Your data, in plain language
Privacy Notice
Splatline works without a player account or gameplay server. Core progress stays on your device. Under-18s use private mode without advertising or purchase services; adult mode can use carefully limited third-party services for ads and an optional purchase.
1. Who is responsible
The controller is the Splatline publisher identified in the developer details on the App Store or Google Play listing from which you obtained the app (“we”, “us” or “our”).
Contact: admin@revisiongoat.com
ICO registration number: ZC216542
EU data-protection representative:
Not applicable — Splatline is not offered to users in the European Economic Area.
UK data-protection representative:
Not applicable — the controller is established in the United Kingdom.
2. Who this notice is for
This notice covers the Splatline mobile app, this legal and support website, and support messages sent to us. Splatline is a mixed/general-audience game. The complete local core game is available in both private and adult modes.
The first public release has been reviewed only for United Kingdom. Store availability must not be expanded until the additional countries’ privacy, child-safety, advertising, consumer, tax, accessibility and representative requirements have been reviewed and this notice has been updated where needed.
A neutral on-device age check uses the entered birth year to determine whether the player is under 18. The birth year and a private-mode or adult-mode age band are kept on the device. Under-18s continue into private mode; they are not blocked from the core game. See Children and young people below.
3. Information handled
| Information | How it is used | Where it goes |
|---|---|---|
| Game progress and preferences | Current and unlocked levels, per-level best stars, completion count, fastest completion time, fewest mistakes, lives, gifts, settings, sound choices and locally recorded document versions keep the game working between sessions. For the replay gallery, Splatline can also keep compact ordered grid-stroke instructions for one best finished canvas for each completed level captured on this device. Each painting record is strictly limited in dimensions, strokes, points and shape length. A legacy completion created before painting capture was available can keep its statistics and use a labelled reconstructed preview until that level is replayed. | Stored on the device. We do not operate an account or cloud-sync service for this data, and the stored gallery instructions are not uploaded by Splatline. |
| Birth year and age band | Selects private mode for an under-18 player or adult mode for a player aged 18 or over. Only a calendar year is requested. | The birth year and resulting band are stored on the device. If an adult changes to private mode after adult services started, Splatline also keeps one random process-session token locally until it proves the native app process was restarted. The token is not a device, account, install or advertising identifier and is not sent to a provider. In private mode the stored state prevents app-level calls to consent, ad-request and purchase-entitlement services. |
| Adult-mode advertising and consent data | For adults only, determines which ad requests are permitted, shows interstitial or voluntary rewarded ads, measures delivery, limits fraud and stores privacy choices. Splatline also remembers on the device whether UMP says its privacy-options route is required, so that route remains available after an adult removes ads. | In adult mode, Google Mobile Ads, Google User Messaging Platform and the ad partners identified in the in-app consent message may receive data. The app’s derived required/not-required route flag stays on the device. Splatline configures Google’s Publisher First-Party ID as disabled before ad setup and keeps app measurement delayed until the adult flow permits ad initialization. In private mode Splatline does not call UMP or request or load an ad. Google’s native library remains bundled. |
| Adult-mode purchase and entitlement data | For adults only, processes the optional “remove ads” purchase, confirms entitlement and supports restoration. Before checkout, Splatline stores a bounded product-ID and timestamp safety receipt so ads stay paused across relaunches if ownership still needs verification. If a newer receipt generation becomes unreadable, a device-local uncertainty status keeps ads off instead of trusting an older no-receipt backup. The receipt or status never grants ad-free access and is cleared after an authoritative entitlement or successful Restore result resolves the check. | The bounded safety receipt stays on the device and is not sent by Splatline as a separate provider record. In adult mode, Apple App Store or Google Play processes payment. RevenueCat receives a random anonymous App User ID, Apple receipt or Google purchase token, product and derived transaction or entitlement history, and may process platform or device type, operating-system, app and SDK version, locale, currency or country, and first-seen, last-seen and purchase timestamps. RevenueCat may transiently process an IP address to infer country and states that it then drops the address. Exact fields depend on the final SDK and dashboard configuration. We do not receive full card details. In private mode Splatline does not call RevenueCat product, purchase, restore or entitlement APIs and offers no purchase. |
