Privacy Policy

01The short version

If you read nothing else, read this. The rest of the page is the same information in full detail.

• There is no account. No sign-up, no email address, no password, no profile.
• Your cars, paint, parts and settings are saved on your device, not on a server we run. We do not run a server.
• The game shows ads through Google AdMob. Ads are the reason the game is free. Before any personalised advertising, you are asked.
• We use Firebase Analytics and Crashlytics to see which screens people use and to receive crash reports.
• If you buy Pocket Garage Pro, Apple or Google takes the payment. We never see your card. RevenueCat checks the receipt for us.
• AR mode uses your camera. The camera image is processed on your device, is never uploaded, and is never used for advertising.
• You can change your mind about advertising at any time in the game: Settings → Privacy Options.
• There is nothing social: no chat, no friends, no leaderboards, no content shared with other players.

02Who is responsible for your data

Pocket Garage is made and published by Gambit Global Ltd, trading as Pocket Garage, of Unit 501 Leroy House, 434-436 Essex Road, London N1 3FY, United Kingdom (“we”, “us”). For the purposes of the UK and EU General Data Protection Regulation we are the data controller for the personal data described on this page.

You can reach us about anything on this page at info@gambitgg.com.

03No account, no profile

Pocket Garage does not offer account creation and does not require a login. We never ask for your name, email address, date of birth, phone number, postal address or photograph, and there is nowhere in the game to enter them.

We do not build a profile about you, we do not know who you are, and we cannot connect one device to another. If you install the game on a second phone, it starts from scratch, because your progress was never anywhere but on the first one.

04What stays on your device

The game keeps your progress in the operating system's standard local preference store on your own device. That includes:

• which car you last selected, and which cars are unlocked;
• the paint colour, finish, headlight colour, stripes, stickers, underglow, rims, tyres and spoiler you chose for each car;
• your in-game currency and upgrade levels;
• music, sound-effect and graphics-quality settings;
• the expiry time of any 24-hour rewarded-ad unlock;
• a flag recording whether you own Pocket Garage Pro, and your advertising and analytics consent choices.

None of this is transmitted to us. It is not backed up to any service we run. Deleting the app deletes it — see how to delete your data.

05What leaves your device, and to whom

Three companies receive data from the game. There are no others. We have no server, no database, no mailing list and no analytics of our own — everything below is collected by a third party's software development kit (SDK) built into the app, and goes to that company directly.

We are given only aggregated reports by these services. We cannot look up an individual player, because there is no identity to look one up by.

Each of these companies acts under its own privacy policy, and each is contractually required to protect the data it receives to a standard at least equal to the one described here:

• Google (AdMob and Firebase) — policies.google.com/privacy, and Google's business data-protection terms. How Google uses data from apps that use its services: policies.google.com/technologies/partner-sites.
• RevenueCat — revenuecat.com/privacy.
• Apple (App Store purchases) — apple.com/legal/privacy.
• Google Play (Play Store purchases) — policies.google.com/privacy.

06Advertising

Pocket Garage is free because it shows advertising. There are three places it appears:

• Rewarded ads — you choose to watch one, and in exchange a locked car, paint colour or part is unlocked for 24 hours. Nothing is ever taken from you if you decline, and the reward is exactly the same whether or not you allowed tracking.
• Interstitial ads — a full-screen ad shown between sessions, when you return to the garage from driving. Never during driving, and never in AR mode.
• A sponsored panel in the garage — a native ad presented on the garage wall, marked Sponsored, with Google's AdChoices marker.

Personalised versus non-personalised ads

A personalised ad is chosen using your device's advertising identifier and data associated with it, which may include activity in other apps and on websites. A non-personalised ad is chosen using only the current context — roughly, that you are in a car game, and your approximate region.

Non-personalised ads still involve some data: your IP address, a request for an ad, and measurement of whether it was shown. Google may also use a non-personalised request for frequency capping, aggregate reporting and fraud prevention. What they do not do is build or use an advertising profile of you.

Buying Pro removes advertising entirely

If you own Pocket Garage Pro, the game stops requesting ads. The AdMob SDK is still present in the app, but it is not asked for anything, so no ad request, advertising identifier or impression data is sent.

