Privacy Policy
Last updated: November 1, 2026
This policy explains what data is handled when you play games by Two Pebbles Games, including Galaxy Merge, or visit this website.
Two Pebbles Games is run by an individual independent developer, who is responsible for this data. Contact: [email protected].
The short version
- Our games have no accounts. We don't ask for your name or email.
- Your progress and settings are stored on your device.
- The game uses third-party services for ads, analytics, crash reports and purchases. They collect device identifiers and usage data, as described below.
- Where the law requires consent, the game asks first, and you can change your choice later.
Data handled by the services in our games
| Service | Why | Data |
|---|---|---|
| Google AdMob | Show ads, measure them, and prevent ad fraud | Advertising ID, IP address, device information, ad views and clicks |
| Google Firebase Analytics | Understand how the game is played so we can improve it | App instance ID, advertising ID where allowed, device information, approximate location from IP, game events (see below) |
| GameAnalytics | Game balance and retention statistics | Device identifiers, device information, game events (see below) |
| Firebase Crashlytics | Find and fix crashes | Crash logs, device model and OS version, installation ID |
| Firebase Remote Config | Adjust game settings without an app update | Firebase installation ID, app version, device information |
| Google Play Billing | Process in-app purchases | Purchase details. Google handles payment; we never see your card details |
Game events are: levels started, completed and failed, with score, stars, duration and attempt number; session count and days since install; ads shown, clicked and completed; the reason a level was failed (for example a full board or a time limit); and purchases, with product, price and currency.
These providers process data under their own policies: Google, Firebase, GameAnalytics. See also how Google uses data from apps that use its services.
Data stored on your device
Level progress, scores, hints, sound settings, whether you bought Remove Ads, and your privacy choices. This data is stored on your device and is deleted when you uninstall the game. If Android backup is turned on for your phone, Android may also copy app data to your Google account. That backup is controlled by Google and your phone settings, not by us.
Your choices
- Consent. In regions where consent is required, such as the EEA and UK, the game shows a consent form on first launch. Analytics and crash reporting stay off unless you allow them. Ads follow your choice and may be limited or non-personalized.
- Changing your mind. In those regions, use Privacy options under Settings in the game's main menu. You can also open this policy in the game with Settings > Privacy policy.
- Other regions. Where consent isn't required, these services run by default. Use the options below to limit them.
- Advertising ID. Reset or delete it in your Android settings under Privacy > Ads.
- Remove Ads. This optional purchase turns off banner and interstitial ads. Rewarded videos stay available if you choose to watch them.
Legal basis
Where the GDPR or similar laws apply, we rely on your consent for personalized ads, analytics and crash reporting, on our legitimate interests for keeping the game working and secure, and on performing our contract with you for purchases.
Keeping and deleting data
Analytics and crash data are kept for the retention periods set in each provider's service, then deleted or anonymized. Emails you send us are kept only as long as needed to help you.
To request deletion, see Delete my data or email [email protected]. We reply within 7 days and finish deletion within 30 days. Because the game has no accounts, we may not be able to link data to you without an identifier, and we'll tell you what we can do. Uninstalling the game deletes data stored on your device and stops further collection.
Your rights
Depending on where you live, you may have the right to access, correct, delete or move your data, to object to or restrict its use, and to withdraw consent. You may also complain to your local data protection authority. Email us to use these rights.
Sharing and transfers
Data is shared only with the service providers listed above, or where the law requires it. These providers may process data in other countries, including the United States, under their own safeguards. Data is sent over encrypted connections.
Security
Galaxy Merge has no servers of our own that receive your data. Game data goes from the app to the service providers listed above over encrypted (HTTPS) connections, and your progress is kept in the game's private storage on your device. Only the developer has access to our accounts with those providers. If we learn of a data breach that affects you, we will tell affected users and the authorities where the law requires it.
Children
Our games are not designed for or directed at children under 13, and we do not knowingly collect their data. If you believe a child has provided data, email us and we'll help remove it.
This website
By default this site sets no cookies and runs no analytics or ads. If you press Accept on the analytics banner, we use Google Analytics 4, provided by Google, to count visits and see which pages people read. Google Analytics sets cookies (named _ga and _ga_ followed by an identifier) and receives the pages you view, your browser and device details, and an approximate location that Google works out from your IP address; Google says it does not log or store IP addresses in Google Analytics 4. We turn off Google signals and ad personalization for it. Our legal basis is your consent.
The Google Analytics script does not load, and nothing is sent to Google, unless you accept. If you press Decline, or later change your mind with Analytics settings in the page footer, collection stops and we remove the _ga cookies. Analytics event data is kept for two months, then deleted. You can also use Google's browser opt-out add-on. Google's own explanation of how it uses data applies.
Our hosting provider, OVHcloud, and Cloudflare, which delivers and protects the site, process visitors' IP addresses, including in short-term server logs. If you email us, we receive your email address and message.
Changes
We'll update this page if our practices change and revise the date at the top.