| App update data | After adult mode and the current Service Terms are confirmed, Splatline makes one non-blocking availability check after admitted gameplay loads. If a compatible JavaScript, styling or image update exists, the app shows a prompt; no update is downloaded until the adult chooses “Update”, and restarting remains a separate choice. An adult can also check from Settings. Native automatic launch and error-recovery checks are disabled. Private mode does not initiate an EAS Update request. | During an adult-mode availability check or requested download, Expo Application Services may receive a randomly generated persistent installation identifier (sent as EAS-Client-ID), app, platform, runtime and update identifiers, IP/network information, and update-check, download and launch status. The identifier is not a Splatline account, but it can distinguish one app installation for update delivery and diagnostics. An already embedded or previously downloaded update can still run locally without a new request. |
| Notification settings | Schedules optional local reminders after you make a choice in context and grant operating-system permission. | Stored on the device. Splatline does not operate a marketing push-notification database. |
| Paintings you save or share | In adult mode, saves a painting to your photo library or opens an operating-system share or destination chooser only when you ask. In private mode, external Share is not available. Private-mode Save uses only the direct add-to-library route on iOS and Android 13 or later; on Android 7–12 the painting remains in the on-device studio gallery under the per-painting size limits described above because Splatline does not expose the broader destination chooser or request legacy storage access. | For a direct Save, your device photo library. For an adult-initiated Share, or the adult Save fallback on Android 7–12, the destination selected in the operating-system chooser; that destination has its own privacy practices. Splatline does not upload the painting to a developer server. |
| Support communications | Answers adult or parent/guardian questions, restores adult purchases where possible, handles privacy requests and complaints, and investigates bugs, safety concerns or unsuitable adult-mode ads. Ordinary private-mode support is parent/guardian-led. | Us and the providers of our email/support tools. A child should not send screenshots, photos, audio, a full name or birth date, address, location, school, identifiers, identity documents, passwords, card information or receipts. If a child contacts us directly, we restrict the message to the contact purpose, request no further personal information and follow the prompt-deletion or rights/complaint/safeguarding escalation process below. |
| Legal-site requests | Serves these pages, maintains availability and protects the site from abuse. The pages themselves set no analytics or advertising cookie and load no third-party font, tracker or media. | The static host may receive ordinary web-request information such as IP address, browser/user-agent, requested page, time and security logs. Host: GitHub Pages, operated by GitHub, Inc. (privacy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). |
In adult mode only, the Google Mobile Ads SDK may automatically handle IP address (which can indicate general location), app interactions such as launches, taps and video views, diagnostic information, and device or account identifiers. Availability of identifiers depends on platform settings, consent and our technical configuration. In private mode Splatline does not call Google UMP or request or load Google ads, and configures ad measurement to remain delayed. The Google native library is still part of the distributed binary and may perform essential platform startup. Splatline does not add a separate gameplay analytics SDK.
Adult mode is intended to request only non-personalized advertising after the applicable consent and privacy-choice gates, and not cross-app behavioural tracking. Where UMP reports that the European-regulations choices apply, including in the EEA, UK and Switzerland, Splatline makes no Google Limited Ad request if either required publisher choice is refused or missing. On iOS, Splatline does not intend to request Apple’s permission to track activity across other companies’ apps and websites. If that approach changes, we will update the app permissions, store disclosures and this notice before using the new purpose.
Splatline disables automatic Expo update checks at native launch and during native error recovery. Only after adult mode and the current Service Terms are confirmed, it makes one availability check after admitted gameplay loads and exposes explicit download and restart actions; Settings also retains a manual check. Neutral and private-mode paths do not initiate an EAS Update request and do not send the local age band, birth year or game progress to Expo. If an installation previously used the adult update route, its Expo identifier or a downloaded update can remain stored locally after an age-setting change; private mode still makes no new update request.
4. Purposes and lawful bases
Under UK data protection law, we rely on the following bases where they apply:
- Contract: to provide requested game functions and, for an adult who chooses to buy, process the remove-ads purchase and honour the entitlement.
- Legitimate interests: to check whether a compatible app update is available after admitted adult gameplay loads, deliver it only when the adult requests the download, serve and secure the legal site, prevent adult-mode ad or purchase fraud, answer support requests and understand whether a requested technical update succeeds. We balance these interests against user rights, with heightened care for children and young people.
- Adult consent: where required for advertising storage, access or data use in adult mode. The production plan is not to request personalised behavioural ads, but Google’s message may still request choices needed for its configured purposes and vendors. Consent can be changed or withdrawn without affecting earlier lawful processing. Private-mode players are not asked for advertising consent because Splatline does not call the consent flow or request ads in that mode.
