Nova Strike

Effective 21 September 2026

Nova Strike Privacy Policy

Effective date: 21 September 2026 Developer: Flowzy ("Flowzy", "we", "us", "our") Contact: support@flowzy.ai

Nova Strike is a space-shooter game for iOS and Android published by Flowzy. This policy explains what information the game collects, why we collect it, who receives it, how long we keep it and the choices you have. It applies to the Nova Strike mobile app (the "App") and the online services that power it. It does not cover the Apple App Store, Google Play or any third-party website the App links to; those services have their own privacy policies.

1. Summary

  • You can play without creating an account or telling us who you are. On first launch the App creates an anonymous player account identified by a random ID.
  • You may optionally link an e-mail address so you can restore your progress on another device. This is the only personal contact detail we ever ask for.
  • The App shows ads through Google AdMob. Where the law requires it you are asked for consent first, and you can change your choice at any time from Settings.
  • Purchases are processed by Apple, Google and RevenueCat. We never see your payment card details.
  • You can delete your account and all associated data from inside the App (Settings, then "Delete account & data"). Deletion takes effect immediately.
  • The App is not directed at children under 13, and we do not knowingly collect their personal data.

2. Information we collect

2.1 Account and identity

  • Anonymous account ID. A random identifier (UUID) created by our authentication provider, Supabase, when you first open the App. It links your cloud save, leaderboard entries and purchase entitlement together. It is not derived from your device and does not identify you personally.
  • E-mail address (optional). Only if you choose to link one. It is used solely to verify that you own the address (a one-time code or sign-in link) and to let you sign in to the same account later. We do not send marketing e-mail.
  • Pilot name. The display name shown on leaderboards. A random name (for example "Pilot-4F2A") is assigned when the account is created and you can change it at any time. Because it is visible to every other player, please do not put personal information in it.
  • Country (optional). A two-letter country code stored on your profile if the App or you set it. It is not collected automatically at this time.
  • Sign-in security logs. Our authentication provider records the IP address and app identifier ("user agent") of sign-in, code-verification and session-refresh requests in its security audit log. We use these records only to detect abuse and keep accounts secure; they are not linked to gameplay data and are kept for 7 days at most.

2.2 Game progress (cloud save)

Your coins, gems, ships, hangar upgrades, stars, missions, achievements, in-game settings and statistics (runs, kills, best waves, play time) are stored on your device and mirrored to our server so they survive reinstalling the App and can be restored on another device. Each cloud save carries a short device label (platform and device model, for example "android Pixel 8") so the Account screen can show which device last synced; the label is stored only with your save and deleted with it. Leaderboard entries contain your best endless-mode wave and score, the ship you used, the number of runs and the time the record was set.

2.3 Advertising identifiers and ad data

The App uses Google AdMob to show rewarded ads (which you choose to watch for an in-game benefit) and occasional interstitial ads. AdMob and its advertising partners may collect:

  • the advertising identifier of your device (Google Advertising ID on Android, Identifier for Advertisers / IDFA on iOS), where you allow it;
  • your IP address, approximate (city-level) location derived from it, device type and model, operating system version, language, App version, and ad interaction data such as impressions, clicks and whether a rewarded ad was watched to completion.

On iOS the App asks for permission through App Tracking Transparency (ATT) before the IDFA is accessed. If you decline, ads are still shown but they are not personalised. On Android the App declares the AD_ID permission; use of the advertising ID is subject to your Google advertising settings and to the consent choices described in Section 6.

2.4 Purchase records

When you buy gems, the Starter Pack or the Nova Pass subscription, the transaction is processed by the Apple App Store or Google Play under their terms. RevenueCat, our subscription-management provider, receives the purchase receipt or purchase token, product ID, price and currency, purchase and expiry dates, store country and your anonymous account ID so that your entitlement can be verified, kept in sync and restored. We store only your subscription status (active or expired, and the expiry date) on your player profile. We never receive your payment card number, billing address or store account credentials.

