Privacy Policy — BREWLORE
Last updated: October 4, 2026
This policy explains how the game BREWLORE (the "Game"), published by VS3 Digital Ltda. ("VS3 Digital", "we"), handles personal data. It applies to the Game on Android (package com.brewlore.game) and, once released, on iOS.
Summary:
- We do not ask for your name, email, login or registration. The Game has no accounts.
- Your progress is stored only on your device.
- We use Google services (Firebase) to understand how the Game is used and to fix crashes, using app identifiers — not your name.
- The Game shows ads from Google AdMob. All ads are non-personalized (they do not use a profile of you) and suitable for all ages, for everyone, in every country.
- In-game purchases are made through the store (Google Play). We do not receive payment details.
- We do not sell your data.
1. Who is the controller
VS3 Digital Ltda., Brazilian company registration (CNPJ) 22.140.212/0001-07, Avenida Deputado Jamel Cecílio, 2929, Quadra B27, Sala 1810, Jardim Goiás, Goiânia – GO, 74810-100, Brazil (https://vs3.com.br).
Contact for privacy matters and to exercise your rights: contato@vs3.com.br.
Data protection officer (Brazilian LGPD): VS3 Digital is a small-scale processing agent and, under ANPD Resolution No. 2/2022, handles data subject requests through the contact above.
2. What data we process
2.1 Data that stays on your device
Level progress, stars, coins, boosters, workshop upgrades, daily reward, delivered purchases, language and settings (sound, vibration, animations, privacy choices). This data is not sent to us. It is deleted when you uninstall the Game or clear the app's data. If Android backup is enabled on your device, Android itself may copy it to your Google account, according to your device settings.
2.2 Usage and diagnostic data (collected automatically)
When the device is connected to the internet, the Game sends to Google Firebase:
- Game events: session start and end, level start and result (level, attempt, moves, stars, reason for losing), booster use, tutorial steps, workshop upgrades, daily reward and chests, ad offers and impressions, estimated ad revenue, purchases, Game language and a random session identifier.
- Automatic Firebase events: first open, sessions, engagement time, app or OS updates.
- App identifiers: app instance ID and Firebase installation ID. They identify the installation of the Game, not you by name.
- Device data: model, manufacturer, OS version, language, time zone, Game version.
- Approximate location (country, region or city), estimated from the IP address. We do not use GPS or precise location.
- Install source (for example, whether it came from the store page or a campaign), provided by Google Play.
- Crash reports: when the Game closes because of an error or records a technical error, technical details of the error and of the device state (memory, free space, screen orientation) and the latest usage events are sent. We never include personal data in these messages.
- Remote configuration: the Game periodically checks Firebase Remote Config for adjustments (for example, ad frequency).
Firebase does not use the device's advertising ID for analytics: advertising storage is always turned off in Firebase.
In the European Economic Area, the United Kingdom and Switzerland, usage events are only sent to Firebase after you consent in the privacy form (section 2.4). Without consent, they stay off.
2.3 Downloaded content
The Game may download new levels, recipes, texts and images from our content server (content.vs3.com.br, operated by Cloudflare). These requests carry no identifier of ours; like any website, the server receives the IP address, technical request data (such as the user agent) and the time, used to deliver the file, protect the service and produce aggregated statistics.
2.4 Ads
The Game shows ads through Google AdMob. To show, measure and protect ads against fraud, Google receives: the device's advertising ID, the IP address (used to estimate approximate location), device data, app performance data and ad interactions (impression, click, completed rewarded ad).
- All ads in the Game are non-personalized, in every country: they are not chosen based on a profile of you or your interests. All of them request content suitable for all ages.
- In the EEA, the United Kingdom and Switzerland, the Game shows Google's consent form at launch when the law requires it. You can change your choice at any time in Settings → Privacy → Privacy options (this option appears when the form applies to you).
- You can reset or delete the advertising ID in your Android settings (Google → Ads).
- Rewarded ads are always optional.
