Privacy Policy

Last updated: 2 November 2026

1. Scope and controller

This policy explains how data is processed in SkyRoads and on skyroads.games. The game publisher and the controller for the processing described below is Samsufi sp. z o.o., address: ul. Jagiellońska 4A, 19-120 Knyszyn, Poland, entered in the Polish National Court Register (KRS) under number 0000901262, EU VAT: PL5423435334.

For privacy, GDPR and data deletion requests, contact [email protected]. For technical support, contact [email protected]. We do not run a telephone helpline; email is our contact channel. You do not need to install the game or create an account to contact us.

The company has not appointed a data protection officer (DPO). For data protection matters, contact [email protected].

This policy covers Android, including the app with package name pl.samsufi.skyroads, version 1.0.0. The game has not yet been released; a closed test on Google Play is planned before release. This policy describes the launch version, which will show Google AdMob ads with consent managed through Google's User Messaging Platform (UMP). An iOS version is planned; section 8 explains what this means.

We do not operate our own server containing player profiles. This does not mean that no data leaves your device when you use the game: in the launch version, Google provides advertising and store services and, if you have enabled device backup, keeps a backup of your progress in your Google Account, and Cloudflare delivers the website. We are responsible for selecting and configuring the services used in SkyRoads to the extent required by law.

2. Key information

• SkyRoads is a single-player strategy game against computer-controlled rivals. It has no multiplayer mode, chat, leaderboard, SkyRoads accounts, user-generated content or forms. It does not use Google Play Games.
• The game is free. It has no in-app purchases and no pay-to-win features.
• Settings and progress are stored locally. If Android device backup is enabled, Android may copy saved progress to your Google Account (section 4).
• The game does not ask for your real name or email address. However, these may appear in an email you send to us.
• The game has no analytics or crash-reporting tool of our own, and its own code makes no network connections. In the launch version, all of the game's network traffic comes from the Google Mobile Ads SDK, which may process its own diagnostic and usage data.
• The game is fully playable offline. Without a connection, no ads are loaded and the game works the same.
• The game uses only the vibration permission, for haptic feedback. It does not use contacts, the camera, microphone, photos or location permissions. AdMob may estimate your approximate location from your IP address; this is not GPS location.
• The game is intended for ages 13 and above. The age for playing the game and the age for independently consenting to data processing are different questions.

3. Data, purposes and legal bases

In the table, “contract” means GDPR Article 6(1)(b), “consent” means Article 6(1)(a), “legal obligation” means Article 6(1)(c), and “legitimate interest” means Article 6(1)(f). A legal basis for personal data processing does not replace any required permission to store or access information on your device.

Providing information in correspondence is voluntary, but we cannot handle a matter without the information necessary to respond. Technical data is needed for the selected service to work. Android backup is optional and controlled in your device settings. Refusing ad personalisation consent does not mean refusing access to the game.

4. Data on your device and Android backup

The game stores the following information in its private app directory:

We do not upload these files to our own server. There are no in-app purchases, so the game does not process payment or purchase data.

Android Auto Backup: if you have enabled device backup, Android may copy progress.xml to the backup in your Google Account and transfer it to a new device during setup. The game's backup rules include only progress.xml; battle.xml is excluded from both cloud backup and device-to-device transfer and stays on the current device. The backup is managed by Android and Google under your Google Account; we have no access to it. When you reinstall the game, Android may restore your progress from that backup. Google's information on Android backup.

“Reset progress” in the game's menu (confirmed with a second tap) clears progress, stars, best times, statistics, achievements, challenge and event records, streaks, Embers, Kingdom Commissions, collected cosmetic items, tips shown and any unfinished battle, while keeping most settings. Android's next automatic backup normally replaces the earlier backup copy. Uninstalling the game or clearing its data removes both files from the device; a backup copy in your Google Account may remain until you delete it (section 11).

Vibration: the game uses the Android vibration permission only for short haptic feedback, for example when a building is captured. This permission does not show a prompt and gives no access to your data. You can turn vibration off in the game's settings. In the launch version, the Google Mobile Ads SDK adds the permissions it needs, such as internet access, network state and the advertising ID permission (AD_ID).

