Privacy Policy

1. Who we are

VELIAN Games is the registered assumed name and publishing brand of VELIAN Interactive LLC, an independent game studio based in Austin, Texas. In this policy, “VELIAN,” “we,” “us,” and “our” refer to VELIAN Interactive LLC.

2. Information you provide on our website

When you use the contact form or email us, we may receive your name, email address, subject, message, and any other information you choose to include. Please do not send passwords, payment card details, health information, or other sensitive information through the form.

Our contact form is delivered through EmailJS. Our hosting, email, security, and delivery providers may process limited technical data, such as IP address, browser information, request timestamps, and delivery logs, as needed to operate and protect their services.

3. Game data, platform accounts, and advertising

You can play Emoji Merge without signing in. Gameplay progress, settings, and Emoji Vault discoveries are stored locally. Newer signed-in versions also synchronize account wallets and avatar unlock information as described below. Optional online features use different accounts and services on each platform, described below. We do not request access to your contacts, photos, precise location, or payment card information.

Apple 1.1.9 and later: Game Center and the shared VELIAN service

Game Center remains the sign-in provider, without a separate password or registration. The app sends a fresh Apple identity-verification proof, including a Game Center-bound player identifier, certificate URL, signature, salt, timestamp, and app identifier, to our HTTPS service at api.veliangames.com. Proofs verify ownership; we do not receive your Apple password. Temporary session credentials authorize subsequent requests.

VELIAN operates the shared service for global rankings, profiles, account wallets, and seasonal rewards, hosted with Contabo and backed by MongoDB. We process the platform account identifier, internal player identifier, Game Center nickname, chosen bundled avatar ID, highest discovered stage for avatar unlocks, completed-run IDs and scores/combos, run-start and completion/update times, ranking periods and places, reward eligibility, claim and delivery receipts, and bonus-ticket status.

Your nickname, selected character avatar, results, and rank appear in shared global leaderboards alongside compatible Android players. Avatar unlocks use game characters, not uploaded photos. Apple and Google identities remain separate accounts. The shared service does not transfer a subscription or link your Apple and Google accounts.

Gems and tickets are synchronized to an account wallet. We process balances, an installation wallet identifier, immutable earn/spend operation IDs and amounts, and purchase receipt keys needed to reconcile balances and avoid duplicate credit. Another device signed in to the same Game Center account can restore the last synchronized balance. Offline changes not yet synchronized cannot be restored after app data is lost. Avatar unlock information does not back up the full Emoji Vault, settings, or an unfinished run.

Friends comparisons and recovery of previously uploaded all-time records still use Game Center. The app reads native nicknames, available photos, and ranking entries for these Apple features. In older Apple releases, Game Center also hosts the global competitions. Eligible historical rewards and recovery use private CloudKit records tied to the original Game Center and iCloud accounts. Those records include season results, pending rewards, bonus-ticket status, and claim/delivery receipts. New shared prizes use the VELIAN service and do not require iCloud. Account identifiers, authentication proofs, bearer credentials, and wallet receipt keys are not sent in custom Firebase Analytics events.

In Apple 1.1.10, a separate guest wallet, records and collection stay on the device and are not uploaded or merged into an online account. Signing out preserves that online account’s local cache for a later sign-in; confirmed profile deletion clears the deleted profile’s cached data. Routine game-account synchronization is deferred until an unfinished run ends or the player returns to the menu, with scoped exceptions for purchase backup and confirmed deletion. These changes do not add a new category of collected data.

Android: Play Games and online services

Android 1.0.9 and later use the same VELIAN ranking, profile, wallet, avatar, and reward service. Google Play Games supplies a one-use server authorization code for verification, without sharing your Google password with us. Google and Apple accounts remain separate. The shared service processes the equivalent Android account, game, wallet, and reward information listed above. Earlier Android versions use the Firebase services described below.

