Privacy
Policy

1. Controller

Managing Director: Mithat Arda
Email: info@playfalcon.app

2. The short version

• No Falcon account, name, email address, login, or social profile is required to play.
• Campaign progress, settings, coins, weapons and mission files stay on your device. Drylabs does not receive your campaign save, and there is no cloud save.
• Falcon for iPhone does not track you. It never asks for Apple's App Tracking Transparency permission, never reads the advertising identifier (IDFA), and asks Google for non-personalised ads only.
• Ads are optional reward videos and, on iPhone, a full-screen ad that can appear only when you leave a case you won, never after a failure. On iPhone, Remove Ads or the Field Operator subscription stops the automatic ads.
• Apple (or Google Play on Android) takes every payment. We never receive card or bank details. Our server verifies Remove Ads and Field Operator; coin packs and weapon unlocks, where your version offers them, are verified by Apple on your device and recorded only there.
• Falcon for iPhone 1.0 sends no gameplay analytics. Crash and performance reports stay on your device unless you copy them and send them to us.
• Mission files come from content.playfalcon.app through Cloudflare, which necessarily processes your IP address and request data.
• The website uses no cookies, advertising pixels, third-party fonts, or client-side analytics.
• We do not sell personal information for money. On Android, personalised ads, where your choices allow them, can count as sharing under some US privacy laws; iPhone ads are non-personalised.

3. Data we handle

3.1 Local game data

Falcon stores campaign progress, stars, coins, weapons and upgrades, your settings (audio, haptics, blood effects, graphics quality, mission preparation and Open all cases), the tutorial state, a random installation identifier used only with the reward and purchase services (sections 3.8 and 3.9) and, where your version sells coin packs or weapon unlocks, a record of each such purchase, in the app's private storage on your device. Prepared mission files are kept in a bounded least-recently-used cache so they can be replayed without downloading them each time.

Drylabs does not receive the campaign save. Deleting Falcon normally deletes the save, settings, diagnostics files and mission cache, but does not delete the server records described below. Your device's own backups (for example iCloud Backup) can include the save under your backup settings and the platform's terms. There is no Falcon account and no cloud save, so Drylabs cannot restore deleted progress or coins.

3.2 Mission and update delivery

Falcon downloads authenticated game content from content.playfalcon.app, hosted with Cloudflare Workers and Cloudflare R2. Cloudflare and our delivery service process information needed to route, secure, cache, and complete each request. Depending on the network and platform, this can include:

• IP address, request time, requested content path, request method, response status, byte range, and transfer volume;
• transport and protocol details, limited device or app network headers, and IP-derived region metadata supplied by Cloudflare;
• security, abuse-prevention, cache, reliability, and error information.

Our delivery service keeps no log of individual requests. It records only warnings and errors (release, content path, request identifier, method and error). The content request does not include your name, email address, campaign save, advertising ID, contact list, precise GPS location, or a Falcon account identifier. Content URLs are release-scoped and mission files are verified before use.

3.3 Website

This website is delivered through Cloudflare. When you request a page, Cloudflare necessarily processes an IP address, requested URL, timestamp, protocol and routing information, response status, and security signals. Drylabs does not place cookies, use browser local storage, run client-side analytics, load third-party fonts, or embed advertising trackers on this site.

3.4 Player support and privacy requests

If you contact info@playfalcon.app, we process your email address, message, attachments, technical details you provide, our replies, and the request history. Cloudflare Email Routing forwards the message to a Gmail inbox operated by Google. If you paste text from Settings → Copy diagnostics or Copy support reference into a message, we receive what you paste (sections 3.8 and 3.10). Please do not send passwords, access tokens, advertising identifiers, payment credentials, or full purchase receipts.

3.5 Apple and Google stores

Apple or Google independently processes information when you browse, download, install, update, review, buy in-app items or obtain store support for Falcon. Drylabs receives only the store information made available to developers, such as aggregate distribution data, review communications and the purchase information described in section 3.9. Falcon does not receive your Apple or Google password, card number, billing address, or bank details. The stores' own privacy notices govern their independent processing.

3.6 Permissions, tracking and device identifiers

Falcon does not request access to contacts, photos, microphone, camera, health data or precise GPS location.

iPhone. Falcon does not ask for App Tracking Transparency permission and does not track you across apps or websites owned by other companies. Falcon's own code never reads the advertising identifier (IDFA); because Falcon never asks for tracking permission, iOS gives every part of the app, including Google's advertising software, only a zeroed identifier in its place.

Android. Google's advertising software can use the device's advertising ID as your Android settings and consent choices allow.