5. Advertising and privacy choices

How advertising works

In the launch version, SkyRoads shows full-screen Google AdMob interstitial ads only after some won battles, on the result screen, after the result and rewards have been saved. There are no banner ads, rewarded ads or paid ad removal. Ads never affect rewards, stars, progress or events. The terms of use describe how often ads may appear.

The Android launch version uses the Google Mobile Ads SDK, which includes Google's User Messaging Platform, or UMP. SkyRoads' own code makes no network connections: all of the game's network traffic comes from this Google SDK, which Google states uses encrypted HTTPS/TLS connections.

The advertising SDK may process IP addresses, approximate location inferred from IP, the Android advertising ID, App Set ID, device and app information, app launches, taps, ad views and other interactions, and diagnostics such as performance and hang rate. Google's documentation also includes certain account identifiers where applicable. This does not mean that the game receives your Google Account email address. Google's Mobile Ads SDK data disclosure.

Consent and withdrawal

At every launch, the game first asks UMP for the status of your choices. In regions where consent is required (the EEA, the United Kingdom and Switzerland), UMP shows a form based on the IAB TCF. Delivering the form itself may require a technical connection to Google; that is different from consent to personalised advertising.

Ads are requested only when UMP reports that ads may be requested: you have completed the form, whatever choices you made, or consent is not required. If UMP cannot confirm this, no ad is requested and the game continues normally.

Settings → “Privacy options” reopens the UMP privacy options form. You can change your choices or withdraw consent there at any time. Withdrawal does not affect the lawfulness of processing carried out previously.

Refusing personalisation disables personalisation based on that consent. It does not automatically provide permission for identifiers or advertising measurement. Non-personalised ads may also use device storage and require consent. Google decides, based on your TCF choices, whether a personalised ad, a non-personalised ad, a limited ad or no ad is shown. Declining personalisation never blocks the game.

Device settings

On Android, search the device settings for “Ads” or go to Privacy → Ads; on some versions, use Google → All services → Ads. You can reset or delete your advertising ID. Older versions offer an option to opt out of ad personalisation. Menu names vary by device. See Google's instructions. You can also manage Google's ad settings in My Ad Center.

Resetting the ID does not delete data Google has previously collected and does not replace changing your UMP choice. It also does not change other SDK identifiers, such as App Set ID.

6. Store data

Google Play separately handles installations and updates. Through Google Play Console and Android vitals, we receive aggregated statistics (such as installs, ratings, countries, device models and Android versions) as well as crash and ANR (“app not responding”) reports containing technical stack traces, the device model and the operating system version. Crash, ANR and vitals data come only from users who have allowed their device to share usage and diagnostics data with Google. We do not link this data to a player's identity. It is available to us for as long as Google Play Console retains it.

During the closed test, the tester list in Google Play Console holds the email addresses of the Google Accounts that testers use to join, and we receive testers' feedback sent through Google Play. We use them only to run the test, on the basis of our legitimate interest in testing the game before release.

7. The skyroads.games website

Hosting and security

The website is static, without accounts, forms or advertising. Cloudflare Pages delivers the website and protects it against abuse. Cloudflare receives IP addresses and HTTP request data needed to transmit content and protect its services, and keeps its logs according to its own policy. We do not have access to raw IP logs. Fonts are served from the website itself, so the site sends no requests to external font services.

The site itself sets no cookies. Cloudflare's security features may set strictly necessary security cookies (such as __cf_bm) only when bot protection requires it.

Website statistics

We use Cloudflare Web Analytics on skyroads.games. According to Cloudflare, it uses no cookies and no fingerprinting. The page loads a small beacon script from static.cloudflareinsights.com, which collects aggregated metrics: page views, referrer, browser, device type, country derived from the IP address and page performance. We see only aggregated statistics. The legal basis is our legitimate interest in improving the website.