In earlier Android versions, when you sign in through Google Play Games, the app reads your player identifier, display name, and available profile avatar URL and authenticates with Firebase Authentication. This creates or accesses an Emoji Merge Firebase game profile linked to your Play Games identity. You do not need to create a separate password. Google handles sign-in credentials; VELIAN does not receive your Google password.

Earlier Android versions use separate leaderboards operated by VELIAN in Google Cloud Firestore. We store the Firebase user identifier, player display name, available profile avatar URL, best score and combo, ranking period, and completion and update timestamps. Player names, avatars, results, and positions are visible to other signed-in Android players; ranking records also contain a technical user identifier. These records provide rankings and keep submissions associated with the correct player. Pending submissions and cached records are kept on the device for retries and display.

In earlier Android versions, Firebase Authentication processes authentication identifiers, IP addresses, and technical app information to operate sign-in and prevent abuse. These earlier Android releases include Firebase App Check with Google Play Integrity, which processes integrity tokens and device/app signals to help verify requests. These services are distinct from advertising consent. Starting with Android 1.0.1, the app also includes Firebase Analytics and Crashlytics, described below. Google Mobile Ads processes its own measurement and diagnostic data.

Earlier Android versions do not award seasonal prizes. Android 1.0.9 and later participate in the shared global competition. Android does not synchronize with Apple Game Center or iCloud. Android local wallets, purchases, discoveries, and saved runs do not transfer to the Apple version. For account and ranking deletion, see Delete account & data.

Both platform versions use Google AdMob through the Google Mobile Ads SDK to show interstitial ads at natural breaks and optional rewarded ads that you choose to watch in exchange for an in-game benefit. Google and its advertising partners may deliver, measure, personalize, limit, and protect those ads as described below.

4. Data the Google Mobile Ads SDK may process

Depending on your device, region, consent choices, and the ad served, the Google Mobile Ads SDK may process:

• IP address, which may be used to estimate general location;
• device identifiers and identifiers linked to the app or developer;
• advertising data, including ads shown to you;
• app and ad interactions, such as app launches, taps, and video views;
• crash logs, diagnostics, app launch time, hang rate, energy use, and other performance information.

Google may use this information to deliver and measure ads, provide advertising and analytics services, improve performance, and prevent fraud and abuse. For details, review Google’s iOS data disclosure, Android data disclosure, advertising technologies information, and Privacy Policy.

5. Analytics and crash reporting

Android 1.0.1 and later. Firebase Analytics collection is enabled for production-marked builds installed through Google Play. Development, benchmark, sideloaded, and separately built testing versions keep behavioral collection disabled. Events describe screens, game sessions, scores, combos, discoveries, abilities, virtual-currency changes, leaderboard interactions, purchase flows, and advertising outcomes. They include the app environment, version, build, and collection policy. Analytics may process app-instance and device identifiers, approximate location derived from IP, and app/device data. Android Analytics advertising-ID collection is disabled; this does not disable the separate Google Mobile Ads SDK or its consent handling.

Android release builds use Crashlytics for Java and native crashes, supported application-not-responding reports, and technical diagnostics. Reports may include installation identifiers, stack traces, device and OS information, app version, and activity breadcrumbs. Ad diagnostics can include an ad response identifier, source, placement, SDK version, timing, interruptions, and reward outcome. An unfinished-ad report can also result from process termination; it is not proof that the ad froze. Debug and benchmark builds disable automatic crash delivery. We do not attach player names, emails, purchase tokens, order IDs, or player IDs to custom Analytics events or Crashlytics reports. Ad response identifiers are diagnostic-only and are not sent as custom Analytics parameters.

The Apple version and Android 1.0.1 or later use Google Analytics for Firebase to understand app engagement, monitor technical performance, and improve the reliability of ads and in-game rewards. Depending on your device, region, and consent choices, Google Analytics may process an app-instance identifier, an identifier for the app vendor, approximate location derived from IP address, app and device information, session data, and interactions with the app.