2.5 Purchases
Purchases are made through Google Play (and, on iOS, the App Store). We do not receive or store card or payment data. We receive the purchase confirmation from the store (product, order ID, receipt/token, price and currency) to deliver the item, restore purchases that can be restored (such as "Remove ads") and prevent duplicate charges or deliveries. We also record purchase events in Firebase for analytics. The Game uses the Unity IAP library, from Unity Technologies, to communicate with the store. When you tap to buy, when a purchase completes and when it fails, this library sends Unity technical transaction data (product, title and description, price, currency, transaction ID and the Google Play receipt, which includes the order number and the purchase token), device data (model, Android version, language, storage space), the install date and the versions of the Game and the library. Unity acts as a service provider for purchases. The advertising ID is not sent to Unity.
2.6 Age signal from the store
In some countries (such as Brazil), Google Play may tell the Game the user's age range (for example, "13 to 15"), when you allow it in a request shown by Google Play itself. The Game uses this information only to apply age-appropriate protections. It is not stored, not sent to us, to analytics or to ads, and is never used for advertising or profiling. If you decline or the store does not provide it, the Game works normally.
2.7 What we do not collect
Name, email, phone number, address, photos, contacts, files, microphone, camera, precise location, list of installed apps, messages or typed text. The Game has no chat, no accounts and no interaction between players.
3. Why we use data and on what legal basis
| Purpose | Data | Legal basis (LGPD, Brazil) | Legal basis (GDPR) |
|---|---|---|---|
| Run the Game, deliver new content and keep settings | Device data, IP (remote content), remote configuration | Performance of contract (art. 7, V) and legitimate interest (art. 7, IX) | Art. 6(1)(b) and (f) |
| Fix crashes and keep the Game stable | Crash reports, device data, app identifiers | Legitimate interest (art. 7, IX) | Art. 6(1)(f) |
| Understand usage and improve the Game (level difficulty, tutorial, retention) and test setting variations | Usage events, app identifiers, approximate location, install source | Legitimate interest (art. 7, IX) | Consent, art. 6(1)(a) (and ePrivacy Directive, art. 5(3)) |
| Show non-personalized ads, measure delivery and prevent fraud | Advertising ID, IP, device data, ad interactions | Legitimate interest (art. 7, IX) | According to your choice in the consent form (art. 6(1)(a)) and legitimate interest for fraud prevention (art. 6(1)(f)) |
| Process purchases, deliver and restore items | Purchase confirmation | Performance of contract (art. 7, V) | Art. 6(1)(b) |
| Operation and diagnostics of the purchase library (Unity IAP) | Technical transaction data, store receipt and device data (section 2.5) | Performance of contract (art. 7, V) and legitimate interest (art. 7, IX) | Art. 6(1)(b) and (f) |
| Apply age-appropriate protections | Age range provided by the store (on the device only, not stored) | Legal obligation (art. 7, II) and best interests of children and adolescents (art. 14) | Art. 6(1)(c) |
| Comply with legal obligations and defend rights | Whatever is necessary | Art. 7, II and VI | Art. 6(1)(c) and (f) |
We do not make automated decisions that produce legal effects on you and we do not profile users for advertising.
4. How long we keep data
- Data on the device: until you uninstall the Game or clear the app's data.
- Usage events (Firebase Analytics): data at the app identifier level for up to 14 months; after that, only aggregated reports that do not identify the installation.
- Crash reports (Crashlytics): up to 90 days; Firebase identifiers and remote configuration: for the periods set by Firebase (https://firebase.google.com/support/privacy).
- Purchase library data (Unity): service logs for up to 90 days; order records until deletion, according to Unity (https://docs.unity.com/en-us/iap/privacy-and-consent/overview).
- Ads (AdMob): for the periods set by Google (https://policies.google.com/technologies/retention).
- Content server logs (Cloudflare): for as long as needed to run and protect the service, according to Cloudflare's policy.
- Purchases: records are kept by the store; those we receive, for the period required by law (for example, tax and consumer protection).
