Privacy Policy

How Arrow Chain Blitz handles your information and honors your rights

Last Updated — September 8th, 2026

Arrow Chain Blitz collects certain information in order to operate — to render chain reactions, remember where you left off, serve advertising, and pay out optional rewards. This policy sets out what is gathered, why it is needed, who receives it, and the control you keep over it. It has been written to align with the General Data Protection Regulation, the California Consumer Privacy Act and Privacy Rights Act, and the Virginia Consumer Data Protection Act.

Definitions

A handful of terms recur throughout this document, so they are defined once here.

Application: Arrow Chain Blitz, the mobile arrow-chain puzzle software distributed by the Company.
Company: The operating entity behind Arrow Chain Blitz, referred to as "we," "us," or "our."
Personal information: Any information relating to an identified or identifiable natural person.
Usage Data: Information recorded automatically from your Device or our infrastructure, including chain clears, session length, and diagnostics.
Device: Any smartphone, tablet, or comparable hardware used to reach the Application.
Service Provider: A party that processes personal information on the Company's instructions.

What Data Do We Gather?

Two streams of personal information exist: the technical data your Device produces the moment the Application opens, and the details you choose to hand over.

Recorded automatically

IP address and network connection data
Device Info — model, operating system, WebView
Identifiers such as GAID and ANDROID_ID
Usage Data — chains cleared, levels, session duration
Crash logs, diagnostics, performance metrics

Provided by you

Advertising identifiers (GAID on Android, IDFA on iOS)
Engagement and in-app event signals
PayPal account email and name, used only for withdrawals

Why Do We Need Your Data?

Nothing is gathered speculatively. Each category of personal information serves a stated operational purpose.

Operating, maintaining, and monitoring arrow-chain gameplay and progression
Managing accounts, authentication, and in-game preferences
Processing PayPal withdrawal transactions, including identity verification
Answering support enquiries and delivering service notifications
Analyzing usage patterns to refine levels, difficulty, and stability
Measuring promotional campaigns and presenting related offers
Enabling any merger, acquisition, or corporate reorganization

When Is Data Shared?

We are selective about disclosure. Personal information travels beyond the Company only in the circumstances below.

Service Providers — analytics, hosting, customer support, and payment processing
Business Transfers — merger, acquisition, financing, or sale of assets
Affiliates — entities under common ownership, bound by this policy
Business Partners — parties with whom we jointly offer products or promotions
Legal Obligations — where law, regulation, or valid legal process compels it
Consent — any further purpose disclosed at collection or later agreed by you

The Company neither sells nor rents user PayPal account email addresses. That information is disclosed only with your explicit consent, or where applicable law requires it.

Analytics & Server Endpoints

Analytics and game services are delivered through https://zmpb.arrowchainz.com. Payloads handled by the analytics layer are anonymized and are not designed to carry personally identifiable information. The same endpoint supports core puzzle delivery, progress synchronization, stability engineering, and support tooling.

Endpoint safeguards

Transport Layer Security (TLS) 1.2 or higher on every transmission
Role-based access controls restricting data to authorized personnel
Data minimization applied across all processing activities
Recurring security audits and vulnerability assessments
Data Processing Agreements executed with every third-party handler

Your Privacy Rights

Depending on where you live, data protection law grants you concrete, enforceable rights over your personal information.

GDPR — European Economic Area

Access — obtain a copy of the personal information undergoing processing
Rectification — have inaccurate or incomplete data corrected
Erasure — request deletion where qualifying conditions apply
Restrict processing — limit specific processing activities
Object — oppose processing based on legitimate interests or direct marketing

CCPA / CPRA — California

Know — learn the categories and specific pieces of information collected
Delete — request deletion, subject to statutory exceptions
Opt-Out — decline the sale of personal information
Non-Discrimination — exercise these rights without penalty

VCDPA — Virginia

Access and Correct — confirm processing and fix inaccuracies
Delete — request removal of personal information
Portability — receive data in a portable, readily usable format
Opt-Out — decline targeted advertising, sales, and profiling

To exercise any right above, write to igtryeh202407@gmail.com and name the right concerned.