Starting with iOS version 1.1.4, Firebase Analytics collection is enabled only for recognized production App Store installations. Collection is disabled in TestFlight, sandbox, and development environments. Analytics events include app environment, build, and collection-policy information to distinguish production reporting from test activity. This restriction applies to Firebase Analytics; crash reporting and advertising services are described separately in this policy.

Starting with version 1.1.3, the app records screen_view events when an app screen becomes visible, using predefined screen names such as the main menu, gameplay, shop, collection, leaderboard, settings, and pause. The custom parameters contain the screen name and app screen class; they do not contain Game Center names, identifiers, search text, or free-form content.

To measure the reliability of the advertising flow, the app sends a custom ad_funnel event with limited parameters describing the ad placement, processing stage, and a technical reason when applicable. Parameters may also include load attempts, queue wait and loading times, active gameplay duration, and SDK error codes and domains. In version 1.1.3, these events also record whether an optional random-ability offer was shown, accepted, or declined, and distinguish Quick Break and Game Over ad placements. These custom events do not contain a VELIAN user ID, ad creative ID, consent string, or gameplay payload.

The app also records limited gameplay and store events to understand run completion, scores, Emoji Vault discoveries, ability use, virtual gem and ticket sources and spending, product views, and checkout outcomes. Event parameters use bounded in-game categories and numeric totals rather than free-form gameplay content.

In version 1.1.0 and later, limited leaderboard events record views, filter selections, loading outcomes, and score-submission outcomes. They describe the selected ranking period, score or combo category, screen, and a general result or error category. A short-lived, on-device marker also indicates whether the next run followed a leaderboard interaction. These custom event parameters do not include Game Center player identifiers, nicknames, avatars, search text, ranking lists, or raw error messages.

For a verified Apple In-App Purchase, Firebase Analytics may receive purchase details supplied through StoreKit, including the product identifier and name, currency, price or value, quantity, and whether the transaction relates to a consumable or subscription. The app does not add the Apple transaction identifier, App Store account details, or a VELIAN user ID as custom Analytics parameters.

Analytics events also include technical outcomes and broad reason codes, such as network errors or unavailable ads and leaderboards, to measure reliability and troubleshoot failures. These events may be associated with the Firebase app-instance identifier, like other Analytics events.

Our Firebase Analytics configuration does not include IDFA collection capability. Google processes Analytics data to provide measurement and reporting services under its Firebase privacy information and Privacy Policy.

The Apple version and Android 1.0.1 or later also use Firebase Crashlytics to identify crashes and improve stability. Crashlytics may process crash stack traces, relevant app state, device and operating-system information, the app version, and Analytics breadcrumb events that describe actions immediately before a crash. VELIAN does not attach a name, email address, Apple transaction identifier, or VELIAN user ID to Crashlytics reports. Learn more in Google's Firebase privacy information.

Starting with Apple 1.1.8, we also use Apple MetricKit hang diagnostics and responsiveness checks during ads to investigate app hangs. Reports sent through Firebase Crashlytics may include sampled stack frames, binary identifiers and offsets, app version and build, device and operating-system information, diagnostic time windows, and ad timing, placement, source, SDK version, and response identifiers. Reports can arrive after the incident; a responsiveness delay or unfinished ad does not by itself prove that an ad froze.

Apple 1.1.8 and later and current Android releases also use Firebase Remote Config to fetch settings that control ad availability. The last valid settings are cached on the device so they can be used when a fetch fails or the device is offline.

6. Personalized and non-personalized ads

Where permitted, Google may serve personalized ads based on information such as prior activity or inferred interests. On iOS, tracking also requires your permission through Apple’s App Tracking Transparency (ATT) prompt. If you do not consent to personalization, or applicable law requires a more limited treatment, Google may serve non-personalized or limited ads. These ads may still use contextual information, such as the app, general location, and the content being viewed, and may still process data for frequency capping, aggregated reporting, security, and fraud prevention.