07Your consent, and changing it

How you are asked

Consent is gathered through Google's User Messaging Platform (UMP), a Google-certified consent management platform registered with the IAB Transparency & Consent Framework. The form you see depends on where you are:

• In the EEA, the UK and Switzerland, the game shows a GDPR consent form on first launch, listing Google and its advertising partners, and asking whether they may use your data for personalised advertising and related purposes. You can consent, refuse, or make purpose-by-purpose choices. If you refuse, the game still works and you still see ads — they are simply non-personalised.
• On iOS, in addition, Apple's App Tracking Transparency permission is required before the app or Google may read your device's advertising identifier (IDFA). You will see a short explainer and then Apple's own system prompt asking whether Pocket Garage may track you across apps and websites owned by other companies. If you say “Ask App Not to Track”, the IDFA is not read and ads become non-personalised.
• Elsewhere, the consent form may not appear, because local law does not require it. Your device-level advertising controls still apply (see below).

How to change your mind, at any time

• In the game: tap the gear icon in the garage, then Privacy Options. That reopens the same consent form, with your current choices shown, and you can change them. The entry appears wherever the applicable law gives you an ongoing right to withdraw consent.
• On iOS: Settings → Privacy & Security → Tracking, where you can turn Pocket Garage's permission off (or off for every app).
• On Android: Settings → Google → Ads, where you can delete or reset your advertising ID, or opt out of ads personalisation entirely. Deleting the ID stops apps receiving it at all.
• Everything at once: buy Pocket Garage Pro, and the game stops requesting ads.

Withdrawing consent does not undo processing that already happened lawfully before you withdrew it, but it stops it going forward.

Your consent choice is also passed to Firebase Analytics using Google's consent-mode signals for ad storage, ad user data and ad personalisation, so that analytics behaves consistently with what you chose.

08Analytics and crash reports

Firebase Analytics tells us things like how many people opened AR mode, which cars are customised most, and where players stop playing. It reports in aggregate. It identifies a device by a random app-instance ID, not by you.

Firebase Crashlytics sends us a report when the game crashes: what the app was doing, the device model and OS version, and a short trail of the actions immediately before the crash. Without it we would only know that something broke, not what.

We do not attach your name, email, or any custom user identifier to analytics or crash reports, because we do not have any. We do not use analytics data to target advertising at you.

09Purchases and subscriptions

Pocket Garage Pro is sold as an auto-renewing yearly subscription (pocketgarage_pro_yearly).

Payment is handled entirely by Apple or Google. You buy from the App Store or Google Play, using the payment method already on your store account. We never see, receive or store your card number, bank details, billing address or name. Apple and Google are independent controllers of the payment data they collect from you, under their own privacy policies.

What the game receives back from the store is a receipt. That receipt is passed to RevenueCat, which validates it with Apple or Google and tells the game whether the “pro” entitlement is active. RevenueCat therefore holds a purchase history for an anonymous customer ID: which product, when it was bought, when it renews or expires, the price and currency, the store, and the country the store reported.

That record is what makes Restore Purchases work when you reinstall the game or move to a new device. It is the one piece of data whose whole purpose is to persist.

10Camera and AR mode

AR mode uses your device's camera, through Apple's ARKit on iOS and Google's ARCore on Android, so the game can find a flat surface and place a car on it. The permission is requested the first time you open AR mode, and the game explains why. If you refuse, every other part of the game still works.

Specifically:

• The camera image is used live, on your device, to render the scene and detect surfaces.
• Nothing from the camera is recorded, saved or transmitted. No photograph or video of your surroundings is stored by the game or sent anywhere.
• The plane and depth information the AR system detects is never used for marketing, advertising or data mining, by us or by anyone else, and no advertising SDK in the app has access to it. This is both our policy and a requirement of Apple's App Review Guidelines.
• Interstitial ads are disabled in AR mode.

You can revoke the camera permission at any time in your device's settings.

11Legal bases, if you are in the UK or EU

Under the UK GDPR and EU GDPR we must have a lawful basis for each purpose. Ours are:

You can object to any processing we base on legitimate interests — see your rights.

12How long data is kept

• On your device: until you delete it, or delete the app. We set no expiry.
• Firebase Analytics: event-level data is retained for the period set in the Firebase console. We use the shortest option Firebase offers for user-level data. Aggregated, non-identifying reports may be kept indefinitely.
• Firebase Crashlytics: crash reports are retained by Google under Crashlytics' standard retention, currently 90 days for individual reports.
• AdMob: retention is governed by Google's own policies. See Google's data retention page.
• RevenueCat: purchase records are kept for as long as the app is operated, because they are what restores your purchase. If you ask us to delete them, we will, but you will then be unable to restore that purchase without buying it again or asking the store for help.
• Correspondence with us: emails you send us are kept for up to 24 months, then deleted.

13International transfers

Google and RevenueCat are United States companies and process data on servers in the United States and elsewhere. If you are in the UK, the EEA or Switzerland, that means your data is transferred outside your home jurisdiction.