2.5 Crash and diagnostic data

This release does not include a third-party crash-reporting SDK. When the App hits an error it keeps a short diagnostic trail (stack trace, App version, device model, operating system version and a trail of in-app events) in memory on your device only, so that it can recover gracefully. Nothing is transmitted to us or to a third party. If we enable a crash-reporting provider in a future release we will update this policy and name the provider before it is switched on.

2.6 Analytics events

The App records gameplay and product events, such as app opens, runs started and finished (mode, sector, ship, wave reached), purchases, ads watched, and settings changes, tied to your anonymous account ID. We use these events in aggregate to balance the game, find bugs and decide what to build next. This release does not include a third-party analytics SDK such as Firebase Analytics or Amplitude, and these events are not shared with an analytics vendor.

2.7 Local notifications

If you turn on reminders, the App schedules notifications on your device (for example when a free chest is ready). These are created and stored locally; no push token or notification data is sent to us.

2.8 Information we do not collect

We do not collect precise location, contacts, photos, microphone or camera data, health or biometric data, or the contents of your other apps. Nova Strike has no chat or messaging features.

3. Why we use your information

We process the information above for the following purposes. Where the EU/UK General Data Protection Regulation (GDPR) applies, the legal basis for each purpose is shown.

  • Providing the game and your account (creating the anonymous account, saving and restoring progress, showing leaderboards, verifying a linked e-mail): performance of our contract with you (the Terms of Service).
  • Processing purchases and subscriptions (verifying and restoring entitlements, preventing fraud): performance of a contract and our legitimate interest in preventing abuse.
  • Showing ads to fund the free game: your consent where required (EEA, UK, Switzerland and applicable US states); otherwise our legitimate interest in funding a free-to-play game. Non-personalised ads rely on legitimate interest and use only the data needed to serve and count the ad.
  • Keeping the game stable and secure (crash reports, rate limiting, plausibility checks on leaderboard scores): our legitimate interest in a working, fair game.
  • Improving the game (aggregate analytics): our legitimate interest in understanding how the game is played. Where consent is required for analytics identifiers, we ask for it.
  • Answering support requests: performance of a contract and our legitimate interest in helping you.
  • Complying with the law (tax records for purchases, responding to lawful requests): legal obligation.

We do not sell your personal information and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Who receives your information

We share information only with the service providers needed to run the game, each of which processes it under its own privacy policy and, where required, a data-processing agreement with us:

  • Supabase, Inc. (authentication, database and serverless functions): anonymous account ID, linked e-mail, pilot name, cloud save and device label, leaderboard entries, subscription status and sign-in security logs (IP address and user agent). Data is hosted in Australia (Sydney region).
  • Google LLC / Google Ireland Ltd (AdMob and the User Messaging Platform): advertising identifier, IP address, device information and ad interaction data, as described in Section 2.3.
  • RevenueCat, Inc.: purchase receipts and tokens, product and price data, and your anonymous account ID.
  • Apple Inc. (App Store) and Google LLC (Google Play): they process your purchases and app installation under their own terms. Apple and Google also provide us with aggregated, non-identifying download and crash statistics.
  • .

We may also disclose information if required by law, to protect the rights, safety or property of Flowzy, our players or others, or in connection with a merger, acquisition or sale of assets (in which case we will notify you through the App or by e-mail before your information becomes subject to a different privacy policy).

5. How long we keep your information

  • Account, profile and cloud save: until you delete your account. Anonymous accounts with no activity for 12 months may be deleted automatically.
  • Linked e-mail address: until you delete your account.
  • Leaderboards: weekly boards are rotated every week; all-time entries remain until your account is deleted.
  • Purchase records: RevenueCat keeps them for the life of your account; Apple and Google keep their own transaction records. We keep the minimum needed to meet tax and accounting obligations, typically 7 years.
  • Crash and diagnostic data: 90 days.
  • Analytics events: 14 months, after which only aggregated statistics remain.
  • Advertising data collected by Google is retained according to Google's policies.
  • Support e-mails: 24 months after the request is closed.