7. Consent and privacy choices

We use Google’s User Messaging Platform (UMP) to request and manage advertising consent where required, including in the European Economic Area, the United Kingdom, and Switzerland. We request ads only after UMP indicates that advertising requests are permitted. Where required, the Apple app also applies the available consent choices to Google Analytics and advertising measurement.

UMP may process approximate location derived from your IP address, device and app performance information, and interactions with consent forms to select and display the appropriate privacy messages and manage your choices.

When privacy options are required for you, open Emoji Merge settings and select Privacy Options to review or change your choices. You may also use privacy controls provided by your device, Apple, or Google. A changed choice applies to future ad requests; it does not undo processing that lawfully occurred before the change.

8. Device advertising identifiers

Android. Google Mobile Ads may use the Android advertising ID, app set ID, and other identifiers described in its disclosure to deliver and measure ads and prevent fraud. You can manage advertising ID and ad privacy options in your Android or Google device settings; labels vary by device and system version. Regional consent choices remain available through Privacy Options where required. Apple ATT and IDFA do not apply to Android.

Beginning with the iOS update that introduces tracking permission, Emoji Merge uses Google’s UMP consent flow to present Apple’s App Tracking Transparency (ATT) prompt to eligible users before enabling advertising tracking. With your permission and any required regional consent, Google Mobile Ads and its advertising partners may use the Identifier for Advertisers (IDFA) to personalize ads and measure advertising across other companies’ apps and websites. Earlier versions do not request ATT permission or access to IDFA.

You can play whether you allow or decline tracking. If permission is declined, restricted, or not yet granted, the app requests non-personalized or limited ads without IDFA. Consent in another privacy form does not override your ATT choice. You can change tracking permission in iOS Settings under Privacy & Security > Tracking. The app refreshes its advertising settings and clears previously loaded ads when it detects a change to that permission.

The app continues to use the Firebase Analytics product without IDFA collection capability. Google may process other identifiers, including an app-instance identifier or Apple’s Identifier for Vendors, as described above, and may use Apple’s SKAdNetwork for privacy-preserving ad attribution. Regional privacy choices remain available through Privacy Options in the game’s settings.

9. How we use and share information

We use information available to us to:

• provide gameplay, account sign-in, profiles, avatars, synchronized wallets, rankings, purchases, and available rewards;
• provide ads and measure ad performance;
• measure app engagement and the reliability of advertising flows;
• answer support, business, press, and partnership inquiries;
• troubleshoot technical issues and improve our games and website;
• protect our services from spam, abuse, fraud, and security threats;
• comply with legal obligations and enforce our rights.

We do not sell personal information for money. Information may be processed by Google for Firebase Analytics, Firebase Crashlytics, and advertising services, by Google for Play Games on Android, and for Firebase Authentication, Firestore, and app integrity services in earlier Android releases, by Contabo for hosting the shared game service, by advertising partners involved in serving an ad, and by providers that help us operate the website, deliver email, host services, or maintain security. Some privacy laws define certain personalized-ad disclosures as “sharing” or a “sale.” Where applicable, you can exercise the available advertising privacy choices through the app.

The VELIAN Games website uses Cloudflare for content delivery, security, and aggregate web analytics. Cloudflare may process limited technical information such as IP address, browser and device details, request metadata, performance data, and security signals to deliver and protect the site and provide aggregate traffic measurements.

We require service providers that process personal information on our behalf to protect it consistently with this policy and applicable contractual and legal requirements.

10. Purchases and subscriptions

Emoji Merge offers optional consumable gem and ticket packs and a weekly auto-renewing Party Pass. On Apple devices, these use Apple In-App Purchase. Apple processes payment, billing, refunds, purchase history, and App Store account information under Apple's policies.

Starting with version 1.1.3, Creator Code in the Shop opens Apple's native offer-code redemption sheet. Apple handles code validation and redemption. The app uses verified StoreKit transactions to deliver the items associated with an eligible offer. The code entered in Apple's sheet is not included in the app's custom Analytics events.

