Privacy Policy
Last updated: 5 October 2026
This policy explains what information the game Spirit & Shadow (the “Game”, on Android, iOS and the web) uses, why, and the choices you have.
Who we are
The Game is published by ERDEN2 LTD, a company registered in England and Wales (company number 17084131), registered office 48 Castle Street, Canterbury, Kent, CT1 2PY, United Kingdom. ERDEN2 LTD is the data controller for the information described here. Contact: contact@spiritandshadow.com.
The short version
- You can play without an account. Your progress is then stored only on your device.
- If you choose to sign in with Google or Apple, we store your game save and leaderboard scores so you can play on any device.
- The Game shows ads only when you choose to watch a video for a reward. Ads are provided by Google AdMob.
- Purchases are handled by Google Play or the App Store. We never see your card or bank details.
- You can delete your account and online data at any time from inside the Game.
Information we use
1. Game progress on your device
Your heroes, gear, pets, coins, diamonds, settings and similar progress are saved in your device’s local storage. This stays on your device and is not sent to us unless you sign in (see below). Android may include it in your own Google device backup, which you control in your phone’s settings.
2. Account and cloud save (optional)
If you sign in with Google or Apple, we use Firebase Authentication and Cloud Firestore (services of Google LLC) to:
- create an account identifier for you and receive the name and email address linked to your Google or Apple account (with Apple you can choose to hide your email);
- store your game save so your progress comes back on any device where you sign in;
- show the leaderboard: your first name, best Endless Tower floor, weekly challenge score, hero and rank are visible to other signed-in players.
Why (legal basis): to provide the features you asked for (performance of a contract).
3. Rewarded video ads
The Game offers optional videos in exchange for a reward (for example a free revive, double coins, a daily chest or a reroll). There are no forced ads. Ads are served by Google AdMob, which may collect and use device identifiers (such as the advertising ID), IP address, approximate location derived from it, device and app information, and ad interaction data to show, measure and limit ads and to prevent fraud.
In the UK, the European Economic Area and Switzerland, Google’s consent form asks for your choice before ads are personalised. You can change your choice at any time in the Game: Settings → Ad privacy. You can also reset or delete your advertising ID in your phone’s settings. On iOS, ads are only personalised if you allow tracking when asked.
Why (legal basis): your consent for personalised ads; our legitimate interest in funding a free game and preventing ad fraud for non-personalised ads.
More: How Google uses information from apps that use its services.
4. In-app purchases
Diamond packs are sold through Google Play or the Apple App Store. Payment is handled entirely by them under their own privacy policies; we do not receive your payment details. We receive a purchase token and the product bought so we can deliver your diamonds and prevent duplicate delivery.
Why (legal basis): performance of a contract.
5. Technical data
Google Play, Apple and Firebase may process basic technical information (such as device model, operating system version and crash information) to deliver and secure their services. We do not run our own analytics or tracking.
Who we share information with
| Service | Purpose | Policy |
|---|---|---|
| Google AdMob | Rewarded video ads, consent form | Google Privacy Policy |
| Firebase (Google) | Sign-in, cloud save, leaderboard | Firebase privacy |
| Google Play | App delivery, purchases | Google Privacy Policy |
| Apple App Store, Sign in with Apple | App delivery, purchases, sign-in (iOS) | Apple Privacy Policy |
We do not sell your personal information. These providers may process data outside the UK; they use safeguards such as the UK International Data Transfer Addendum and Standard Contractual Clauses.
How long we keep it
Your online save and leaderboard entry are kept while your account exists. If you delete your account, they are deleted straight away from the live database (backups are cleared within 30 days). Leaderboard entries of accounts inactive for more than 24 months may be removed.
Deleting your account and data
In the Game: tap the cloud icon on the main screen (or Settings → Account), then Delete account. This removes your online save, leaderboard entry and sign-in account. Progress stored on your device stays until you uninstall the Game or use Settings → Reset progress.
You can also email contact@spiritandshadow.com from the email address linked to your account with the subject “Delete my data”. We will do it within 30 days. See also Delete your account.
Your rights
Under UK and EU data protection law you can ask to access, correct, delete or export your data, object to or restrict its use, and withdraw consent at any time. Email us at contact@spiritandshadow.com. If you are not happy with our answer, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
Children
The Game is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.
Security
Data sent to Firebase is encrypted in transit, and access rules allow each player to read and change only their own save.
Changes
We may update this policy. The date at the top shows the latest version; important changes will also be shown in the Game.