Privacy Policy
Officina Frecce is a puzzle game that also works offline. It requires no account and never asks for your name, email or other contact details. This page explains which data the app, the web version and the community level catalogue process, who receives it, and what your rights are.
1. Data controller
Zenzeroot SRL, registered office in Seregno (MB), 20831, Italy — VAT IT14290290965.
Email: info@zenzeroot.it.
This policy covers the "Officina Frecce" app for Android and iOS, the version of the game played in the browser, and the website officinafrecce.zenzeroot.it.
2. Data stored on your device
The following stays only on your device and is never sent to Zenzeroot:
- your game progress (completed levels, stars, repaired automata) and settings;
- the year of birth the app asks for on first launch: it is used only to decide which kind of ads to show (section 6);
- the list of authors you chose to hide in the community catalogue.
"Start over" deletes your progress and year of birth; uninstalling the app or clearing its data from the phone settings deletes everything.
The level codes you can share (for example in links with ?l=) describe only the puzzle grid: they
contain no personal data.
3. Community level catalogue
In the app you can publish a level made with the editor and play levels published by others. The catalogue is a service run directly by Zenzeroot. There are no accounts and no text fields: a level is a code and a few numbers.
- What the service receives
- the code of the level you publish; the outcome of the levels you play (played, won) and any reports; a random device identifier, generated once by the app and not linked to your identity.
- What is stored
- the device identifier is not stored as is: the service keeps only a fingerprint of it (hash with a secret salt), from which the original identifier cannot be recovered. For each level it keeps the code, the publication date, the author's fingerprint and the play and win counters; for each outcome and each report, the level, the device fingerprint and the date.
- What others see
- the level, its counters and the author's fingerprint, which contains no personal data and is used only to hide all levels by the same author.
- IP address
- the service uses it only in memory to limit the number of requests per minute and does not store it. It does appear in the server's technical logs described in section 8.
- Purpose and legal basis
- providing the feature you chose to use (performance of a contract) and preventing abuse: at most 20 publications per device per day, one outcome and one report per level (legitimate interest).
- Reports
- any level can be reported; after three reports from different devices the level is no longer shown. "Hide this author" acts only on your device and sends nothing.
- Use for tracking
- none: the identifier is used solely to run the catalogue and is not shared with third parties.
4. Third-party services in the app
The Android and iOS app uses the services below. They receive technical data directly from the device; none of this data allows Zenzeroot to identify you by name.
Google AdMob — Google Ireland Ltd
- Purpose
- showing ads: optional videos you choose to watch in exchange for help (an extra heart, a hint) and, from the fourth day of play, one ad at the end of a level every four levels. With the "Remove ads" purchase the end-of-level ad no longer appears.
- Data
- the device's advertising identifier and other device identifiers, IP address (from which an approximate location is derived), ad interactions, diagnostic and performance data.
- Legal basis
- consent for personalised ads and for the use of identifiers where the law requires it (section 5); legitimate interest for non-personalised ads, fraud prevention and diagnostics.
- Policy
- policies.google.com/privacy · how Google uses data from partner apps
Google Analytics for Firebase — Google
- Purpose
- understanding how the game is played (levels started and completed, drop-offs, difficulty) in order to improve it.
- Data
- game events: start and end of a level with outcome, moves and duration; help used; ads watched; purchases made; opening of the Zenzeroot link; whether, based on the declared year, the user is under 16 (yes or no only, never the year). Also: app installation identifier, device model and operating system, country and approximate location derived from the IP address.
- Legal basis
- legitimate interest in improving the game.
- Policy
- policies.google.com/privacy
RevenueCat — RevenueCat, Inc.
- Purpose
- handling the "Remove ads" purchase, verifying it and restoring it on a new device.
- Data
- an anonymous identifier generated by RevenueCat, purchase history, technical device data. No payment data: that stays with Google Play and the App Store.
- Legal basis
- performance of a contract.
- Policy
- revenuecat.com/privacy
The "Discover Zenzeroot" link in the menu opens the zenzeroot.it website in your browser: from that point that website's privacy policy applies.
5. Consent to ads
Where the law requires it (European Economic Area, United Kingdom, Switzerland) the app shows Google's consent form before any ad (User Messaging Platform, compliant with IAB Europe's Transparency & Consent Framework). You can decline: the game remains fully playable and you will not see personalised ads.
On iOS, if you are at least 16, the system also asks whether to allow tracking (App Tracking Transparency). If you decline, ads are still shown but are not personalised.
To change your choice, clear the app's data from the phone settings (or reinstall it): the form appears again at the next launch. You can also reset or delete the advertising identifier from your device settings.
6. Age and minors
The app is intended for users aged 13 and over. On first launch it asks for the year of birth, which stays on the device. If the resulting age is under 16 (or the year is not available), the app tells AdMob that the user is under the age of consent: only non-personalised ads, no consent form and, on iOS, no tracking request.
7. In-app purchases
The only purchase available today is "Remove ads", a one-off purchase. Payment takes place on Google Play or the App Store under their terms: Zenzeroot does not receive your card details or your name. "Restore purchases" recovers it on a new device through RevenueCat.
8. Web version and website
The browser version of the game (officinafrecce.zenzeroot.it/gioca/) and the pages of this website use no ads, no analytics tools and no cookies. The game stores progress, settings and the random identifier for the community catalogue in the browser's local storage, and sends them to no one except the catalogue itself when you use it.
The website and the catalogue are hosted on a Zenzeroot server at Hetzner Online GmbH in Germany. Like any website, the server records technical logs (IP address, page or address requested, date and time, response status, browser type) for security and troubleshooting. The logs are analysed automatically by a protection system that blocks addresses from which attacks originate; addresses identified as a source of attacks may be reported to the CrowdSec security network. Legal basis: legitimate interest in the security of the service.
9. Retention
- Data on your device: until you delete it, use "Start over" or uninstall the app.
- Community catalogue: published levels, their counters, outcomes and reports are kept while the catalogue is active or until Zenzeroot removes the level, including at your request. Levels hidden after reports are no longer visible but remain archived until they are removed. If you clear the app's data or reinstall it, the device identifier changes and what you published can no longer be linked to your device.
- Server technical logs: rotated automatically by size and kept for a limited period, normally no longer than two months.
- Third-party services: according to the policies and retention settings of Google and RevenueCat.
10. Your rights
You can request access, rectification, erasure, restriction, objection and portability of data concerning you by writing to info@zenzeroot.it. Since there are no accounts, for the community catalogue please tell us the codes of the levels you published: we will remove them. For data collected by Google and RevenueCat you can also contact them directly. You can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (gpdp.it), or with the authority of your country of residence.
11. Where data is processed
The community catalogue, the website and the web version are hosted in the European Union (Germany). Google and RevenueCat may process data in the United States under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
12. Changes
If this policy changes, the updated version is published at this address with the new date at the top.
13. Contact
For privacy questions and support: info@zenzeroot.it.