Privacy Policy — PlaneFlow

Last updated: 25 September 2026

Some of what this policy describes is not running yet. It is written down here first, on purpose, so that nothing starts being sent before it is described. The Play Games statistics arrive with the next version of the Android app. The sign-in check in Checking that a result is really yours starts no earlier than the next Android release. The Play Integrity check in Checking that a result is really yours starts with a later Android release. Everything else on this page describes the app as it is today.

PlaneFlow (“the game”, “we”) is a casual air-traffic-control game. This policy explains what data the game handles and how. We keep it minimal on purpose: the game asks for no personal information and there is no sign-up, no password and no account you have to create. On Android, the game optionally lets you sign in with Google Play Games to use achievements and leaderboards — that part is described below and is entirely optional. If you post a score to our own Survival leaderboard in the Android app, a random player id — and, if you are signed in, your Play Games display name — are stored on our server so the board can show your result; you can have those deleted at any time. Because that board is public, the Android app also asks Google to confirm that a result really comes from the player it is signed with and from a genuine copy of the game — what that adds is described in Checking that a result is really yours. The game also lets you write us a message about a level or about the game — that is voluntary, and what you type goes to our own server and to the developer. The only personal data we ever ask for is an email address you enter yourself if you choose to join our optional notification list (see Email notifications below).

What we store

The game stores the following locally on your device (in the browser/app storage), so your progress and preferences persist between sessions:

• Game progress & settings — unlocked levels, stars, best results, chosen language, sound/vibration and visual-theme preferences.
• Anonymous gameplay analytics — a randomly generated identifier (not linked to you or any account), session timing, and in-game events such as level start/finish, tutorial steps, settings changes, and error/crash details. Alongside each event we store basic technical context: app version, interface language, platform, and screen size. On the web this stays on your device; in the Android app, once you consent, it is also sent to Firebase (see below).

Google Play Games (Android, optional)

The Android version of PlaneFlow offers an optional sign-in with Google Play Games so you can earn achievements and post Survival scores to leaderboards. This feature is provided by Google. It is off until you choose to sign in, and you can play the entire game without it. The web version does not use Google Play Games at all.

When you sign in, Google provides the game with your Play Games player ID and your Play Games display name (gamer tag) and avatar, and the game sends your achievement progress and leaderboard scores to Google Play Games Services. Your gamer tag and scores are stored on Google’s servers and can be visible to other players on the leaderboards you take part in. Your gamer tag is also what signs your entry on our own Survival leaderboard described below, so it is sent to our server too, and our server asks Google to confirm the sign-in behind it — see Checking that a result is really yours. We use this data only to run achievements, leaderboards and the statistics described below — we do not use it for advertising and we do not sell it.

Play Games statistics. While you are signed in, the game also sends Google Play Games a few running totals of your play (from the next version of the Android app): planes landed, planes sent off, services done, coins earned, stars, your best streak, medals unlocked and how far you are through the campaign. Google shows them as game statistics in your Play Games profile. They are the game’s own lifetime totals, sent as they stand, so the first time they go out they include everything you have played so far. Google keeps the highest value it has received: deleting your statistics or resetting your progress in the game does not lower the totals your profile already shows (only the campaign progress follows the game back down). What is in your Play Games profile is managed through your Google account, as described below. The statistics are counts only — nothing else about you, and nothing about your device.

Saved games (cloud progress). While you are signed in, the game also keeps a copy of your saved game in your Play Games account, using Google’s Saved Games service, so that your progress follows you to another device. That copy is the whole save file — unlocked levels, stars, best results, medals, your settings and language — and it is stored by Google, not by us: we never receive it. (Earlier versions of the game also put the random key described in the leaderboard section into that copy; it no longer goes there, and the next save from an updated game removes it.) Your device keeps the original; the cloud copy is a mirror. It is removed when you delete the game’s data from your Play Games account, and resetting your progress in the game’s settings erases the cloud copy too. If you never sign in, nothing is copied anywhere.

