Lanternfish Studios
DRAFT, not legal advice. Have a lawyer review this page, then remove every yellow TODO box before publishing. The policy must match the live app and the Google Play Data safety form (docs/PLAY_DATA_SAFETY.md in the repo).

Privacy Policy

Abyss Fishing · Lanternfish Studios
Effective date: October 17, 2026 · Last updated: October 17, 2026

This policy explains what information the mobile game Abyss Fishing (the "Game") collects, why, who it is shared with, and the choices you have. "We", "us" and "our" mean Lanternfish Studios.

The short version: your game progress is stored on your device. We don't ask for your name, email, phone number, location, contacts or photos. For friend features, a small game profile (username, avatar, stats, Fish Log, aquarium) is stored on our server and shown to your friends. Our ad partner (Google AdMob) and our purchase partners (Google Play, RevenueCat) process some device data to show rewarded ads and handle purchases.

1. Who we are

Abyss Fishing is published by Lanternfish Studios, the business name of Kelvin Cao, a sole proprietor in British Columbia, Canada, who is the data controller for the information described here. Contact details are in section 13.

If you offer the Game in the EU/UK without an establishment there, decide whether you need an EU/UK representative (GDPR Art. 27) and list it here.

2. What we collect

2.1 Game data stored on your device

Your progress (coins, gems, upgrades, catches and Fish Log, aquarium, settings, tutorial progress and similar) is saved in the Game's local storage on your device. It is not sent to us unless you use the online features below. It includes a random Player ID created on first launch. The Player ID is not linked to your name or any account; it is shown in Settings → Account & Help so support can find your purchases and save.

We don't currently back up your save to a server. If you uninstall the Game or clear its data, your progress is lost.

Update this section if cloud save, analytics or crash reporting (for example Firebase Crashlytics) are added. None are in the Game today.

2.2 Online profile and friend features

When the Game starts with an internet connection, it signs in to our friends service with an anonymous account for your device (no email or password), keeps a sign-in token on the device, and uploads your game profile so friends can find you. The server stores:

Today this happens for every player at launch (Friends.start() in main.ts), even if they never open FRIENDS. Consider connecting only once the player opens the FRIENDS tab: it collects less, and helps if the audience includes children. Update this paragraph to match.

Usernames are chosen in-game and should not be your real name.

Confirm this section once the friends backend is live (it is built but not switched on). Note that the server account is separate from the on-device Player ID.

2.3 Purchases

In-app purchases (gem packs, coin packs, the Starter Pack, the Captain's Pass and cosmetics) are processed by Google Play (and, on iPhone, by Apple). We never see or store your card or bank details. To deliver and restore purchases we use RevenueCat, which receives the store's purchase records (product, price, currency, date, transaction ID), an app user ID, and basic device information such as OS version and country.

Decide which ID is sent to RevenueCat as the app user ID (the Player ID is the natural choice, so support can look up purchases) and say so here.

2.4 Advertising

The Game offers optional rewarded ads (for example, watch an ad to refill your dive tanks). These are served by Google AdMob, which collects your device's advertising ID, IP address, device and app information, and how you interact with ads. See section 5 for your choices.

2.5 Support emails

If you email us, we receive your email address and whatever you write. The CONTACT SUPPORT button pre-fills your Player ID, the Game version and your device's browser/user-agent string so we can help; you can delete them before sending.

2.6 What we don't collect

We don't collect your real name, phone number, precise or approximate location (beyond what ad and hosting providers infer from IP address), contacts, photos, microphone or camera data.

3. How we use it

PurposeDataLegal basis (EU/UK)
Run the Game and keep your progressOn-device game dataContract (providing the Game you asked for)
Friend features, profiles, leaderboardsOnline profile, social activityContract
Deliver and restore purchases, prevent fraudPurchase records, app user IDContract; legal obligation (tax and accounting records)
Show rewarded adsAdvertising ID, device dataConsent for personalised ads; legitimate interests for non-personalised ads, frequency capping and fraud prevention
Moderation and safety (reports, blocks, abuse prevention)Reports, profile snapshots, IP addressLegitimate interests (keeping players safe)
Answer support requestsEmail, Player ID, device infoLegitimate interests; contract
Lawyer to confirm the legal bases, particularly for ads.