The app receives StoreKit product, verified transaction, and subscription-entitlement information needed to display localized offers, deliver purchases, prevent duplicate consumable delivery, and restore the Party Pass. Transaction identifiers, wallet balances, and entitlement state are stored locally. Apple 1.1.9 also sends account balances, wallet operations, and receipt keys to the VELIAN service for synchronization and replay protection. This is an in-game wallet, not a payment account. We do not receive payment card details.

After a verified purchase is delivered, the app may report the purchase to Google Analytics for Firebase for revenue measurement, product performance, and purchase-funnel analysis. The Analytics purchase event may include product, currency, price or value, and quantity information supplied by StoreKit. Apple remains the source of truth for billing, refunds, and financial records.

Purchase and renewal details are shown before confirmation in the app. The Party Pass renews weekly until canceled through Apple. See Apple's Standard Terms of Use and manage subscriptions through your App Store account.

Android purchases. Google Play Billing handles payment, subscription renewals, order history, and refunds under Google's policies. The app receives product IDs, localized prices, purchase tokens, signed purchase information, quantities, and subscription state to verify and deliver purchases and avoid duplicate delivery. Delivery records and entitlement state are stored locally. Earlier Android versions do not send wallet data to the leaderboard database. Android 1.0.9 and later synchronize balances, wallet operations, and receipt keys through the shared VELIAN service; payment card details are not included. Google Play remains responsible for its billing records; VELIAN does not receive payment card details. Android 1.0.1 and later also measure purchase-flow outcomes, products, localized prices, and currency through Firebase Analytics. Connected Google Play and AdMob services provide automatic purchase and advertising revenue measurement. Custom Analytics events do not include purchase tokens, order IDs, or payment card details.

Android Party Pass renews weekly until canceled through Google Play. Use Manage Subscription in the Shop or your Google Play subscription settings. Purchases and subscriptions do not transfer between stores. See our Terms of Use for platform-specific terms.

11. Retention and deletion

Local progress and settings remain until you remove or reset app data, subject to device backups you control. Uninstalling does not delete an online profile, account wallet, provider records, or submitted rankings. Online records are kept while needed to operate the account and competitions, resolve rewards and support, and protect the service; a season rollover does not itself erase them.

In Apple 1.1.9 and Android 1.0.9 and later, open Settings → Online Profile and choose Delete Profile on Apple or Delete Online Profile on Android, with the same platform account and internet access. Confirmed deletion removes the shared profile, avatar/unlock data, live ranking and run records, account wallet and operation ledger, and uncollected rewards, and revokes its sessions. Shared submissions pause if deletion is interrupted. You can retry or use our deletion request route without the app. Automatic sign-in does not recreate the profile; explicit reconnection creates a new one.

Restricted identity/deletion markers, hashed import and purchase replay markers, immutable reward/delivery receipts, audit records, and one-time bonus status may be retained to prevent replay, duplicate credit, and recreation through old sessions, for as long as needed for those protections or applicable legal obligations. These restricted records are not active public profiles. Historical settlement snapshots may retain ranks, results, and internal player identifiers under a “Deleted player” label; they are not restored as a new profile. Limited operational logs, backups, security records, or records needed for a dispute may remain under the relevant retention and legal requirements; contact us for details applicable to your request.

Deleting the online profile removes its synchronized gems and tickets and uncollected rewards. In Apple 1.1.10, its cached BEST and pending submissions are also cleared, and a separate local guest profile is selected. The guest profile’s own local progress is retained. It does not cancel Party Pass or delete your Apple/Google account, historical Game Center records, legacy Firestore data, or private iCloud records. Manage subscriptions through the store. Request legacy records separately through Delete account & data. VELIAN cannot browse your private CloudKit database in the developer console. Apple-managed Game Center and iCloud data can also be managed through Apple’s privacy and storage controls.

