Privacy Policy

Last updated: 27 July 2026

1. Who we are

Downcore ("the game", "the app") is developed and published by Luka Hristic Grubor, an individual developer based in Spain, acting as the data controller for the limited processing described here. In this policy "we" and "our" refer to that developer, and "you" refers to the person using the app.

You can reach us at downcore.game@gmail.com. This policy covers the Downcore iOS app and this website.

2. Data stored on your device

Downcore does not have user accounts. Everything the game knows about you lives in files inside the app's own storage on your iPhone:

• Your save file. Best depth, cores, which relics, events, classes and skins you have unlocked, your selected loadout, mission progress, daily-run streak, and lifetime totals such as runs played, enemies destroyed and metres descended.
• Preferences. Sound and haptics settings, and small flags remembering which one-off tips and coach marks you have already seen.
• Housekeeping counters. How many rewarded ads you have watched today (to enforce the daily cap) and whether the app has already asked you to rate it.
• Local run telemetry. The game writes a small technical summary of your last twenty runs (depth reached, duration, cause of death, relics picked) used to sanity-check game balance. This file never leaves your device. It is not uploaded, and we have no way of reading it.

None of this is transmitted to us. It is removed when you delete the app. If you use iCloud or iTunes device backups, these files may be included in your own encrypted backup, which is between you and Apple.

3. Game Center

Downcore uses Apple's Game Center for leaderboards and achievements. This is optional and depends on whether you are signed in to Game Center on your device.

• If you are signed in, the game submits your best depth and your daily-run score to two leaderboards, and reports progress towards twenty achievements.
• Apple gives the app a player identifier that is scoped to Downcore. We never receive your Apple Account, your real name or your email address.
• Your display name and avatar on a leaderboard are the ones you chose in Game Center, and they are shown to other players by Apple, not by us.
• This processing is governed by Apple's Privacy Policy. You can turn Game Center off in iOS Settings → Game Center, and the game will simply stop submitting scores.

4. Purchases

Downcore offers a single optional in-app purchase, Downcore Supporter, a one-time non-consumable unlock. There is no subscription.

Apple

The payment itself is handled entirely by Apple through the App Store. We never see and never receive your card number, billing address or Apple Account details.

RevenueCat

We use RevenueCat to validate the purchase and to remember that you own it, including when you restore it on a new device. Acting as our processor, RevenueCat receives:

• An anonymous app user ID generated on your device. It is not linked to your name or email.
• The App Store transaction data for the purchase (product, date, transaction identifiers), which is what proves you own it.
• Basic technical context: device model, iOS version, app version, country and locale, and the vendor identifier (IDFV) that Apple assigns to our apps on your device.

See RevenueCat's privacy policy. We use this data only to grant, restore and support the purchase, and to see anonymous aggregate sales figures.

5. Rewarded ads

Downcore shows ads in exactly one place: an optional "Watch an ad and double" button on the results screen after a run, which doubles the cores you earned. That is the whole of it.

• No ads during a run, no interstitials between runs, no banners.
• A maximum of three per day, and only if you tap the button.
• The advertising software is not started when you launch the app. It is initialised the first time you choose to watch an ad, and never at all if you own Supporter.
• Supporters get the same core bonus without watching anything.

What Google receives

Ads are served by Google AdMob. When an ad is requested, Google may collect and process:

• Device identifiers used for advertising: the IDFA only if you allow tracking (see below), otherwise non-permanent identifiers;
• Your IP address, which gives an approximate location (typically city or country level, not GPS);
• Device and system information such as model, operating system version, language and app version;
• Ad interaction events: that an ad was requested, shown, watched to the end, clicked or closed.

Google uses this to select and deliver the ad, cap how often you see the same thing, measure performance and detect fraud and invalid traffic. See how Google uses data from apps that use its services and Google's privacy policy.

Consent, and how we ask for it

• Consent form (EEA, UK, Switzerland). Before the first ad loads, Google's User Messaging Platform shows you a consent form covering advertising purposes and storage on your device. Whatever you choose is respected, including refusing everything.
• App Tracking Transparency. On iOS, we then ask for permission to track. We show our own short explanation screen first so the system prompt is not a surprise, and we only ask it when you are about to watch an ad, never on first launch.
• If you decline, the IDFA is not available and ads are non-personalised: chosen from context rather than from a profile of you. The button still works and you still get your cores.

SKAdNetwork

The app includes Apple's SKAdNetwork configuration, which lets advertisers measure whether an ad campaign led to an install without identifying you. Reporting is aggregated and delayed by design, and it is run by Apple, not by us.

Ad revenue reporting

Technical ad events (an ad loaded, an ad was shown, its estimated revenue) are also sent to RevenueCat so that ad income and purchase income appear in one dashboard. This adds no new personal data beyond what is described above, and we see it only as aggregate figures.

