Privacy policy

The short version

Cash Dash has no accounts. You never give us a name, an email address or a password, because there is nowhere to type one. Your progress — coins, cash, unlocked tycoons, pets, districts, missions and settings — is stored on your device and nowhere else.

The app does two things that involve data leaving your device:

• Ads. Cash Dash shows rewarded video ads that you choose to watch. Those are served by ironSource / Unity LevelPlay and the ad networks it mediates.
• Analytics and crash reporting. Firebase Analytics and Firebase Crashlytics tell us which parts of the game people play and what crashed.

On iOS, both are gated behind the tracking permission prompt you see when you first open the app. If you decline it, we turn analytics and crash reporting off entirely, and ads are served without your advertising identifier.

What we collect, and why

1. Nothing that identifies you personally

We do not collect your name, email address, phone number, postal address, date of birth, photos, contacts, calendar, microphone, camera or location. The app requests none of those permissions and links none of those frameworks.

2. Analytics — how the game is played

Processor: Google (Firebase Analytics).

When analytics is enabled (see “Your choice” below), the app sends events describing gameplay, not people:

• session started / ended, and session length
• a run starting and ending, with distance, coins and cash earned, combo reached, which tycoon and pet were equipped, and how the run ended
• coins or cash earned and spent, and what they were spent on (a tycoon, a pet, a trail, a district, a power-up upgrade, a revive)
• a rewarded ad being offered, started, completed or failed, and which slot it was offered in
• missions completed, daily rewards claimed, tutorial steps reached
• unlocks and progression milestones

We deliberately do not log anything per-frame or per-pickup. Coin pickups are aggregated into a single end-of-run event rather than sent individually.

Each event carries two pseudonymous identifiers:

• an install ID — a random value generated on your device the first time the game runs and stored locally. It is not your advertising identifier, not your device’s serial number, and not derived from anything about you or your hardware. Delete the app and it is gone; reinstall and a brand-new one is generated with no link to the old one.
• a session ID — a random value regenerated every time you open the app.

Firebase itself additionally collects standard technical information such as app version, device model, OS version, language, coarse (country/region-level) location derived from IP address, and a Firebase-generated app instance identifier. Google’s handling of that data is described in the Firebase Privacy and Security documentation and Google’s Privacy Policy.

Why: to understand which districts, characters and difficulty points people actually reach, so the game can be balanced and fixed. Legal basis under GDPR: your consent.

3. Crash and error diagnostics

Processor: Google (Firebase Crashlytics).

When crash reporting is enabled, a crash or an unhandled error sends:

• the error message and stack trace
• a short trail of the last few gameplay events before the fault, so we can see what you were doing (for example: opened store → started a run → crashed)
• device model, OS version and app version
• the same pseudonymous install ID described above, so we can tell “one device crashed forty times” apart from “forty devices crashed once”

Stack traces are program text — file names, class names and line numbers from our own code. They contain no personal information about you.

Why: to find and fix crashes. Legal basis under GDPR: your consent.

4. Advertising

Processor: Unity / ironSource (LevelPlay mediation) and the ad networks it mediates.

Rewarded video ads are the only monetisation in Cash Dash. There are no banner ads and no full-screen interstitials — every ad is one you tap to watch in exchange for something (a second chance after being caught, a doubled run payout, or a small coin payout from the Get Coins sheet).

The ad SDK collects, subject to your tracking choice:

• your device’s advertising identifier (IDFA) — only if you allow tracking at the prompt. If you decline, the IDFA is not available to the SDK and you see contextual rather than personalised ads.
• IP address, and coarse location derived from it
• device and app technical information: device model, OS version, screen size, language, network type, app version
• ad interaction data: which ad was shown, whether it was watched to the reward point, whether it was clicked

SKAdNetwork. Cash Dash also participates in Apple’s SKAdNetwork, an attribution system built into iOS. SKAdNetwork lets an advertiser learn that an install came from a particular ad campaign without identifying you — Apple sits in the middle, aggregates and delays the report, and no device or user identifier is shared. SKAdNetwork works whether or not you allow tracking, by design, and is not affected by your choice at the prompt.

Why: to fund the game. Legal basis under GDPR for personalised advertising: your consent, given through the tracking prompt.

