Privacy policy

Last updated: 5 October 2026 · ArrowFlow for iOS and Android

This policy explains how Flow Group AB (“we”, “us”) handles personal data when you play ArrowFlow, use its FlowGames online services or contact us. Flow Group AB, Sweden, is the data controller.

Data the game collects

ArrowFlow needs no account or login. The data below is linked to your player profile in the game, not to your real name.

• Identifiers. We create a player ID and an installation ID, and use authentication credentials and sessions to recognise your game installation and protect your save. On iOS, the game may also use Apple’s identifier for vendor (IDFV) for analytics. If you allow tracking, the game also sends Apple’s advertising identifier (IDFA) for install attribution (see Advertising and tracking); on Android, the Google Play install referrer, the App Set ID and a hashed device identifier serve the same purpose. If you allow notifications, we store your device’s push token so we can deliver them.
• Profile and progress. The display name you choose, your built-in avatar, your cloud save (levels, stars, islands, coins, boosters and rewards) and your level results keep your progress safe and in sync and power the Ranking. Your display name, avatar and level are shown to other players on the Ranking, and your country or region decides which country ranking you appear in. You do not need to use your real name.
• Gameplay and usage. We receive game events such as sessions, level starts, wins and losses, durations, booster use and reward claims, plus more detailed play data from a sample of levels. We use these to run and improve the game, tune level difficulty and verify progress.
• Purchases. Product IDs, transaction identifiers, signed transaction data or purchase receipts, price, currency, purchase status and delivery records. Our server verifies every purchase with Apple or Google before it delivers the items, and uses these records to restore eligible purchases and prevent duplicate or fraudulent claims. Apple or Google processes your payment; we never receive your payment-card number.
• Diagnostics. Crash reports, performance data such as frame and loading times (on iOS also Apple’s daily performance summary), and network and launch information help us find and fix problems.
• Approximate location. Our server derives your country or region from your IP address. We use it for fraud and cheat checks and for the country ranking. ArrowFlow never asks for or uses your precise (GPS) location.
• Device and context. Your device class (such as the kind of device and its operating-system version) and broad play-context groupings help us understand performance and adapt parts of the game, such as which in-game offers are shown.
• Security. Online requests expose your IP address to our service providers. Installation and session records, timestamps, gameplay evidence and risk signals help secure the service and investigate cheating and abuse.
• Support. If you email us, we receive your email address, message and any information or attachments you choose to provide. Please do not send passwords, payment-card details or identity documents.

We do not collect your contacts, photos, precise location, health data, browsing or search history, or payment-card details.

Advertising and tracking

Tracking permission and the advertising identifier (iPhone and iPad). When you first open ArrowFlow, before your first level, the game shows a short screen and then Apple’s App Tracking Transparency prompt. If you allow tracking, the game reads your device’s advertising identifier (IDFA) and sends it to our FlowGames servers (api.flowgames.yflow.io and attr.flowgames.yflow.io), linked to your player profile and installation ID. We use it only for install attribution: to measure which of our ads or partner apps brought you to the game, and how well that advertising works. Because this matches data about you from the ad or partner app that sent you with data from ArrowFlow, Apple calls it tracking. If you allow tracking, Google AdMob, the ad network in the game, may also use the IDFA to show you personalised ads (see Ads). If you do not allow tracking, the advertising identifier is never read or sent, and the game plays exactly the same. You can change your answer at any time in your device’s Settings → Privacy & Security → Tracking; once tracking is off, no new advertising identifier is sent. We do not sell your data.

Android. For install attribution our FlowGames servers do not receive Google’s advertising ID: they use the Google Play install referrer (which link or partner app led to the install) and, with your analytics consent, the App Set ID and a hashed device identifier. Google AdMob reads the Android advertising ID for ads (see Ads); you can reset or delete it in your device’s settings (Google → Ads, or Privacy → Ads).

