Privacy Policy
I collect nothing about you.
The game has no analytics, no advertising, no crash reporting, no tracking, no account or sign-in of its own, and no server. Nothing about you is sent to me, or to anyone else, with one exception: the leaderboard, which is Apple's Game Center on iPhone, iPad and Apple TV and Google Play Games on Android. On Android, Google's library for it, inside the app, also collects analytics and diagnostics for Google. All of it is described below.
Who is responsible
Amaru Surf is made and published by Ignacio Moreno, an individual developer. I am the data controller for the purposes of this policy, insofar as there is any data to control — as set out below, there is not.
Questions about this policy, or about anything the app does, go to support [at] amaru.surf. I read that address.
What Amaru Surf does not do
This list is specific rather than general, because a vague policy is worth nothing. None of the following exists in the app, apart from the one Android exception in the note right after the list:
- No analytics or telemetry of any kind
- No advertising, and no advertising SDK in the build
- No in-app purchases and no subscriptions
- No crash or diagnostic reporting service
- No user accounts, sign-in, or registration
- No email address, phone number, or contact collection
- No advertising identifier (IDFA on iOS, Advertising ID on Android)
- No location access, camera, microphone, contacts, photos, or files
- No cookies, no web views, no embedded browser
- No third-party trackers, pixels, or SDKs that phone home
- No selling, sharing, or transfer of personal information
One exception, on Android only: the Android app contains Google's Play Games Services library, which runs the leaderboard. By Google's own description it signs you in to Play Games and collects analytics and diagnostics for Google, so the lines above about analytics, diagnostics, sign-in, SDKs and the transfer of personal information describe the game itself, not that library. What the library does is set out under “The leaderboard” below.
Because I collect nothing, I have nothing of yours to give you, correct, export, or delete. If you would like to exercise a right under the GDPR, the CCPA, or any other data protection law that applies to you, the honest answer is that I hold no personal data about you to act on. You are welcome to write and ask me to confirm that. Apple or Google holds the leaderboard's data, not me, and requests about it go to them (see “The leaderboard” below).
Everything the app can do off your device
Rather than describe this in the abstract, here is the complete list. The app's connection to the outside world is a small, fixed interface, and these three things are all of it.
-
Local network discovery, for multiplayer
When you open the multiplayer screen, the game announces a room on your local network and looks for rooms other players have opened. On iPhone, iPad and Apple TV this uses Bonjour; on Android it uses Network Service Discovery. Both are the operating system's standard way for devices on the same network to find each other.
This traffic never leaves your local network. There is no matchmaking server, no relay, and no internet connection involved. Your device talks directly to the other device over your WiFi.
What is announced is: the room's name — which is the nickname you typed in, up to six letters — how many players are in it, whether it is mid-heat, and the network address to reach it on. Other players on your network can see that while the room is open. If you would rather not broadcast a name you recognise, pick a different one; the game does not care what it is.
During a multiplayer heat, your nickname, your position on the wave and your score travel to the other devices in the room, because that is what makes the heat shared. They go to those devices and nowhere else.
-
The leaderboard: Game Center and Google Play Games
When a run ends, the game submits your final score to a single best-score leaderboard, and the title screen can open the leaderboard's panel. On iPhone, iPad and Apple TV this is Apple's Game Center: the score goes to Apple, is associated with your Game Center account by Apple, and is displayed by Apple's own interface.
I do not run a scoreboard, do not receive your Game Center identity, and have no database of players. Apple's handling of Game Center is governed by Apple's privacy policy, not this one. You can turn Game Center off in the Settings of your iPhone, iPad or Apple TV, and the game works normally without it.
On Android the leaderboard is Google Play Games Services, and the app contains Google's library for it. When the game starts, Google Play Games signs you in with your Play Games profile if you already have one; if you have none, nothing is shown. The game asks you to sign in, or to create a profile, only when you tap LEADERBOARD while signed out, and it works normally if you never do. When a run ends, the same final score goes to Google, which associates it with your Play Games profile and shows it in Google's own interface.
By Google's own description, its Play Games library also collects your gamer identity (gamertag and avatar) when you create or update your Play Games profile, and analytics and diagnostics data that Google uses to keep the library stable and improve its products; Google encrypts what it collects in transit. Google's handling of all of it is governed by Google's privacy policy, not this one. Google lets you choose who can see your Play Games profile, and delete the profile with its game data, from Play Games or your Google Account. The game never asks Google who you are, and none of this reaches me.
Google Play counts this as data the app collects. Its rules treat what a library inside an app sends off the phone as collected by that app, even when it goes to Google and not to me, so the game's Data safety section on Google Play lists what Play Games collects (see “Store declarations” below).
-
The system clipboard
The multiplayer room screen lets you copy the room's address so you can send it to a friend, and the address-entry screen has a PASTE button for the other end of that. The Apple TV has no clipboard, so there the game has neither.