6. What we never collect

Downcore does not ask for, collect or transmit:

• Your name, email address, phone number or postal address;
• Precise or GPS location;
• Contacts, photos, files, calendar, microphone or camera;
• Health, fitness or biometric data;
• Gameplay analytics sent to us (there is no analytics SDK in the app);
• Crash reports through a third-party SDK. We may see the anonymous, aggregated crash and performance statistics that Apple offers all developers, and only if you opted in to sharing them with developers in your iOS settings.

There are no accounts, no social logins, no newsletters and no push marketing.

This website

This site is static and sets no cookies. It has no analytics, no tracking pixels and no embedded third-party scripts. It is hosted on Cloudflare Pages, which processes standard server logs, including your IP address, to deliver the pages and protect against abuse, as described in Cloudflare's privacy policy. The App Store badge, when present, loads an image from Apple.

7. Third parties at a glance

8. Children

Downcore is not directed at children under 13, is not published in the App Store Kids Category, and contains advertising and an in-app purchase. We do not knowingly collect personal data from children under 13 (or under the equivalent age in your country). If you believe a child has used the app in a way that provided personal data to the advertising service, contact us and we will help you route the request to Google.

9. Legal bases (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland:

• Performance of a contract (Art. 6(1)(b)): delivering the game, and validating, restoring and supporting your purchase.
• Consent (Art. 6(1)(a)): personalised advertising and the associated storage on your device, collected through the consent form and App Tracking Transparency. You can refuse, and you can change your mind.
• Legitimate interests (Art. 6(1)(f)): showing non-personalised ads so a free game can pay for itself, preventing ad fraud, and keeping purchases secure against tampering.

10. Your rights

Under the GDPR and similar laws you have the right to access, correct, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time.

In practice, we hold nothing that identifies you: there is no account, and the identifiers our providers use are anonymous or device-scoped. That means:

• To erase everything on your device, delete the app. Progress, telemetry and preferences go with it. This cannot be undone, and Supporter can be restored later from the App Store.
• For purchase records, write to us with your transaction details and we will locate and delete the RevenueCat record, or contact Apple, who holds the billing side.
• For advertising data, Google is the controller for the profiles it builds; use the Google links in section 7 and the choices in section 11.
• For Game Center, manage or delete your data through your Apple Account.
• You can also exercise your rights by writing to us at downcore.game@gmail.com.

You also have the right to lodge a complaint with a supervisory authority: in Spain, the Agencia Española de Protección de Datos, or the authority where you live.

11. Changing your choices

• Tracking (ATT). iOS Settings → Privacy & Security → Tracking. Turning Downcore off there stops the use of the IDFA and makes ads non-personalised. You can also turn off Allow Apps to Request to Track entirely.
• Advertising consent. Your answer to the consent form is stored on your device by Google's software. Deleting and reinstalling the app clears it and the form will be shown again the next time you choose to watch an ad. We intend to add an in-app control for revisiting this choice; until then, the reinstall route and the iOS tracking setting above are the ways to change it.
• Ads altogether. Never tap the ad button, or buy Supporter, in which case the advertising software is never started.
• Game Center. iOS Settings → Game Center.

12. Retention

• On your device: until you delete the app. Run telemetry is capped at the twenty most recent runs and older entries are discarded automatically.
• RevenueCat: purchase records are kept for as long as the purchase is valid (it is permanent, so it can be restored) and as required for accounting and tax obligations.
• Google: according to Google's own retention policies, described in their privacy policy.
• Apple: Game Center and App Store data according to Apple's policies.

13. International transfers

Apple, Google and RevenueCat are established in the United States and may process data there or in other countries. They provide safeguards for transfers out of the EEA and the UK through Standard Contractual Clauses and, where applicable, participation in the EU-US Data Privacy Framework. Details are in each provider's privacy policy, linked in section 7.

14. California

For residents of California (CCPA/CPRA):

• We do not sell your personal information for money.
• However, allowing personalised advertising means advertising identifiers are shared with Google for cross-context behavioural advertising, which the CPRA treats as "sharing" and, in some readings, as a "sale". You opt out by declining the tracking prompt or turning Downcore off under Settings → Privacy & Security → Tracking, and we honour that choice.
• The categories involved are identifiers (advertising IDs, IP address) and internet activity (ad interactions). We do not collect sensitive personal information.
• You have the right to know, delete, correct and opt out, and we will not discriminate against you for exercising them.

15. Security

Your progress is stored in the app's private container, protected by iOS app sandboxing and device encryption. All network traffic from the app to Apple, RevenueCat and Google uses encrypted connections. No system is perfect, but because there is no account and no server of ours, there is no database of players to breach.

16. Changes to this policy

If we change how Downcore handles data, we will update this page and the "last updated" date above. Significant changes (a new third-party service, a new kind of data) will also be noted in the App Store release notes for the version that introduces them.

17. Contact

Questions, requests or corrections: downcore.game@gmail.com. We are one person, so please allow a few days for a reply, and in any case no more than the one month the GDPR provides for.