ArrowZen Privacy Policy
Effective date: October 15, 2026
Last updated: October 15, 2026
1. Who we are
ArrowZen (the "App") is an offline arrow puzzle game for Android published by Tovabit, Derech Menahem Begin 7, Ramat Gan 5268102, Israel ("we", "us").
- Privacy contact: privacy@tovabit.com
- Support: support@tovabit.com
2. Summary
- No account. You do not sign up or log in.
- Progress stays on your device. Levels, settings and your Remove Ads status are stored locally only. We do not have servers that receive your game data.
- We do not collect personal data ourselves through the App.
- Ads are served by Google AdMob, which collects device and usage data, including your advertising ID and IP address, to show ads, measure them and prevent fraud.
- Consent: in the EEA, UK and Switzerland we ask for your consent for ads through Google's User Messaging Platform (UMP), and in certain US states we offer an opt-out of personalised ads. You can change your choice any time in Settings → Privacy options .
- Purchases of Remove Ads are handled by Google Play Billing.
- We do not sell your personal data for money. Under some US state laws, ad personalisation may count as "sharing" or "targeted advertising"; see section 9.
3. Data processed when you use the App
3.1 Data stored only on your device
Game progress, level completion, settings (sound, theme, etc.), your consent choices (stored by Google UMP on the device as IAB TCF and Google consent strings) and your Remove Ads entitlement are stored in the App's local storage on your device. This data is not sent to us.
3.2 Advertising – Google AdMob
The App displays banner, interstitial and rewarded ads using the Google Mobile Ads SDK (AdMob). Google, and where applicable its ad partners, collect and process the following data from your device when the App requests and displays ads:
| Data | Examples | Purpose |
|---|---|---|
| Device or other identifiers | Android advertising ID (AAID), app-set ID, other device identifiers | Ad delivery, frequency capping, measurement, personalisation (if permitted), fraud prevention |
| IP address and approximate location | IP address, coarse location derived from IP | Ad delivery, regional ad targeting and legal compliance, fraud prevention |
| Device information | Device model, OS version, language, screen size, network type | Ad delivery and formatting, fraud prevention |
| App interactions | Ad impressions, taps/clicks, video views, rewarded ad completion, app launches | Ad measurement, analytics, fraud prevention |
| Diagnostics | SDK crash logs, performance and error data | Maintaining and improving ad services |
Tovabit does not receive this data in identifiable form; we receive only aggregated reports (for example, total impressions and earnings) from Google.
Personalised vs. non-personalised ads. Depending on your consent choices and location, Google may show personalised ads (based on your interests inferred from your activity across apps and websites) or non-personalised / limited ads (based on context such as the App and your general location). Even non-personalised ads involve processing of identifiers and IP address for frequency capping, aggregated reporting and fraud prevention.
Google's own practices are described at https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy. The list of ad technology providers we have enabled is shown in the consent message ("Manage options" / "Vendors") .
3.3 In-app purchase – Google Play Billing
If you buy Remove Ads, the transaction is processed by Google Play Billing under Google's terms and privacy policy. Google handles your payment method and billing details; we never see them. The App receives a purchase confirmation/token from Google Play on your device so it can unlock the feature and restore it after reinstall .
Through the Google Play Console we may receive limited transaction records from Google, such as order number, date, product purchased, price and currency, and country/state for tax purposes . We use these only for accounting, tax, refunds and fraud prevention.
3.4 When you contact us
If you email us, we process your email address and the content of your message to respond. See the Tovabit Website Privacy Policy (https://tovabit.com/privacy) for details and retention.
4. Legal bases (EEA, UK and Switzerland – GDPR / UK GDPR / revFADP)
| Processing | Legal basis |
|---|---|
| Storing/accessing information on your device for ads (advertising ID, SDK storage) | Your consent, collected via Google UMP (ePrivacy Directive Art. 5(3), UK PECR reg. 6) |
| Personalised advertising and ad measurement | Your consent (GDPR Art. 6(1)(a)) |
| Non-personalised / limited ads, fraud prevention and security | Consent where device storage is involved; otherwise our and Google's legitimate interests in funding the free App and preventing fraud (Art. 6(1)(f)) |
| Remove Ads purchase and restore | Performance of a contract with you (Art. 6(1)(b)) |
| Accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Responding to emails and privacy requests | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
For personalised advertising, Google acts as an independent controller of the data it collects under the Google Ads Controller-Controller Data Protection Terms; to the extent Tovabit is a (joint) controller for the collection of data via the SDK in the App, we rely on your consent as described above .
EU / UK representative:
5. Your consent choices (Google UMP)
When you first open the App in the EEA, UK or Switzerland, a consent message from Google's User Messaging Platform appears. It is an IAB Transparency & Consent Framework (TCF v2.2) message from a Google-certified consent management platform. You can:
- Consent to all purposes and vendors;
- Manage options to choose purposes and vendors individually and object to processing based on legitimate interests; or
- Do not consent .
If you do not consent, the App may show limited or non-personalised ads, or no ads where ads cannot be served lawfully. You can change your choice at any time via Settings → Privacy options in the App .
In US states with privacy laws, a US state regulations message / "Do Not Sell or Share My Personal Information" option is available in the same Privacy options menu .
You can also, at any time:
- Reset or delete your advertising ID: Android Settings → Privacy (or Google) → Ads → Reset advertising ID / Delete advertising ID (wording varies by device);
- Uninstall the App to stop all collection by the App.
6. Who receives data
- Google LLC / Google Ireland Limited (AdMob, Google Play Billing, Google Play).
- Ad technology partners selected in the consent message (for EEA/UK users, only those you allow) .
- Service providers we use for email and accounting.
- Authorities where required by law.
