INNsomnia – Privacy Policy

Last updated: 8 November 2026

This privacy policy covers the INNsomnia mobile game for iPhone and Android ("the game") and the game's website, innsomnia.app. It explains what data the game handles, who handles it and why, how long it is kept, and what your rights are. It follows the EU General Data Protection Regulation (GDPR) and Hungarian data protection law.

In short

• We never ask for your name, email address or phone number. The game does not ask for access to your location, camera, microphone, photos or contacts.
• The game creates a nameless account for your installation on our server. That is how we verify your purchases and give them back to you after a reinstall or on a new phone.
• You only see an ad when you ask for one, for a reward. The ads are provided by Google. Google asks for your consent to personalise them, and you can change your choice in the game's settings at any time.
• Your saved game is on your phone and in your own iCloud or Google account. We cannot access it.
• We do not sell your data.
• For questions or requests, write to: privacy@innsomnia.app. How to delete your data: section 8.

1. Who is responsible for your data?

The controller is Flexbox Kereskedelmi és Szolgáltató Korlátolt Felelősségű Társaság (Flexbox Kereskedelmi és Szolgáltató Kft.), a limited liability company registered in Hungary.

• Registered office: Nyári Pál utca 15., 2724 Újlengyel, Hungary
• Company registration number: 13-09-246718
• Tax number: 27284450-2-13
• Email: privacy@innsomnia.app
• Website: https://innsomnia.app

We have not appointed a data protection officer, as the law does not require one. You can reach us about any privacy matter at the email address above.

2. What data we process, why, on what legal basis and for how long

2.1 Your game account

When the game first connects to our server, it uses Google's Firebase service to create a nameless account.

• Data:

  • a random account ID;
  • a random ID for your installation, which the game also puts into your purchases so that they can be matched to your account;
  • when the account was created and last used;
  • whether you play on iPhone or Android, and whether you use the live or a test version of the game.

  When the game signs in, Firebase also processes your device's IP address and the request's technical identifier (user agent).

• Purpose: to match your purchases securely to your game, and to give them back to you after a reinstall or on another device. We use the IP address and user agent to prevent abuse.

• Legal basis: the account is needed to provide the game and the content you buy, that is, to perform our contract with you (Article 6(1)(b) GDPR). Preventing abuse is our legitimate interest (Article 6(1)(f)), as the service cannot be kept secure without it.

• Retention: for as long as we provide the game, or until you ask us to delete it (section 8). Firebase keeps logged IP addresses for a few weeks.

2.2 In-game purchases

Payments are handled by Apple (App Store) or Google (Google Play). We never see your payment details, such as your card number or billing address.

• Data:

  • the product you bought and when;
  • the store's identifiers for the purchase: on the App Store, the transaction ID and original transaction ID; on Google Play, the purchase token and order ID;
  • the purchase's status: valid, pending, refunded, revoked or test purchase;
  • the game accounts the purchase was sent from;
  • the add-ons that belong to your account.

  When a purchase changes (for example, it is refunded), the store notifies us. We keep these notifications too.

• Purpose: to check that a purchase is genuine; to credit it once; to give your add-ons back on all your devices and after a reinstall; to handle refunds; to prevent abuse.

• Legal basis: performance of a contract (Article 6(1)(b)). Preventing abuse is our legitimate interest (Article 6(1)(f)).

• Retention: for as long as we provide the game, since add-ons are yours for good.

2.3 Game Center and Google Play Games

If you are signed in to Game Center (iPhone) or Google Play Games (Android) on your phone, the game links your game account to it, so that the account follows you to another device.

• Game Center: Firebase's sign-in service receives and verifies your player IDs, your Game Center nickname and a signature from Apple. We store your player IDs and when the account was linked.
• Google Play Games: the game asks Google for a one-time code. Our server exchanges that code with Google for your player ID. We store your Play Games player ID, the name you use in Play Games, and when the account was linked. We do not ask for your email address.
• Purpose: so that your account and your purchases are there on another device too.
• Legal basis: performance of a contract (Article 6(1)(b)).
• Retention: together with your game account (section 2.1).

