Particle ArcadeSmall games. Big little joys.

Box Pop

Box Pop Privacy Policy

Effective date: October 19, 2026
Last updated: November 11, 2026

Who we are

Box Pop is a puzzle game for iOS and Android. Particle Arcade, LLC makes Box Pop. We are a company in Colorado, United States. In this policy, "we" and "us" mean Particle Arcade, LLC.

This policy tells you what information the Box Pop app uses, where that information stays, and what choices you have.

Summary

  • You can play Box Pop without an account. The game works offline.
  • Your saved game and settings stay on your device. Unless you turn off usage analytics, gameplay events and scores are sent to Google Firebase.
  • Current iOS and Android builds download game configuration from Google Firebase for all players. Ad-supported releases use Google AdMob for ads. From version 0.6.6, AdMob can also show ads from ad partners (see "Advertising"). Usage analytics, crash reports and install attribution are on by default. Each has its own switch in Settings → Privacy, so you can turn each one off. Install attribution is used in the Android release and, from version 0.6.5, in the iOS release. On iOS, from version 0.6.5, the app asks once for Apple’s permission to track. Tracking happens only if you allow it.
  • The game engine, Unity, may send basic hardware statistics about your device to Unity Technologies. See "Unity" below.
  • Service availability depends on the build. iOS 0.4.3 build 1 has ads disabled; the ad-supported iOS configuration begins with build 2. Earlier test builds may have additional services disabled. Remote Config and voluntary feedback are separate from ad delivery.

What stays on your device

Box Pop keeps this information in the app's storage on your device:

  • Saved game: your current game, so you can continue it later.
  • Scores and progress: your best scores, level progress, Endless milestones and the play time of the current game.
  • Tutorial progress: the lessons you completed.
  • Settings: sound, music and effects volume, haptics, appearance and reduced motion.
  • Privacy settings: your privacy choices.

The saved-game file and your privacy choices stay on your device. Unless you turn off usage analytics, selected gameplay events, scores and progress information are sent as described below.

Device backups. Your device can include Box Pop's data in its backups. On iPhone and iPad, iCloud Backup and computer backups include it. On Android, Google's Android backup and device-to-device transfer include it. These backups belong to your Apple or Google account, and we cannot see them. If you restore a backup to a device, your saved game and settings can come back.

What we do not collect

Box Pop does not collect:

  • your name, email address or phone number automatically from your device. If you choose to send feedback or contact support, we receive the message and any contact details you provide, as described below.
  • your contacts, photos or other files
  • your precise device location (online services receive your IP address and may infer a general location)
  • payment information
  • the Apple IDFA, unless you allow tracking in Apple’s prompt (see “Advertising” and “Install attribution”). Other installation and device identifiers are described below.

Box Pop has no account, chat or social feature of its own. We do not sell your information.

Game configuration and usage analytics

Game configuration. The iOS and Android apps contact Google Firebase Remote Config to download game settings, such as button text and game tuning, for all players. Firebase Installations creates a per-installation identifier. Firebase also processes app and SDK versions, operating-system/platform information, country and language codes, and time zone. Network connections expose your IP address to the service. Downloaded settings are cached on your device so the game can work offline. This service works even if you turn off usage analytics.

Usage analytics. Usage analytics is on by default. You can turn it off in Settings → Privacy. Google Analytics for Firebase then processes an app-instance identifier, app/device information and usage events. These include starting and finishing runs, scores, moves, play duration, level progress, tutorials, hints and experiment variants. We use these reports to understand and improve the game. Analytics can derive a general location from IP information; the app does not request precise device location.

Before version 0.6.6, advertising storage, advertising user data and advertising personalization consent stayed denied for Firebase Analytics. From version 0.6.6, the app grants them only when all of these are true: usage analytics is on, your consent is not limited, you have not chosen "Do not sell or share my information", and, on iOS, you allowed tracking in Apple’s prompt. Google can then connect installs and app events with its ads, so we can measure our own advertising. In every other case they stay denied.

