Privacy Policy

This policy explains what information Onyxfish LLC (“Onyxfish”, “we” or “us”) collects when you play Private Sales, and what we do with it. It covers the game on iOS and Android, test versions of the game that run in a web browser, and this website, privatesales.onyxfish.dev.

Our other activities, including our company website and consulting work, are covered by the Onyxfish privacy policy.

The short version

You can play Private Sales without giving us your name or email address.
By default the game backs up your save to the cloud under a guest account with no name or email. You can turn this off.
Signing in with Google or Apple is optional. It lets you continue your game on another device.
Usage and crash data help us improve the game. We collect them only if you agree, and you can change your mind at any time in Settings.
This website uses Google Analytics only if you agree to it.
There are no ads in the game or on this website. We don’t sell your information or use it to track you.
You can delete your account and cloud save from inside the game, or ask us to delete them. At least once a year, we delete accounts that haven’t been used with cloud saves on for more than 3 years. You can ask us to see, correct or delete any of your information at any time, free of charge.

Who we are

Private Sales is made by Onyxfish LLC, a California limited liability company. We decide how the information this policy covers is used, so under the EU and UK GDPR and the Swiss Federal Act on Data Protection we are its “controller”. Our founder, Chris Groskopf, is responsible for privacy at Onyxfish.

Onyxfish LLC
2108 N Street Ste N
Sacramento, CA 95816
United States
privacy@onyxfish.dev

What we collect and why

Your game, on your device

The game keeps your save, your settings and a random device identifier on your device. The identifier is generated by the game, not taken from your hardware; it tells your devices’ saves apart. None of this leaves your device unless cloud features are on.

On Android, your device may include the game’s data in the backup it makes to your Google account, depending on your device’s backup settings. Google handles those backups under its own terms.

Cloud saves and your guest account

Cloud features are on unless you turn them off, under Account → Enable cloud saves. While they’re on:

The game signs you in to a guest account. It has a random account ID and no name, email address or password.
The game stores a copy of your cloud save under that account: your progress in the current game, a short summary of it (such as the turn, the in-game date, your cash, prestige and level, the difficulty and how the game ended), the device identifier and the times it was saved.
The game stores your catalogue: the works, collectors and venues you’ve come across in all your games, so it carries over to your other devices.
The game stores a record of what you agreed to: which version of our Terms of Service you accepted, whether you agreed to share usage and crash data, and when. We keep it as a record of your agreement.

We use this to back up your game and to keep it in sync across your devices. When you abandon a game, its cloud copy is deleted.

Like any online service, the servers that store your cloud save receive your IP address and basic technical information about your device and connection. They use it to connect you and to keep the service secure.

The game has no chat, profiles, leaderboards or other players. Nothing you do in the game is shown to anyone else.

Signing in with Google or Apple

You can choose to sign in to your account with Google or Apple, where the game offers it. That lets you continue your game on another device, or recover it if you lose yours.

When you sign in, the provider shares your email address with us. Google also shares your name and profile photo, and Apple may share your name. Our sign-in service, Firebase Authentication, stores the provider’s identifier for your account, your email address, and the name and photo address the provider shares.

We use your email address to show you which account you’re signed in with, and we use your sign-in to connect you to your cloud save. We don’t use your name or photo. We don’t email you unless you’ve written to us, or unless the law requires us to tell you something, such as about a security problem that affects your information.

With Apple, you can choose Hide My Email. Apple then gives us a private relay address in place of your real one.

Usage and crash data (optional)

When you first open the game, we ask whether you want to share usage and crash data. If you say yes:

Google Analytics for Firebase records how the game is played. This includes events such as starting a game, the difficulty you chose, your in-game results each turn (such as cash, net worth, prestige and level), the perks you choose, how a game ended, and which screens you visit.
Firebase Crashlytics (iOS and Android only) sends us a report when the game crashes or hits an error. A report includes the error, what the game was doing at the time and the state of your device.
Along with both, Firebase collects standard technical information: a random identifier for your installation of the game, your device model, operating system and language, the game’s version, and your approximate country or region, which it works out from your IP address.

We use this data to understand how the game is played, to balance it and to fix bugs. It’s tied to the random installation identifier, not to your account, name or email address. We have turned off advertising identifiers and ad personalization in both SDKs. Google says Google Analytics doesn’t log or store IP addresses.

You can change your answer at any time under Settings → Share usage and crash data. In the web versions of the game, Google Analytics uses cookies to do this.

This website

privatesales.onyxfish.dev has no advertising, forms or accounts. Its fonts, images and scripts are all served from our own site. The only exception is Google Analytics, and only if you agree to it (see the next section). The site is served only over HTTPS.

Amazon Web Services (AWS) hosts the site. Like any web host, AWS has to process your IP address and the details your browser sends with each request, such as the page you asked for and your browser type, in order to deliver pages to you. We don’t keep logs of those requests.

Website analytics and cookies

With your permission, we use Google Analytics to see how many people visit this website, how they find it and what they read. We ask the first time you visit. Until you say yes, the site doesn’t load Google Analytics at all, and nothing is sent to Google. This is separate from the usage data the game asks about, and your answer to one doesn’t change the other.

