Privacy Policy

Last updated: October 10, 2026

This Privacy Policy explains how MindGrid ("we", "us", or "our") handles information when you play our mobile games. It applies to every app MindGrid publishes on Google Play (the "Games"):

• Block Puzzle: Grid Blast (com.mindgridpuzzle.blocks) — game page
• Candy Capy: Capybara Match 3 (app.mindgrid.candycapy) — game page
• Moonlit Pour: Potion Sort (app.mindgrid.moonlitpour) — game page

The Games do not all work the same way, so this policy says which Game each section applies to. It does not cover Google Play itself, which has its own policies.

1. Who we are

The Games are made and published by MindGrid, an independent mobile puzzle game studio and the developer named on the Games' Google Play listings.

• Privacy contact: [email protected]
• Website: https://mind-grid.app

2. What each Game uses

3. Information stored only on your device

Each Game keeps the following in its private storage on your device. None of it is sent to us.

• Your progress and game state: levels, stars and scores, coins, boosters, lives or hearts and their timers, daily rewards, spins and streaks.
• Your settings, such as sound, music, vibration, reminders and accessibility options.
• Which one-time purchases you own (for example Remove Ads), and records that stop a purchase from being granted twice.
• Your consent choices (Grid Blast and Moonlit Pour).
• Reminder notifications scheduled on your device (Grid Blast and Moonlit Pour), and a cached copy of game settings (Moonlit Pour).

This information stays on your device until you uninstall the Game or clear its storage in Android settings. If Android backup is turned on, Android may include it in your device backup to your Google account; that backup is handled by Google, not by us. Because we have no copy, we cannot restore lost progress or coins.

4. Information processed by services in the Games

4.1 Consent and privacy choices

Moonlit Pour uses Google's User Messaging Platform (UMP). When the Game starts, UMP asks Google's servers whether a consent message is needed where you are, and shows it if so. Google decides this from your device and network information, including your IP address. Ads and analytics start only after this step, and follow your answers.

Grid Blast shows its own consent message the first time you play, where you can accept or decline personalized ads. You can see the message again and change your answer in Settings > Privacy. Your choice is passed to the ad networks, and declining also tells them not to "sell" or "share" your information under US state laws. Please note that ads and analytics start when the Game opens, so on your first launch ads may be requested before you answer; until you answer, the ad networks use their default settings.

Candy Capy has no ads or analytics, so it does not show a consent message.

4.2 Advertising (Grid Blast and Moonlit Pour)

Grid Blast shows ads through Unity LevelPlay, a mediation service by Unity Technologies that picks an ad from Google AdMob or Unity Ads. Moonlit Pour shows ads from Google AdMob. Both Games show rewarded ads (only when you choose to watch one), ads between levels, and a banner during play. Buying Remove Ads turns off the banner and the ads between levels; rewarded ads stay available as an option.

Ad services automatically collect and share, for advertising, analytics and fraud prevention:

• Your IP address, which may be used to estimate your general location.
• How you interact with ads and the app, for example app launches, taps and video views.
• Diagnostic information, for example app launch time and performance.
• Device identifiers, such as the Android advertising ID and the app set ID, and device information such as model, operating system, language and screen size.

Whether ads are personalized depends on your consent choices and where you live. If you decline, you may still see non-personalized or limited ads, which use contextual information instead of a profile and still use your IP address to deliver the ad and prevent fraud. Moonlit Pour limits ad content to the "PG" rating. Neither Game marks ad requests as directed to children.

Google uses this information as described in How Google uses information from sites or apps that use our services and the Google Privacy Policy. Unity uses it as described in the Unity Game Player and App User Privacy Policy.

4.3 Game analytics (Grid Blast and Moonlit Pour)

We use Google Analytics for Firebase to understand how the Games are played, for example which levels are too hard and whether ads and offers are balanced.

• Grid Blast records when a level starts and ends (level, game mode, score and result), the furthest Adventure level reached, when a rewarded ad is shown (type and placement), and purchases (product ID).
• Moonlit Pour records level events (started, won or failed, with moves, time, boosters and coins), booster use and hearts, coins earned and spent, daily reward claims, ad impressions and the ad revenue AdMob reports, purchases (product, price and currency), reminder prompt answers and reminder opens, and a test-group label used to compare game settings.

Firebase also collects automatically: an app-instance ID, the Android advertising ID (where allowed), coarse location derived from your IP address, app start and session information, how the app was installed, in-app purchases, and device and app details such as model, operating system version, language and app version. We do not set a user ID and do not link this data to your name or email.

