The Chocolate House Privacy Policy

Effective date: 29 October 2026

This policy explains what The Chocolate House does with your data. It is published at https://playchocolatehouse.com/privacy, the address registered with the App Store and Google Play and linked from Settings inside the game.

Who we are

The Chocolate House (the game) is made and published by Franz Health Ltd. Franz Health Ltd is the data controller for your personal data. Franz Health Ltd is registered in England and Wales, company number 17182431. We are registered with the UK Information Commissioner (ICO), registration number ZC198020. You can reach us at support@playchocolatehouse.com.

The short version

• There are no accounts run by us. You can choose platform game services through Game Center or Google Play Games, and they are optional.
• Optional local notes can tell you when the next order is ready, the takings are in the till, your run of daily orders is about to lapse, a commission is near its deadline, a showpiece is finished or an event opens tomorrow. There are no remote push notifications.
• The game never requests camera, microphone, photo or location permission.
• Your chocolatier, its saves and its settings stay on your device. If you sign in to platform game services, a copy of your save also goes to your own Google or iCloud account. We cannot see it.
• Play statistics are kept only if you switch on Share play statistics. They stay on your device, and leave it only inside a support email you choose to send.
• The only data that leaves your device goes to the vendors described below, for ads, optional install attribution and purchases, and, if you sign in to them, to Google Play Games or Game Center.

The rest of this document is the same information, at the length the law prefers.

Data that stays on your device

The game stores your save, your settings, your purchase records and, if you switch them on, your play statistics locally on your device. We run no servers, so none of this data comes to us, and we could not recover a save for you. Deleting the game deletes this local data. If you chose platform game services, the device also keeps a record of which Google or Apple account your cloud save belongs to, so that a different account cannot overwrite your save, and it keeps up to three backups of any save the game replaces when you choose the cloud copy. These never leave the device. A cloud save kept by Game Center or Google Play Games stays on your platform account until you remove it there.

Advertising (Google AdMob)

The game shows ads through Google AdMob, and asks for advertising consent through the User Messaging Platform (UMP), also from Google. Ads are limited to content rated PG (parental guidance) or below. There are two kinds of ad:

• Reward videos, which play only when you choose one, in exchange for the reward stated before it starts. The reward is granted only when the video finishes, and no reward ever depends on tapping an ad or allowing tracking.
• Automatic ad breaks, a full screen ad that can appear when you close a trading report. The button that closes the report says so before you tap it. None appears early in your first session, breaks are spaced apart and capped per hour, and the Ads card in Settings states the current limits. The Remove Automatic Ads purchase turns them off for good, and reward videos stay available.

Consent comes first. At first launch the consent form appears where the law requires it (in the UK, the EEA and Switzerland), and no ad is requested until it is done. On iOS the tracking question comes later, once the game has shown you a first reward video or time away report: a short card explains that ads pay for the free game and that allowing tracking roughly doubles what an ad pays us. Its one button, Continue, leads straight to the question Apple asks, whether the game may use your advertising identifier (App Tracking Transparency), and Ask App Not to Track there is how you decline. Until you allow it, ads are non personalised, and neither answer changes what you can do in the game.

When an ad is requested, Google processes: device identifiers (including the advertising identifier, where you have permitted it), your IP address (from which a coarse location is derived), device and app information, ad interaction events, and diagnostics. If you decline consent, or decline tracking permission on iOS, ads become non personalised, but Google still processes your IP address and device information to serve ads, limit how often they appear and prevent fraud.

Google describes its own processing at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites.

Optional notes from the shop

The game schedules a few local notifications on your device while it is away. There are at most three in the first week of an absence and one per local day, between 09:00 and 21:00. After the first week there are at most two a week, each a word from the house about your shop, and none after the thirtieth day. Notes report the next order, takings in the till, a finished showpiece, a calendar event that opens the next day, or a word from the house. Two warn ahead while there is still time to act: at 20:00, a reminder to claim the order of the day before a run of daily orders lapses, and before a commission deadline, a reminder while it can still be delivered. No note is sent as a penalty for being away.