- Legal obligation: to keep or disclose information when consumer, tax, accounting, law-enforcement or data-protection law requires it.
An adult can refuse an optional advertising consent without losing access to the complete local core game. Ad availability can still vary by region, device, consent status and ad inventory. Private-mode players receive the complete local core game without ads or a purchase prompt. We do not use solely automated decisions that produce legal or similarly significant effects.
5. Advertising privacy choices
This section applies only to adult mode. For an adult, Splatline uses Google’s User Messaging Platform (UMP) to show a certified consent message where one is required, including in the UK, EEA or Switzerland. The message identifies the ad technology providers configured for the app and records the choices on the device.
An adult can revisit an available choice from Settings → Privacy and cookie settings in the app. Splatline requests only non-personalized ads. Where UMP reports that the European-regulations choices apply, including in the EEA, UK and Switzerland, an adult must affirmatively consent both to storing or accessing information on the device for advertising and to using limited data to select basic ads. If either choice is refused or missing, Splatline makes no ad request even when Google’s broader status says an ad request could be made. Other regions remain subject to the applicable Google message and law. An adult can optionally buy “remove ads”, but doing so does not itself erase purchase records or other information needed to provide the entitlement.
See Ads & rewards for timing and reward rules. Do not rely on this website as the consent control; adults should use the in-app privacy settings so the SDK receives the updated signal. In private mode the app does not call UMP, initialize the Google Mobile Ads client, or request/load an ad, so an under-18 player is not shown an advertising-consent message or advertising privacy control. The bundled native-library startup caveat above still applies.
6. Service providers and independent platforms
- Google — Google Play distribution for Android users; AdMob and consent messaging in adult mode only.
- Apple — App Store distribution, device permissions and adult-mode purchasing.
- RevenueCat — adult-mode purchase validation and remove-ads entitlement management only.
- Expo — EAS Update delivery and deployment insights.
- GitHub Pages, operated by GitHub, Inc. (privacy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) — delivery and security of this legal and support site.
- The support mailbox admin@revisiongoat.com is operated by the Splatline developer (identified in the store listing developer details) using Google Workspace, provided by Google. Google's privacy information: https://policies.google.com/privacy — restricted delivery and storage of support, privacy and store-review contacts.
In adult mode, Google’s in-app consent message is the current source for the particular ad vendors enabled for a user and region. Platforms may act as our processor, an independent controller, or both for different activities. Their notices explain their own purposes, legal bases and retention.
Where we share user data with a provider, we require that provider to protect it to the same or an equivalent level as this notice, applicable data-protection law and the app-store rules require. We use a provider for that data only after reviewing its relevant terms, safeguards and configuration; we will not use it if it cannot provide the required protection.
7. International transfers
Some providers operate outside the UK. Where we are responsible for a restricted transfer, we require an approved safeguard such as a UK adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, plus supplementary measures where appropriate. Provider privacy notices contain more information about locations and safeguards. You may contact us for information about the safeguard relevant to your data.
8. How long information is kept
- Device-local game data, gallery paintings, age band and settings: until replaced by a newer or better local record, or until you reset the app, clear its storage or uninstall it, subject to device backups controlled by you or the platform. Splatline keeps at most one strictly size-bounded exact painting record for each distinct completed level captured on the device, so the number of local level records can grow as more distinct levels are completed. A legacy completion without an exact painting keeps its statistics and uses a labelled reconstruction until replayed.
- Adult-mode consent records: until the choice expires, is replaced or is reset, according to the consent platform configuration and applicable rules. The device-local required/not-required route flag is replaced whenever UMP supplies a newer status. Private mode creates no Google UMP consent record.
- Adult purchase and entitlement records: provider records are kept for as long as needed to provide and restore the non-expiring entitlement, meet store and legal obligations, resolve disputes and prevent fraud. The bounded device-local verification receipt is cleared when an authoritative entitlement check or explicit successful Restore resolves it. Private mode creates no Splatline purchase entitlement.
- Adult-mode update availability and delivery records: according to Expo’s configured service and retention terms; we retain access only as long as operationally needed.
- Adult or parent/guardian support messages: normally up to 24 months after the request is closed, longer only where reasonably needed for an unresolved dispute, safeguarding concern or legal obligation.
- Unsolicited child support messages: an ordinary message and its attachments are deleted from the active mailbox and Trash promptly, normally within seven calendar days after the permitted brief reply or a decision that no reply is needed. A privacy-rights request, complaint, repeated contact, safeguarding concern or legal duty is escalated and kept only as long as the documented purpose requires. Deleted content may remain in protected provider backups only for Deleted support messages may remain in Google Workspace backups for up to about 25 days before they are permanently removed.
