Privacy Policy

Last updated: 2026-11-09

This policy explains what information the game Festiglow: Block Puzzle ("Festiglow", "the game") and this website collect, why, and the choices you have. Festiglow is made by DCABox ("we", "us"). Questions: [email protected].

In short

• You do not need an account, and we never ask for your real name, phone number or contacts.
• Instead of your identity, the game uses a device code: an identifier your phone gives this app, scrambled (hashed) on the phone and again on our server. On Android, reinstalling the game on the same phone keeps the same code.
• We do not sell your personal information.
• The game is free and shows ads through Google AdMob, Google's advertising service, which collects some information from your device to do so (see "Advertising"). In the European Economic Area, the United Kingdom and Switzerland, ads are personalized only if you agree. There are no in-app purchases.
• You can delete your data at any time (see "Your choices and rights").

1. Information stored on your device

Your progress, settings, the email address you last entered in the feedback form and any messages you have not sent yet are saved on your device (and may be included in your phone's backups). The game also keeps the times of the ads it has recently shown and of the ones you tapped, to space ads out and to detect invalid taps; they are not part of the backup copy of your progress on our server and are deleted with the app's data. The game's device code is made from an identifier your phone's system gives this app (the Android ID; on iPhone, the identifier for vendor). On Android it stays the same when you reinstall the game and changes when the phone is reset; on iPhone it changes when you remove the game. Uninstalling the game removes everything else from your device.

2. Information sent to our game server

When your device is online, the game talks to our server to run its community features. The server stores:

• a hashed form of the device code (we never receive the phone's identifier itself), the app version, the platform (Android or iOS), the device model and operating system version, how the app was installed (from the store, through TestFlight, or as a test or other build), how many times the game has been installed on the device, and a fingerprint of the app's signing certificate, to recognise copies of the game someone else republished;
• when you open the game, the days you play, and the country and province or state you play from (worked out from your IP address);
• level results: which level, win or loss, stars, pieces used and time taken;
• your pets (each pet's species, island, growth stage, fullness and happiness), whether other players may visit your pet islands, and the visits, hearts and food gifts you give and receive, and when;
• a backup copy of your game progress and settings (levels, stars, pets, food and the like, but not the device code or your sign-in), so that a reinstall or a new phone can get them back, and the one-time codes you create to move your progress to another phone (each works once, for 24 hours);
• how often the game's features are used: a daily count per feature (for example, how many times a pet's island was opened or a pet was fed, and for how long), used only to improve the game;
• the name you choose to show other players (until you choose one, a nickname the game gives you, such as "Lantern Keeper 123"), and whether you allow other players to see it;
• feedback you send from the game: your message, its category, your level, the app version and platform, and your email address, which the form requires so that we can reply (we use it only to answer you);
• the result of a device check: when the game signs in, it asks Google Play Integrity (on Android) or Apple App Attest (on iPhone) to confirm that it is the genuine app on a real device. We keep only the verdict (for example, "recognised app, genuine device") and, on iPhone, the public key App Attest creates for the game, to tell real players from emulators and modified copies of the game.

Your IP address is used to deliver the game's requests, to limit abuse and to tell which country and province or state you play from: our network provider, Cloudflare, works out the country and the province or state, and we keep only those (never your city or exact location). The IP address itself is not saved in our game database; our servers and Cloudflare may keep it in short-lived security logs.

What other players can see: visitors to your pet islands see your pets, the hearts they have received and when you were last active, and the owners of the islands you visit see your visits and the hearts and food gifts you leave. In both cases your nickname is shown only if you allowed it ("Show my name" in the game's Settings); otherwise you appear as an anonymous player. To keep visitors away, turn off "Let others visit my islands" in the game's Settings. Level time rankings show you only your own place, never other players' names. A Duel code you share contains your nickname, score and moves, and reaches only the people you send it to.

3. Crash reports, analytics and notifications (Google Firebase)

• Firebase Crashlytics sends a report when the game crashes: the error, device model, operating system and app version, the level you were playing, how the app was installed, and an installation ID.
• Google Analytics for Firebase records how the game is used, such as screens viewed, levels started and finished, ads watched and what they earned, and whether you turned notifications on, together with an app-instance ID, the game's language, device information and an approximate location (country) derived from your IP address.
• Firebase Cloud Messaging uses a device token to deliver notifications, for example when a new festival begins; your device also joins the notification topics for all players and for the game's language. Notifications are on when you install the game. After you have cleared a few levels, the game asks whether you want them, and then your device asks for your permission (on iPhone, and on Android 13 and later). You can turn them off at any time in the game's Settings or in your device settings.