Ads (Google AdMob). ArrowFlow shows ads from Google AdMob: rewarded videos that you choose to watch (for extra coins, a free life or to keep playing a level) and, from level 15, a short full-screen ad between some levels. Buying No Ads removes the ads between levels. To show and measure ads, limit how often you see them and prevent fraud, Google receives your IP address, your device’s advertising identifier (on iPhone and iPad only if you allow tracking; on Android the Google advertising ID), information about your device and the app, and how you interact with the ads. Google processes this data under its own privacy policy: How Google uses information from sites or apps that use its services.

Your ad choices. In the EEA, the UK and Switzerland, the game shows Google’s consent message before any ad loads; if you do not consent, Google shows only non-personalised (limited) ads. In US states with privacy laws, Google’s message lets you opt out of the sale or sharing of your data for ads. You can change your choices at any time in the game: Settings → Privacy opens your privacy choices wherever they apply.

Rewards are confirmed by our server. When you finish a rewarded video, Google confirms it directly to our server (the ad unit, the reward, a one-time code and your player ID), and our server then delivers the reward to your player profile. We do not receive your ad data from Google.

Notifications

The game asks for permission to send notifications right after you complete your first level, and it plays the same without them. If you allow them, we send reminders and game news, such as when your lives are full or a daily reward is ready. You can switch notifications off at any time in the game’s Settings or in your device’s settings.

Why we use data and who receives it

We use data to provide the game and its online features, keep your progress, fulfil purchases, send the notifications you allowed, answer support requests, measure and improve the game, measure which ads and partner apps bring new players (install attribution, with the advertising identifier only if you allow tracking), show ads through Google AdMob and deliver the rewards you watched videos for, and protect players and the service. Where the GDPR applies, we rely on performance of our agreement with you for the services you request, our legitimate interests in improving the game and preventing fraud and cheating, your consent where it is required (for example for notifications, for tracking with the advertising identifier and for personalised ads), and legal obligations where they apply.

Data is processed by our hosting and infrastructure providers (the FlowGames backend runs on Amazon Web Services), and by Apple and Google for app distribution, purchases and the delivery of push notifications. Google also receives the ad data described under Ads for Google AdMob. We may also disclose necessary information to comply with law, protect legal rights or complete a business transfer with appropriate protections. Some providers process data outside the EEA. Where required, transfers must use an adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for information about the safeguards relevant to your data.

Retention and security

We retain your player profile and save while needed to provide the game and recover your progress. Retention of usage, support, purchase and security records depends on their purpose, ongoing disputes, fraud investigations and applicable legal record-keeping duties. Uninstalling the app does not itself delete server-side records or necessarily remove credentials stored by your device; use Delete my data or email us for that.

We use measures such as HTTPS, access controls and protected authentication credentials. No storage or transmission system can be guaranteed completely secure.

Your choices and rights

Delete my data. In the game, open Settings → Delete my data and confirm. This erases your profile, progress, coins, boosters, gameplay data and identifiers on our server and resets the game on your device to a fresh start. It needs an internet connection and cannot be undone. Purchase and reward records that we must keep for bookkeeping are kept with the identifiers that link them to you removed.

You can choose a display name that does not identify you, and you can switch notifications off at any time. You can allow or refuse tracking in the prompt and change it at any time in your device’s Settings → Privacy & Security → Tracking.

Depending on where you live, you may request access, correction, deletion, a copy of your data, restriction of processing or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

You can also send requests to hello@pollflow.io with “ArrowFlow privacy request” and your Player ID (shown at the bottom of the game’s Settings) so we can locate your profile. We may ask for proportionate verification to protect your data. You can complain to your local supervisory authority, including Sweden’s Integritetsskyddsmyndigheten (IMY).

Children and updates

ArrowFlow is a general-audience game and is not directed at children under 13. If you believe a child has provided personal data without the permission required by local law, contact us so we can investigate and address it.

We may update this policy as the game or our practices change. The date above identifies the current version. Material changes will be communicated as required by applicable law.

About this page

This privacy page has no advertising, analytics scripts or cookies. Our hosting infrastructure still receives the technical information needed to deliver and secure the page.