Effective date: September 12, 2026

Wyrm & Whelp (“we,” “us,” or “our”) operates the mobile game Wyrm & Whelp: Idle Hoard (the “App”), available on Google Play. This Privacy Policy explains what information the App collects, how it is used and shared, and the choices and rights you have regarding that information.

By downloading, installing, or using the App, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the App.

1. Summary

• The App is a single-player idle/incremental game with optional cloud save, an optional account, rewarded video ads, and optional in-app purchases.
• We do not require you to create an account to play. On first launch, the App automatically creates an anonymous account so your progress can sync to the cloud; you can optionally upgrade this to a real account with an email address and password.
• We do not sell your personal information for money.
• We use two third-party services that process data on our behalf: Supabase (authentication and cloud game-save storage) and Google (Google Mobile Ads for rewarded video ads, and Google Play Billing for in-app purchases).
• The App is not directed at children under 13, and we do not knowingly collect personal information from children under 13.
• You can permanently delete your account and all associated data at any time from within the App (Settings → Danger Zone → Delete Account), or by emailing us.

The rest of this policy explains all of this in detail.

2. Information We Collect

2.1 Information Created Automatically When You Play

• Anonymous account identifier. The first time you open the App, we create an anonymous user account (via Supabase Authentication) tied to a randomly generated ID. This ID is not linked to your real-world identity unless you choose to add an email address (see below).
• Game progress data. To enable cloud save and cross-launch sync, the App stores your gameplay state — for example, gold/gem/platinum balances, owned lairs and upgrade levels, achievements, avatar selection, daily-reward streak, and similar in-game progress. This data is associated with your account ID, not your real name.
• Auto-generated username. Every account, including guest/anonymous accounts, is automatically assigned a placeholder display name (e.g., “Anonymous123456”) used solely for the in-app leaderboard. This name, together with your total gold earned and your leaderboard rank, is publicly visible to other players inside the App. It is not linked to any other personal information.
• Locally stored data. A copy of your game progress is also stored directly on your device (in a local database) so the App can function without an internet connection. This local data is deleted if you uninstall the App or clear the App’s storage/data from your device settings.

2.2 Information You Choose to Provide

• Email address and password. If you choose to create a full account (to preserve your progress across devices/reinstalls), you provide an email address and password. Your password is never visible to us — it is processed and stored (hashed) by our authentication provider, Supabase.
• Chosen username. If you have a full (signed-in) account, you may choose your own public leaderboard display name, subject to our validation rules (length and allowed characters). This chosen name is also publicly visible on the leaderboard.
• Support communications. If you contact us for support (e.g., via email or a social media account listed in the App’s “Help & Social” section), we receive whatever information you choose to include in that communication (such as your email address and the contents of your message).

2.3 Information Collected by Third-Party Services

Certain features of the App are provided by third-party services that may independently collect information. See Section 4 (“Third-Party Services”) for details on:

• Google Mobile Ads (AdMob) — for rewarded video ads. This may include device and advertising identifiers, IP address, general (coarse) location inferred from IP address, and ad-interaction data.
• Google Play Billing — for processing in-app purchases. Google, not us, receives and processes your actual payment details (card number, etc.); we only receive confirmation that a purchase was completed and which item was purchased.

2.4 Information We Do NOT Collect

We do not request or knowingly collect: your real name, physical address, phone number, precise GPS location, government ID numbers, financial account or full payment card numbers, contacts, photos, camera/microphone data, or biometric data. The App does not access your device’s camera, microphone, contacts, or precise location.

3. How We Use Your Information

We use the information described above to:

• Provide, maintain, and sync your game progress across sessions and devices;
• Operate account features (guest play, sign-up, sign-in, sign-out, account recovery);
• Operate the leaderboard feature;
• Process and fulfill in-app purchases and grant the correct in-app rewards;
• Serve rewarded video ads and measure their delivery;
• Detect, prevent, and respond to fraud, abuse, or unauthorized activity (e.g., preventing duplicate leaderboard names, rate-limiting sign-up attempts);
• Respond to your support requests and communications;
• Comply with legal obligations and enforce our terms.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not use your gameplay data to build advertising profiles ourselves (though our third-party ad provider, Google, may do so independently — see Section 5).

4. Third-Party Services

We do not run our own servers for authentication, cloud storage, advertising, or payments. Instead, we rely on the following third-party service providers, each of which processes certain data as described below and maintains its own privacy policy:

4.1 Supabase

We use Supabase (a backend-as-a-service platform) to provide account authentication and cloud storage of your game-save data. Supabase stores your account identifier, email address and hashed password (if you created a full account), your username, and your game-progress data. Supabase acts as our data processor and secures this data using access controls that restrict each account to only its own data.

Learn more: Supabase Privacy Policy

4.2 Google Mobile Ads (AdMob)

We use Google Mobile Ads SDK to serve optional, opt-in rewarded video ads (e.g., “Watch an Ad” buttons that grant an in-game bonus). No ad plays without you actively choosing to start it — the App never shows forced or interstitial ads. Google may collect device identifiers (such as your Android Advertising ID), IP address, coarse location, and ad-interaction data to select and measure ads, and may use this information consistent with its own privacy policy, including for ad personalization.

Your choices: You can limit ad personalization or reset/delete your advertising identifier at any time in your device settings (on Android: Settings → Google → Ads → “Delete advertising ID” or “Opt out of Ads Personalization”). This is controlled by your device and by Google, not by us.