3.7 Advertising and consent

Falcon shows ads through Google Mobile Ads (AdMob) and uses the Google User Messaging Platform (UMP) for consent. Reward videos are always optional: on iPhone, HAZARD PAY after some won cases and SUPPLY at headquarters. On iPhone, an automatic full-screen ad can appear only when you leave a case you won, never after a failure, and within frequency limits. On Android version 12, an automatic full-screen ad can appear when you leave the result screen after every two completed attempts, failed attempts, retries and replays included.

iPhone ads are non-personalised. Every iPhone ad request asks Google for non-personalised ads, with Google's publisher first-party identifier and ad personalisation switched off. Google's software can still process an IP address and approximate location derived from it; app- or developer-scoped device identifiers (not the IDFA); ad views and interactions; app interactions; crash, performance and other diagnostic information. Google uses these to serve, limit and measure ads, prevent fraud and improve its services. On Android, Google's software can also process the advertising ID and, where applicable, identifiers associated with accounts signed in on the device, and can personalise ads where your choices permit. Falcon does not offer account sign-in and does not send Google your campaign save, your name or your email.

For each reward video, Falcon gives Google a pseudonymous player identifier and an opaque reward reference, so that Google's signed confirmation can be matched to the reward you asked for (section 3.8).

Where the law requires it, Google's consent message appears before ads are requested, and ads load only once Google's software confirms they may be. You can decline or manage consent. Use Settings → Ad privacy choices when Google offers it in your region to reopen the message and change or withdraw consent. Refusal never blocks missions, weapons, upgrades or free retries.

Further information: Google advertising technologies, Google Privacy Policy, and Google Mobile Ads data disclosures for iOS and Android. The website itself does not use these advertising SDKs.

3.8 Verified reward service

When Falcon first needs our reward service (to offer a reward video, to check whether an automatic ad may appear, or to apply an ad-free purchase), the app creates a random installation identifier, keeps it in the save on your device, and exchanges it with our Cloudflare service for a signed session that lasts up to two hours. These are not hardware identifiers, a named account or a login with Google or Apple. The service derives a pseudonymous player identifier and does not store the installation identifier itself. It uses your IP address only to compute a short-lived key, rotated every hour, that limits abuse; it does not store or log the address. Cloudflare processes network data for these requests as section 3.2 describes.

When you request an optional reward video, the service records that player identifier, the session, the placement (HAZARD PAY or SUPPLY), the case the reward is for, the amount, ad unit, request and reservation identifiers, timestamps, verification status and Google's transaction identifier, and keeps the running balance of verified reward coins. Ad opportunity and session counters enforce the limits. Before an automatic full-screen ad, the app asks the service for a permit; the service records a random attempt identifier, the reported win or failure, the case, platform, ad unit, permit and operation identifiers, timestamps and whether the ad was shown. These records control ads only; they never establish a purchase or grant mission currency. Coins from a video are added only after Google's signed confirmation reaches our server, and recovery records prevent lost or duplicate grants. A Field Operator subscriber claims the same rewards without the video, and the claim is recorded the same way. This reward ledger is separate from your local mission earnings and is not a campaign cloud save.

3.9 Purchases and the Field Operator subscription

On iPhone every purchase is made with Apple's App Store, which charges your Apple Account.

Remove Ads and Field Operator. Remove Ads is a one-time purchase; Field Operator is an optional monthly auto-renewing subscription. StoreKit provides the local price, the purchase confirmation and Apple-signed proof of the purchase. The app sends that signed proof, and Apple's signed record that this copy of Falcon came from the App Store, to our Cloudflare service. The service verifies Apple's signatures and stores: Apple's app transaction identifier, a pseudonymous owner identifier and an account token derived from it, and the app version; for each purchase, Apple's transaction and original transaction identifiers, the product, the App Store environment, purchase, expiry, signing and revocation times and a hash of the signed evidence; renewal, grace-period and refund status; and acknowledgements of its own operations. Apple's App Store Server Notifications about renewals, expiry and refunds are recorded the same way (notification identifier, hash and time). Signed receipts are processed only while a request runs and are not stored in server records or request logs; pending signed evidence can stay in the app's storage until the server acknowledges it. The service links your pseudonymous player identifier to the owner identifier so that automatic ads stop and, for Field Operator, rewards can be claimed without the video. Purchase history is not sent to Google and is not used for advertising.

Coin packs and weapon unlocks, where your version offers them, are verified by Apple's StoreKit on your device. The app records each transaction (Apple's transaction identifiers, product, environment, times, quantity and what was delivered or taken back) in the save on your device, so that each purchase is delivered exactly once and reversed if Apple refunds it. These purchases are not sent to our server.