Your saved game in the cloud. The game also uploads your saved game to your own iCloud storage (Game Center) or Google account (Play Games). We cannot access it: Apple or Google stores it, under their own terms.

2.4 Ads (Google AdMob)

We only show an ad when you ask for one, for a reward such as an instant build. The ads are served by Google AdMob.

• Consent:
  • In the European Economic Area (EEA), the United Kingdom and Switzerland, before your first ad Google's form asks whether you agree that Google may store and read information on your device for ads, and personalise the ads.
  • On iPhone, Apple's prompt asking whether you allow tracking (App Tracking Transparency) may also appear. Google only receives your advertising identifier (IDFA) if you allow it there.
  • Each time the game starts, it asks Google for the state of your consent. If your choice allows it, the game loads one ad in advance, so that it can start straight away when you ask.
• Data, according to Google:
  • your IP address and the approximate location derived from it;
  • advertising and other device- or app-level identifiers;
  • the ads you have seen, and what you did with them (views, taps);
  • your device's model, operating system and language;
  • performance and crash data.
• Purpose: to show the ad you chose and credit your reward; to measure ads and prevent fraud; to personalise ads, if you consented.
• Who is responsible: Google is an independent controller of the data processed for ads; in the EEA, this is Google Ireland Limited. Details: https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites
• Legal basis: your consent (Article 6(1)(a) GDPR, and the ePrivacy rules; in Hungary, section 155(4) of Act C of 2003 on Electronic Communications). It is needed for Google to store and read information on your device, and to personalise ads. If you do not consent, Google may show non-personalised ads; Google's form and privacy policy explain the legal basis for that.
• Withdrawing consent: you can withdraw it at any time. This does not affect processing before you withdrew it.
  • In the game: Settings → Ads → Ad privacy choices. This card appears where Google asks for consent.
  • On iPhone, you can also turn tracking off in the phone's Settings → Privacy & Security → Tracking.
• Retention: under Google's own rules.

2.5 Data stored on your phone

The game stores on your phone:

• your hotel's saved game;
• your settings (language, walls);
• whether we have already asked you for a rating;
• a record of the add-ons you bought;
• your game account's ID and the token it signs in with;
• the IDs of any Google Play purchases not yet completed.

This data stays on your phone, with two exceptions: the copy of your saved game in the cloud (section 2.3), and the checks of your purchases (section 2.2).

• Legal basis: this data is strictly necessary for the game to work (performance of a contract, Article 6(1)(b)), so no consent is needed.
• Retention: until you delete it. Start over in the settings deletes your saved game, and deleting the game deletes everything it stored on your phone.

2.6 Server logs

Our server functions (Google Cloud Functions) and Google's infrastructure keep technical logs. These contain the time, the function called, the game account's ID, the purchase IDs, error messages and the request's IP address. We never log tokens, codes or passwords.

• Purpose: running the service, fixing errors, security.
• Legal basis: our legitimate interest (Article 6(1)(f)).
• Retention: 30 days.

2.7 Statistics and ratings

We have not built any analytics or crash reporting service of our own into the game.

• Apple and Google give us aggregated statistics, for example on downloads.
• We receive crash reports only if you allowed sharing with app developers in your phone's settings.
• The rating prompt is Apple's; we receive no data from it.

2.8 If you email us

If you email us, we use your email address and your message to answer you and handle your request.

• Legal basis: our legal obligation when you exercise your rights (Article 6(1)(c)); otherwise our legitimate interest (Article 6(1)(f)).
• Retention: 1 year after your request is closed.

2.9 This website

innsomnia.app uses no cookies, analytics, scripts or fonts from elsewhere. To serve it, Google (Firebase Hosting), as our processor, handles visitors' IP addresses to prevent abuse and to give us traffic statistics.

• Legal basis: our legitimate interest (Article 6(1)(f)), as the site cannot be served securely without it.
• Retention: a few months, according to Google.

3. Who receives your data?

• Google (Firebase and Google Cloud): holds the game accounts and the purchase records, runs our server functions, keeps their logs, and serves this website. Google acts as our processor, on our instructions, under Google Cloud's and Firebase's data processing terms.
• Google (AdMob): provides the ads, as an independent controller (section 2.4).
• Apple (App Store, Game Center, iCloud) and Google (Google Play, Google Play Games): handle purchases, sign-in and cloud saves. Each is an independent controller for its own services. Their privacy policies: https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy
• Authorities, where the law requires it.