The clipboard is only ever read at the moment you tap PASTE — never in the background, never on a timer, never when the app comes to the foreground. On iOS 16 and later you will see the system's "Paste from…?" prompt at that moment, which is exactly where it belongs. What is read is used to fill in one address field and is not stored, logged, or transmitted anywhere.
That is the entire list. Nothing else in the game reaches outside the device it is running on.
What is stored on your device
The game keeps a small settings file on your own device. It holds three things, and nothing else:
- Whether you have muted the music
- The nickname you chose for multiplayer — up to six letters, whatever you typed
- The language you picked on the settings screen, English or Spanish — if you picked one. If you have not, the game follows your device's language instead, which it reads when it starts and never writes down
Your progress within a run — lives, heat, score — lives in memory while you play. None of this is sent anywhere. Deleting the app removes it.
On Android the file is in the app's private storage, and the app also sets allowBackup="false", so this settings file is not swept into a cloud backup. On iPhone and iPad it is in the app's own storage, which iOS includes in your device's backups (to iCloud or to a computer) like any app's data; the game itself never sends it anywhere. On Apple TV the same three settings are kept in the app's own storage on the Apple TV, and the game never sends them anywhere either.
Permissions, and why each one is there
Android
The app declares four permissions. All four exist for local multiplayer discovery. None of them is there for advertising, analytics or tracking, and the app requests nothing else.
| Permission | What it is actually for |
|---|---|
INTERNET | Android requires this to open any network socket at all, including one that only ever talks to another phone on your own WiFi. That is the only thing the game uses it for. |
ACCESS_NETWORK_STATE | To know whether there is a network to look for rooms on. |
ACCESS_WIFI_STATE | To find this device's own address on the WiFi, so the room screen can show you the address another player can type in. |
CHANGE_WIFI_MULTICAST_STATE | Many WiFi chipsets drop multicast frames to save power unless an app holds a multicast lock. Discovery needs those frames to arrive. Without this, the room list would simply stay empty on a lot of phones. |
Notably absent: AD_ID (the advertising identifier) and BILLING (in-app purchases). Neither is declared, because the game does neither.
WiFi hardware and a touchscreen are both marked as not required. A device with no WiFi loses the room list and nothing else, and a controller or keyboard plays the game perfectly well.
iPhone and iPad
iOS will show you a Local Network permission prompt the first time the game looks for rooms. You will see it, and it is worth knowing why:
Since iOS 14, an app cannot touch the local network — not even to find another copy of itself on your own WiFi — until you have said yes. The prompt exists because of the multiplayer room list and nothing else.
You can decline it. The game works completely normally without local network access: solo play, couch play, the leaderboard, all of it. What you lose is the automatic room list — and even then you can still join a friend by typing in their address by hand.
The app's privacy manifest, the same on iPhone, iPad and Apple TV, declares no tracking, no tracking domains, and no collected data types. The only system APIs it declares using are the ordinary ones for reading its own files, reading the device's uptime for game timing, and storing its own settings. The only capability the app requests is Game Center. The Apple TV app declares the same local network use, for the multiplayer room list and nothing else.
Buying the game
Amaru Surf is a paid app. Your purchase is handled entirely by Apple or Google — they take the payment, and the app itself never sees your name, your payment details, or your email address. I receive only the aggregate sales reporting the stores provide to developers, which does not identify individual buyers.
Apple's and Google's handling of your purchase is governed by their own privacy policies and terms, not by this one. Refunds are handled by the store you bought from.
Children
Amaru Surf is suitable for all ages. I collect no personal information from anyone, and therefore none from children — knowingly or otherwise. There is nothing in the game that asks a child for an email address, a name, a photograph, a location, or an age, and there is no advertising, no in-app purchase, and no way for a player to communicate with a stranger. The exception is Google's, on Android: its Play Games library collects what “The leaderboard” above describes, and tapping LEADERBOARD while signed out opens Google's own screen to sign in to Play Games or create a profile. Both are governed by Google's privacy policy.
The one place a player types anything is a nickname of up to six letters, used to label their board in multiplayer, stored on their own device and shown only to other players already on the same WiFi network. Chat in multiplayer is limited to eight fixed phrases chosen from a menu — free text cannot be sent.
If you believe a child has somehow provided personal information through this app, please write to support [at] amaru.surf and I will look into it, though I do not expect to find anything to delete.
Changes to this policy
If the game ever changes in a way that affects this policy, I will update this page and change the effective date at the top. Material changes — anything that would mean the game started collecting something it does not collect today — will also be reflected in the app's store listing before the change ships, because the stores require that.
This page lives at https://amaru.surf/privacy and will stay there.
Store declarations
On the App Store, Amaru Surf is declared as "Data Not Collected". On Google Play, its Data safety section declares what Google's Play Games library collects for the leaderboard — your Play Games identity, your scores, and analytics and diagnostics, as described above — and no other data. This policy is written to match those declarations exactly; if you ever find a discrepancy between this page, the store listing, and what the app actually does, that is a bug, and I would like to hear about it at support [at] amaru.surf.