Privacy Policy

This Privacy Policy applies to the Grow A Fish mobile application and related cloud services operated by Elomar Studio (collectively, the “Application” or “Service”). Elomar Studio is hereinafter referred to as the “Service Provider”, “we”, “us”, or “our”.

1. Data Controller Information

Elomar Studio acts as the Data Controller responsible for the processing of your personal data:

• Entity Name: Elomar Studio
• Address: Bogøgade 6, 1.th, 9000 Aalborg, Denmark
• Contact Email: elomarstudio@gmail.com

For any data protection inquiries or to exercise your GDPR, UK GDPR, or CCPA/CPRA rights, please contact us at the email address above.

2. Summary of Collected Data (Apple Privacy Nutrition Labels)

In alignment with Apple’s App Store Privacy Manifest (PrivacyInfo.xcprivacy) and Google Play Data Safety disclosures, the table below summarizes every category of data processed when you use the Application:

3. What Information Does the Application Obtain and How Is It Used?

A. User-Provided Information

• Account Credentials: When you create or sign into an account (via Email/Password, Sign in with Apple, or Google Sign-In), your email address, authentication tokens, and chosen username are managed securely through our backend provider (Supabase) solely to authenticate you and protect your cloud save. You may also play using a guest session.
• Game Progress & Virtual Inventory: Virtual fish attributes (species, growth stages, custom fish names), aquarium layouts, decorations, virtual currencies (coins and pearls), battle pass progress, and unlocked cosmetics (avatars and frames).
• In-App Purchases: Purchase receipts and product entitlements processed directly by the Apple App Store or Google Play Store. Financial and payment card credentials are handled exclusively by Apple or Google and are never seen, transmitted to, or stored by Elomar Studio.
• Private Communications (End-to-End Encrypted Chat): In-game friend chat messages are protected by client-side End-to-End Encryption (E2EE) using X25519 (ECDH) key exchange and AES-GCM-256 authenticated encryption. Our servers transmit and temporarily hold only encrypted cipher blobs to complete delivery; private decryption keys never leave your device, and Elomar Studio cannot decrypt or read your private messages.
• Optional Profile Photo Access: If camera or photo library permissions are requested on your device for custom profile imagery, access occurs only upon your explicit action and permission.

B. Automatically Processed Technical Information & Local Storage

• Device & Rendering Compatibility: General device model, operating system version, local timezone identifier (used strictly to schedule local fish-care or daily check-in reminders on your device), and screen dimensions to scale UI and graphics properly.
• On-Device Storage: Offline game saves, audio/graphics settings, and encrypted session keys stored locally on your device via SharedPreferences, Hive, and Flutter Secure Storage (iOS Keychain / Android Keystore).
• No Cookies or Tracking Pixels: Neither the Application nor this website uses advertising cookies, tracking pixels, fingerprinting, or cross-context behavioral tracking technologies.

4. Artificial Intelligence (AI) & Automated Profiling

The Application does not use Artificial Intelligence (AI) or machine-learning models to process your personal data, and does not engage in automated decision-making or profiling that produces legal or similarly significant effects concerning you.

5. Legal Bases for Processing (GDPR / UK GDPR)

Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we process personal data under the following lawful bases:

1. Performance of a Contract (Art. 6(1)(b) GDPR): Processing strictly necessary to provide the Application, maintain your player account, synchronize cloud saves, and fulfill virtual item purchases.
2. Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary to maintain server stability, network security, anti-cheat enforcement, and abuse prevention, provided such interests do not override your fundamental rights.
3. Legal Obligations (Art. 6(1)(c) GDPR): Processing required to comply with mandatory tax, accounting, consumer protection, or regulatory obligations.
4. Consent (Art. 6(1)(a) GDPR): Where you explicitly opt into optional device permissions (such as local notifications), which you may withdraw at any time in your in-app or device settings.

6. Third-Party Infrastructure Providers & Data Sharing

We do not sell, rent, or trade your personal information to any third party. We share data solely with essential infrastructure processors bound by confidentiality and Data Processing Agreements (DPAs) under Article 28 GDPR:

We may also disclose information only where strictly required by applicable law (such as a valid court order or subpoena) or in good faith to prevent fraud or protect the safety of players.

7. International Data Transfers

Where personal data is processed outside the European Economic Area (EEA) or the United Kingdom, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, including European Commission adequacy decisions and approved Standard Contractual Clauses (SCCs).

8. Data Retention Policy

• Active Player Account Data: Retained for the duration of your active account. If you delete your account in-app, your personal account data is permanently deleted immediately, subject only to any statutory financial/tax record obligations (up to 12 months where required by law).
• Encrypted Chat Payloads: Retained only as needed to deliver encrypted messages between friends.
• Local Device Data: Stored on your device until you sign out, delete your account, clear application storage, or uninstall the Application.

9. Account Deletion & Opt-Out Rights

You have full control over your account and personal data at all times:

• Instant In-App Account Deletion: Open Grow A Fish and navigate to Profile → Settings → Delete Account (press and hold to confirm permanent deletion of your account and cloud save).
• Email Deletion Request: If you no longer have the Application installed, email elomarstudio@gmail.com from your registered email address with the subject “Account Deletion Request”. We will verify and permanently erase your account within statutory timelines (and within 30 days at most).
• Uninstalling the Application: Uninstalling Grow A Fish immediately stops all local data processing on your mobile device.

10. Children’s Privacy

The Application is not directed to children under the age of 16 (or the applicable minimum age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 16 without verifiable parental consent. If you are a parent or guardian and believe your child has provided personal data without consent, please contact elomarstudio@gmail.com and we will promptly delete such data.

11. Security Safeguards & Breach Notification

• End-to-End Encryption (E2EE): Private friend messages are encrypted on-device with X25519 (ECDH) and AES-GCM-256.
• Encryption in Transit: All communication between the Application and backend servers uses HTTPS / TLS encryption.
• Row-Level Security & Access Controls: Database tables enforce strict Row-Level Security (RLS) policies and administrative multi-factor authentication.
• Data Breach Notification: In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and notify affected users without undue delay as required by law.

12. Your Privacy Rights (EEA/UK GDPR & California CCPA/CPRA)

A. EEA, Denmark & UK Residents

Under the GDPR, you have the right to request access, rectification, erasure (“right to be forgotten”), restriction of processing, and data portability, as well as the right to object to processing based on legitimate interests and to withdraw consent at any time. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), your local EU Data Protection Authority, or the UK ICO.

B. California & US State Privacy Rights (CCPA / CPRA)

California residents have the right to know what personal information is collected, request deletion, request correction, and receive non-discriminatory treatment. We do not “sell” or “share” personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect legal or operational updates. Material changes will be posted at this URL with an updated “Last Updated” date.

14. Contact Us

If you have questions or requests regarding this Privacy Policy or our privacy practices, please contact:

Elomar Studio
Bogøgade 6, 1.th, 9000 Aalborg, Denmark
Email: elomarstudio@gmail.com