Opting Out

Android: Settings → Google → Ads → “Opt out of Ads Personalization”
iOS: Settings → Privacy → Advertising → “Limit Ad Tracking”
Sale of personal information: email igtryeh202407@gmail.com with the subject line Do Not Sell

Data Retention

Retention follows the principle of necessity: personal information is kept only while it serves the purposes described here.

days of continuous inactivity, after which your personal information is permanently deleted from our systems. Anonymized or aggregated Usage Data may persist for internal analysis where it can no longer identify you.

Data Security

The Company maintains commercially reasonable physical, administrative, and technical safeguards: encryption of sensitive data in transit, TLS 1.2 or higher, need-to-know access controls, periodic security audits, and contractual security obligations imposed on partners. No method of internet transmission or electronic storage is entirely secure, however, so absolute security cannot be guaranteed.

International Transfers

Personal information may be transferred to, and processed on, servers located outside your country of residence. Such transfers are protected by TLS 1.2 or higher and, where required, by appropriate contractual safeguards including Standard Contractual Clauses.

Third-Party Services & Ad Partners

Advertising is served through AppLovin and its mediated partner network. Only a limited set of categories reaches those partners.

Shared with partners

Resettable advertising identifiers
Device model, OS, and screen size
Session frequency and engagement duration
Ad impressions and clicks
Non-precise demographics (country, language)

Never shared

Email addresses or phone numbers
Account credentials
Detailed chain progress or reward balances
User-generated content
Precise geolocation data

Advertising partner privacy policies

AppLovin Chartboost Google InMobi IronSource Kwai Fyber Mintegral Moloco Bytedance (Pangle) Vungle Unity Ads Yandex BidMachine Verve Bigo TaurusX

Application Permissions

Each permission is disclosed before installation, confined to the stated purpose, and aligned with Google Play Developer Program Policies.

Permission	Purpose	Data collected
`INTERNET`	Network access for ads, updates, and gameplay	Network status, transfer statistics
`ACCESS_NETWORK_STATE`	Adapt behavior to connection type	Network type and status
`ACCESS_WIFI_STATE`	Keep Wi-Fi sessions stable	Wi-Fi status, signal strength
`AD_ID`	Advertising identifier for personalization	Resettable device ad ID
`VIBRATE`	Haptic feedback on chain reactions	None
`ACCESS_ADSERVICES_TOPICS`	Ad interest topic signals	Advertising topic data
`ACCESS_ADSERVICES_ATTRIBUTION`	Campaign attribution measurement	Attribution data
`BIND_GET_INSTALL_REFERRER_SERVICE`	Identify install source	Install source, campaign parameters
`BIND_APPHUB_SERVICE`	Optimize ad delivery via AppHub	Ad parameters, impression data
`ACCESS_ADSERVICES_AD_ID`	Comply with modern ad API requirements	Ad service identifiers
`FOREGROUND_SERVICE`	Maintain critical functions when backgrounded	None
`DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`	Secure internal broadcast communication	None

Children's Privacy

Arrow Chain Blitz is not directed to, nor intended for use by, individuals under the age of thirteen (13), and the Company does not knowingly collect personal information from children under 13. A parent or guardian who believes a child has supplied personal information should contact igtryeh202407@gmail.com; the data will be deleted promptly once verified.

Disclosure Requirements

Business transactions — personal information may pass to an acquiring entity, with prior notice where practicable
Law enforcement — disclosure may follow law, subpoena, court order, or governmental request
Rights and safety — disclosure may occur in good faith to protect the rights, property, or personal safety of the Company, its users, or the public

Third-Party Links

The Application may link to websites or services the Company does not operate. We are not responsible for their content, privacy practices, or security, and we recommend reading the privacy policy of any external destination before using it.

Data Breach Notification

Should a data breach affect your personal information, we will notify you within 72 hours of becoming aware of the incident where applicable law requires it, describing the nature of the breach, its likely consequences, and the measures taken or proposed in response.

California Shine the Light

California residents may request details of any disclosure of personal information to third parties for those parties' direct marketing purposes. Send such a request to igtryeh202407@gmail.com with the subject line Shine the Light.

Changes to This Policy

This policy may be revised at any time, with amendments taking effect once the updated text appears on this page and the "Last Updated" line is refreshed. Where a change materially affects how personal information is processed, notice may be given by email or through a prominent in-app message.