5. Who we share data with
We do not sell personal data. Data only goes to:
| Company | Role | Purpose | Policy |
|---|---|---|---|
| Google LLC / Google Ireland Ltd. (Firebase Analytics, Crashlytics, Remote Config) | Processor (on our behalf) | Usage analytics, crashes, remote configuration | https://policies.google.com/privacy · https://firebase.google.com/support/privacy |
| Google LLC / Google Ireland Ltd. (AdMob) | Ad network (also a controller of data it uses for its own purposes, such as fraud prevention) | Ads | https://policies.google.com/privacy · https://policies.google.com/technologies/partner-sites |
| Cloudflare, Inc. | Processor | Delivery of downloaded content | https://www.cloudflare.com/privacypolicy/ |
| Google Play | Store (independent controller) | Game distribution, payments and age signal | https://policies.google.com/privacy |
| Unity Technologies (Unity IAP) | Processor (purchase service provider) | Communication with the store during purchases and service diagnostics | https://unity.com/legal/privacy-policy · https://unity.com/legal/game-player-and-app-user-privacy-policy |
We may also share data when required by law or by order of a competent authority, or in a corporate reorganization (with the same protection as this policy).
6. International transfers
The providers above process data on servers outside Brazil (mainly in the United States) and, for users in Europe, outside the European Economic Area. These transfers rely on the safeguards provided by law, such as standard contractual clauses and the providers' contractual data protection commitments (LGPD, art. 33; GDPR, chapter V).
7. Your rights
Under the LGPD (art. 18) and, if you are in Europe, the GDPR (arts. 15 to 22), you may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion; portability; information about sharing; withdrawal of consent; and objection to processing based on legitimate interest. You may also complain to the Brazilian ANPD (https://www.gov.br/anpd) or to the data protection authority of your country.
How to exercise them:
- On your device, right away: uninstalling the Game or clearing the app's data deletes all local data and creates new app identifiers the next time the Game opens. Where the consent form applies, you change your choice in Settings → Privacy → Privacy options. The advertising ID can be reset or deleted in your Android settings.
- By email: write to contato@vs3.com.br. Since the Game has no accounts and does not ask for your name, we usually cannot link a request to a person; if needed, we will ask for technical information that helps locate the data of an installation. We reply within 15 days (LGPD) or 1 month (GDPR).
8. Children and teenagers
The Game is intended for players aged 13 and over and is not directed at children. In Brazil, the Game's age rating is 14 (ClassInd), because of in-game purchases.
Since the Game may be used by teenagers, it was built with protective settings for everyone, by default:
- all ads are non-personalized and suitable for all ages; we do not profile users for advertising;
- there is no chat, no accounts, no interaction between players and no collection of name, email or precise location;
- nothing with random content is sold (chests with a randomly drawn prize are earned by playing and cannot be purchased);
- the age range provided by the store is used only for protection (section 2.6).
Purchases require the Google Play account; parents and guardians can require purchase approval through Google Play's parental controls (Family Link). We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has provided us with data, contact contato@vs3.com.br and we will delete it.
9. Security
Data sent by the Game is encrypted in transit (HTTPS/TLS). Downloaded content is checked by a cryptographic hash (SHA-256) before use. Data is stored in the systems of the providers above, with their security measures. No system is 100% secure; if an incident may cause relevant risk, we will notify the ANPD and the data subjects as required by law.
10. Changes to this policy
We may update this policy when the Game changes (for example, with new services). The date at the top shows the latest version. Relevant changes will be announced in the Game or on the store page; where the law requires, we will ask for consent again.
11. Contact
VS3 Digital Ltda. — CNPJ 22.140.212/0001-07 — contato@vs3.com.br — Avenida Deputado Jamel Cecílio, 2929, Quadra B27, Sala 1810, Jardim Goiás, Goiânia – GO, 74810-100, Brazil — https://vs3.com.br
Portuguese version: https://vs3.com.br/brewlore/privacidade. In case of discrepancy between versions, the Portuguese version prevails for users in Brazil.