This Play Games data is collected and processed by Google under Google’s Privacy Policy, and you control it through your Google account and your Play Games settings (including your gamer-tag visibility and deleting your Play Games data). If you never sign in, no Play Games data leaves your device.

Survival leaderboard — our own server (Android app)

The Android app has a global Survival leaderboard that we run ourselves, on our own server, separate from Google Play Games. When your Survival run ends and the result is posted to that board, the game sends the following to our server at api.planeflow.jevgenia.com:

• Your Play Games display name (gamer tag), if you are signed in — the game has no separate nickname field, so your board entry is signed with the same public alias you already use in Google Play Games. It is shown publicly next to your score. If you are not signed in, no name is sent at all and the board simply labels your entry automatically (“Player-” plus four characters). You change this alias in Play Games itself, not in the game; you can have our copy of it deleted (see below).
• A random player id — a string the game generates on your device the first time it needs one. It is generated by the game itself, not taken from your Google account, not your email, and not derived from your device’s hardware; it exists so the board can tell that two results belong to the same player (your personal best, your position, and so that nobody can post scores under your name). It travels with a random key the game generates once and keeps on your device, which is what proves to our server that the id is yours — it identifies nothing else and is never shown to anyone. When a device presents the wrong key for its id (or none), our server refuses it and adds to a daily count: how many refusals, and how many different ids were refused that day. Only those two numbers are kept. To tell ids apart during the day, the server holds a one-way scrambled form of each refused id, in memory only, and discards it when the day ends; the id itself, and anything else about the device, is not recorded.
• Proof that the entry is really yours — if you are signed in, a one-time code from Google (no earlier than the next Android release) that lets our server confirm which Play Games player is behind the entry, and, whether or not you are signed in, a statement from Google Play (from a later Android release) about the app and the device. Both are described in full in Checking that a result is really yours below.
• Your score and how long the run lasted, and the time it was recorded.

That is the whole list — no contacts, no location, and no hardware or advertising identifiers (the two random strings above are generated by the game itself and identify nothing outside it). The one identifier that does come from your Google account — your Play Games player ID — reaches our server only to confirm that an entry is yours, is never shown to anyone and is used for nothing else; that is the section below. We use all of it only to build the leaderboard and to keep it honest. It is not shared with third parties, not used for advertising, and never sold. The web version of the game does not send scores to this leaderboard.

Where it is stored. On a virtual server we rent and administer ourselves from Contabo, located in a data centre in France — so this data is stored in the European Union and does not leave it. It is not handed to a third-party analytics or game-backend service: it sits in a single database file on that server, and travels there over HTTPS. The two exceptions are the checks described below: to perform the sign-in check, our server passes the one-time code back to Google; to perform the Play Integrity check, it passes the encrypted verdict token to Google’s own decoding service. Both answer from Google’s infrastructure under Google’s Privacy Policy. Nothing else on the list goes anywhere but that database file, and Google gets nothing from us besides that code and that token.

How long it is kept. Your display name, your player id and the record that links it to your Play Games sign-in are kept until you ask us to delete them — whether or not you are still on the board, and whether or not you ever posted a score at all. Individual run records are deleted automatically after about 90 days; weekly, monthly and seasonal placings drop off automatically once the period is well past. Your all-time best stays until it is deleted.

Deleting it. Write to planeflow@jevgenia.com and we will erase everything our server holds about you — display name, player id, what we keep of your Play Games sign-in, every recorded run and any messages you sent us — which also removes you from the leaderboard. Note that if you keep playing afterwards and post a new score, a new entry is created in the same way as the first time.

