Cosmic Merge

Privacy Policy

Effective and last updated: August 12, 2026

This policy explains what information is handled when you play Cosmic Merge, why it is used, which service providers receive it, and the choices available to you.

This policy is a privacy notice, not a request for agreement or consent. Where consent is required for advertising or tracking, the game asks separately through Google's User Messaging Platform or Apple's App Tracking Transparency prompt.

Cosmic Merge is published and operated by Piercarlo Puccini Rodriguez under the Puccini Labs brand. For privacy questions or requests, email hello@puccinilabs.com.

1. Scope and summary

This policy applies to the Cosmic Merge iOS app and the related accountless services used for advertising, purchases, progression, analytics, diagnostics, and support. Cosmic Merge does not require a Puccini Labs account and does not ask you to provide a name, email address, phone number, contacts, photos, microphone recordings, or precise GPS location to play.

Most detailed gameplay state stays on your device. Limited gameplay, technical, advertising, purchase, and support information is processed by the providers described below.

2. Information handled

On-device game information

The app stores game progress and state locally, including scores, current and recent match state, settings, progression, achievements, powerup inventory, cached purchase entitlements, daily-reward state, and counters used to enforce the advertising cadence. This supports normal gameplay, recovery after interruption, fraud-resistant inventory use, and your preferences.

Product analytics and diagnostics

Cosmic Merge sends bounded events to PostHog to understand app reliability and feature use. These may include app launches, gameplay milestones, scores and tier progression, match duration and merge counts, settings and store actions, purchase and restore outcomes, ad lifecycle outcomes, app version, build, operating-system version, device class, and sanitized error or crash diagnostics.

Some match events contain a random match identifier. After the app verifies its accountless commerce profile, an app-generated random Support/Operations identifier is used as the PostHog analytics identity and as the RevenueCat customer identifier. It is not your Apple Account identifier, advertising identifier, name, or email. Cosmic Merge disables PostHog session replay, automatic screen capture, automatic element capture, and automatic screen-view capture. Its event sanitizer rejects names, email addresses, IDFA, IDFV, purchase transaction identifiers, raw device identifiers, and Support/Operations identifiers as event properties.

Advertising and consent information

The free version uses Google AdMob for fullscreen interstitial ads and narrowly bounded interrupted-ad recovery. Cosmic Merge does not use banner ads or rewarded ads. Google and the ad technology providers disclosed in the Google consent form may process IP address, general location inferred from IP, device and app characteristics, language, advertising interactions, fraud and security signals, and an advertising identifier when legally permitted.

On iOS, IDFA is available to advertising providers only if you allow tracking through Apple's App Tracking Transparency prompt. Where required, Google's User Messaging Platform presents regional consent choices before ads are requested. Consent state is stored and refreshed by Google's SDK. Declining personalized advertising does not necessarily remove ads; eligible contextual, non-personalized, or limited ads may still use information such as IP address to deliver, secure, and measure an ad. The app disables Google's publisher first-party identifier, mediation initialization, and Google Mobile Ads SDK crash reporting.

An active Remove Ads entitlement suppresses third-party ad requests. RevenueCat receives bounded ad-impression revenue and placement information through its AdMob integration so purchases and ad revenue can be measured together. If you authorize tracking through Apple's prompt, Cosmic Merge also asks RevenueCat to collect IDFA, IDFV, IP address, and device version as reserved customer attributes for advertising attribution and measurement. These identifiers do not enter gameplay, support diagnostics, PostHog event properties, or app logs. Cosmic Merge does not send its Support/Operations identifier to Google Mobile Ads.

Purchases and accountless commerce

Apple processes App Store purchases and payment information. Cosmic Merge uses RevenueCat to verify products, purchases, entitlements, restores, and virtual powerup balances. RevenueCat may receive the app-generated Support/Operations identifier, device and app information, Apple receipt or transaction information, product identifiers, purchase status, entitlement state, virtual-currency activity, and related diagnostics. We do not receive your payment card details or Apple Account password.

Our accountless commerce service verifies Apple-signed app and transaction evidence and maintains the accountless commerce profile. It stores the random Support/Operations identifier, StoreKit environment, entitlement and inventory reconciliation state, idempotency records, bounded fraud or conflict evidence, and daily progression information. Daily-reward requests include your current IANA time-zone identifier so the service can calculate the correct local calendar day; the service stores the last successful claim timestamp, local date, and time zone. It does not request GPS access or store an Apple Account identifier.

Game Center

If Game Center is available and authenticated, Cosmic Merge uses Apple's GameKit services to load and report achievements and leaderboard scores. Apple handles the associated Game Center player account and service data under Apple's policies. Local achievement and progression state also remains on your device.

Information you choose to provide

If you contact support, we process the email address, name, message, and attachments you choose to send. If you choose to copy and send a diagnostic summary, it may contain the visible Support/Operations identifier, app and build version, purchase environment, entitlement state, inventory status, and bounded logical diagnostics. The app does not silently transmit that support summary.

3. How information is used

Operate, save, restore, secure, and improve gameplay.
Provide purchases, Remove Ads, powerups, and daily progression.
Display and measure ads when the player is eligible.
Respect consent, tracking, and privacy choices.
Diagnose crashes, performance problems, failed operations, and abuse.
Provide customer support and resolve purchase or inventory issues.
Comply with App Store, accounting, security, and legal obligations.

4. Legal bases

Depending on your location and the specific processing, we rely on: your consent for personalized advertising, tracking, and other consent-based processing; performance of a contract to deliver the game, purchases, and requested services; legitimate interests in operating, securing, diagnosing, and improving the app where those interests are not overridden by your rights; and compliance with legal obligations. You may withdraw consent without affecting processing that was lawful before withdrawal.

5. Service providers and disclosure

We disclose information only as needed to operate the app, follow your choices, comply with law, protect players and services, or complete a transaction you request. The principal providers are:

Google AdMob and User Messaging Platform: Advertising, consent, ad delivery, measurement, and fraud prevention. See Google's Privacy Policy and how Google uses information from partner apps.
Apple: App distribution, StoreKit purchases and receipts, App Tracking Transparency, SKAdNetwork attribution, and Game Center. See Apple's Privacy Policy.
RevenueCat: Purchase validation, entitlements, virtual currency, restores, bounded AdMob revenue attribution, and—only after ATT authorization—device identifiers and related attribution information. See RevenueCat's Privacy Policy.
PostHog: Product analytics, sanitized diagnostics, and error tracking. See PostHog's Privacy Policy.
Cloudflare: Hosting, secure network delivery, and the accountless commerce and progression service. See Cloudflare's Privacy Policy.

We do not sell personal information for money. Advertising-related disclosures may be treated as a “sale,” “sharing,” or targeted advertising under some privacy laws even when no money is exchanged for personal information. Use the controls below to manage those activities where applicable.

6. Retention

Local gameplay information remains until you reset the relevant feature or delete the app, subject to iOS backup and restore behavior. Some accountless purchase identity may remain in the iOS Keychain so that purchases and inventory can be restored safely after reinstall.

Commerce, entitlement, purchase, inventory, fraud-prevention, and support records are retained while needed to provide durable purchases and services, resolve disputes, prevent abuse, meet accounting or legal obligations, and support restore operations. Analytics and diagnostic records are retained according to our configured operational needs and the provider's applicable retention settings. Advertising, App Store, and Game Center records are retained by Google and Apple under their respective policies.

A deletion request does not require deletion of information that must be retained for legal compliance, transaction records, security, fraud prevention, or the defense of legal claims. Where deletion is not possible, information may be restricted or de-identified when appropriate.

7. Your privacy choices

Regional ad choices: when Google reports that a privacy-options form is required, open Cosmic Merge Settings → Privacy, Terms & Credits → Ad Privacy Choices.
Tracking: change Apple's tracking permission in iOS Settings → Privacy & Security → Tracking.
Remove Ads: purchase or restore the lifetime Remove Ads entitlement through the in-app Store to suppress third-party ads.
Game Center: manage Game Center authentication and privacy through your Apple device settings.
Local data: deleting the app removes ordinary local gameplay data, subject to iOS backup, purchase restoration, and Keychain behavior described above.
Requests: email hello@puccinilabs.com to request access, correction, deletion, restriction, objection, portability, or help withdrawing a choice, where applicable.

We may need information sufficient to verify and locate the relevant accountless profile, such as your Support/Operations identifier. You may also have the right to complain to your local data-protection authority.

8. Children

Cosmic Merge is a general-audience game and is not designed specifically for children or enrolled in Apple's Kids Category. We do not knowingly ask children to provide personal contact information. Parents or guardians who believe a child has provided personal information may contact us so we can review the request. Advertising and consent treatment may vary based on applicable law, platform settings, and the information available to Google.

9. International processing and security

Providers may process information in countries other than your own, including the United States. Where required, transfers rely on applicable contractual or legal safeguards. We use HTTPS, bounded identifiers, access controls, data minimization, and sanitization, but no system can guarantee absolute security.

10. Changes and contact

We may update this policy when the app, providers, or legal requirements change. The effective date above will be updated, and material changes will be communicated through an appropriate app or store notice when required.

Questions or privacy requests: hello@puccinilabs.com.