- Legal-site request logs: according to the selected static host’s documented retention, which we must verify before publication.
We will shorten these periods where the information is no longer needed and no legal reason requires continued retention.
9. Children and young people
Splatline is a mixed/general-audience game. We do not claim that it is not directed to children. It is not enrolled in Apple’s Kids Category, and its Google Play target-audience selections must truthfully reflect the people for whom the game is designed.
Every under-18 player enters private mode and can play the complete local core game. In private mode Splatline does not call Google UMP, request or load Google ads, or call RevenueCat product, purchase, restore or entitlement APIs; it shows no ads, ad prompts or in-app purchase. The native libraries remain included in the distributed binary and may perform essential platform startup, while Google ad measurement is configured to remain delayed. A birth year entered for the neutral check and the resulting private-mode band are stored only on the device. Device-local progress, the on-device studio gallery, direct local saves where the operating system supports the restricted add-only route, optional local notifications, and the embedded or already-downloaded app code still work as described elsewhere in this notice. Private mode does not initiate an EAS Update network check. External Share is not available in private mode; on Android 7–12 a finished painting remains in the on-device studio gallery under the per-painting size limits described above instead of opening the broader operating-system destination chooser.
If an age correction changes adult mode to private mode after adult services have already started in the same app process, Splatline immediately suspends its JavaScript-owned advertising objects, retry timers and purchase listeners, saves the private choice, and blocks gameplay. A random native process-session token keeps that block in place across JavaScript and EAS reloads; it changes only after the player fully closes and reopens Splatline. Native SDK setup already performed for the earlier adult session cannot safely be described as unconfigured in place; the private-mode service-call restrictions in this notice describe the fresh launch that follows that required process restart.
We use high-privacy defaults, minimise data and write important information in clear language. A parent or guardian may contact us about a child’s privacy or exercise rights on the child’s behalf where the law permits.
For an ordinary private-mode support question, a parent or guardian should contact us on the player’s behalf. A child should not email us a screenshot, photo, audio recording, full name, birth date, home address, precise location, school, identifier, identity document, password, payment detail or store receipt. If a child nevertheless sends an ordinary message, we do not ask for more personal information, normally send at most one brief reply directing ordinary support through a parent or guardian, and then follow the prompt deletion period above.
This does not prevent a child who has sufficient understanding from exercising their own privacy rights, making a complaint or reporting an urgent safety concern. We restrict and escalate those contacts before any further response. Where safeguarding or law requires preservation or sharing, we use only what is necessary, apply limited access and record the reason and review date.
10. Your privacy rights
Depending on the circumstances, UK residents can ask for access, correction, deletion, restriction, portability or an objection; withdraw consent; and complain about our handling of personal information. These rights can have legal exceptions.
Email admin@revisiongoat.com and describe the request. Because there is no Splatline account, we may hold little or no information that we can connect to you. We will not ask for more identity evidence than reasonably necessary. Device-local progress can normally be removed by clearing app storage or uninstalling; this does not erase store transaction records.
For deletion instructions, the data we can delete, information that must be kept and the relevant retention periods, see Request deletion of Splatline data.
Data-protection complaints
You can make a data-protection complaint through the contact details above; no special form or legal wording is required. We will acknowledge a complaint within 30 days of receiving it. The 30-day period is for acknowledgement, not a blanket deadline for the final outcome. We will begin considering the complaint when it arrives, make enquiries appropriate to the circumstances without undue delay, keep you informed of material progress or delay, and communicate a reasoned outcome and any action we will take. Rights requests such as access or deletion have their own legal time limits. See the ICO’s official complaints-handling guidance.
You can also complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address the concern first, but you do not have to contact us before the ICO.
11. Security
We use data minimisation, platform permission controls, encrypted network connections supplied by our providers, access restrictions and dependency review appropriate to this small, account-free app. No app or transmission method is completely secure. Keep the device operating system and Splatline up to date and protect access to your store account.
12. Changes to this notice
We may update this notice when the app, providers or law changes. The effective date and version appear at the top. We will use an in-app notice or fresh choice before a material new use where the law requires it. EAS Update may deliver compatible app code, styling and image changes, but it does not reduce your rights or replace required app-store review.
Contact us
Privacy, support and legal-notice email: admin@revisiongoat.com