Checking that a result is really yours (Android app)

A shared leaderboard is only worth anything if the results on it are real. Two checks make that possible, and each one means our server receives something extra, so both are described here in full. The sign-in check starts no earlier than the next Android release; until it starts, no sign-in code is sent anywhere. The Play Integrity check starts with a later Android release; until it starts, no Play Integrity verdict is sent anywhere. They happen only in the Android app, and never on more than the requests that put something of yours on our server at api.planeflow.jevgenia.com — posting a Survival result, or sending us a message. Requests that carry nothing of yours never get them: reading the leaderboard, and the anonymous tally of consent answers described below, stay exactly as they are. Whether every such request is checked or only some of them is a question of how much checking Google lets us do; either way it is never more than what this section describes. The web version does none of this.

• Confirming who posted it. If you are signed in with Play Games, the game asks Google for a one-time sign-in code and sends it to our server. Our server hands that code back to Google in exchange for permission to read exactly one thing — your Play Games player ID — and then drops that permission. Google’s answer is what tells us that the display name and the results on the board really belong to the Play Games player they are signed with, so that the board can tell your real results from ones that only borrow your name. What we keep afterwards is only what that check needs: a record that this player id belongs to that Play Games player. It is stored next to your player record, it is never shown to anyone, it is used for nothing else, and it is the only trace of your Google account on our server. We do not receive, ask for or store your Google email address, your real name, or anything else from your Google account.
• Confirming what posted it. The game asks Google Play for a Play Integrity verdict and sends it to our server. It is a signed statement from Google Play about the app and the device, not about you: whether this is a genuine, unmodified copy of PlaneFlow, whether it was obtained from Google Play with your account, and whether the device passes Google’s standard integrity checks. Nothing in it identifies you — no name, no account name or address, no email, no advertising identifier, no location — and it tells us nothing about what else is on your device. We use it to keep whatever it travels with — a leaderboard result, or a message you send us below — from being faked or spammed by a modified build or an automated client, which is also the only thing it can be used for.

How long they are kept. What we keep of your Play Games sign-in sits next to your player record and lives exactly as long as that record does. The Play Integrity verdict is checked at the moment of the request and not stored: all that remains is whether the last check passed, and when.

Deleting them. The verdict itself was never stored, so there is nothing of it to delete. What the sign-in check keeps, and the note that the last check passed, sit in the same record as everything else our server holds about you, so a deletion request erases them together with your display name, your player id, your results and your messages.

If you never sign in with Play Games there is no sign-in code and no player ID for us to check, and your entry is simply signed automatically as before. The integrity verdict is about the app rather than about you, so it is sent whenever a result or a message is, signed in or not. As with everything else in this section, both checks are performed by Google under Google’s Privacy Policy; what reaches us is the answer, not the workings.

Feedback you write (Android app)

The game has two places where you can type a message to us in your own words, and both are entirely voluntary — they start empty and nothing is sent unless you write something and press send:

• “Something else” on the results screen — a short note about the level you just played, up to 300 characters.
• The envelope button in Settings — a message about the game as a whole, up to 1000 characters.

What you write is sent to our own server at api.planeflow.jevgenia.com — the same server in France described above — where it is stored, and it is also forwarded to the developer as a Telegram message so that someone actually reads it. Alongside the text we send the tag you picked, the level and mode it was about (for the results-screen note), and the app version, interface language and platform, so we can tell which build a problem came from. The note from the results screen is also counted in the anonymous analytics described below, if you consented to those; the message from Settings is not.

Please note that this is a free-text field: whatever you type is what we receive. Before it is stored, the game and the server both strip anything that looks like an email address and any long random-looking string (such as an id or a token) and replace it with [redacted] — so please don’t rely on that and don’t put personal details, your own or anyone else’s, into the message. We only want to know what you think about the game.

Your message is sent together with the same random player id described in the leaderboard section, so it is pseudonymous rather than anonymous: messages from one device are linked to each other, and to your leaderboard entry if you have one. Sending a message opens the same connection to our server that the leaderboard uses, so if you are signed in, your Play Games display name is stored on our server at that point too — even if you never post a score, and the same connection carries the two checks described in Checking that a result is really yours. Messages are kept for up to a year; your display name and player id stay until you ask us to delete them, whether or not you are on the leaderboard. All of it is erased together with everything else our server holds about you if you ask us to delete your data (see below). We do not use them for advertising and we never sell them.

