Monlings Privacy Policy
Effective date: November 11, 2026
This policy explains what data the Monlings mobile game ("the app") collects, why, who we share it with, how long we keep it and what you can do about it.
Who we are
Monlings is made by Xipem Digital Ltda ("Xipem", "we"), Av. Paulista, 1636, Cond. 4, Pav. 15, Sala 1504, Bela Vista, São Paulo - SP, 01310-200, Brazil, CNPJ 66.506.226/0001-77. We are the data controller for the data described here. Contact: support@xipem.com. This address is also our contact for data protection requests (including as the LGPD "encarregado" channel).
The short version
- No accounts. Your game progress is stored only on your device.
- The app makes a random install ID when you first open it. It is not your name, email or phone number.
- We use Google AdMob for optional rewarded ads, Google Firebase for analytics and crash reports, and our own server for game settings and to check in-app purchases.
- Personalised ads and ad tracking happen only if you allow them (Apple's tracking prompt, and the consent form in the EEA, UK and Switzerland).
- You can delete the data linked to your install ID from Settings > Delete my data.
What we collect and why
| Data | Source | Why | Legal basis (GDPR / LGPD) |
|---|---|---|---|
| Install ID: a random ID made on your device, kept until you delete the app | The app | Link purchases to your install, fix purchase problems, split players into test groups (A/B tests of game settings) | Contract (purchases); legitimate interest (game tuning, fraud prevention) |
| Purchase records: Apple transaction ID, product, date, store environment, the game world you were in, your install ID | Apple (signed receipt sent by the app), our server | Give you the coins you paid for, prevent double or fake purchases, handle refunds | Contract; legal obligation (accounting); legitimate interest (fraud prevention) |
| Gameplay events: stage started / won / lost / quit, hero picked, world reached, ad watched, purchase made, test group | The app, via Firebase Analytics | Understand how the game is played and balance it | Legitimate interest; consent where required (see "Consent") |
| Crash and performance data: crash logs, device model, OS version, app version | The app, via Firebase Crashlytics | Find and fix crashes | Legitimate interest |
| Advertising ID (IDFA): only if you allow tracking | Your device, via Google AdMob | Show and measure ads, personalised ads | Consent |
| Ad data: ads shown, ad interactions, device and app information | Google AdMob | Serve rewarded ads, count ad views, prevent ad fraud | Consent (personalised ads); legitimate interest (non-personalised ads, fraud prevention) |
| IP address and coarse location (country / region derived from IP) | Our server logs, Google AdMob, Firebase | Security, abuse prevention, choosing the right consent form, ad delivery | Legitimate interest |
We do not collect your name, email, phone number, contacts, photos, precise location or payment card details. Apple processes payments; we only receive a signed record of the purchase.
Consent, tracking and ads
- EEA, UK and Switzerland: on first launch you see Google's consent form (UMP). Until you answer, analytics and ad storage stay off. You can change your choice at any time in Settings > Ad privacy options.
- Apple tracking prompt (ATT): if you choose "Ask App Not to Track", the app does not access your IDFA and ads are not personalised with it. Firebase Analytics does not collect the advertising ID either.
- Rewarded ads are optional. You never have to watch an ad, and no reward depends on allowing tracking.
- We ask Google to show only ads rated for general audiences (G / PG).
Who we share data with
We do not sell your personal data. We share data only with these service providers, who process it for us or under their own terms:
| Provider | What for | Their privacy terms |
|---|---|---|
| Google (AdMob, User Messaging Platform) | Rewarded ads, consent form | https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites |
| Google (Firebase Analytics, Crashlytics) | Gameplay analytics, crash reports | https://firebase.google.com/support/privacy |
| Apple | App distribution, in-app purchases, refunds | https://www.apple.com/legal/privacy/ |
| Fly.io | Hosting our game server | https://fly.io/legal/privacy-policy/ |
Under California law (CCPA / CPRA), sharing the advertising ID with Google for personalised ads may count as "sharing" for cross-context behavioural advertising. You can opt out by choosing "Ask App Not to Track" in the Apple prompt or in iOS Settings > Privacy & Security > Tracking.
We may also disclose data if the law requires it, or to protect our rights and users (for example in a fraud case).
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it (for example GDPR or LGPD), transfers rely on the providers' standard contractual clauses or other approved safeguards.
How long we keep data
| Data | Kept for |
|---|---|
| Server logs (may include IP address and install ID) | 30 days |
| Purchase ledger | 24 months, then deleted, unless the law requires longer (for example tax records) |
| Firebase Analytics events | 2 months |
| Crashlytics crash reports | per Firebase's retention (currently 90 days) |
| Game progress and install ID on your device | Until you delete the app (Settings > Reset progress clears progress but keeps the install ID) |
Apple keeps its own records of your purchases under Apple's policy.
Your rights and choices
Depending on where you live (for example the EU, UK, Brazil or California) you have the right to access, correct, delete or get a copy of your personal data, to object to or restrict processing, and to withdraw consent at any time. You also have the right to complain to your data protection authority (in Brazil, the ANPD).
How to use them:
- Delete my data: Settings > Delete my data deletes the purchase records linked to your install ID on our server and resets your Firebase Analytics ID, so new events are no longer linked to old ones (past analytics events expire after 2 months). Coins already granted stay in your game.
- Ad choices: Settings > Ad privacy options (consent form), and iOS Settings > Privacy & Security > Tracking.
- Anything else: email support@xipem.com with the install ID shown in Settings, so we can find your data. We answer within 30 days (15 days for LGPD requests where required).
Because we have no accounts, the install ID is the only way to find your data. If you delete the app, a new install gets a new ID and we can no longer link the old data to you; it is then deleted on the schedule above.
Children
Monlings is a general-audience game rated 9+ on the App Store. It is not directed to children under 13 (or the minimum age in your country), we do not knowingly collect personal data from them, and we ask Google not to treat the app as child-directed. If you believe a child has given us personal data, contact support@xipem.com and we will delete it.
Security
The app talks to our server only over HTTPS. Purchase records are checked against Apple's signature before we store them. Our server keeps no passwords or payment details because none are collected.
Changes
If we change this policy we will update the effective date above, and for important changes we will tell you in the app.
Contact
Xipem Digital Ltda, Av. Paulista, 1636, Cond. 4, Pav. 15, Sala 1504, Bela Vista, São Paulo - SP, 01310-200, Brazil, support@xipem.com