On iOS the first pause requests quiet provisional permission. After you have opened your first away report, at a calm moment with nothing in front of the shop, the game asks your phone for ordinary notification permission, on iPhone and on Android 13 and later, and a button on the first order card offers the same request. It never asks twice in one sitting. Shop notes in Settings stops delivery at any time, and device settings control permission. Opening the game cancels pending notes. Notes use no push token, server, contact details or new SDK. The device keeps the scheduled times and the kind of note opened. If you separately enable install attribution, the choice and opened kind are among the authored milestones below.

Optional install attribution (AppsFlyer)

Share install attribution in Settings > Privacy is on unless you switch it off. After the advertising consent flow has completed, it starts AppsFlyer so we can measure which campaign led to an install. AppsFlyer may process your IP address (to estimate an approximate location), device identifiers (including the advertising identifier where permitted), and app launch data. Through RevenueCat, it also receives your purchases (the product, price, currency, renewals and refunds), reported against your AppsFlyer install identifier. While install attribution is on, it also receives ad impression revenue reported by the advertising SDK: the ad network, format, unit, currency and revenue. This helps us measure which campaigns support the game. Switching install attribution off stops this forwarding. Watching an ad or making a purchase does not require enabling attribution. It also receives a small set of named events: opening the Store, each purchase step (started, completed, pending, cancelled, failed or blocked, and a restore; a started, cancelled or failed purchase also carries the price the store showed and its currency code), each rewarded or automatic ad step (a reward offer shown, or shown with no ad ready and the reason none was ready, how long a reward ad took to be ready, requested, started, rewarded, failed, no fill, and leaving the game shortly after an ad closes, after a reward ad closes or after an ad break was due but no ad was ready), spending Sovereigns, and play milestones: the welcome being read, skipping the opening from the welcome, the second time you open the game, each First step and opening course step, leaving the opening early (and the step you were on), session length, the interval before a return, viewing the Plan, reaching its stops, the screen used to ask for sign in, your shop notes choice, the kind of note you opened, sharing a front page and the Plan stop it was shared from, the first sale, hire, return report, video reward, order of the day, unpaid wages and second city, what put the Starter Pack offer on screen, claiming the order of the day (its run of days and its surprise kind) and the weekly challenge, opening a Sealed Hamper (the kind of gift it paid and how many have been opened), the City Stamps earned out of the total, install attribution starting (after the consent answer, or on a build that cannot ask for it), your answer to the tracking question, or the choice your phone already held for it (allowed, denied or restricted), and store review measurements: when a request for a store rating becomes due, is held back and the game defined reason why, expires or is handed to the store, and a tap on Write a review in Settings. Every milestone includes total active play time, the number of sessions and the hours since the game was installed. Fields are authored numbers and game defined ids, never names, anything you type, your save, contact details or a platform account id. A delivery buffer keeps at most 256 pending events until the SDK is ready. The milestones show us where players stop playing, so we can improve those parts of the game. While this setting is off, these events are discarded rather than sent. Switching this setting off stops AppsFlyer collection on this device and withdraws that identifier from RevenueCat, so purchases stop being reported too. The game remains fully playable either way.

AppsFlyer describes its processing at https://www.appsflyer.com/legal/privacy-policy/.

Optional platform game services

Game Center on iOS and Google Play Games Services on Android can provide achievements, leaderboards and a cloud save. Returning platform players may sign in silently. A new player sees no sign in sheet until they choose Sign in inside the game. The game asks Google or Apple for your player ID only, not for your name or avatar.

On Android, signed in, the game sends Google your achievements, your scores on its three leaderboards (Lifetime Takings, Weekly Takings, and The Grand Tour, Fast) and six Game Stats: units sold, commissions delivered, recipes developed, showpieces finished, staff hired and houses owned. Each Game Stats event is a count the game defines. They go in one batch about once a minute and when you leave the app. The game does not send Game Stats from iPhone.