If you agree:

Google Analytics sets two cookies on privatesales.onyxfish.dev, _ga and _ga_QZTY69GNF5. They hold a random identifier for your browser and last up to 13 months after your last visit.
It receives:
- the pages you visit and the site that sent you here;
- how you use each page, such as scrolling and following links to other sites;
- your browser, device type, screen size and language;
- your approximate location. Google works this out from your IP address, and says it doesn’t log or store the address.
Google processes this data for us as our service provider, under its data processing terms, on servers in the United States and elsewhere. Google deletes the event- and user-level data 2 months after it’s collected. We keep the aggregated reports Google Analytics produces, such as the number of visits each month, which don’t identify you.
We’ve turned off Google signals, all of Google Analytics’ advertising features, and sharing data with Google for its own products and services. We don’t use the data to advertise to you.

Google explains how it handles this data in How Google uses information from sites or apps that use our services.

Your choice is saved in your browser’s local storage, not in a cookie, and we don’t keep a copy of it on our servers. We ask again after 12 months, or sooner if what we collect changes. To change your mind at any time, choose Cookie settings at the bottom of any page. If you withdraw, we stop analytics and delete its cookies. If your browser sends a Global Privacy Control signal, we take that as a no and don’t ask, though you can still turn analytics on under Cookie settings.

When you email us

When you email us, for example to ask for help, we receive your email address, your name if you give it, what you write and anything you attach. We use them to reply to you and to keep a record of our correspondence. Our email provider, Google Workspace, stores these messages for us.

We won’t add you to a mailing list or send you marketing email unless you ask us to. If we’d like to quote something you’ve written to us, such as in our store listings, we’ll ask your permission first.

Purchases

You buy Private Sales from the App Store or Google Play. Apple and Google handle payment, and we never receive your payment details. They give us sales reports and order records. These can include the country of a purchase and, from Google Play, the state or region, postal code and an order number, but not your name or payment details.

How we use information

We use the information above only to:

provide the game and its cloud features;
respond to you when you write to us;
understand how the game is played and improve it, if you agree to share usage data;
understand how people find and use this website, if you agree to analytics;
find and fix crashes and bugs, if you agree to share crash data;
keep the game and our services secure and prevent abuse;
comply with the law.

We don’t use your information for advertising, and we don’t sell it.

Do you have to give us information?

No. You can play Private Sales without giving us your name or email address, and without sharing usage or crash data. Cloud features are on by default, but you can turn them off and keep playing with the save on your device. Signing in with Google or Apple is optional. You can read this website without giving us anything, and saying no to analytics doesn’t change how the site works.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Legal bases (EEA, UK and Switzerland)

If you’re in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

Contract: to provide the game and the cloud features and sign-in you use.
Consent: for usage and crash data from the game, and for Google Analytics and its cookies on this website. You can withdraw consent at any time, in the game’s Settings or under Cookie settings on this website. Withdrawing doesn’t affect what was collected before.
Legitimate interests: our interests in delivering and securing the game, its cloud features and this website, preventing abuse, answering the people who write to us, and keeping records so we can establish or defend legal claims. We’ve weighed these against your interests and rights, and you can object (see below).
Legal obligation: where the law requires us to keep or disclose information.

We don’t sell your personal information, share it for cross-context behavioral advertising, or give it to anyone for their own marketing. We share it only with:

Google, which provides Firebase Authentication, Cloud Firestore (where cloud saves are stored), Google Analytics for Firebase and Firebase Crashlytics. Google processes this information on our behalf, under its Firebase data processing terms. See Privacy and Security in Firebase. Google also provides analytics for this website, if you agree to it, and our email (Google Workspace).
Google and Apple as sign-in providers, when you choose to sign in with them. Their own privacy policies cover what they collect when you sign in: Google and Apple.
Amazon Web Services, which hosts this website and the web versions of the game.
Authorities, where the law requires it, or where we need to protect the rights, property or safety of our players, Onyxfish or others.
A buyer or successor, if our business changes hands, for example in a merger or sale. Your information would stay covered by this policy’s commitments, and we’d let you know in the game.

Our contracts with our service providers require them to protect your information and to use it only to provide their services to us.

We may share aggregated statistics that don’t identify anyone, such as how many people have played the game.

Google user data

When you sign in with Google, the game asks Google only for your basic profile: your name, email address and profile photo. We use your email address to show you which account you’re signed in with, and your sign-in to connect you to your cloud save. We don’t use Google user data for advertising, we don’t sell it, and we don’t transfer it to anyone except Google’s Firebase services, which provide our sign-in. No person at Onyxfish reads it, unless you ask us to (for example when you ask for help), it’s needed for security or the law requires it.

Private Sales’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other websites and services

The game and this website link to other websites and services, including the App Store, Google Play, our company website and the Google and Apple sign-in pages. They have their own privacy policies, and this policy doesn’t cover them.

