Your information

Privacy policy

Effective 26 September 2026 · Twinwinch public release

Webam Games operates Twinwinch and these account pages. Contact us about privacy or data rights at play@webamgames.com.

What we process

• Google sign-in: Firebase Authentication processes your Google account identifier, email, display name and available profile image information. We do not receive your Google password.
• Cloud game data: progress, results, badges, inventory, equipped items, virtual balances, lives and timers, active missions and operation identifiers. These support saving, recovery and prevention of duplicate rewards.
• Google Play Games: the game reads your Play Games player identifier and available player name. We link the player identifier to your cloud career to publish eligible mission records and their career total to Google Play leaderboards. Rankings may show your Play Games profile and scores to other players according to your Google Play Games settings. Short-lived authorization codes and access tokens are processed only for the synchronization request; we do not store them or request a refresh token.
• Device-local data: offline campaign, controls and audio preferences, cached cloud data and pending actions. The game may record local diagnostic session information. Manually shared feedback or backups contain the information you choose to provide.
• Service diagnostics: Google infrastructure processes technical request information, including IP addresses, times and response codes, to operate and protect authentication, hosting and the API. We do not intentionally log authentication tokens or full game saves.
• Support: when you email us, we receive your email address and the contents you send.

Optional Google Play purchases

You can choose to buy special-credit packs through Google Play. Google Play processes the payment flow; we do not receive card details. We send purchase tokens, product identifiers and an account hash to the Google Play Developer API to verify ownership and payment state. A private receipt prevents duplicate credits. Raw purchase tokens are retained only until consumption succeeds, then removed. Receipt hashes, credited amounts and refund adjustments remain with the account until deletion. Refunded credits are removed; if already spent, the remaining adjustment is applied to future credit packs. Pending payments do not grant credits. Store prices and payment terms are shown by Google Play before you confirm. Special credits have no cash value and are not transferable.

Optional rewarded advertising

You can choose an AdMob rewarded ad for an extra life, a normal-credit bonus after a verified delivery, or one robot/cargo rescue per assisted attempt. Rescue checkpoints retain elapsed time, collected cache IDs and completed-delivery measurements. Assisted attempts do not enter official rankings. Google Mobile Ads and its User Messaging Platform process device and advertising identifiers, IP-derived approximate location, ad interactions, diagnostics and privacy choices. Twinwinch does not request precise location permission. Where required, the Google consent form appears before ad requests; you can manage or withdraw your choices through Settings / Privacy & data / Advertising privacy choices. Refusing personalized advertising does not prevent gameplay.

Reward verification sends a cloud account identifier and a single-use ticket to Google. Google signs a callback to our server; we retain the transaction receipt to prevent duplicate rewards. Only a verified callback grants a reward. Lives have a maximum of five; delivery bonuses use the verified base-credit amount and are granted at most once per delivery. Scores and special credits are unchanged. Ad duration is controlled by Google, and watching is optional. Enrolled test and review accounts receive test ads. Ad availability and duration depend on the provider. See Google's Privacy Policy and AdMob privacy information.

Why we use it

We process account and gameplay data to provide the cloud features you request; security and operational information to protect the service and investigate faults; and support correspondence to answer your request. Where applicable, these purposes rely on providing the requested service and legitimate interests in security and reliability. We will request consent where a feature requires it.

Providers and sharing

Google Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Scheduler and Firebase Hosting provide authentication, storage, processing and hosting. The game database and API are configured in europe-west1; authentication and supporting infrastructure may process data in other locations under Google's terms and safeguards. See Firebase privacy information. We do not sell account or gameplay records. Advertising providers may process or share advertising identifiers, approximate location, interactions and diagnostics for ad delivery, measurement and fraud prevention, according to your applicable privacy choices and their policies.

From version 0.8.4, eligible production cloud records synchronize to Google Play Games leaderboards. Google Play Games handles the gaming profile and platform rankings under the Google Privacy Policy. Optional purchases and rewarded ads are enabled in the public release. The app does not include a separate automatic Firebase Analytics or Crashlytics integration. Google SDKs may collect their own interaction, crash, launch, hang, energy-use and device diagnostics as described above. Google Play independently handles installation and store-related information under its own terms.

Optional public showcase

From version 0.8.6, the in-game rankings browser displays scores and player names returned by Google Play Games. You can separately choose to share your Twinwinch robot appearance, earned badges, titles, permanent collection, campaign completion and mastery level with other signed-in players. This showcase is hidden by default and can be hidden again from Profile > Public showcase. We do not include your email, credit balances, lives or purchase history. Other players may retain screenshots they take; hiding the showcase prevents future requests from retrieving it. Account deletion immediately makes the showcase unavailable and removes its visibility setting during cleanup. This setting does not change your Google Play Games profile or leaderboard visibility.

Retention and deletion

Cloud account data is kept while your account exists. An accepted deletion request immediately blocks further cloud operations. A background process normally removes the live account tree, game and reward receipts and Firebase identity within 15 minutes; temporary service failures are retried. Contact support if deletion appears delayed.

A completion record containing a hashed account identifier, environment and dates is retained for 30 days to prevent delayed operations from recreating a deleted account, then removed automatically. Pending requests remain until resolved. Operational logs currently have a 30-day retention period; mandatory Google Cloud audit logs have a 400-day retention period. These logs are not used to restore a deleted game account. Firestore may retain internal historical document versions for up to one hour; point-in-time recovery is disabled. Support correspondence is retained as needed to resolve your request and any applicable legal obligations; contact us to request its removal.

Deleting your Twinwinch cloud account also removes our private Play Games account link. It does not delete your Google account, Play Games profile or scores already held by Google Play Games. Manage or delete that platform data through Google Play Games account and game-data controls.

Independent local campaigns and copies you exported are not removed remotely. Erase the local campaign from the game's Privacy & data screen, clear Android app storage or remove exported files yourself. Cached account data on other devices can remain while they are offline; it is cleared when the app detects the account deletion online. Development and production accounts are separate; you can request deletion from both.

Your choices and rights

You can play local/practice modes without a cloud account, sign out, or request account deletion. Depending on your location, you may request access, correction, deletion, restriction or portability of your information, object to processing based on legitimate interests, and contact your data protection authority. Send requests to play@webamgames.com; we may verify identity to protect your account.

Website storage

The deletion page uses Google verification and holds the application sign-in session in memory for this page. Google sign-in may use its own cookies or storage. These pages do not add advertising or analytics trackers.

Audience and changes

Twinwinch is designed for teenagers and adults, not for children under 13. Contact us if you believe a child has provided account information. We will update this policy when data practices or enabled services change, with the effective date shown above.