On iPhone, the game sends Game Center your achievements and your scores on the same three leaderboards. Lifetime Takings and The Grand Tour, Fast are sent as you play. Weekly Takings is sent only when you choose to submit your result for the week to the weekly Challenge.

The cloud save is a copy of your whole save: your progress, your balances and the record of what you have bought. It does not include your settings or your play statistics. On Android it is kept in Google Play Saved Games, in your own Google account. On iPhone it is kept in Game Center Saved Games, in your own iCloud account, and needs iCloud Drive to be switched on. The game uploads a changed save about every five minutes while you play, and when you leave the app. Android and iPhone saves do not sync with each other. If the save on your device and the cloud copy have both changed, the game shows you both and asks which to keep. Saves are not merged; one is chosen, and the game keeps a backup of the copy it replaces on the device.

Leaderboards are public. On Android, other players can see your Play Games name and score, and Google lets you limit who sees your Play Games activity in your profile settings. On iPhone, Apple says your Game Center nickname, avatar and scores are visible to all Game Center users for games with global leaderboards. Compare with friends is a button you press. It asks Google or Apple for permission to read your friends, and then reads the entries of your friends on a leaderboard so the game can show where you stand. The names and scores are shown on the screen and the game does not keep them. If you want a score removed, email us and we will remove it where Google and Apple let us.

None of this passes through us. There is no server of ours to hold it. These identifiers, scores, stats and cloud saves are not sent to AppsFlyer or to us. Google and Apple hold them under their own policies. What their developer tools show us is limited: Apple shows the top 100 scores and the player names on a live leaderboard and lets us remove a score, and Google Play Console shows aggregate statistics about how the game uses Play Games Services. We never receive your save.

You can delete your Play Games data from your Play Games profile or your Google Account, as Google explains at https://support.google.com/googleplay/answer/9130646. Google says deleting the data for a game can also delete your achievements, saved progress and leaderboard scores for that game. Google describes the data Play Games Services handles at https://developer.android.com/games/pgs/data-collection. You can delete the data an app keeps in iCloud from your iCloud storage settings (Settings, your name, iCloud, Manage Account Storage), which Apple describes at https://support.apple.com/en-us/108922. Apple describes what Game Center handles at https://www.apple.com/legal/privacy/data/en/game-center/, and says Game Center keeps its information for as long as you keep the Apple Account behind it.

All of this is optional. Without Play Games, Game Center or iCloud, core play is unchanged and works offline, and your save stays on your device only.

Purchases (RevenueCat)

In app purchases are made through Apple or Google and managed through RevenueCat. Because we do not run player accounts, RevenueCat assigns an anonymous random app user ID and records your purchase history and receipt validation data against it. This is used to deliver your purchases, restore them when you reinstall, and help you when something goes wrong. Payment itself is handled entirely by Apple or Google. We never see your card details, and neither does RevenueCat.

• Sovereigns are the game currency you can buy. They can also be earned free in play and from reward videos. Your balance, and a count of where your Sovereigns came from, are kept on your device with the rest of your save.
• Each purchase is credited once. The game keeps the store transaction IDs it has credited on your device, so a repeated report from the store, or a reinstall, never credits a purchase twice.
• A purchase waiting for approval (Ask to Buy, or a pending payment on Google Play) grants nothing until the store confirms it. A cancelled or failed purchase grants nothing and is not charged.
• Restore purchases, in the Store and in Settings, asks the store which one time purchases (such as Remove Automatic Ads) belong to your store account and applies them again. Sovereign packs are consumable, so they are spent in the game and cannot be restored.
• Refunds are decided by Apple or Google under their own policies. When a one time purchase is refunded, the game removes what it unlocked the next time the store reports your purchases. Sovereigns from a refunded pack may be taken back, never more than you hold, and a refund never removes your chocolatier, its stock or its cash.

RevenueCat describes its own processing at https://www.revenuecat.com/privacy.

