Idle Holdings privacy policy

Updated 11 September 2026. This policy describes data processing in Idle Holdings for iOS and Android. Website visits and email correspondence are covered by the website privacy notice.

Controller

Privacy enquiries: support@riffsource.com

Data on your device

The app stores game progress, settings, language and chosen founder and family names on your device. These names are fictional game labels; you do not need to enter your real name. Local saves support gameplay, offline progress and continuity (Art. 6(1)(b) GDPR). Technical account state, session credentials and recovery or deletion markers are also stored locally where needed for the account functions.

The game can be played offline without signing into a platform account. It does not include advertising, advertising tracking, behavioural analytics or push notifications. Local reset, clearing app data and uninstalling may remove device data. They are separate from cloud-account deletion.

Cloud backup and authentication

Cloud backup starts automatically when online. Unity Authentication creates or resumes a pseudonymous player account. Unity Cloud Save receives a complete saved game associated with that player ID: progress, chosen game names, settings, save lineage and revision metadata, and game/build version information. Connection data is processed to deliver and secure the online services. A pseudonymous or anonymous player ID can still identify an account; this is data collection.

This processing provides game saving, backup, account continuity and recovery (Art. 6(1)(b) GDPR). Service security and failure diagnosis also support a legitimate interest in reliable, secure operation (Art. 6(1)(f) GDPR). The game does not use automated decisions with legal or similarly significant effects.

Cloud backup begins automatically when online. The local save remains the basis for gameplay. Account settings show backup and connection status; a failed connection does not establish that a backup exists. Conflicting saves require a choice between complete saves. After cloud-account deletion, online backup stays off until explicitly enabled again.

Optional platform linking and recovery

Linking Game Center on iOS or Google Play Games on Android associates a platform player identifier with the Unity account. Platform identity-verification credentials are sent to Unity to authenticate or link the account. The game does not request your Apple or Google password, email address, contacts or payment information. Unity Player Accounts and email/password registration are not offered.

Recovery uses a previously linked account on the same platform and requires access to that account and the relevant online services. It is not a guarantee against lost progress. Losing the local credentials of an anonymous account can prevent recovery, even if a cloud save exists. Recovery between iOS and Android is not supported. Platform sign-in and profile processing are governed by the provider’s own settings and terms.

Recipients, diagnostics and international processing

RIFFSOURCE uses Unity Technologies and its service providers for Unity Authentication and Cloud Save. Apple provides Game Center and Google provides Google Play Games. Platform services also process their own account and profile information. Cloud save contents are used to provide the game services, not for advertising.

Unity’s iOS SDK privacy declarations include player identifiers, approximate location and crash diagnostics. The app does not request GPS location. Google Play Games processes gamer identifiers and SDK usage, diagnostic and performance information. Engine analytics and crash-reporting switches are disabled; this does not remove processing performed by enabled service providers. Achievements, leaderboards, friends and Google Play Games Saved Games are not used by this game.

Unity and the platform providers operate internationally, including in the United States. Their published privacy and transfer information explains their processing locations and transfer mechanisms. Unity’s published Data Processing Addendum provides for EU Standard Contractual Clauses where applicable; processing is not limited to the EU. You may contact us for information about the safeguards applicable to your data.

• Unity player privacy policy and Data Processing Addendum
• Apple Game Center privacy
• Google privacy policy and Play Games SDK data processing

Storage and retention

Local game data remains in the app’s storage until reset or removed through the device. Cloud saves and account associations are kept for the account service until deleted. No automatic fixed-period expiry is configured by the game. Vendor security logs, backups or legal obligations can have separate retention rules; these records are subject to the provider’s applicable deletion and retention rules. We provide information about any applicable retention obligation when handling a request.

Delete your Idle Holdings cloud account

Open Settings → Account & cloud backup → Delete cloud account and confirm. The app deletes this game’s Cloud Save player files before deleting its Unity Authentication player. Your local progress remains playable. Deletion does not delete your Apple or Google account or platform profile.

If deletion is interrupted or unconfirmed, cloud access remains paused, including after restarting. Reconnect and choose Try again to complete the request. After successful deletion, backup stays off until you explicitly enable it again. A local reset or uninstall is not a substitute for deleting the cloud account.

Without the app, send an Idle Holdings account-deletion request to support@riffsource.com. For access or other privacy requests, use the same address. Include the platform and any account or support identifier available to you. We may request information needed to verify ownership; do not send passwords or sign-in tokens. An account may not be identifiable from an email address alone. For Google Play Games profile data, use Google’s game-data deletion controls.

Your rights and choices

Under the applicable legal requirements, you may request access, correction, deletion, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for the future without affecting earlier lawful processing. You can complain to a supervisory authority, including Der Landesbeauftragte für den Datenschutz Niedersachsen (Lower Saxony, Germany).

Platform linking is optional. Online backup and recovery cannot be provided without the necessary account and saved-game data. Local-only data cannot be retrieved or deleted remotely by RIFFSOURCE. App stores and operating systems separately process downloads, platform accounts, device backups and diagnostics under their own settings and policies.

Questions about playing or saving? Visit Idle Holdings support. Email support processing is explained in the website privacy notice.