Privacy Policy
- Piano Tiles: Magic Song is a rhythm game published by EXO Studio. It has no user account, and we never ask for your name, email address, phone number, contacts, photos, camera, microphone, or precise location.
- The App shows third-party advertising and uses analytics and marketing attribution services. Those services process device identifiers, approximate location derived from IP address, app interaction events, and advertising and diagnostic data.
- Before any cross-company tracking is enabled, the App asks for permission through Apple's App Tracking Transparency prompt. If you decline, Meta, TikTok, and Adjust are never started.
- Where a regional advertising consent message is required, Google's User Messaging Platform is shown first, and you can reopen it later from Settings > Privacy Choices inside the App.
- Your game preferences stay on your device. We do not sell personal information for money.
1. Who we are
This Privacy Policy explains how EXO Studio, Hanoi, Vietnam ("EXO Studio," "we," "us," or "our") handles information in connection with Piano Tiles: Magic Song (the "App"), a rhythm game for iOS distributed through Apple's App Store. EXO Studio is the controller of the processing described here. For questions, use the contact details in section 15.
2. Information collected
The App itself does not ask you to create an account or to provide personal details. The categories below are processed by the App and by the advertising, analytics, and attribution services embedded in it, and what is actually processed depends on your device settings, your region, your consent choices, and whether an advertisement is served.
| Category | Examples | Why it is processed |
|---|---|---|
| Identifiers | Apple's advertising identifier (IDFA) only when you allow tracking, vendor and installation identifiers, and technical identifiers generated by the advertising and analytics SDKs. | Serving and measuring advertising, attributing installs and ad revenue, fraud prevention, and analytics. |
| Approximate location | Coarse location inferred from network information such as your IP address. The App does not request GPS or precise location. | Regional legal compliance, ad delivery, and aggregate analytics. |
| Product interaction | App launches, screen views, onboarding and gameplay events, and ad-related events such as impressions and clicks. | Understanding how the App is used and improving it. |
| Advertising data | Ad format and placement, the mediation network that served the ad, estimated ad revenue for that impression, and interaction with the ad. | Measuring advertising performance and reporting revenue to our advertising and attribution partners. |
| Diagnostics | Technical and performance information reported by the SDKs, such as SDK initialization results and ad request outcomes. | Keeping the App reliable and diagnosing errors. |
| Local settings | Difficulty, sound, vibration, and whether onboarding has been completed. | Remembering your preferences between sessions. |
The App does not collect your name, email address, phone number, contacts, photos, camera or microphone input, health data, precise location, or payment information. There is no login, no user profile, and no user-generated content.
3. How information is processed
Local settings are stored on your device using the standard iOS preferences store and are not transmitted to us. They are removed when you delete the App.
The identifiers, approximate location, interaction, advertising, and diagnostic data described above are transmitted to the third-party services listed in section 6 and processed on their infrastructure under their own privacy terms. EXO Studio receives this information only in aggregated, report-level form through those services' dashboards; we do not operate our own backend for the App and do not maintain a user database.
The App also uses Firebase Remote Config to retrieve its advertising configuration, which controls which ad placements are enabled. This is a download of settings to your device.
Apple's SKAdNetwork framework may be used by advertising partners for privacy-preserving install attribution. SKAdNetwork reporting is handled by Apple and does not expose your device identifier to us.
4. Purposes and legal bases
Where the EU or UK GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the game and remembering your on-device settings | Performance of a contract with you (Art. 6(1)(b)). |
| Personalized advertising, cross-app tracking, and marketing attribution | Your consent (Art. 6(1)(a)), collected through the App Tracking Transparency prompt and, where required, the Google User Messaging Platform consent message. You may withdraw consent at any time. |
| Non-personalized or limited advertising where consent for personalization is not given | Legitimate interests in funding a free game (Art. 6(1)(f)), applied only to the extent permitted in your region. |
| Aggregate analytics, reliability, and fraud prevention | Legitimate interests in operating, securing, and improving the App (Art. 6(1)(f)), or consent where required locally. |
5. Tracking permission and consent choices
On supported iOS versions, the App presents Apple's App Tracking Transparency prompt before any tracking across apps or websites owned by other companies is enabled. This is a real gate, not a formality: if you decline, the Meta, TikTok, and Adjust SDKs are never initialized and no attribution or ad-revenue events are forwarded to them.
In regions where an advertising consent message is required, the App shows Google's User Messaging Platform consent form before requesting any advertisement, and no ads are requested at all if consent cannot be obtained. When the consent framework offers a privacy options form for your region, you can reopen it at any time from Settings > Privacy Choices inside the App.
