Privacy policy
This policy explains how Flow Group AB (“we”, “us”) handles personal data when you play LanternFlow: Mahjong Solitaire (“LanternFlow”), use its FlowGames online services or contact us. Flow Group AB, Sweden, is the data controller.
Email hello@pollflow.io. You can ask about your data, request a copy, or request deletion. You can also delete your data yourself in the game: Settings → Delete my data.
Data the game collects
LanternFlow needs no account or login. The data below is linked to your player profile in the game, not to your real name.
- Identifiers. We create a player ID and an installation ID, and use authentication credentials and sessions to recognise your game installation and protect your save. With your analytics consent, the game also uses Apple’s identifier for vendor (IDFV) on iPhone and iPad, and the App Set ID and a hashed device identifier on Android. LanternFlow never reads your device’s advertising identifier (IDFA or the Google advertising ID).
- Profile and progress. The name and built-in avatar you may choose, and your cloud save (levels, records, stars, islands, coins, helpers, collection, settings and the record of your purchases), keep your progress safe so it can be restored, for example after you reinstall the game. Your name and avatar are not shown to other players. You do not need to use your real name.
- Game statistics. With your consent where consent is required (see Analytics), we receive game events such as sessions, level starts, wins and losses, durations, helper use, coins earned and spent, and the daily challenge. We use these to improve the game and tune level difficulty. Some of these events also go to Google Analytics for Firebase.
- Level records. When you clear a level of the journey, the game sends a short record of it (the level, when and how long you played it, the helpers you used and an app-integrity check) so our server can verify your progress. It is sent whatever your statistics choice, because verified progress is part of the game’s online service and of the rewards partner apps pay (see Partner apps and rewards).
- Purchases. Product IDs, transaction identifiers, signed transaction data or purchase receipts, price, currency, purchase status and delivery records. Our server verifies every purchase with Apple or Google before it delivers the items, and uses these records to restore eligible purchases and prevent duplicate or fraudulent claims. Apple or Google processes your payment; we never receive your payment-card number.
- Diagnostics. Crash reports, performance data such as frame and loading times (on iOS also Apple’s daily performance summary), and network and launch information help us find and fix problems.
- Approximate location. Our server derives your country or region from your IP address. We use it for fraud and cheat checks. LanternFlow never asks for or uses your precise (GPS) location.
- Device and context. Your device class (such as the kind of device and its operating-system version) and your language help us understand performance and show the game in the right language.
- Security. Online requests expose your IP address to our service providers. Installation and session records, timestamps, gameplay evidence, app-integrity checks from Apple (App Attest) and Google (Play Integrity) and risk signals help secure the service and investigate cheating and abuse.
- Support. If you email us, we receive your email address, message and any information or attachments you choose to provide. Please do not send passwords, payment-card details or identity documents.
We do not collect your contacts, photos, precise location, health data, browsing or search history, or payment-card details.
Partner apps and rewards
You may have found LanternFlow in a partner app that rewards you for playing, such as Rewly. When you open LanternFlow from such an app, the app’s link tells our FlowGames servers which partner sent you (on Android, the Google Play install referrer does the same). When you then reach a level milestone, our server confirms it from the level records (see Data the game collects), and we tell the partner app which milestones you reached, linked only to the partner’s own reference for you, so it can pay your reward. The partner app handles your reward under its own privacy policy. If you did not come from a partner app, nothing is shared with one.
Ads and tracking
LanternFlow shows no ads from ad networks and does not track you across other companies’ apps or websites: it never asks for Apple’s tracking permission and never reads your device’s advertising identifier. We do not sell your data. If we add ads, we will update this policy before they appear.
Analytics (Google Analytics for Firebase)
We use Google Analytics for Firebase, a Google service, to understand how players use LanternFlow and to improve it. Google processes this data for us as our service provider. When it is on, Google Analytics receives:
- Game events: level starts and results (the level and whether you won, lost or quit), finishing the tutorial, coins earned and spent, and other game events such as helper use.