Those transfers are covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which each of these providers incorporates into its data-processing terms, together with any applicable adequacy framework such as the EU–US Data Privacy Framework. We do not transfer data anywhere ourselves, because we do not receive it.

14Children

Pocket Garage is intended for a general audience aged 13 and over [confirm against the age ratings actually submitted]. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

We do not set the game's target audience to include children in Google Play's Families programme, and we do not opt the app into child-directed treatment. Because of this, the app is not designed to comply with the US Children's Online Privacy Protection Act (COPPA) as a child-directed service.

If you believe a child under 13 has used the game and that personal information has been collected, contact us at info@gambitgg.com and we will take steps to have it deleted.

15Your rights if you are in the UK or EU

You have the right to:

• Access the personal data we hold about you, and receive a copy;
• Rectify it if it is wrong;
• Erase it (“the right to be forgotten”);
• Restrict or object to processing, including any processing based on legitimate interests;
• Data portability — receive data you provided in a machine-readable form;
• Withdraw consent at any time, without affecting the lawfulness of processing before you did;
• Complain to a supervisory authority.

Complaints in the UK go to the Information Commissioner's Office (ico.org.uk). In the EEA, to your national data protection authority; the list is at edpb.europa.eu. We would rather you came to us first, but you do not have to.

16Your rights if you are in California

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), California residents have the rights set out below.

Categories of personal information we and our partners handle

We disclose the identifiers, commercial information and network-activity categories to our service providers (Google, RevenueCat) for the business purposes described in this policy. We retain each category for the periods in section 12.

Your California rights

• Right to know what personal information is collected, used, disclosed and shared;
• Right to delete personal information we hold about you;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information — see the next section;
• Right to limit the use of sensitive personal information — we collect none, so there is nothing to limit;
• Right to non-discrimination for exercising any of these rights.

Exercising your rights costs you nothing and changes nothing about the game. Opting out of sharing does not remove advertising — it makes the advertising non-personalised. You may use an authorised agent; we may ask them for proof of your authorisation.

To make a request, email info@gambitgg.com with “California privacy request” in the subject line. We respond within 45 days, and may extend once by a further 45 days if we tell you why.

17Do Not Sell or Share My Personal Information

We do not sell personal information for money, and we never have. However, under the CPRA's broad definitions, allowing Google to use your advertising identifier to serve personalised ads counts as “sharing” personal information for cross-context behavioural advertising, and possibly as a “sale”. We therefore give you a clear way to stop it.

To opt out of the sale or sharing of your personal information:

1. In the game — open the garage, tap the gear icon, and choose Privacy Options. Decline consent for personalised advertising. This takes effect immediately, on this device.
2. On your device — on iOS, turn off tracking for Pocket Garage under Settings → Privacy & Security → Tracking. On Android, delete or reset your advertising ID under Settings → Google → Ads. Either of these stops the identifier reaching us or Google.
3. By email — write to info@gambitgg.com with “Do Not Sell or Share” in the subject line.
4. Automatically — we honour opt-out preference signals such as Global Privacy Control where they are transmitted to us and we are technically able to receive them.

There is no account to log into and no charge for opting out, and you can opt back in the same way whenever you like.

18Other US states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly similar rights: to confirm processing and access data, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale and profiling with legal or similarly significant effects. Some states also give you a right to appeal a refusal.

Use the same routes as in section 17. If we refuse a request and your state gives you a right of appeal, say so in a reply and we will reconsider and explain the outcome in writing.

19Security

All data sent by the SDKs described here travels over encrypted connections (TLS/HTTPS). Google and RevenueCat encrypt data in transit and hold their own security certifications; their infrastructure is far better protected than anything an independent developer could build, which is one reason we chose to keep no server of our own.

Local data on your device is protected by your device's own security — your passcode, and the operating system's app sandbox, which stops other apps reading it.

No system is perfectly secure. Since we hold no names, email addresses, passwords or payment details, there is very little in our possession that could be exposed. If a breach ever did affect you, we would notify you and the relevant regulator as the law requires.

20Changes to this policy

If we add an SDK, remove one, or change what data is collected, we will update this page and change the “last updated” date at the top. For a change that materially reduces your privacy, we will also ask for your consent again inside the game before the change takes effect for you.

Older versions are not archived here; if you need to know what the policy said on a particular date, ask us.

21Contact

Questions, requests, complaints and corrections all go to the same place.

We aim to answer within 5 working days, and always within the statutory deadline that applies to your request — one month under the UK/EU GDPR, 45 days under the CCPA.