Privacy, without the thorns.

1. Scope

This Privacy Policy applies to the Bloom Bastion mobile application (the “App”), package identifier game.getcto.bloombastion, published by Get CTO Sdn Bhd (“Get CTO”, “we”, “us”, or “our”). It also explains the limited processing involved when you visit this policy page.

2. Information we handle

Gameplay data stored on your device

The App creates a random guest profile identifier and stores it locally with your unlocked and completed levels, stars, viewed Guardian introductions, and game settings. This data supports guest play and restores your progress. It is not an account and is not uploaded by the local-save feature.

Firebase Analytics

We use Google Analytics for Firebase. It may process an app-instance identifier, approximate location derived from network information, app version, device and operating system information, session statistics, and automatically collected app events. We also record gameplay events such as level and wave starts, level results, Guardian placement and upgrades, and ad availability or completion events.

We do not intentionally send names, email addresses, precise location, contact lists, or player-entered free text in our analytics events.

Firebase Remote Config

We use Firebase Remote Config to retrieve operational settings, including safety limits and whether advertising is enabled. Remote Config uses a Firebase installation identifier and may process app, platform, version, and region information to return the appropriate configuration.

Advertising and consent information

When advertising is enabled in the released App, Google AdMob and its advertising partners may process advertising or app-set identifiers, IP address, approximate location, device and app information, ad impressions and interactions, consent choices, and fraud prevention signals. Ads may be personalised or non-personalised depending on your region, device settings, and consent choices.

The App uses Google’s User Messaging Platform to request and manage advertising privacy choices where required. The App checks whether ads may be requested before loading them.

This policy page

This static page contains no first-party advertising or analytics scripts and does not intentionally set cookies. It is hosted on Cloudflare Pages. Cloudflare may process technical request information, such as IP address, browser details, and security logs, to deliver and protect the page under its own privacy terms.

3. How information is used

• to operate the game and preserve local campaign progress;
• to retrieve safe operational and monetisation configuration;
• to understand game balance, progression, reliability, and feature use;
• to provide, limit, measure, and protect optional advertising;
• to prevent fraud, abuse, and invalid advertising traffic; and
• to comply with applicable law and respond to valid legal requests.

4. Legal bases where required

Where applicable law requires a legal basis, we rely on:

• performance of a service for local save data and features you request;
• legitimate interests in operating, securing, measuring, and improving the App, balanced against your rights;
• consent for personalised advertising or other processing where consent is legally required; and
• legal obligation when processing is required by law.

You may withdraw consent through the available privacy controls. Withdrawal does not affect processing that was lawful before withdrawal.

5. Service providers and sharing

We do not sell information that directly identifies you. We make information available to service providers only as needed to operate and improve the App or deliver this page:

• Google Firebase for Analytics and Remote Config;
• Google AdMob and configured advertising partners for ads, measurement, consent, and fraud prevention;
• Google under its privacy policy for the Google services listed above; and
• Cloudflare for delivery and security of this policy page.

We may also disclose information when required by law, to protect rights or safety, or in connection with a merger, acquisition, financing, or transfer of the business, subject to appropriate safeguards.

6. Your choices and rights

Local progress

You can remove locally stored progress and settings by clearing the App’s data in your device settings or uninstalling the App. Because the current release has no account or cloud save, uninstalling may permanently remove that local progress.

Advertising choices

Where required, the App presents Google’s consent message and provides a Privacy choices entry in game settings when the SDK indicates that an entry is required. You can also manage ad personalisation and tracking choices in your iOS or Android device settings and in Google’s ad settings. Rewarded advertisements are optional; declining one does not prevent normal campaign play.

Privacy requests

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to complain to a data protection authority. Contact us using the address below. Because the App does not ask for your identity and analytics uses pseudonymous app-instance identifiers, we may not be able to associate every record with you without additional information.

7. Retention and security

Local gameplay data remains on your device until you clear it or uninstall the App. Firebase and AdMob retain information according to their service settings, data controls, and published retention policies. We retain privacy correspondence only as long as needed to respond, maintain appropriate records, and meet legal obligations.

We use reasonable technical and organisational measures designed to protect information. No system or method of transmission or storage can be guaranteed completely secure.

8. Children’s privacy

Bloom Bastion is a general-audience strategy game and is not directed to children under 13 or the higher minimum age required by local law. We do not knowingly ask children to provide personal information directly to us. If you believe a child has provided personal information to us, contact us so we can review and address the request.

9. International processing

We and our service providers may process information in Malaysia, the United States, and other countries where facilities or personnel are located. These countries may have different data-protection laws. Where required, the relevant provider uses recognised transfer safeguards.

10. Changes to this policy

We may update this policy when the App, its service providers, or legal requirements change. We will post the revised version here and update the effective date above. Material changes may also be communicated in the App or store listing where appropriate.