5. Data stored only on your device

Everything below stays on your device in iOS’s standard app preferences store and is never uploaded anywhere:

• coins and cash balances
• which tycoons, pets, trails, times of day and districts you own, and what is equipped
• power-up upgrade levels and consumable counts
• best distance, run history counters, mission progress, daily login streak
• story beats you have already seen
• audio volumes, vibration, screen shake, reduced motion and high contrast settings
• your recorded tracking-consent choice and the install ID

Your choice: the tracking prompt (ATT)

The first time you open Cash Dash, iOS shows Apple’s App Tracking Transparency prompt asking whether the app may track you across apps and websites owned by other companies.

What your answer actually controls in this app:

Two things are worth being explicit about, because they are stricter than most apps:

• Declining does not restrict the game. Every feature, every unlock and every rewarded ad works exactly the same either way. Nothing is paywalled or degraded behind the prompt.
• Declining turns analytics and crash reporting off, not just advertising. We use your tracking answer as a single consent signal for everything that leaves the device. If you decline, we instruct Firebase to stop collecting and to reset the analytics identifier it holds.

Until you answer the prompt, nothing is transmitted: the ad SDK is not started at all, and analytics events are held unsent on the device.

Changing your mind, at any time: iOS Settings → Privacy & Security → Tracking → Cash Dash, and toggle it on or off. The app re-reads your choice every time it launches, so the change takes effect the next time you open it — including switching analytics and crash reporting back off and clearing the analytics identifier.

Who we share data with

We do not sell your personal information for money, and we do not share it with anyone beyond the service providers needed to run the game:

Under the CCPA/CPRA, allowing personalised advertising may count as “sharing” personal information for cross-context behavioural advertising. Tapping “Ask App Not to Track” is your opt-out, and we honour it for the whole app. We never sell personal information, and we do not knowingly share the personal information of anyone under 16.

We may also disclose information if we are legally required to, or to protect our rights — but with no accounts and no server of our own, we hold very little that could be requested.

How long data is kept

• On your device: until you delete the app, or clear its data.
• Analytics events: for the retention period configured in our Firebase project. Firebase’s maximum for event-level data is 14 months, after which Google deletes it automatically.
• Crash reports: per Crashlytics’ standard retention (crash-free-user metrics are kept longer than individual crash sessions, which age out).
• Advertising data: governed by each ad network’s own policy, not ours.

Your rights

If you are in the EU/EEA or UK (GDPR): you have the right to access, correct, delete, restrict, object to and port your personal data, to withdraw consent at any time, and to complain to your local data protection authority.

If you are in California (CCPA/CPRA): you have the right to know what is collected and why, to delete it, to correct it, to opt out of sale or sharing, and not to be discriminated against for exercising any of those rights. Cash Dash does not offer financial incentives for data.

Other US state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas and others) grant broadly similar rights, and we apply the same process to all of them.

How to exercise them. Because there is no account, most of these are things you can do yourself in seconds:

• Withdraw consent / opt out: iOS Settings → Privacy & Security → Tracking → turn Cash Dash off. This stops future collection and resets the analytics identifier.
• Delete everything held on your device: delete the app.
• Access or delete data already sent to us: email support@lmtdstudios.com. We will need the install ID to find anything, and there is no way to look it up from outside the app — so if you have already deleted the app, that data is no longer linkable to you by anyone, including us, and is deleted automatically at the end of the retention period above.

We respond to requests within 30 days, or within the shorter period your local law requires.

Children

Cash Dash is not directed at children under 13, is not published in the App Store Kids Category, and is not intended for use by children under 13. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/EEA and UK).

The app shows third-party advertising and uses third-party analytics, both of which are incompatible with the Kids Category and with COPPA’s rules on children’s data, which is exactly why it is not offered as a children’s app.

If you believe a child under 13 has used the app and that data has been collected, contact support@lmtdstudios.com and we will delete what we hold.

Security

Data sent by the app travels over HTTPS. Firebase and LevelPlay hold it on their own infrastructure under their own security programmes. We keep no server and no database of our own, so there is no user database of ours to breach — which is a deliberate design choice, not an accident.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

International transfers

Firebase and LevelPlay process data on infrastructure that may be located outside your country, including in the United States. Those transfers rely on the providers’ own safeguards, including the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Changes to this policy

If this policy changes materially we will update the effective date above and publish the new version at the same URL before the change takes effect. Material changes to what we collect will be reflected in an app update and in the App Store privacy label.

Contact