Restore and refunds. Restore uses the same Apple Account and Apple's verification. Apple decides refund requests; when Apple refunds a purchase, Falcon removes what that purchase delivered, as the Terms of Use describe.

Android. If your Android version offers Falcon Ad-Free, Google Play supplies the localized price and confirms the purchase using your Play account. Falcon sends the app-specific purchase token to our Cloudflare verification service, which queries Google's purchase API and acknowledges delivery after recording verified access. We retain that token, a derived pseudonymous record identifier, product, test or production environment, expiry, renewal, acknowledgement and verification status. The token is necessary to recheck subscription changes. Raw tokens, API credentials and purchase payloads are not written to request logs. Falcon does not receive your payment-card or bank details.

Purchase records are separate from campaign saves and reward history. Deleting online reward data removes the link between the installation's reward profile and a purchase, but does not cancel or erase the purchase or subscription. Purchases are specific to the store where they were made; automatic transfer between Apple and Google accounts is not offered. A purchase does not create a Falcon account or restore deleted mission progress.

3.10 Diagnostics

Falcon for iPhone 1.0 contains no analytics service and sends no gameplay statistics: our own statistics client is not included in this version, and the game engine's analytics, crash reporting and hardware statistics are switched off. Apple's MetricKit and Falcon's crash journal record crashes, hangs, memory exits and terminations (build, iOS version, device type, exception and termination reasons) in files on your device of at most 64 KB each. They leave your device only if you tap Settings → Copy diagnostics and send us the copied text. If you agreed in iOS to share analytics with app developers, Apple can separately give us crash reports under Apple's terms.

3.11 Game Center and iCloud

Falcon for iPhone 1.0 does not use Game Center or iCloud storage.

Optional iOS and mission email updates

If you sign up on the download page, we save your email address, selected updates (iOS availability and/or the new-mission newsletter), signup and update times, source page, and the consent-text version. Neither option is required to play. Your address is initially unverified; signup does not confirm ownership of the mailbox or send an email.

Cloudflare processes the form and uses temporary network identifiers to limit abuse. Subscriber records are held in a separate, access-restricted private GitHub repository, outside this website's public files. Email addresses and consent records are not published. GitHub may process data outside the EEA; the international-transfer information below applies.

You consent to the updates you select and may withdraw at any time by emailing info@playfalcon.app. We will stop using your address for updates when you withdraw. Email delivery will be configured separately; every future update will include a way to unsubscribe. We retain the active signup while needed for those updates or until withdrawal. Restricted Git version history can retain earlier records after the current file changes; deletion requests must also be handled for that history. We do not sell the signup list.

4. Purposes and legal bases

Providing network data is technically necessary to retrieve online content. Providing support information is voluntary, but we may be unable to investigate without enough non-secret detail to identify the issue. Advertising choices are voluntary. Withdrawal does not affect the lawfulness of processing before withdrawal or processing that has a separate applicable legal basis.

5. Recipients and processors

Personal data is available only where necessary to Drylabs personnel and service providers supporting the relevant purpose. Current provider categories include:

• Cloudflare, Inc. for domain services, DNS, security, website delivery, Workers, Durable Objects reward and purchase storage, R2 mission storage and delivery, and email routing;
• Google LLC for AdMob advertising, UMP consent services, Gmail support email and, independently, Google Play distribution and billing;
• Apple Inc. independently for App Store and TestFlight distribution, in-app purchases, subscription billing, refunds, StoreKit and App Store Server Notifications;
• GitHub, Inc. for the access-restricted record of website email sign-ups;
• professional advisers, courts, regulators, or authorities where required by law or necessary to establish, exercise, or defend legal claims.

We require processors to handle personal data under contractual confidentiality, security, and data-protection obligations. Provider privacy notices: Cloudflare, Google, and Apple.

6. International transfers

Cloudflare, Google, Apple and GitHub operate internationally. Information can be processed in the European Economic Area, the United States, and other countries where those providers operate. Where Chapter V GDPR or equivalent UK rules apply, transfers are based on an applicable adequacy decision, approved standard contractual clauses, or another lawful safeguard. You may contact us for information about the safeguard relevant to your request.