Play statistics

Share play statistics is a switch in the Privacy card of Settings. It is off until you switch it on. While it is on, the game keeps a small record of play events on your device, such as a session ending, opening the Store, a purchase starting, completing or failing, a restore, or a reward video finishing. Each event holds only numbers and names the game itself defines, such as a product ID or the length of a session. Store, purchase and ad events also note whether you have removed ads or bought anything, your Sovereign balance, and how much of your cash in the game came from rewards or purchases. The record keeps only the latest 256 events. It never holds your name, anything you typed, your location, or any identifier of you or your device.

Nothing sends this record anywhere. It leaves your device only if you write to support with Email support in Settings while the switch is on: the email then includes a short summary of the record, which you can read, change or delete before you choose to send it. Switching Share play statistics off deletes the record.

Identifiers

We run no servers and hold none of these identifiers ourselves. They exist on your device and at the vendors and platforms named above, nowhere else.

Legal bases

Under the UK GDPR and the EU GDPR, we rely on: consent, for personalised advertising and for play statistics you include in a support email; contract, for delivering, restoring and supporting the purchases you make; and legitimate interests, for non personalised ad serving, fraud prevention and vendor diagnostics. Optional install attribution relies on your consent, which you can withdraw in Settings. Where we rely on legitimate interests, the interest is running a free game funded by ads and optional purchases without being defrauded while doing it.

The optional game services (Google Play Games Services, Game Center and iCloud) are provided by Google and Apple under their own terms and policies, and they run only while you are signed in to them.

Consent, and changing your mind

The consent form comes before any advertising processing, and the tracking question follows your first reward or report, as described under Advertising above. Ad privacy options, in the Ads card of Settings, reopens the consent form at any time wherever the form applies. You can also withdraw tracking permission in iOS Settings > Privacy and Security > Tracking, and on Android you can reset or delete your advertising ID in system settings. Withdrawing consent is as easy as giving it. Declining everything leaves the game fully playable.

Choices inside the game

• Ad privacy options, in the Ads card of Settings, reopens the consent form so you can revisit your advertising choices.
• Share install attribution, in the Privacy card of Settings, is on after the consent flow and can be switched off there at any time.
• Share play statistics, in the Privacy card of Settings, is off until you switch it on, and switching it off deletes the record.
• Remove Automatic Ads, in the Store, turns automatic ad breaks off for good.

Retention

We do not store game saves or play statistics on our own servers. Play statistics on your device keep only the latest 256 events, and are deleted when you switch them off or delete the game. The vendors above retain data under their own policies, at the links above. Your cloud save stays in your Google or iCloud account until you delete it, as described under Optional platform game services. Support email threads are kept for as long as needed to resolve the issue and are then deleted.

Children

The game is for players aged 13 and over. It is not directed at children under 13, and it carries an age rating in each store. We do not knowingly process the data of children under 13. If you believe a child has sent us personal data by email, contact us and we will delete it.

Your rights (UK and EU)

You have the rights of access, rectification, erasure, restriction, portability and objection. To exercise them, email support@playchocolatehouse.com. For most of the data described in this policy the vendors above are the ones actually holding it, and we will point you to the right place rather than pretend to search servers we do not have. For Play Games data, your Play Games profile and Google Account are the quicker route. For Game Center and iCloud, it is your Apple Account and your iCloud settings. If you want a leaderboard score removed, email us as well. You also have the right to complain to the ICO (https://ico.org.uk) or to your local EU supervisory authority.

US state privacy

We do not sell personal information for money. The advertising described above is the processing that some US state laws count as sharing or targeted advertising. You can opt out through the consent form, the tracking permission, Ad privacy options in Settings and the advertising ID controls of your operating system. We honour rights requests sent to the support email, verified against device level identifiers you provide, because we hold nothing else to verify you with.

International transfers

The vendors named above process data in the United States and elsewhere. Those transfers rely on standard contractual clauses, the UK Addendum, or the Data Privacy Framework between the EU and the US where the vendor is certified under it.

Changes

When this policy changes, we will update this page and the effective date at the top.

Contact

support@playchocolatehouse.com. Franz Health Ltd, England and Wales, United Kingdom.