Learn more: Google Privacy Policy · How Google uses information from sites or apps that use our services

4.3 Google Play Billing

In-app purchases of our virtual currency (“Platinum Pieces”) are processed entirely through Google Play Billing. Google collects and processes your payment information directly — we never see or store your payment card details. We only receive a purchase confirmation and the product identifier, which we use to grant the corresponding in-app currency to your account.

Learn more: Google Payments Privacy Notice

4.4 No Sale of Personal Information for Money

We do not sell your personal information to third parties in exchange for money.

5. Advertising Identifiers and “Sale/Sharing” Under Privacy Laws

Some privacy laws (including California’s CCPA/CPRA) define “sale” or “sharing” broadly enough that it can include allowing an ad network like Google to receive device/advertising identifiers for ad personalization or measurement, even when no money changes hands. Out of caution, we treat this as a “share” for legal purposes.

You can opt out of ad personalization at the device level at any time using your Android device’s ad settings described in Section 4.2 above. Rewarded ads may still be shown to you afterward, but with less/no personalization.

6. In-App Purchases

The App offers optional consumable in-app purchases of “Platinum Pieces,” a virtual in-game currency, ranging from approximately $0.99 to $9.99 USD. All purchases are final and non-refundable except as required by law or Google Play’s own refund policies — refund requests should be directed to Google Play, since Google processes the transaction. Platinum Pieces have no cash value, cannot be redeemed for real money, and are not transferable between accounts.

7. Children’s Privacy

The App is intended for a general audience and is not directed at, nor designed to specifically appeal to, children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us using the information in Section 12.

8. Data Retention

We retain your account and game-progress data for as long as your account remains active, or until you request deletion. Specifically:

• Guest (anonymous) accounts: Data persists on our servers tied to the anonymous device identity until you delete it (see Section 9) or it becomes inactive. Uninstalling the App does not delete your cloud data — it only removes the local copy and disconnects your device from that anonymous identity (reinstalling creates a brand-new, unrelated anonymous account).
• Full (signed-in) accounts: Data persists until you delete your account or request deletion.
• Leaderboard records: Aggregated leaderboard rankings are recalculated periodically and retained as long as the underlying account exists.

9. Your Rights and Choices

9.1 In-App Controls

• Reset Account (Settings → Danger Zone): Wipes your current game progress (gold, gems, owned lairs, etc.) back to a fresh start, while keeping your account, Platinum Pieces, and permanent purchased upgrades intact. This does not delete your account or any personal data we hold about you.
• Delete Account (Settings → Danger Zone, available to signed-in email accounts): Permanently and irreversibly deletes your account, including your email address, cloud save data, username, and leaderboard history. This action cannot be undone. Note this option currently applies to full (signed-in) accounts; if you play as a guest and want your anonymous data deleted, contact us using the information in Section 12 and we will delete it manually.
• Sign Out: Disconnects your device from your account without deleting any data, and starts a new local guest session.

9.2 General Privacy Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate personal information (e.g., via the in-app username field, or by contacting us);
• Delete your personal information (via the in-app Delete Account feature, or by contacting us);
• Port your data to another service, in a portable format, upon request;
• Object to or restrict certain processing of your information;
• Withdraw consent at any time, where processing is based on consent (this will not affect the lawfulness of processing before withdrawal).

To exercise any of these rights, use the in-app tools described above or contact us at the email address in Section 12. We may need to verify your identity (e.g., confirm control of the relevant account or email address) before fulfilling a request.

9.3 California Residents (CCPA/CPRA)

If you are a California resident, in addition to the rights above, you have the right to non-discrimination for exercising your privacy rights, and the right to know the categories of personal information we have collected and disclosed for a business purpose over the past 12 months (which are described in Section 2 and Section 4 of this policy). As noted in Section 5, we treat certain advertising-related data sharing as a “share” under the CPRA, and you may opt out as described there.

9.4 European Economic Area, United Kingdom, and Other International Users

If you are located in the EEA, UK, or another jurisdiction with similar data protection laws, our legal bases for processing your information are: performance of a contract (providing the App’s features to you), our legitimate interests (securing the App, preventing fraud, operating the leaderboard), and consent (where required, such as for certain ad personalization). You have the rights described in Section 9.2, and you also have the right to lodge a complaint with your local data protection supervisory authority.

Your information may be transferred to, stored, and processed in the United States or other countries where our service providers (Supabase, Google) or their subprocessors operate, which may have different data protection laws than your country of residence. Where required, we rely on appropriate safeguards (such as standard contractual clauses) provided by those service providers for such transfers.

10. Data Security

We rely on industry-standard security measures provided by our service providers, including encryption of data in transit (HTTPS/TLS) between the App and our servers, and database-level access controls that restrict each account to only its own data. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

11. Links to Other Sites and Services

The App’s “Help & Social” section contains links to our social media profiles, website, and other third-party sites (e.g., Facebook, Instagram, X, TikTok, Whatnot). This Privacy Policy does not apply to those third-party sites — please review their own privacy policies before providing them with any information.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right described above, or want a guest account’s data deleted manually, contact us at:

Email: support@wyrmandwhelp.com Website: www.wyrmandwhelp.com

We will respond to legitimate requests within a reasonable time and in accordance with applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the App’s features, or legal requirements. We will update the “Effective date” at the top of this page when we do. Material changes will, where required by law, be accompanied by additional notice (such as an in-app notification). Your continued use of the App after a change becomes effective constitutes your acceptance of the revised policy.

14. Governing Law

This Privacy Policy is governed by the laws of the United States, without regard to its conflict-of-law provisions, except where applicable local law (such as the GDPR for EEA/UK residents or the CCPA/CPRA for California residents) requires otherwise for the rights described in Section 9.