App updates (Android app)

The Android app can update the game itself without going through the store. To do that it periodically asks our server at capgo.jevgenia.com whether a newer version exists. This is part of how the app works, so it happens whatever you choose on the analytics consent screen — but it is not analytics, and it carries nothing about how you play.

The check sends the app and content version it currently has, the app’s package name, your Android version, whether the build is a release build, and a random identifier generated by the update component (again: not your account, not a hardware or advertising id, and reset if you reinstall the app). This is the same server in France described above; it reads only the version in order to decide whether to offer an update, does not store the rest, and our web-server logs are configured not to record visitors’ IP addresses.

Analytics & diagnostics — Firebase (Android app, with your consent)

The Android app uses Google’s Firebase for anonymous analytics (Google Analytics for Firebase), crash reporting (Crashlytics) and performance monitoring (Performance Monitoring). This collection is off by default and starts only after you agree on the consent screen; if you decline, nothing is sent. The web version does not use Firebase.

When enabled, Firebase collects the anonymous gameplay events and technical context described above, crash and performance diagnostics, a Firebase installation identifier, and — for analytics attribution — your device’s advertising ID. This data is not linked to your identity, is used only to understand aggregate usage and fix problems, is not shared with third parties for their own purposes, and is never sold. It is processed by Google under Google’s Privacy Policy. You can stop it at any time with the “Share gameplay data” switch in Settings → GDPR, or by clearing the app’s data. No ads are shown in the game.

Separately, when you answer the consent screen — either way — or flip that switch, the app sends our own server one anonymous tally entry: whether the answer was yes or no, whether it came from the consent screen or from Settings, the platform, and the build number. It carries no identifier of any kind — no account, no device or advertising id, no cookie — and the server stores only a daily count, never a row about you. We do this because a refusal produces no analytics at all, so without counting the answers we cannot tell how much of our audience our numbers are missing. It is not linked to anything else we hold, and the count cannot be traced back to a person.

Email notifications — waitlist

On our sign-up page you can voluntarily give us your email address so we can let you know when PlaneFlow’s open test and full launch go live. This is entirely separate from the game itself: you never need an email address to play, and the game does not ask for one.

• Who runs the list — the notification list is operated by the PlaneFlow project (the game’s developer), reachable at planeflow@jevgenia.com.
• What we collect — only your email address, the time you signed up, which version of the consent text you agreed to, and — if present in the sign-up link — a utm campaign tag showing where you came from. We do not ask for your name or anything else. Alongside this, the form keeps a short-lived anti-spam counter (kept for about an hour, then deleted) tied to the IP address the request came from, so that one sender cannot flood the list; it is never used to identify you or linked to your address.
• Double opt-in — after you submit the form we email you a confirmation link; your address is only added to the active notification list once you click it. This keeps the list accurate and confirms it was really you.
• Why — solely to send you notifications about PlaneFlow’s testing phases and its launch. We do not use your address for any other purpose, and we never sell it or share it for anyone else’s marketing.
• How it is processed — the sign-up form runs on Cloudflare Workers (serverless code we wrote), with your entry stored in a Cloudflare D1 database restricted to Cloudflare’s EU jurisdiction, so this data is kept on servers in the EU. The confirmation and notification emails themselves are sent on our behalf by Brevo (Sendinblue SAS) purely as a transactional email relay (it does not host the waitlist), under its own privacy policy. The form is also protected by Cloudflare Turnstile, a cookieless bot check that briefly sees your IP address to confirm you’re not a bot — it does not track you.
• Removing your address — you can unsubscribe at any time by writing to planeflow@jevgenia.com; we will delete your address from the list on request.
• Retention — we keep your address only until you withdraw consent (unsubscribe or ask us to remove it) or until the PlaneFlow notification programme ends, whichever comes first — after which it is deleted. Sign-ups that never confirm are deleted automatically after a few days.