We do not sell your data, and we do not pass it to anyone for their own advertising or marketing. We only work with partners whose contracts and privacy rules give your data at least the protection described in this policy.

4. Transfers outside the EEA

• The database of game accounts and purchases, and our server functions, run in the European Union, in Belgium.
• According to Google, Firebase's sign-in service processes data in the United States.
• This website is served by Google's worldwide network.
• Apple and Google, including Google's ad service, may also transfer data outside the EEA, mainly to the US.

These transfers rely on the EU–U.S. Data Privacy Framework, which Google LLC and Apple Inc. have both joined, and on the standard contractual clauses adopted by the European Commission.

5. How we protect your data

• All data between the game and the servers travels over an encrypted connection (HTTPS), and the database stores it encrypted.
• Nobody can reach the database directly from the game; only our server functions can.
• We verify purchases by Apple's signature or Google Play's confirmation.
• We keep the server's secret keys in a separate, protected store. We never log tokens, codes or passwords.
• We only process the data the purposes above need, and only the developer has access to it.

6. Children

The game's content suits all ages, but the service is not directed at children under 13, and we do not knowingly collect personal data from them.

In the EEA, consent to personalised ads (section 2.4) for anyone under 16 must come from a parent. If you are under 16, decline in Google's form, or ask a parent to decide for you.

If we learn that we have processed data from a child under 13, we delete it. As a parent, you can tell us at the email address above.

7. Your rights

You can ask us to:

• tell you what data of yours we process, and give you a copy;
• correct inaccurate data;
• delete your data (section 8);
• restrict processing;
• give you the data we process under our contract in a machine-readable format.

You can also object to processing based on our legitimate interests. You can withdraw your consent at any time (section 2.4).

Send your request to privacy@innsomnia.app. We answer within one month. We may extend this by two months where necessary, and will tell you if we do.

Since we do not know your name, please tell us how we can find your game:

• your Game Center or Play Games name;
• the order ID of a Google Play purchase (it starts with GPA, and is in the confirmation email);
• or the date and product of a purchase.

If we still cannot identify your data, we will tell you. In that case we can only fulfil your request if you can identify yourself with other information (Article 11 GDPR).

If you think we have infringed your rights, please write to us first; we may be able to sort it out quickly. You can complain to the Hungarian National Authority for Data Protection and Freedom of Information:

• NAIH, Falk Miksa utca 9–11, 1055 Budapest, Hungary
• Postal address: 1363 Budapest, Pf. 9., Hungary
• Phone: +36 1 391 1400
• Email: ugyfelszolgalat@naih.hu
• Website: https://naih.hu

You can also complain to the data protection authority of the EEA country where you live, and you can go to court.

8. Deleting your data

On your phone and in the cloud

• Settings → Saved game → Start over deletes your saved game from your phone and from the cloud (iCloud or Google Play Games).
• Deleting the game deletes everything it stored on your phone, but not the cloud save. You can delete that with Start over, or in Apple's or Google's settings.

On our server

• Email privacy@innsomnia.app with the subject "Delete my data", and tell us how we can find your game (section 7).
• Within 30 days at most, we delete your game account, its Game Center and Play Games links and its record of add-ons, and confirm it to you.
• We remove your account ID from our purchase records. We keep the purchase itself (the product, the time, the status and the store's ID) for 5 years to handle refunds and prevent abuse.
• You can still get your add-ons back later with the Restore purchases button in the Shop, because the store keeps a record of them.

Ads

• In the game: Settings → Ads → Ad privacy choices. On iPhone, you can also use the phone's Tracking setting.
• About the data Google keeps: https://policies.google.com/privacy

Game Center, Google Play Games

• You can manage and delete these accounts in Apple's or Google's settings.

9. Changes to this policy

If the way the game handles data changes, we update this policy and the date at its top. We also tell you about significant changes in the game.

This policy is also available in Hungarian. If the two differ, the Hungarian version prevails.