Privacy policy

Who we are

Crushteroid is published by Ludoitte Oy, Köydenpunojankatu 4 B 25, 00180 Helsinki, Finland (Business ID 3242565-2) ("we").

Privacy contact: info@ludoitte.com. No data protection officer is designated; privacy questions go to info@ludoitte.com.

Effective date: 29 October 2026.

What the game collects

The game does not ask for your name, email address, phone number, contacts, photos or location. When you first open it, it creates a guest account on our server.

Account and sign-in

• An account id, a public id and a callsign generated by the server (you cannot type a name).
• For each signed-in device: a random installation id the app creates, a device secret (stored encrypted) and sign-in tokens (stored only as hashes).
• Your recovery code, if you create one (stored as a hash and encrypted so it can be shown to you again).

Gameplay

• The steering inputs of each flight, sent during the flight and when it ends, so the server can replay the flight and confirm its result.
• Flight results, progress, upgrades, inventory, artifacts, boosters, settings and weekly records.
• Rewarded ads you choose to watch: the placement, when, and whether the ad network confirmed the view.

Purchases

• For each purchase: the store's order or transaction id, the product, the time, its status (for example pending or refunded) and whether it was a test purchase. Google Play and Apple handle payment; we never receive card or bank details.

Support messages

• The topic and text you send, an optional receipt reference and, only if you switch it on, diagnostics: app version, operating system name and content version.

Network information

• Your IP address reaches our server with every request. We use it only to limit abuse (for example repeated account creation or recovery-code guessing). We do not work out your location from it. Counters of failed recovery and pairing attempts are stored with the address and are not linked to your account.

Advertising partner: Unity LevelPlay

The game shows optional rewarded video ads through Unity LevelPlay (including ironSource Ads), with the Unity Ads network. The ad software starts only once the game knows your advertising choice, as described under Your choices. According to Unity's own data disclosures, it collects and shares with Unity, for advertising, analytics and fraud prevention:

• your IP address, from which Unity derives your approximate (country-level) location;
• how you interact with ads, such as views and taps, and the ads you have seen;
• diagnostics such as initialization speed and energy use;
• device identifiers: on Android the advertising ID when your device allows it; on iPhone the advertising identifier only if you allow tracking when iPhone asks.

Our game gives LevelPlay one user id, a one-way hash (SHA-256) of your account id, so that a finished ad can grant its reward once. We send Unity no name, email, purchase or gameplay data. See Unity's Game Player and App User Privacy Policy for Unity's practices and your rights.

Why we use it

• To run the game and your account, and to restore it on another device.
• To confirm flights by replaying them, and to keep the weekly board honest.
• To grant purchases and rewards once, and to handle refunds.
• To prevent fraud and abuse, and to keep the service secure.
• To answer support messages.
• To show rewarded ads (through Unity, as described above).

Our legal bases: running the game and your account, confirming flights and granting what you bought or earned are needed to provide the game you asked for (our contract with you). Preventing fraud and abuse and keeping the service secure rest on our legitimate interest in a fair and safe game. The purchase records we keep after an account is deleted are kept because Finnish accounting law requires them. Ads based on your activity are shown only with your consent in the regions where the game asks first (described under Your choices), and you can withdraw it at any time; elsewhere they are on by default and you can switch them off at any time. An iPhone shows them only if you allow tracking.

Who receives it

• Unity (LevelPlay, ironSource Ads and Unity Ads), as described above.
• Google Play and Apple, when our server checks a purchase or a refund with them.
• Our hosting provider, which stores the game server's data for us: Microsoft Azure, North Europe region (Ireland).
• Other players see your callsign, your weekly and all-time records, and your build only if you make it public on the League screen (builds are private until you choose).
• Authorities, when the law requires it.

We do not sell your data.

Your choices

• Ads are optional. An ad plays only when you tap a Watch ad button.
• Public build. League screen: Make my build public or Make my build private.
• Hide or report a player from their profile on the League screen.
• Android advertising ID. You can reset or delete it in your device's privacy settings.
• Advertising preferences in the game: Your ship & privacy > Privacy & accessibility > Manage choices. Personalised ads decides whether ads may use your activity in other apps. Where the game asks first (the EU/EEA, the UK, Switzerland, Canada, or when we cannot tell your country), a sheet appears the first time you open the game, and personalised ads stay off until you say yes. Elsewhere they are on by default (the switch says On by default) and you can switch them off at any time. If you say no, rewarded ads stay available but are not personalised. We pass your choice to Unity LevelPlay before it starts (your consent and the US state-law opt-out signal). On iPhone, Apple's tracking prompt comes first at the first launch in every country; if you do not allow tracking, ads are never personalised and no sheet is shown. The game has no analytics.

Your data, your rights

• Get a copy: Your ship & privacy > Export my data prepares a file with your account record, your saved progress, the history of your in-game actions and a list of your support messages (topic, status and date), which you can download or share.
• Delete: Your ship & privacy > Delete my account, or see Delete your account.
• Ask us: info@ludoitte.com.

How long we keep it

Account and gameplay data are kept while the account exists. After a deletion request, everything linked to the account is deleted 30 days after the request, except one record of each purchase, kept for tax and refund reasons for as long as Finnish accounting law requires: the store's transaction number, the product, its price and the dates, no longer linked to your account, your devices or your profile. A data export file stays available while the account exists and is deleted with it.

Security

The game talks to our server only over an encrypted connection (HTTPS). Device secrets and recovery codes are stored encrypted, sign-in tokens only as hashes, and support messages that look like a recovery code or a token are refused.

Children

Crushteroid is for players aged 13 and over and is not designed for children. The game includes random paid items, paid power in public competition and ads, and it is not directed at children under 13.

Changes

We will update this page when the game's data use changes and show the new effective date above.