Google processes this data for us under the Google Privacy Policy.

4. Advertising (Google AdMob)

The game is free to play and is paid for by ads. They are delivered by Google AdMob, Google's advertising service for apps, through the Google Mobile Ads SDK built into the game; they come from advertisers and other ad buyers that work with Google (Google's ad partners). There are no banner ads. You may see two kinds of ads:

• rewarded videos, only when you choose to watch one for a reward: to continue a level you lost, to double the Light you won, or for free gems;
• full-screen ads between games in Classic mode: at most one every five games, at least five minutes after the previous ad, and never on the day you install the game.

To show ads, Google and its ad partners collect information from your device: the advertising ID and other device identifiers (see below), IP address (from which they work out an approximate location), device model, operating system, language and other device settings, the app showing the ad, how you interact with ads, such as which ads you see and tap, and diagnostic information about how the ads load and perform. They use it to deliver and choose ads, to limit how often you see the same ad, to measure how ads perform and to prevent fraud and abuse, and they handle it under their own privacy policies.

• In the European Economic Area, the United Kingdom and Switzerland, before the game requests any ad, it shows Google's consent message: a consent management platform certified by Google that follows the IAB Europe Transparency & Consent Framework. It lists Google and its ad partners and what they want to use your data for, and you can agree to all, decline, or choose purpose by purpose and partner by partner. If you agree, Google and its ad partners may use your advertising ID and information about how you use apps to choose ads that suit your interests and to measure them. If you decline, you still see ads, but they are not personalized. You can change your choice at any time in the game's Settings, under "Privacy choices".
• On iPhone, the game asks for your permission through Apple's App Tracking Transparency prompt before ads start; in the regions above, only after Google's consent message, and only if you agreed to personalized ads there. Only if you allow it can Google and its ad partners use your device's advertising identifier (IDFA) to personalize ads and measure them across apps. If you do not, the IDFA is not shared, and installs from ads are counted with Apple's SKAdNetwork, which does not identify you.
• On Android, ads use your device's advertising ID, which you can reset or delete at any time, and the app set ID, an identifier shared only by apps from the same developer and used for analytics and to prevent fraud.
• When you tap an ad, the game also tells our game server (which ad spot, when, the app version, and how many full-screen ads the device has shown recently), so that we can detect and stop invalid clicks: if one device taps a lot of ads in a short time, or nearly every ad it is shown, the game shows no ads on it for a while (24 hours by default). This record is kept with your other game data and deleted with it.
• To turn off personalized ads: in the European Economic Area, the United Kingdom and Switzerland, use "Privacy choices" in the game's Settings. Everywhere, you can also do it on your device: on iPhone, open Settings > Privacy & Security > Tracking and turn tracking off for Festiglow (or for all apps); on Android, open Settings > Google > Ads and choose Delete advertising ID. You will still see ads, but they will be less personalized.

Learn more: how Google uses information from sites or apps that use its services, and the Google Privacy Policy.

5. The game in a web browser

You can also play Festiglow in a web browser, on game websites (portals) such as CrazyGames. There, the game sends no notifications, uses neither Google Firebase nor Google AdMob, and makes no device check; if the website shows ads, they come from its own ad service, under its own privacy policy. The game uses our server as described in "Information sent to our game server", with these differences and additions:

• Device code: a browser gives the game no device identifier, so the game makes a random device code and keeps it in the browser's storage, with your progress. Instead of the device model and operating system version, it sends the names of the browser and operating system (for example, "Android Chrome"), the size of the browser window and the game website it runs on.
• Loading: to see how many players leave before the game has loaded, and how long loading takes, the page tells our server each step: the page opened, the game started, its first screen appeared and play began, then after 1, 10, 30 and 60 minutes of play (counted only while the page is in view). Each report carries a random code made for this one page load (kept only in the page's memory, never stored on your device, and new each time the page opens), the time since the page opened (and, in the reports of minutes played, the time played), the game version, the game website and, once the game has signed in, its player ID on our server. The server adds your country (worked out by Cloudflare from your IP address) and whether your device is a phone or a tablet (from what your browser says about itself). To count players per day without cookies, it makes a code from your IP address and browser that changes every day and cannot be turned back into either. The IP address itself is not stored.
• Error reports: instead of Crashlytics, when the game or the page runs into an error, the page sends our server the error message, where in the game's code it happened (the technical trace), how many times it came up, the game version, the game website and, once the game has signed in, its player ID; the server adds your country. A page load sends at most 10 kinds of error.
• "Delete my data" also removes the player ID from these loading and error records.
• On CrazyGames, everything the game keeps in your browser (see "Information stored on your device"), the device code included, is also saved by CrazyGames' save service, with your CrazyGames account if you are signed in; the CrazyGames Privacy Policy applies to it. Our server keeps no backup copy of your progress there, and there are no codes to move it to another device.
• On game websites that do not allow it, the game does not connect to our server at all.

6. This website

This website uses no cookies, no ads and no third-party trackers. To see how many people visit and from where, each page view tells our server the page and its language, the website that linked to it (its domain only), whether the screen is a phone's, and your country and province or state (worked out by Cloudflare from your IP address). To count visitors per day without cookies, the server makes a code from your IP address and browser that changes every day and cannot be turned back into either. The IP address itself is not stored.

If your browser sends a Do Not Track or Global Privacy Control signal, your visits are not counted.

How we use information

• to run the game and its features, such as pet island visits, level rankings and duels;
• to find and fix bugs and crashes;
• to understand which levels are too hard or too easy, and to improve the game;
• to answer your feedback;
• to keep the game fair and secure, including checking that the app and device are genuine, and to prevent cheating and abuse;
• to show ads that keep the game free.

Where the law asks for a legal basis: we rely on providing the game you asked for; on our legitimate interests in keeping it working, fair and improving, in funding it with ads, and in telling you about new festivals and events through notifications (you can turn them off at any time); and, where the law requires it, on your consent for personalized ads (in the European Economic Area, the United Kingdom and Switzerland, the game asks for it before showing ads; on iPhone, Apple's tracking prompt asks for it too).

Who we share it with

We do not sell your personal information. We share it only with service providers that run parts of the game for us (Google Firebase, Google Play Integrity, Apple App Attest, Cloudflare (which delivers and protects our server and this website) and the company hosting our server), or when the law requires it.

Our advertising partner Google and Google's ad partners also collect information directly from the game, as described in "Advertising", and use it under their own privacy policies. Some privacy laws (such as California's) treat this as "selling" or "sharing" personal information; to opt out, turn off personalized ads as explained above.

How long we keep it

We keep server data while you play. "Delete my data" in the game removes it from our game server straight away; when you ask us by email, we remove it within 30 days. Crash and analytics data are kept by Google for the periods set in our Firebase settings. Daily feature usage counts are deleted after 400 days. Google and its ad partners keep ad data for the periods set in their own privacy policies.

Your choices and rights

• Delete your data: in the game, open Settings and choose "Delete my data". This deletes your data from our game server and resets the game on your device. You can also ask through the game's Feedback screen or by email to [email protected]. If you play again afterwards, the game starts a new, empty record for your device.
• Other players see your nickname only if you allow it. You can change your choice in the game's Settings or by writing to [email protected].
• Turn off notifications in the game's Settings or in your device settings, and personalized ads in your device settings or, in the European Economic Area, the United Kingdom and Switzerland, with "Privacy choices" in the game's Settings.
• Depending on where you live, you may have the right to access, correct, delete or export your data, to object to some uses, and to complain to your data protection authority. Write to [email protected] and we will reply within 30 days.

Children

The game is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has sent us information, contact us and we will delete it.

Security and where data is processed

Data travels over encrypted connections (HTTPS), device IDs are stored only in hashed form, and access to our server is limited to people who need it. Our servers and providers may process data in countries other than yours, such as Vietnam, where we are based, and the United States.

Changes

We will update this page when the game changes what it collects, and change the date at the top. Important changes will also be announced in the game.

Contact

DCABox · [email protected]