We don't sell your personal information, and we don't use it to make decisions that have legal or similarly significant effects on you.

4. Third parties

We share data only with service providers that help run the Game:

ProviderWhat forTheir policy
Google Play (Google LLC)App distribution, paymentspolicies.google.com/privacy
Google AdMob and the Google User Messaging PlatformRewarded ads, consent choicesHow Google uses data from partner apps
RevenueCat, Inc.Purchase validation and restorerevenuecat.com/privacy
Supabase, Inc.Hosting the friends service and its databasesupabase.com/privacy
Apple (iPhone version, when released)App distribution, paymentsapple.com/legal/privacy
If AdMob mediation adds other ad networks, list them here. Check each provider's policy link before publishing.

We may also disclose information if the law requires it, to protect players' safety, or as part of a sale or merger of the studio (in which case this policy would continue to apply).

5. Ads and your choices

Decide whether ads are personalised at all. If the audience includes children (section 10), ads to them must be non-personalised and from Families-certified networks only.

6. What other players can see

Through friend features:

7. How long we keep it

8. Deleting your data

You can delete your data without contacting us:

Request deletion by email. Email support@lanternfishstudios.com with the subject "Data deletion request" and include your Player ID and, if you use friends, your friend code (both in the Game). You don't need the Game installed to ask. We'll confirm and complete the request within 30 days. We delete your online profile and social data and any support emails, and ask RevenueCat to delete its records for your app user ID. We may keep purchase records where tax law requires, and moderation reports without your identity.

The on-device Player ID is not sent to the friends server today, so support can only find a server account by friend code. Either send the Player ID with the profile, or keep asking for the friend code.

9. Your rights

EEA, UK and Switzerland

You can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent at any time (for ads, through PRIVACY OPTIONS). You can complain to your local data protection authority.

California and other US states

Residents of California and other states with privacy laws can ask to know what personal information we collect, use and disclose, and to delete or correct it. We don't sell personal information for money. Personalised advertising through AdMob may count as "sharing" for cross-context behavioural advertising under California law; you can opt out through PRIVACY OPTIONS in the Game or by emailing us. We don't use sensitive personal information, and we won't treat you differently for using your rights.

Lawyer to confirm the CCPA/CPRA wording and whether a "Do Not Sell or Share" link and Global Privacy Control support are needed.

To use any of these rights, email us (see Contact) with your Player ID. We may need to confirm the request comes from the owner of the save or account before acting on it. We reply within one month (EU/UK) or 45 days (California).

10. Children

OPEN DECISION: the target audience (Google Play "Target audience and content" and Families policy, COPPA in the US, GDPR-K / the UK Age Appropriate Design Code). Pick one and replace this box with the matching text:

(A) Not for children (13+ / 16+ in parts of the EU): "The Game is not directed to children under 13 (or the minimum age in your country). We don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it." Still consider a neutral age gate before friend features and personalised ads, because the cartoon style may appeal to children.

(B) Mixed audience including children: needs an age screen; under-13 players get only non-personalised ads from Families-certified networks, no advertising ID, and friend features off or limited; and this section must describe it and parental rights under COPPA. Needs a lawyer.

11. Security and international transfers

Data sent between the Game and our servers is encrypted in transit. The friends database allows each player to change only their own profile, and lets players see only the profiles described in section 6. No system is perfectly secure, but we work to protect your information.

Our providers may process data in the United States and other countries. Where data leaves the EEA or UK, they rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

Fill in the Supabase project's region once chosen.

12. Changes to this policy

If we change this policy, we'll update the date at the top, and for significant changes we'll tell you in the Game before they take effect.

13. Contact

Lanternfish Studios
Email: support@lanternfishstudios.com
Kelvin Caostreet address goes here, Vancouver, British Columbia V5R 1M3, Canada