Privacy Policy

1. Who we are

The app Rainbow Mane: Pony Care (“the app”) and the website rainbowmane.app are run by:

[NAME]
[ADDRESS], Spain
Email: support@rainbowmane.app ([EMAIL])

We are the data controller for the processing described here. We are a very small team and have not appointed a Data Protection Officer; please contact us directly with any privacy question.

2. Who the app is for: age screen and profiles

The app is for a mixed audience: children, teenagers and adults. When you first open the app, we ask for your year of birth on a neutral screen. Depending on the answer, the app uses one of two profiles:

• Child profile — for players under 13, and in the EU/EEA and UK for players under the age of digital consent in their country (between 13 and 16; for example 14 in Spain). These thresholds are set per country and are updated if the law changes.
• Teen/adult profile — for everyone else.

Where Google Play provides an age signal (Play Age Signals API, used for example to comply with age-verification laws in some US states) saying the user is a child or is supervised by a parent, the app switches to the child profile automatically, and the age screen cannot override that. We use this signal only to choose the profile; we do not use it for ads or analytics and do not keep it longer than needed.

The year of birth stays on the device. We only keep the resulting age group (child or teen/adult) and the country used to pick the threshold.

3. What data the app uses

3.1 Data stored only on your device

• Game progress: pets, the names you give them, care levels, gold, items, friendship level, daily tasks.
• Settings: language, sound, reminders, “reduce motion”, parent settings.
• Age group and country for the age threshold (see section 2).

We cannot see this data. It is deleted if you use For parents → Delete game data or uninstall the app.

3.2 Data processed by Google when ads are shown

See section 4. This may include your IP address, device and app information, ad interactions and, only in the teen/adult profile, the advertising ID.

3.3 Purchases

Payments are handled by Google Play. We receive a purchase confirmation (order number, product, time, status) so that we can deliver the item. We never receive your card or bank details.

3.4 Emails you send us

If you write to support@rainbowmane.app, we receive your email address and whatever you write. We use it only to answer you.

3.5 What we never collect

Real name, email address (unless you write to us), phone number, precise or approximate location, contacts, photos, camera, microphone. The app has no chat and no way for players to share personal information with each other.

4. Advertising: Google AdMob

The app shows ads to keep the game free. Our only ad network is Google AdMob (Google Ireland Limited / Google LLC). We do not use ad mediation, so no other ad companies receive data through the app.

Ads appear only as optional rewarded videos (you choose to watch one to earn gold) and as a banner in the shop. Ads never interrupt pet care.

Consent. In the EU/EEA, the UK and Switzerland we ask for consent with Google’s User Messaging Platform (UMP), a consent tool certified by Google. You can change your choice any time in Settings → Privacy choices.

Google’s own use of this data is described in the Google Privacy Policy and in How Google uses information from sites or apps that use its services.

5. Firebase (planned)

The first version of the app works without any server of ours. In a later version we plan to add Google Firebase (Google Ireland Limited / Google LLC) for:

• Purchase verification — checking with Google Play that a purchase is real (purchase token, product, time);
• Server time — so that daily rewards can’t be cheated by changing the clock;
• Remote Config — adjusting game balance without an update (an app-instance identifier, app version, country and language);
• Crashlytics — crash reports (device model, OS version, app state at the crash, an installation identifier), with no personal data in the child profile;
• Cloud save — optional, with Google sign-in, only for players aged 13 or over (above the local consent age in the EU).

We will update this policy and show a notice in the app before any of this is switched on. See Privacy and Security in Firebase.

6. Why we may use data (legal bases, GDPR)

• To provide the game you asked for (Art. 6(1)(b) GDPR): saving progress on your device, delivering purchases.
• Consent (Art. 6(1)(a)): personalised ads for teens/adults. You can withdraw consent at any time; this does not affect earlier processing.
• Legitimate interests (Art. 6(1)(f)): non-personalised ads that keep the game free, preventing fraud and cheating, fixing crashes. We have weighed these against your interests, with extra care for children.
• Legal obligations (Art. 6(1)(c)): keeping purchase and tax records.

7. Children’s privacy (COPPA and similar laws)

We follow the US Children’s Online Privacy Protection Act (COPPA, as updated in 2025–2026), the GDPR and the UK Age Appropriate Design Code. For the child profile:

• We do not knowingly collect personal information from children beyond what is needed to run the app and show contextual ads (for example an IP address and device information processed by Google for “support for internal operations”).
• No targeted advertising, no retargeting, no advertising ID, no location. Because children never get targeted ads, we do not ask parents for the separate consent that COPPA requires for that.
• Purchases with real money are switched off by default. A parent can switch them on behind a parent check.
• A parent check (a small maths question in words) protects purchases, the parent area and every external link.
• No chat and no sharing between players. If we add social features in the future (such as gifts between friends), they will be behind the parent check and will not let children share personal information.
• Privacy-friendly defaults for everyone under 18: no personalisation, no location, no notifications at night.

Parents’ rights. You can ask us at any time what information we hold about your child, ask us to delete it and ask us to stop any further collection. Since game data stays on the device, you can also delete it yourself with For parents → Delete game data. Write to support@rainbowmane.app.

8. Who receives data

We do not sell personal data and do not “share” it for cross-context behavioural advertising, as those terms are used in US state laws.

9. International transfers

Google and Cloudflare may process data outside the EU/EEA, including in the United States. These transfers are covered by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses used by these providers.

10. How long we keep data (data retention policy)

We never keep children’s personal information longer than reasonably necessary for the purpose it was collected for, and then delete it securely.

11. How we protect data (information security program)

We keep a written information security program for the app, as COPPA requires:

• One named person is responsible for it: [NAME].
• We assess risks at least once a year and after any major change, and fix what we find.
• We collect as little as possible; most data never leaves the device.
• All connections use encryption (HTTPS/TLS). Access to developer accounts uses strong passwords and two-factor authentication.
• We choose service providers that offer appropriate protection and contractual safeguards.
• If a data breach affects you, we will inform you and the authorities as the law requires.

12. Your rights

Under the GDPR you can ask to access, correct, delete, restrict or transfer your data, and you can object to processing based on legitimate interests. You can withdraw consent for personalised ads at any time in Settings → Privacy choices.

To use your rights, write to support@rainbowmane.app. We reply within one month. Residents of US states with privacy laws (such as California) have similar rights to know and to delete; we do not sell or share personal data.

You can complain to a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD); you can also contact the authority where you live.

13. This website

rainbowmane.app has no cookies, no analytics, no trackers and no third-party fonts or scripts. The pages are hosted by Cloudflare, which processes your IP address and basic request information to deliver the pages and protect the site.

14. Changes to this policy

If we change this policy, we will publish the new version here with a new date. If the change is important (for example when Firebase is switched on), we will also tell you in the app before it takes effect.