Remembering your language

Only when you explicitly select a language from the menu does the site write an sr-lang entry to your browser's localStorage. It contains the language code and an expiry date, expires automatically 6 months after it is saved, and is never sent to us. It is not used for tracking. You can change the choice in the menu or remove the entry by clearing this site's data in your browser. Blocking storage may prevent the site from remembering your preference.

Article 399 of Poland's Electronic Communications Law and Article 5(3) of the ePrivacy Directive apply to localStorage as well as cookies. Storage strictly necessary to provide a feature you have explicitly requested is exempt from the consent requirement. The sr-lang entry serves only to provide the function you requested by choosing a language, so it does not require consent.

The website links to samsufi.dev and, once the game is available, to its store pages. When you follow an external link, that website's operator applies its own privacy rules.

8. Player age and the planned iOS version

The game is not directed at children under 13 and is not enrolled in Google Play's Families programme. This does not remove protection for minors. In Poland, a person under 16 cannot independently give consent covered by GDPR Article 8; consent or authorisation from the holder of parental responsibility is required. Other EU countries may set the threshold between 13 and 16. This does not mean that every game feature requires personal data consent.

The game does not ask your age and does not set TFUA, TFCD or age-restricted treatment in AdMob or UMP. This is our deliberate decision: ad personalisation depends solely on the choices made in the UMP consent form. Clicking a UMP form or labelling the game “13+” does not verify age or parental consent.

If you live in the EEA and are under 16, check the digital consent age applicable in your country. If you are below the applicable threshold, do not agree to personalised ads without consent or authorisation from your parent or guardian. You can refuse personalisation in the UMP form; Google will then show non-personalised or limited ads, or no ad, depending on your other choices, as explained in section 5. The game has no technical mechanism that verifies age or parental consent, so please follow this guidance.

If you believe that a child's data has been processed improperly, contact [email protected]. Do not send identity document scans or additional information about the child unnecessarily.

An iOS version of SkyRoads is planned. It runs the same game and stores its data locally on the device. Before it is released, we will update this policy with any iOS-specific details, including Apple's App Tracking Transparency if that version shows ads. Until then, this policy describes the Android version only.

9. Recipients and transfers outside the EEA

Google: for AdMob, the publisher and Google generally act as separate controllers. Certain features may be subject to processor terms; refusing personalisation does not automatically turn the entire relationship into a processor arrangement. Google is also separately responsible for its accounts, Android backup and the store. Read Google's Privacy Policy, how Google uses data from partner websites and apps, and its explanation of AdMob roles.

SkyRoads uses Google AdMob as its only ad network and does not use ad mediation. The UMP consent form lists the ad technology providers Google may work with when serving ads; you can review that list and make your choices in the form.

Cloudflare: it acts as a processor for data processed on our instructions, including customer logs and website statistics covered by its data processing agreement. It may act as a separate controller for its own network data and its own purposes described in its policy. Cloudflare Privacy Policy and Data Processing Addendum.

Email: messages sent to [email protected] and [email protected] are routed through Cloudflare Email Routing to a Gmail mailbox provided by Google. According to Cloudflare, Email Routing forwards messages and does not store their content beyond delivery. Both Cloudflare and Google are recipients of this correspondence and process it as our processors. We keep no other backups of this correspondence beyond the mailbox provider.

Google and Cloudflare may process data in the United States and other countries outside the EEA. The mechanism depends on the recipient and the particular transfer:

• Google identifies the EU–US Data Privacy Framework for Google LLC and covered certified US companies, and European Commission standard contractual clauses where required for transfers not covered by an adequacy decision. Google's transfer frameworks.
• Cloudflare identifies the EU–US Data Privacy Framework for transfers covered by its certification, and standard contractual clauses, including for other relevant transfers and as a fallback if the DPF basis is lost. Its privacy policy and Data Processing Addendum provide details.

The DPF does not automatically cover every company or transfer. Contractual clauses require assessment of transfer conditions and, where necessary, supplementary safeguards. To ask about safeguards for data for which we are responsible and how to obtain a copy, contact [email protected].

10. Retention and security

Local files remain until you uninstall the game or clear its data; “Reset progress” clears progress earlier. An Android backup copy requires separate action (section 11). Clearing the website's localStorage removes the language preference, not the history of data previously processed by providers.