International transfers

We are based in the United States, and our service providers store and process information in the United States and other countries where they operate. If you play or visit from outside the United States, your information will be transferred to and processed in the United States, where US courts and authorities may be able to access it.

Google and Amazon Web Services are certified under the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, and we rely on those certifications when we share your information with them. Where they don’t apply, we rely on the European Commission’s standard contractual clauses, and the UK and Swiss equivalents, in our providers’ data processing terms. You can ask us for a copy at privacy@onyxfish.dev.

How long we keep information

On your device: until you delete the game or its data.
Your account and cloud save: until you delete them, or until they’ve gone unused for more than 3 years and we clear them out, which we do at least once a year. An account counts as used whenever the game is opened with cloud saves on, on any device signed in to it. Clearing out an account deletes it, including any email address and Google or Apple sign-in linked to it, along with its cloud save, catalogue and the record of what you agreed to. The save on your device isn’t affected: if you open the game again later with cloud saves on, it’s backed up under a new guest account. If we ever shut down the cloud features, we’ll announce it in advance.
Usage data from the game: Google Analytics deletes event- and user-level data after 2 months. Aggregated reports that don’t identify you are kept.
Crash reports: Firebase Crashlytics keeps them for 90 days.
Website analytics: Google Analytics deletes event- and user-level data after 2 months. Its cookies last up to 13 months after your last visit. Aggregated reports that don’t identify you are kept.
Your website consent choice: 12 months, in your browser.
Emails: at least once a year, we delete emails when more than 3 years have passed since our last exchange with you.
Records of deletion requests: when we delete an account because you asked us to, we record the date and the account ID, and nothing else, so we can show we did it. We keep that record for 3 years.

After we delete information, copies can remain in the backups of our cloud database for up to 60 days, until those backups are replaced. We use backups only to recover from a failure. If we ever restore one, we first delete again anything that was deleted after it was made.

Your choices and rights

In the game:

Turn cloud features off under Account → Enable cloud saves. When you turn them off, the game offers to delete your cloud save and account as well.
Turn usage and crash data on or off under Settings → Share usage and crash data.
Delete your account and cloud save under Account → Delete cloud data. They’re deleted right away, and the game keeps working with the save on your device.

If you can’t use the game, see Delete your account to ask us to delete your account by email. Deleting the game from your device doesn’t delete your cloud account.

On this website, choose Cookie settings at the bottom of any page to turn analytics on or off.

Wherever you live, you can also ask us to tell you what information we hold about you, give you a copy of it, correct it, delete it or stop using it for a particular purpose. Email privacy@onyxfish.dev. It’s free. We may need to confirm the request comes from you. We’ll answer within 30 days, or tell you within that time if we need longer and why. Sometimes we have to keep information anyway, for example where the law requires it. If so, we’ll tell you.

If you’re in the EEA, the UK or Switzerland, you also have the right to restrict our use of your information, to receive it in a portable form and to withdraw consent at any time.

Your right to object

Where we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation, by emailing privacy@onyxfish.dev. We’ll then stop, unless we have compelling legitimate grounds that override your interests, or we need the information to establish or defend legal claims.

Complaints

If you’re unhappy with how we’ve handled your information, tell us at privacy@onyxfish.dev or by post at our address. We’ll acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome.

You can also complain to a data protection authority at any time: in the EEA, the authority where you live or work; in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner. We’d be grateful for the chance to sort out any concern with you, but you don’t have to come to us first.

Children

Private Sales is meant for players aged 13 and older. We don’t knowingly collect personal information from children under 13. If we learn that we have, we’ll delete it. If you’re a parent or guardian and think your child has given us personal information, email privacy@onyxfish.dev.

In some countries the law sets an older age, up to 16, for agreeing on your own to things like sharing usage data. If you’re under that age where you live, ask a parent or guardian before you turn on usage and crash data. Parents can turn cloud features off on the game’s Account screen, and usage and crash data off in its Settings.

Do Not Track

This website honors Global Privacy Control: a browser that sends it is treated as having said no to analytics. We don’t respond to the older Do Not Track signal, because no common standard says what it should do. We ask for your consent instead, on this website and in the game.

Neither the game nor this website tracks you across other companies’ apps or websites, and we don’t sell or share your information for advertising. If you agree to analytics, Google collects information about your use of the game or your visits to this website over time, as described above.

Security

Information is encrypted on its way between the game and our service providers, and this website is served only over HTTPS. Each account can reach only its own cloud save, and only people at Onyxfish who need your information can see it. No system is perfectly secure, so if something ever goes wrong that affects your information, we’ll tell you as the law requires.

Changes to this policy

When this policy changes, we’ll post the new version here with the date it takes effect, and list what changed in the version history. Earlier versions stay available at their own addresses. If a change is significant, we’ll post it at least 30 days before it takes effect and let you know in the game. If a change affects something you consented to, we’ll ask for your consent again. If we want to use information we already hold in a materially different way from what this policy describes, we’ll ask for your consent first.

Contact

Questions about this policy or your information: privacy@onyxfish.dev, or write to Onyxfish LLC, 2108 N Street Ste N, Sacramento, CA 95816, United States.