- Purchases: only after our server has verified a purchase with Apple or Google: the product, price, currency and transaction ID. Never your payment details.
- Identifiers: your player ID (as the Google Analytics user ID) and an app-instance ID that Firebase creates on your device. Google Analytics does not receive your device’s advertising identifier.
- Collected automatically by Google Analytics: your device model, operating-system and app version, language, first opens, sessions and engagement time, and your approximate location (such as your country or city), which Google derives from your IP address.
Consent first. Game statistics and Google Analytics start switched off on every install, with every consent signal set to denied. Where consent is required (for example in the EEA, the UK and Switzerland, as your device’s region, network and time zone indicate), the game asks before anything is collected, and both stay off if you say no; elsewhere they are on unless you switch them off. They are never on for players below the age of digital consent, and Google may not use this data for advertising. You can change your choice at any time in Settings → Game statistics.
We can switch it off. We can turn Google Analytics off for all players at once from our servers; the game then stops sending to it immediately. Google processes the data under its own terms: Privacy and security in Firebase.
Why we use data and who receives it
We use data to provide the game and its online features, keep and restore your progress, fulfil purchases, answer support requests, measure and improve the game (including with Google Analytics for Firebase, see Analytics), confirm progress for the partner apps that reward it (see Partner apps and rewards), and protect players and the service. Where the GDPR applies, we rely on performance of our agreement with you for the services you request, including partner rewards, our legitimate interests in improving the game and preventing fraud and cheating, your consent where it is required (for example for Google Analytics), and legal obligations where they apply.
Data is processed by our hosting and infrastructure providers (the FlowGames backend runs on Amazon Web Services), by Apple and Google for app distribution, purchases and app-integrity checks, and by Google as our service provider for Google Analytics for Firebase. Partner apps receive only what is described under Partner apps and rewards. We may also disclose necessary information to comply with law, protect legal rights or complete a business transfer with appropriate protections. Some providers process data outside the EEA. Where required, transfers must use an adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for information about the safeguards relevant to your data.
Retention and security
We retain your player profile and save while needed to provide the game and recover your progress. Google Analytics keeps event data linked to your identifiers for at most 14 months. Retention of usage, support, purchase, reward and security records depends on their purpose, ongoing disputes, fraud investigations and applicable legal record-keeping duties. Uninstalling the app does not itself delete server-side records or necessarily remove credentials stored by your device; use Delete my data or email us for that.
We use measures such as HTTPS, access controls and protected authentication credentials. No storage or transmission system can be guaranteed completely secure.
Your choices and rights
Delete my data. In the game, open Settings → Delete my data and confirm. This erases your profile, progress, coins, helpers, gameplay data and identifiers on our server and resets the game on your device to a fresh start. It also resets the Google Analytics app-instance ID and user ID on your device; analytics data already sent to Google is deleted when its retention period ends, or sooner if you email us. It needs an internet connection and cannot be undone. Purchase and reward records that we must keep for bookkeeping are kept with the identifiers that link them to you removed.
You can choose a name that does not identify you, and you can change your statistics choice at any time in Settings → Game statistics.
Depending on where you live, you may request access, correction, deletion, a copy of your data, restriction of processing or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.
You can also send requests to hello@pollflow.io with “LanternFlow privacy request” and your Player ID (shown at the bottom of the game’s Settings) so we can locate your profile. We may ask for proportionate verification to protect your data. You can complain to your local supervisory authority, including Sweden’s Integritetsskyddsmyndigheten (IMY).
Children and updates
LanternFlow is a general-audience game and is not directed at children under 13. If you believe a child has provided personal data without the permission required by local law, contact us so we can investigate and address it.
We may update this policy as the game or our practices change. The date above identifies the current version. Material changes will be communicated as required by applicable law.
About this page
This privacy page has no advertising, analytics scripts or cookies. Our hosting infrastructure still receives the technical information needed to deliver and secure the page.