You can switch usage analytics off at any time in Settings → Privacy. The app disables further analytics collection and resets local analytics data; this does not automatically erase previously received server data. For information about Google’s processing, see https://firebase.google.com/support/privacy and https://policies.google.com/privacy.

Advertising

Ad-supported iOS and Android releases use Google AdMob for banner ads and optional rewarded ads. There are no forced interstitial ads today. We will update this policy before that changes. Google processes IP addresses (which can indicate approximate location), app and ad interactions, diagnostic/performance information, and device or installation identifiers to deliver ads, measure their performance and prevent fraud. Google may share this information with advertising partners as described in its privacy policy: https://policies.google.com/privacy. Before version 0.6.6, the Android app removed the Android Advertising ID permission. From version 0.6.6, the Android app keeps that permission, so Google and the ad partners below can use the advertising ID unless your choices in the app or in your device settings limit it. The app does not request precise location.

Ad partners. From version 0.6.6, Google AdMob can also show an ad from another ad network. Unity Ads, from Unity Technologies, takes part today. The app also contains ad software from Meta (Meta Audience Network) and AppLovin. These two do not show ads in Box Pop today, and we will update this policy before they do. When this ad software starts, each company can receive your IP address, device and app information, ad interactions and, when available, the advertising identifier. Each company handles that information under its own privacy policy. The app starts this software only when your consent is not limited and you have not chosen "Do not sell or share my information". In every other case the app does not start it and requests ads from Google only.

Google's consent tool presents choices where required. You can reopen "Advertising privacy options" in the game's Privacy settings when Google makes that option available. "Do not sell or share my information" requests non-personalized ads and Google's restricted data processing; it does not remove ads or stop the technical data needed to serve them. Ads are limited to content rated PG.

iOS advertising. From version 0.6.5, after you finish the first lesson, the app shows Apple’s App Tracking Transparency prompt once. If you allow tracking, Google AdMob can use your device’s advertising identifier (IDFA) to show more relevant ads and measure them, and AppsFlyer can use it to measure which ads bring new players. If you ask the app not to track, or tracking is restricted on your device, the app requests non-personalized ads, disables publisher first-party identifiers, and the IDFA is not available to the app or its partners. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking. “Do not sell or share my information” in the game’s Privacy settings still requests non-personalized ads and restricted data processing, even if you allowed tracking.

Crash reports

Crash reports are on by default. You can turn them off separately in Settings → Privacy. Google Firebase Crashlytics then receives crash stack traces, device and app information, an installation identifier, and diagnostic context such as the last game event, score, moves, completed boxes and configuration status. These reports help us find and fix failures. If usage analytics is also enabled, reports can include gameplay breadcrumbs. Turning crash reports off stops further automatic report collection; it does not delete reports already received by Google. Google explains its processing at https://firebase.google.com/support/privacy.

Install attribution

On Android, and on iOS from version 0.6.5, install attribution is on by default. You can turn it off separately in Settings → Privacy. AppsFlyer then receives installation and app/device information, an AppsFlyer installation identifier, install-referrer information, IP information and selected gameplay events. Events include tutorial completion, run starts, restarts, and Endless run results such as score, moves and duration. We use this to understand how players find the game and whether campaigns bring engaged players. We do not send your name or email address.

From version 0.6.6, AppsFlyer also receives two more things. The first is the estimated value of the ads shown in the game, so we can compare what a campaign costs with what it earns. The second is a push token for the installation, from Firebase Cloud Messaging on Android and from Apple Push Notification service on iOS. AppsFlyer uses the token only to find out that the app was removed. The app does not ask for notification permission and does not show notifications. When you turn install attribution off, the app deletes the token.