We do not sell personal data for money.
7. International transfers
Google and its partners may process data in the United States and other countries. Google relies on the EU–US Data Privacy Framework and/or Standard Contractual Clauses. Tovabit is located in Israel, which benefits from an EU adequacy decision.
8. Retention
- Local data stays on your device until you clear App data or uninstall the App.
- Consent choices are stored on your device and re-requested when they expire or when the consent framework requires it (for example, at least every 13 months under the TCF) .
- Advertising data held by Google is retained according to Google's policies. Google states that it anonymises advertising data in server logs by removing part of the IP address after 9 months and cookie information after 18 months (see https://policies.google.com/technologies/ads) .
- Purchase/transaction records received from Google Play are kept for as long as required by tax and accounting law (in Israel, generally at least 7 years) .
- Emails are kept as described in the Tovabit Website Privacy Policy.
9. Notice for US residents (CCPA/CPRA and other US state privacy laws)
Categories of personal information collected in the last 12 months (through the Google Mobile Ads SDK, and for purchases through Google Play):
- Identifiers (advertising ID, IP address, device identifiers);
- Internet or other electronic network activity information (interactions with the App and ads, diagnostics);
- Geolocation data (approximate location derived from IP; not precise geolocation);
- Commercial information (record of Remove Ads purchase);
- Inferences drawn by Google for ad personalisation (where permitted).
We do not collect sensitive personal information as defined under California law.
Sources: your device, via the Google Mobile Ads SDK and Google Play.
Purposes: showing and measuring ads, fraud prevention and security, processing purchases, legal compliance.
"Sale", "sharing" and targeted advertising. We do not sell personal information for money. Allowing Google and ad partners to collect identifiers and network activity for personalised ads may be considered "sharing" for cross-context behavioural advertising or "targeted advertising" under some US state laws. You can opt out via Settings → Privacy options → Do Not Sell or Share My Personal Information , by resetting/deleting your advertising ID, or by enabling a Global Privacy Control signal where supported. We do not knowingly sell or share personal information of consumers under 16.
Your rights: depending on your state, you may have the right to know/access, delete, correct, obtain a portable copy, opt out of sale/sharing/targeted advertising and profiling, and not to be discriminated against for exercising your rights. Because we do not hold identifiable data about you, most requests will be fulfilled by explaining your device-level options and, where relevant, directing you to Google's tools. Submit requests to privacy@tovabit.com. You may use an authorised agent. If we deny your request, you may appeal by replying to our decision with the subject "Appeal"; we will respond within the period required by law.
Retention: see section 8.
10. Children
ArrowZen is intended for a general audience aged 13 and older and is not directed at children under 13 . We do not knowingly collect personal information from children under 13 (or under the applicable age of digital consent in the EEA/UK, which may be up to 16). We do not use features designed to attract children specifically . If you are a parent or guardian and believe your child has used the App in a way that resulted in data collection, contact privacy@tovabit.com; we will help you delete local data and request that Google delete associated advertising data, and we will review our ad settings (including child-directed treatment) as needed.
11. Israeli residents – Protection of Privacy Law, 5741-1981 (including Amendment 13)
Tovabit is an Israeli company and complies with the Protection of Privacy Law, 5741-1981 and its regulations, including Amendment No. 13 (in force since August 14, 2025), and the Protection of Privacy (Data Security) Regulations, 5777-2017.
- Notice (section 11). This policy is our notice of the purposes of processing, the recipients of data, and whether you are legally obliged to provide data. You are not under any legal obligation to provide personal data; providing it depends on your choice to use the App, and you can limit ad personalisation as described above. The consequence of not allowing ads data processing may be that the App shows limited or no ads; the App remains playable.
- Rights of access and correction (sections 13 and 14). You may request to review personal data about you held in a database of ours and request correction or deletion of data that is inaccurate, incomplete, unclear or outdated. Because the App does not send us identifiable data, in most cases we will hold no data about you beyond emails or purchase records. Send requests to privacy@tovabit.com.
- Database registration.
- Data protection officer.
- Complaints. You may contact the Privacy Protection Authority at https://www.gov.il/en/departments/the_privacy_protection_authority.
12. Your rights (EEA, UK, Switzerland and elsewhere)
Subject to applicable law, you have the right to: access; rectification; erasure; restriction; objection (including to processing based on legitimate interests and to direct marketing); data portability; withdraw consent at any time (via Privacy options in the App); and lodge a complaint with your data protection authority (EEA), the ICO (UK) or the FDPIC (Switzerland).
Because we do not hold identifiable data from the App, we may be unable to link a request to you. In that case we will explain how to use your device controls and Google's tools, and forward or support your request to Google where possible. See our Data Deletion page: https://tovabit.com/arrowzen/delete-data .
We respond within one month (GDPR), extendable where permitted, or within the period set by local law.
13. Security
The App does not transmit game data to us. Communications between the Google Mobile Ads SDK / Google Play and Google's servers are encrypted in transit (HTTPS/TLS). We protect our own records (emails, Play Console reports) with access controls and two-factor authentication .
14. Permissions used by the App
- INTERNET and ACCESS_NETWORK_STATE – to load ads and process purchases (the game itself works offline).
- com.google.android.gms.permission.AD_ID – to allow the AdMob SDK to access the advertising ID.
- com.android.vending.BILLING – for Google Play Billing.
15. Changes to this policy
We may update this policy, for example if we add new features or SDKs. We will post the updated version at this URL, update the "Last updated" date and, for material changes, notify you in the App where reasonably possible.
16. Contact
Tovabit
Derech Menahem Begin 7, Ramat Gan 5268102, Israel
Privacy: privacy@tovabit.com
Support: support@tovabit.com