What we do NOT collect

• Inside the game: we never ask for your real name, email, phone number, or any data that identifies you personally, and there is no field for them (your Play Games gamer tag is a public alias you choose in Google Play Games — it is the same alias that signs your leaderboard entry, because the game has no nickname field of its own, and (no earlier than the next Android release) we also keep a record of which Play Games player an entry belongs to, as the sign-in check describes; neither is your real name, and we never receive one). The one place where you can type free text is the feedback field, and what ends up there is your choice — we strip email addresses out of it and ask you not to put personal details in. The only personal data we ever ask for is the email address you give us if you join the optional notification list described above.
• No precise location, contacts, photos, microphone or camera access.
• No ads are shown in the game, and we never sell your data to anyone.

Where the data goes

Your game progress and settings stay on your device, and the saved game itself is never uploaded to us — the only copy that leaves the device is the Play Games saved game described above, which goes to Google and only while you are signed in. Data that leaves your device is limited to: (1) the Google Play Games information above, including that saved game, only if you sign in; (2) in the Android app, a random player id, your Survival results, the two checks that the result is really yours and — if you are signed in — your Play Games display name, sent to our own server; (3) in the Android app, a message you choose to write us, sent to that same server and forwarded to the developer; (4) in the Android app, the version check our update server needs; (5) in the Android app, the Firebase analytics and diagnostics described above, only after you consent; and (6) the email address you submit to our notification list, only if you sign up (processed by Cloudflare and Brevo, as described above). On the web, analytics stay on your device. We use analytics only to improve the game and to understand aggregate, anonymous usage (for example, how many players complete the tutorial). We never sell your data.

Everything we store ourselves is stored in the European Union. That means both places where we — rather than a big platform — keep data: our own server in France (the Survival leaderboard), and the waitlist database, which runs on Cloudflare D1 restricted to Cloudflare’s EU jurisdiction. Neither leaves the EU.

Three things are not covered by that sentence, and we would rather say so plainly than imply otherwise: data you send to Google — Play Games sign-in data if you use it, and Firebase analytics if you consent to it — is handled by Google on its own infrastructure under Google’s Privacy Policy, which is not limited to the EU; the sign-in check is a request we make to Google, so it leaves the EU the same way; and confirmation emails are delivered through Brevo, as described above.

Children

PlaneFlow is suitable for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children.

Data retention & your control

Because the on-device data is stored on your device, you can erase all of it at any time by clearing the app’s data/storage or uninstalling the game. If you signed in with Google Play Games, your achievements, leaderboard scores, statistics and saved game live in Google Play Games — clearing the app’s data does not remove that copy; you manage or delete it through your Play Games settings. Resetting your progress inside the game erases the cloud copy as well, but does not lower the statistics already in your profile. There is still no PlaneFlow account with a password to close — but if you have posted to our Survival leaderboard, we do hold your display name, random player id, results and what the sign-in check keeps on our server, and you can have all of it deleted: see that section above, or write to planeflow@jevgenia.com. If you joined the email notification list, you can remove your address at any time — see Email notifications above.

Security

The game is served over HTTPS. Any data transmitted off your device — Google Play Games sign-in data, your leaderboard entry and version checks on our own servers, and the Firebase analytics/diagnostics above — is sent over encrypted connections. Scores are accepted only with a key the game holds for your own player id; results are additionally checked with Google — that a result signed with a Play Games name really comes from that player (no earlier than the next Android release), and that the app they came from is one Google recognises (from a later Android release) — so that results posted under someone else’s name can be told apart from real ones. Those are the checks described in Checking that a result is really yours. Playing without signing in stays possible: there is no sign-in to confirm, and such an entry is labelled automatically. What those checks leave on our server is kept only for the checks themselves: never published, never used for anything else, and gone when the rest of your data is.

Changes to this policy

If this policy changes, we will update the “Last updated” date above and, where required, the Google Play listing.

Contact

Questions about this policy: planeflow@jevgenia.com