We retain emails sent to [email protected] and [email protected], including their attachments, for 2 years after the case is closed. This also applies to emails containing GDPR requests.

In addition, we keep a separate minimal register of how GDPR requests were handled: the date, the scope of the request, the outcome, the response date and confirmation that the request was fulfilled. We keep this register for 3 years after the case is closed. It does not contain full emails or attachments.

We do not keep a separate set of evidence for possible disputes by default. If an actual dispute or claim arises, we keep the specific messages relevant to it until the dispute is finally resolved and the limitation period for claims has expired, and we inform the person concerned.

Data held by Google and Cloudflare under their own control is retained according to their policies: Google's information on data retention and Cloudflare's Privacy Policy. We cannot set a single deletion date for that data. UMP stores your consent choices on the device until you change them or clear the app data.

Where providers act as separate controllers, their retention depends on the service purpose, account settings, deletion requests, legal obligations and abuse prevention.

Local data is kept in the app's private directory. Google states that data collected by its advertising SDK is encrypted in transit. This does not mean that every game file is encrypted or that email is end-to-end encrypted. We do not promise absolute security. The game's own code sends nothing over the network; its network traffic is limited to the Google SDK described in section 5.

11. How to delete data without installing the game

1. Data on your phone: uninstall SkyRoads or clear its data in the app settings. This removes local progress, settings and any unfinished battle. To clear only progress and keep settings, use “Reset progress” in the game.
2. Android backup: in your device's backup settings or your Google Account storage (for example in Google One or Google Drive), you can turn off device backup or delete an existing device backup. Menu names vary by device and Android version. See Google's instructions. If you reinstall SkyRoads while a backup exists, Android may restore your progress.
3. Advertising data held by Google: change or withdraw consent in Settings → “Privacy options”, reset or delete your advertising ID (section 5) and use My Ad Center and your Google Account's privacy controls. We do not hold Google's advertising data and cannot delete Google's records directly.
4. Data under our control: email [email protected], identifying SkyRoads and what you want deleted. You may use ordinary webmail. We do not require installation, a SkyRoads account or an in-app request.

There are no SkyRoads accounts to delete. We also have no remote access to your phone's files or your Google Account backups and no authority to delete your Google Account. Where needed, we will help identify the right route, fulfil requests within our responsibility and will not refer you to a provider instead of fulfilling our own obligation.

12. Your rights

To the extent and under the conditions provided by the GDPR, you may:

• access your data and obtain a copy;
• correct inaccurate data and complete incomplete data;
• request deletion or restriction of processing;
• obtain data in a portable format where processing is automated and based on consent or a contract;
• object, on grounds relating to your situation, to processing based on legitimate interests; objection to direct marketing is unconditional;
• withdraw consent as easily as it was given, without affecting earlier lawful processing;
• complain to the President of the Personal Data Protection Office in Warsaw, Poland (PUODO), or the competent authority in the country of your habitual residence, work or the alleged infringement. UODO complaint information.

Send requests to [email protected]. We respond without undue delay, normally within one month. Where the law allows an extension because of a request's complexity or the number of requests, we will explain the reason and extension within the first month, with a maximum of two additional months. If there is reasonable doubt, we may request only information necessary to confirm that the request concerns you.

Rights are not absolute. For example, certain data cannot be deleted where law or the defence of claims requires it. We will explain any refusal and the available remedies. We do not collect extra identifiers solely to identify local data that we do not hold.

SkyRoads does not make decisions about you based solely on automated processing that have legal or similarly significant effects. Ad personalisation may involve profiling by providers, depending on consent and settings.

13. Policy changes

If data, services or legal requirements change, we will update this policy and its date. SkyRoads has no online leaderboard or other online feature of its own; if we add one, or another SDK, we will update this policy before the change takes effect. We will communicate a material change in a way appropriate to its scope before it affects your data. Updating this document or continuing to use the game does not replace fresh consent where required.

For questions about this policy, contact [email protected].