6. Your choices and consent management

  • Ad consent. If you are in the European Economic Area, the United Kingdom, Switzerland or a US state with a privacy law, the App shows Google's consent form on first launch. You can review or change your choices at any time from Settings, "Privacy options". Declining personalised ads does not affect your ability to play.
  • App Tracking Transparency (iOS). Change your answer at any time in the iOS Settings app under Privacy & Security, then Tracking.
  • Advertising ID (Android). You can reset or delete your advertising ID in the Android Settings app under Google, then Ads.
  • Notifications. Turn reminders on or off in the App's Settings; you can also disable them at system level.
  • E-mail. Linking an e-mail is optional. To remove it, delete your account (Section 7) or contact us.
  • Do Not Track and Global Privacy Control. These browser signals do not apply to native mobile apps; use the controls above instead.

7. Deleting your account and data

From inside the App go to Settings, then "Delete account & data" (also available from the Account screen). Deletion is immediate and complete: the authentication record, your profile, cloud save and leaderboard entries are erased from our servers, the App signs out and removes its local data, and no copy is retained other than in short-lived backups that expire within 30 days.

Deleting your account does not cancel an active Nova Pass subscription, because subscriptions are managed by Apple or Google. Cancel it from your App Store or Google Play subscription settings; otherwise it will continue to renew.

If you can no longer access the device, e-mail us from the address linked to the account and we will delete it for you.

8. Your rights

Depending on where you live you may have the right to:

  • access the personal information we hold about you and receive a copy;
  • correct inaccurate information (you can change your pilot name in the App);
  • delete your information (Section 7);
  • restrict or object to certain processing, including processing based on legitimate interest;
  • data portability, that is, receive your information in a structured, commonly used, machine-readable format;
  • withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal;
  • lodge a complaint with your data-protection supervisory authority. In the EU you can find yours at edpb.europa.eu; in the UK it is the Information Commissioner's Office (ico.org.uk).

California and other US state residents. You have the right to know what personal information we collect and how it is used and shared, to delete it, to correct it, to opt out of the "sale" or "sharing" of personal information (which includes personalised advertising), and not to be discriminated against for exercising these rights. Nova Strike does not sell personal information for money. Personalised advertising through AdMob may count as "sharing" under the California Privacy Rights Act; you can opt out through "Privacy options" in Settings or through App Tracking Transparency on iOS. We do not knowingly sell or share the personal information of anyone under 16.

To exercise any right, use the in-App controls or e-mail support@flowzy.ai. We can only act on requests that come from the e-mail address linked to the account or from the device that holds the account, because anonymous accounts contain no other way to verify that you are the owner. We respond within one month (or 45 days for US state requests) and may extend that period where permitted by law.

9. Children

Nova Strike is not directed at children under 13, or under the age at which a child can consent to data processing in their country (up to 16 in parts of the European Union). The game is rated 12+ on the App Store and Teen on Google Play on the app stores. We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, contact us at support@flowzy.ai and we will delete it.

10. Security

All traffic between the App and our servers is encrypted with TLS. Server-side access to your data is restricted by row-level security so that each account can read and write only its own records; leaderboard writes go through validated server functions. Payment data is handled exclusively by Apple, Google and RevenueCat. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we will notify you and the relevant authorities of a data breach where the law requires it.

11. International transfers

Our servers are located in Australia (Sydney region). Our service providers may process information in the United States and other countries whose data-protection laws differ from those of your country. Where information from the EEA, the UK or Switzerland is transferred, we rely on adequacy decisions, the EU-US Data Privacy Framework where the provider is certified, or standard contractual clauses approved by the European Commission.

12. Changes to this policy

We may update this policy from time to time. The effective date at the top will change, and for material changes we will show a notice in the App or send an e-mail if you have linked one. Continuing to use the App after the effective date means you accept the updated policy.

13. Contact us

Flowzy FZC
Building C1, Ajman Free Zone
Ajman, United Arab Emirates
Telephone: +971 58 675 5216 E-mail: support@flowzy.ai

Flowzy FZC is established in the United Arab Emirates.