7. Retention

• Local game data, purchase records, diagnostics files and mission cache: until you delete them, the app evicts cached content, or you uninstall Falcon. Diagnostics files are overwritten once they reach 64 KB. Device backups follow your backup settings.
• Worker invocation and operational logs accessible to Drylabs: no longer than Cloudflare's configured service maximum, currently up to 7 days; security records needed for an active incident can be retained separately for the duration of the investigation and resulting legal limitation period.
• Server reward records: retained while needed to operate the installation's reward balance, recover delayed rewards and prevent duplicate or fraudulent grants. Use Settings → Reward data & support → Delete online reward data. Confirmation stops new video rewards for this installation, and Falcon also stops requesting any ads on it. The service schedules deletion after at least 24 hours, allowing a recovery window of up to eight days for pending rewards, and shows the date in the game. Keep Falcon online before that date to save pending rewards; unsaved rewards cannot be recovered after deletion. The service retries temporary erasure failures. Your saved campaign progress, coins and equipment remain on the device.
• Deletion records and recovery copies: after erasing the active reward ledger, we retain a minimal request identifier, dates and deletion status to honour the choice and prevent the same installation from recreating reward authority. Cloudflare's point-in-time recovery copies can contain earlier ledger data for up to 30 days; we restrict them to recovery purposes and must preserve deletion choices before restoring service. A deletion request here does not erase Google's separately controlled advertising data.
• Purchase and subscription records on our server: retained while needed to provide and restore ad-free access, reconcile renewals and refunds, prevent duplicate fulfilment and meet applicable record-keeping or legal-claim obligations. The service has no automatic deletion schedule for these records, and deleting reward data does not remove them. Contact support to request access or erasure; we assess and remove records that no longer have a necessary lawful purpose. Uninstalling does not cancel a subscription. Cancellation is available through the subscription settings of Apple or Google Play, according to the store of purchase.
• Advertising provider data: Google and its partners apply their own retention rules, subject to your privacy choices and applicable law. Withdrawing consent does not automatically erase all records already lawfully processed.
• Routine support correspondence: generally deleted or anonymised within 3 years after the end of the calendar year in which the matter closes, unless a shorter period is appropriate or law requires longer retention.
• Privacy-request records: generally retained for 3 years after completion to document compliance.
• Legally required business records: retained for the statutory period that applies to the record.

Cloudflare, Apple, Google and GitHub may retain information they control under their own policies. We periodically review retained data and delete or anonymise it when the purpose and applicable obligations expire.

8. Your privacy rights

Depending on where you live and subject to legal conditions and exceptions, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal data; object to processing based on legitimate interests; and complain to a supervisory authority. Where processing is based on consent, you may withdraw it for the future. Use the ad privacy choices described above to manage advertising consent; you can also contact us about other rights.

Send requests to info@playfalcon.app. Settings → Reward data & support → Copy support reference provides a non-secret reference for the reward service. Uninstalling alone does not notify that service; copy the reference or contact us before uninstalling. Because Falcon has no named account, we may need further information to establish that a request concerns your installation or purchase. We will not ask for a game password, installation secret or access token.

You may complain to the data-protection authority where you live, work, or believe an infringement occurred. Drylabs' lead local authority is:

9. Automated decisions

Drylabs does not use the personal data described here for decisions based solely on automated processing that produce legal or similarly significant effects. Falcon does not use spending, ad choices or refusals to change mission difficulty. On iPhone, ads are non-personalised. On Android, Google and its partners may personalise ads where your choices permit; this is separate from gameplay progression.

10. Children

Falcon depicts fictional violence and is not directed at children. It is not enrolled in Google Play Families or Apple's Kids Category. We do not knowingly request personal data from children through a Falcon account because no account exists. A parent or guardian who believes a child sent personal data to support can contact us for review and deletion.

11. Additional regional notices

United States

Falcon processes network identifiers, internet activity, support correspondence, purchase records and the advertising and reward categories described above, including approximate location, device identifiers, advertising interactions and diagnostics. Falcon for iPhone requests only non-personalised ads and does not track you. We do not sell personal information for money. On Android, advertising disclosures to Google and its partners, where your choices permit personalised ads, may qualify as a “sale”, “sharing” or “targeted advertising” under state law. Use Settings → Ad privacy choices when available to exercise the provider's opt-out controls, or contact us for assistance. Residents with applicable access, correction, deletion, portability, opt-out or appeal rights may contact us. We do not discriminate for exercising a privacy right.

Other countries

You may have additional rights under local law. We honour those rights where applicable. Mandatory local protections are not limited by this policy.

12. Security

Falcon uses HTTPS, private content storage, release-scoped immutable manifests, cryptographic content verification, verification of Apple's and Google's signatures, least-privilege deployment credentials, and bounded operational logging. No method of transmission or storage can be guaranteed completely secure. If you believe you found a security issue, contact info@playfalcon.app and avoid including exploit secrets in the first message.

13. Changes and contact

We will update this policy when Falcon's processing materially changes and will revise the effective date. Where required, we will provide additional notice before new processing begins and update Apple App Privacy and Google Play Data safety disclosures.

Privacy questions and requests: info@playfalcon.app.

This policy is designed as a transparent operational disclosure, not as a waiver of rights that cannot lawfully be waived.