You can also change or revoke the tracking permission at any time in the iOS Settings app, under Privacy & Security > Tracking, or in the App's own entry in Settings.
6. Service providers and SDKs
The following services are embedded in the App. Each processes information under its own privacy policy.
| Provider | Component in the App | Role |
|---|---|---|
| Google AdMob, Google User Messaging Platform | Serving advertisements, mediating demand, and collecting advertising consent. | |
| Firebase Analytics, Firebase Remote Config | App usage analytics and remote advertising configuration. | |
| Meta Platforms | Facebook SDK (core, app events) | Marketing attribution and reporting of ad-revenue events, only after you allow tracking. |
| TikTok | TikTok Business SDK | Marketing attribution and reporting of ad-revenue events, only after you allow tracking. |
| Adjust | Adjust SDK | Install attribution and ad-revenue measurement, only after you allow tracking. |
| Mediation partners | AppLovin, Meta Audience Network, Pangle, Mintegral, Unity Ads, ironSource | Ad networks that may supply the advertisement shown in a given placement through AdMob mediation. Which network serves a specific ad varies. |
Provider privacy policies:
- Google (AdMob, Firebase, User Messaging Platform)
- Meta Platforms and Meta Audience Network
- TikTok and Pangle
- Adjust
- AppLovin
- Mintegral
- Unity Ads
- ironSource
7. Sharing and "sale" of personal information
We do not sell personal information for money, and we do not share it with parties other than the service providers listed in section 6 and their own processors, except where disclosure is required by law or is necessary to protect our legal rights.
Some privacy laws, including the California Consumer Privacy Act as amended by the CPRA, define "sale" and "sharing" broadly enough to include personalized advertising and cross-context behavioural advertising. To the extent the advertising described in this policy falls within those definitions, it takes place only when you have allowed tracking through the App Tracking Transparency prompt and, where applicable, the consent message. Declining tracking is the opt-out mechanism for the App.
8. Retention
On-device settings remain on your device until you change them or delete the App. Information held by the service providers in section 6 is retained according to their own published retention schedules and applicable legal obligations; we do not control those schedules and we do not keep a separate copy of the underlying event-level data.
9. Security
The App relies on the security protections built into iOS, on encrypted transport for the network requests made by its SDKs, and on the security programmes of the established providers listed in section 6. Because the App holds no account and stores no personal data on our systems, the attack surface on our side is limited to the published configuration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Device permissions and on-device processing
The only permission the App requests is the App Tracking Transparency authorization described in section 5. The App does not request access to your camera, microphone, photo library, contacts, calendar, health data, location services, or notifications.
Gameplay, audio synthesis, and your saved preferences are processed entirely on your device and are not uploaded to us.
11. Children's privacy
The App is not directed to children under 13, or under the higher minimum age of digital consent that applies in your country. We do not knowingly collect personal information from children. If you believe a child has used the App in a way that resulted in the collection of personal information, contact us using the details in section 15 and we will act on the request.
12. Your rights (GDPR, UK GDPR, CCPA/CPRA)
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to restrict or object to certain processing; to withdraw consent at any time; to opt out of the sale or sharing of personal information and of targeted advertising; and to be free from discrimination for exercising these rights. You also have the right to lodge a complaint with your local supervisory authority.
Because the App has no account, the information involved is tied to device or installation identifiers rather than to an identity we hold. In practice this means that:
- Withdrawing consent is done by turning off tracking for the App in iOS Settings, and by reopening Settings > Privacy Choices in the App where that form is available in your region.
- Resetting or turning off the advertising identifier in iOS Settings breaks the link between your device and past advertising data.
- Deleting the App removes the locally stored settings.
If you want us to help with a request that requires action by one of the providers in section 6, contact us with the approximate date and the region of use, and we will pass the request on. We may need this information to locate the relevant records; we will not ask you for more personal data than is necessary to handle the request.
13. International transfers
EXO Studio is based in Hanoi, Vietnam, and the providers listed in section 6 operate globally. Information processed through those services may therefore be transferred to and processed in countries other than the one where you live, including the United States. Where such transfers are subject to the EU or UK GDPR, the providers rely on transfer mechanisms such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision, as described in their own privacy documentation.
14. Changes to this policy
We may update this Privacy Policy when the App, its service providers, or applicable legal requirements change. The revised version is published at this URL and the "Last updated" date at the top is changed. Material changes affecting how information is used will be reflected in the App's release notes where practicable. Continued use of the App after an update means you accept the revised policy.
15. Contact
EXO Studio
Hanoi, Vietnam
Email: exostudio.feedback@gmail.com
We aim to respond to privacy requests within 30 days.