On Android, before version 0.6.6, the app disabled advertising-identifier collection and AppsFlyer partner sharing. From version 0.6.6, AppsFlyer can use the Android advertising ID and share attribution results with ad partners, unless your consent is limited or you chose "Do not sell or share my information". In those cases both stay off. On iOS, AppsFlyer uses Apple’s SKAdNetwork and the app’s vendor identifier (IDFV). If you allow tracking in Apple’s prompt, AppsFlyer can also use the IDFA and share attribution results with ad partners. If you do not allow tracking, the IDFA is not available and partner sharing stays off. The app does not set a customer user ID. Turning attribution off stops the AppsFlyer SDK; it does not automatically delete information already received. AppsFlyer's privacy information is at https://www.appsflyer.com/legal/privacy-policy/.

Game services

From version 0.6.5, the iOS app can send your best Endless score to an Apple Game Center leaderboard if you are signed in to Game Center. Apple handles Game Center data under its own privacy policy. Google Play Games leaderboards are not enabled. We will update this policy before enabling them.

Unity

Box Pop is built with the Unity game engine from Unity Technologies. We turned off Unity's analytics, crash reporting and performance reporting services. From version 0.6.6, Unity's advertising service, Unity Ads, is an ad partner (see "Advertising"). One engine setting, for hardware statistics, stays on. We could not turn it off with our current Unity license.

So Unity may send basic statistics about your device to Unity Technologies, for example the device model, operating system and graphics chip. As with any data sent over the internet, Unity can also see your device's IP address. Unity handles this data under its own privacy policy: https://unity.com/legal/privacy-policy.

Your choices and rights

  • Delete your data: uninstall Box Pop. This deletes the saved game, scores and settings from your device. Copies in your device backups stay until you delete those backups in your device or account settings.
  • Questions and requests: depending on where you live, you can have the right to ask about, get a copy of, correct or delete personal information about you. Contact privacy@particlearcade.com with a question or request. The game has no account, so we may need additional information to locate data associated with an installation. Uninstalling the app does not itself delete data already received by service providers.

If you email us, we receive your email address and your message. We use them only to answer you.

Private feedback and store reviews

App versions with Send feedback let you voluntarily send a message and an optional reply email to Particle Arcade. Before version 0.6.7, the form also had a category and an optional private star rating. From version 0.6.7, it has neither. The submission includes the app version, the build number, the platform and a random reference number. It does not attach gameplay history or advertising identifiers. Please do not include personal information about children or other people.

Google Firebase hosts this service and stores feedback on our behalf. We use it to answer questions, investigate problems and improve Box Pop, not for advertising. Sending feedback does not change your usage analytics or attribution settings. We schedule feedback and reply-contact data for deletion after 180 days; automated deletion may take additional time. Contact privacy@particlearcade.com with your feedback reference to request earlier deletion. Copies you or we keep in email or linked support tickets may be retained as needed to address the request.

To limit abuse, the service processes the network IP address and keeps a daily keyed hash, scheduled for deletion after two days. Network providers may also keep security/access logs. Only authorized Particle Arcade staff can access the private inbox. Before version 0.6.7, the feedback form had a parent/adult access step before text or email entry; that step did not enable measurement. From version 0.6.7, the form opens directly, and you see a review screen before you send.

Before version 0.6.7, a Rate Box Pop row in Settings opened the review experience for your device's store. From version 0.6.6, the game can also show the store's rating prompt after a good moment, at most once in 30 days and never in your first session. From version 0.6.7, that prompt is the only way the game opens a store rating. Store reviews are handled by Google Play or Apple under their policies and may be public. Private feedback is never automatically posted as a store review, and the option to leave a store review does not depend on your private feedback.

Age requirement

Box Pop is for people 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and think a child under 13 used Box Pop or sent us personal information, contact privacy@particlearcade.com and we will delete it.

Changes to this policy

When we change this policy, we will post the new version on this page and change the "Last updated" date. If a change adds a service that sends data from your device, we will update this page before that service starts. This page stays at https://particlearcade.com/privacy.

Contact

Particle Arcade, LLC
Colorado, United States
Email: privacy@particlearcade.com