• In Moonlit Pour, analytics follows Google's consent mode: if you refuse analytics storage, Google Analytics receives events without device or user identifiers, used only for aggregate measurement; if you refuse ad storage, the advertising ID is not collected.
• In Grid Blast, analytics runs whatever you choose in the consent message. Your choice controls whether analytics data may be used for advertising (ad storage, ad user data and ad personalization); until you answer, these are allowed.

4.4 Crash reports (Moonlit Pour)

To find and fix crashes, Moonlit Pour uses Firebase Crashlytics. When the Game crashes or hits a serious error, Crashlytics sends the error details and stack trace, the time of the crash, device and app state (device model, operating system, CPU type, RAM and disk space, whether the device is rooted, orientation, app version), a Crashlytics installation ID and a Firebase installation ID, the test group and number of sessions, and a short log of recent analytics events. Crash reporting starts after the consent step, whatever choice you make, because we treat it as necessary to keep the Game working and secure.

For all Games, Google Play may also collect crash and performance data from your device under Google's own policies.

4.5 Game settings and tests (Moonlit Pour)

Moonlit Pour downloads its current settings, such as coin rewards, prices, difficulty and how often ads appear, from Firebase Remote Config. Settings may differ between groups of players in a test. To do this, Firebase uses a Firebase installation ID and receives basic information: country and language, time zone, operating system version, app ID and version, and analytics properties such as the test group.

4.6 Purchases (all Games)

All purchases are processed by Google Play. Google collects your payment details under its own terms (see the Google Payments Privacy Notice). We never receive your card or bank details. To give you what you bought, the Game receives the purchase details from Google Play (product ID, order or transaction ID, purchase token, time and status) and checks them on your device. Grid Blast and Moonlit Pour also record purchases in analytics (see 4.3).

The Games use Unity In-App Purchasing (by Unity Technologies) to talk to Google Play.

• In Candy Capy and Moonlit Pour, Unity In-App Purchasing sends a report to Unity's servers when you start, complete, cancel or fail a purchase. It contains the product, price and currency, the Google Play transaction ID and receipt data, and device and app information (device model, operating system version, language and locale, device boot time and total storage, app ID and version, engine and SDK versions, install time). Unity also sees your IP address as part of the connection. It does not include your advertising ID.
• Grid Blast uses an earlier version of Unity In-App Purchasing that, according to Unity, does not collect personal data. To run it, the Game starts Unity Gaming Services, which may send Unity basic technical information about the app and device.

Unity says it acts on our behalf for this data, but uses some transaction data for its own purposes, such as financial reporting, legal compliance and fraud prevention. See the Unity Game Player and App User Privacy Policy.

4.7 Google Play Games (Grid Blast)

Grid Blast uses Google Play Games Services for leaderboards and achievements. When the Game starts it signs you in to Play Games automatically if you have a Play Games profile, and you can also sign in from Settings. Your scores (Classic, Timed and Adventure) and achievements are sent to Google and shown with your Play Games profile. The Game does not request your name, email address or other account details. Google handles this data under the Google Privacy Policy, and you can manage your profile and visibility in the Google Play Games settings.

4.8 Reminders (Grid Blast and Moonlit Pour)

These Games can show reminder notifications, for example when a daily reward or free spin is ready. On Android 13 and later they ask your permission first. Reminders are scheduled on your device; we do not use push notifications, and no notification token is sent anywhere. You can turn reminders off in the Game's settings (Moonlit Pour) or in Android notification settings. Candy Capy does not send notifications.

4.9 The Unity engine

The Games are built with the Unity engine. Unity may receive limited technical information about the app and device, as described in Unity's privacy policy.

4.10 When you contact us

If you email us, we receive your email address, your message and anything you choose to include. We use it to answer you and to handle your request.

4.11 What we do not collect

We do not collect your name, postal address, phone number or date of birth. The Games do not use your precise location, contacts, photos, videos, audio, files, calendar, SMS or browsing history. There are no MindGrid accounts, no chat and no user-generated content.

5. Why we use information, and our legal bases

The legal bases below apply where the EU or UK GDPR applies.

Where we rely on legitimate interests, you can object (see section 12).