The shared Apple and Android Google Analytics property is configured to retain event-level data for 2 months and user-level data for 14 months. Reset on new user activity is enabled: new activity renews the retention period for the user identifier. These settings do not limit most standard aggregated reports. Data that reaches the end of its retention period is removed through Google's monthly deletion process. See Google's data retention explanation.

Legacy Android profiles and rankings. Firebase profiles and submitted leaderboard records remain until deleted following a verified request or as part of service maintenance. Season rollover hides old seasons from the current rankings; it does not automatically delete their records. Uninstalling or clearing local storage does not delete Firebase data. Request deletion of the profile and its associated entries on Android through Settings → Delete account & data, or request help without the app through Delete account & data. Self-service deletion removes current and historical ranking entries before deleting the Firebase profile. A private security marker retains only the old Firebase identifier and deletion start time to prevent old sessions from recreating records, for as long as needed for that protection. Automatic sign-in does not recreate a deleted profile. Local progress and Google Play subscriptions are not erased or canceled by this action. We may retain limited records where necessary for security, fraud prevention, a dispute, or a legal obligation, and will explain any applicable exception when responding. Android cloud backup and device transfer of app data are disabled in the app configuration.

We retain support and contact records while an inquiry is active and afterward only as needed for follow-up, an unresolved dispute, security, business records, or a legal obligation. The reason for keeping a record determines its retention period.

Firebase Crashlytics, Google Mobile Ads, EmailJS, and other service providers have separate retention practices governed by the relevant service settings, policies, and legal requirements. The Analytics periods above do not apply to all provider data. To request deletion of personal information processed by VELIAN or by providers on our behalf, see Your rights and requests.

12. Children’s privacy

Emoji Merge is a general-audience game and is not directed specifically to children under 13. We do not knowingly collect personal information directly from children under 13. A parent or guardian who believes a child sent personal information to us may contact us to request deletion.

13. Your rights and requests

You may contact us about personal information processed by VELIAN or by service providers on our behalf, including support records and applicable app analytics or diagnostics. Depending on your location, you may have rights to access, correct, delete, or receive a copy of that information, object to or restrict processing, withdraw consent, or appeal a decision.

Email contact@veliangames.com with the nature of your request and the game or website involved. We may need to verify your identity and request enough information to locate the relevant records. Current Android game profiles use an internal VELIAN identifier linked to Play Games. Earlier versions use a Firebase identifier; a display name or email alone may not uniquely identify a profile. Some analytics or diagnostic records also may not be identifiable from your name or email alone. We will explain any identification limits, applicable exceptions, or further steps. Please do not send passwords or payment card details.

Where a provider processes information independently, such as Apple's Game Center or App Store data, or Google's Play Games and billing account data, you may need to exercise the relevant rights with that provider. This does not prevent you from contacting VELIAN about our own processing. For advertising choices, see Consent and privacy choices.

14. Security and international processing

We use reasonable administrative and technical safeguards, but no online service can guarantee absolute security. Our service providers may process information in the United States or other countries where they operate.

15. Apple, Google, and device services

Apple and your device may independently process information for App Store delivery, purchases, backups, crash diagnostics, SKAdNetwork, Game Center, CloudKit reward storage, or other system services that you enable. Game Center handles player authentication, profiles, and leaderboard scores under Apple's Game Center privacy notice. You can manage Game Center participation and privacy settings through your Apple device.

Google and your Android device may independently process information for Google Play distribution, billing, Play Games, integrity checks, and system diagnostics under Google's Privacy Policy. Firebase privacy informationexplains Firebase service practices. On supported Android devices, the game checks whether it is visible in a screen recording to adjust rendering. It does not capture, save, or upload your screen recording.

16. Changes to this policy

We may update this policy as our games, website, or legal obligations change. The effective date at the top shows when the latest version became effective.

17. Contact us

For privacy questions or requests, email contact@veliangames.com or write to: