international transfers

Information is disclosed only where needed to provide the chosen feature, comply with law, protect rights, or follow your instructions. Relevant recipients are Apple for iCloud, Game Center, App Store billing, notifications, and ReplayKit platform functions; Google and advertising partners for AdMob and privacy messaging; hosting and security providers for website delivery; and professional advisers where necessary.

Apple and Google may process information outside Switzerland or the European Economic Area. Where required, transfers rely on an adequacy decision, approved contractual safeguards, or another lawful mechanism. We select providers and require protection appropriate to the information and at least the level required by applicable law; provider-specific processing is also governed by the notices linked above.

We do not sell your personal information. We do not disclose gameplay or support information to data brokers.

Retention and deletion

Local game data is retained until you reset it, delete it through available controls, or remove the app, subject to your device backups. iCloud data remains subject to your iCloud settings and Apple’s retention controls. Game Center and App Store records are controlled primarily by Apple.

Purchase records are retained for as long as needed to provide entitlements, prevent duplicate grants, handle refunds, and meet legal accounting obligations. Website security logs are retained only as long as operationally and legally necessary. Support correspondence is retained until the request is resolved and for a limited period thereafter where needed to document the response.

You can withdraw advertising consent from the privacy options in the app where available. To request access or deletion of information held by Cod3.io GmbH, contact us below. For information held directly by Apple or Google, use that provider’s account and privacy controls.

Children

NOVA POP! is a general-audience game and is not directed specifically to children below the minimum age required to consent to digital services in their country. If you are not old enough to accept these terms or make privacy choices yourself, a parent or legal guardian must review them and supervise your use.

We do not knowingly request a child’s real name, address, contacts, precise location, or other direct profile information. If you believe a child has sent personal information to us through support without appropriate permission, contact us so we can assess and delete it where required.

Your rights and choices

Depending on your location, you may request information and access, correction, deletion, restriction, objection, or portability, and may withdraw consent for future processing. We may need to verify your identity before fulfilling a request. Statutory exceptions may apply, for example where a record must be kept for accounting or legal claims.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, your local supervisory authority. You can also manage Apple and Google information through the relevant account and device privacy controls.

Security, changes, and contact

We use safeguards appropriate to the information and service, including local-first storage, platform security, encrypted network transport supplied by Apple and Google, access controls, limited production access, and secure development practices. No system can guarantee absolute security; please protect your device and Apple account.

We may update this policy when the game, providers, or law changes. Material changes will be communicated in an appropriate way where required. The effective date and version at the top identify the current policy.

Questions and privacy requests can be sent through the protected contact option below or by post to Cod3.io GmbH, Hegiweg 2, 4457 Diegten, Switzerland.