6. Your choices

• Consent and ad choices: in Moonlit Pour, open Settings > Privacy and ad choices; in Grid Blast, open Settings > Privacy. This includes, in supported US states, opting out of the "sale" or "sharing" of personal information for targeted advertising.
• Advertising ID: in Android, go to Settings > Privacy > Ads to reset or delete your advertising ID. On some older Android versions, the path is Settings > Google > Ads, where you can opt out of ads personalization.
• Notifications: turn reminders off in the Game's settings where available, or in Android notification settings.
• Google Play Games: manage or sign out of your Play Games profile in the Google Play Games settings.
• Purchases: use Google Play's parental controls and purchase authentication to limit purchases.
• Uninstalling a Game removes everything it stored on your device. Information already sent to the services above is kept as described in section 9.

7. Who receives information

We do not sell your information for money, and we do not give it to data brokers. Information is received by:

8. "Sale" and "sharing" under US state privacy laws

California and other US state laws treat some ad-related data transfers as a "sale" or "sharing" of personal information, even when no money changes hands. When personalized ads are on in Grid Blast or Moonlit Pour, the Game gives ad partners identifiers (advertising ID, IP address), information about app and ad interactions, and approximate location for cross-context behavioral advertising. You can opt out in the Game's privacy settings (see section 6) or by deleting your advertising ID. Candy Capy does not sell or share personal information.

We do not knowingly sell or share personal information of consumers under 16, and we do not use or disclose sensitive personal information as defined by these laws. In the last 12 months, the categories of personal information collected through the Games are: identifiers (advertising ID, app-instance ID, installation IDs, IP address); internet or other electronic network activity (game and ad interactions, crash and diagnostic data); commercial information (purchase records); and approximate location derived from IP address.

9. How long information is kept

10. International transfers

Google and Unity may process information in the United States and other countries, which may not offer the same level of protection as your country. Where EU, UK or Swiss rules apply, these transfers rely on safeguards such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or the European Commission's Standard Contractual Clauses in the providers' data processing terms.

11. Children and teens

The Games are not designed for or directed to children under 13, and we do not knowingly collect personal information from children under 13. Moonlit Pour is meant for players aged 13 and over. The Games do not ask your age.

If you are under the age at which you can consent to data processing where you live (13 to 16 in the EU, depending on the country), please ask a parent or guardian before agreeing in a consent message. If you believe a child under 13 has used a Game and their information was sent to the services above, contact us and we will delete any information we can locate.

12. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and get a copy.
• Correct inaccurate information.
• Delete your information.
• Restrict or object to processing, including processing based on legitimate interests.
• Data portability.
• Withdraw consent at any time in the Game's privacy settings. This does not affect processing that happened before.
• Opt out of the sale or sharing of personal information and of targeted advertising (US state laws).
• Not be discriminated against for using these rights.
• Complain to a data protection authority, for example the one where you live.

To use these rights, email [email protected] with the name of the Game in the subject line. We have no account to check your identity against, so we may ask for details that help us find your data, such as a Google Play order number. We answer within one month under GDPR, or 45 days under US state laws; both deadlines can be extended where the law allows.

Because we keep no player database, most of your information is either only on your device or held by Google and Unity. We will pass on your request to them where they act on our behalf, and for data they control themselves we will tell you how to contact them.

13. Deleting your data

You can request deletion without an account:

• On your device: uninstall the Game, or open Android Settings > Apps > [Game] > Storage and clear its storage. This deletes your progress, settings, consent choices and reminders.
• Advertising ID: reset or delete it in Android Settings > Privacy > Ads.
• Data held by our service providers: email [email protected] with the subject "[Game name] data deletion". We will ask Google to delete analytics data we can link to you, let crash reports expire (90 days) or delete specific ones you identify, pass your request to Unity for purchase data using the details you give us (for example your Google Play order number), and delete our emails with you, except where we must keep a record.

Google Play purchase records and your Play Games profile are kept by Google and managed in your Google account.

14. Security

Information sent by the Games and their services travels over encrypted connections (HTTPS). Data on your device is kept in the Game's private app storage, which other apps cannot read on a normal, non-rooted Android device. No system is perfectly secure; if a breach affects your information, we will notify you and the authorities where the law requires it.

15. Changes to this policy

We may update this policy when a Game, a new MindGrid app, or the law changes. We will change the "Last updated" date above, and for significant changes we will also give notice in the Game or on its store listing, and ask for consent again where required.

16. Contact us

If you have any questions about this Privacy Policy or our data practices, you can reach us at [email protected]. See also our Terms of Use.