Privacy Policy — Hourloop

This policy explains what data is processed in the mobile game Hourloop (the "Game"), by whom and for what purpose. The Game is distributed through Huawei AppGallery and RuStore.

Developer: NeMedi
Studio Contact: nemedistudio@gmail.com
Game Support: hourloop.support@gmail.com

---

1. In short

The Game requires no registration and never asks for your name, email, phone number or payment details. Run progress and settings are stored on your device only. The exception is chronites, keys, and banner items: to prevent balance tampering and cheating, they are stored on the game server and linked to a randomly generated player ID rather than to an individual or a permanent device identifier.

Three kinds of data leave your device, and none of them identifies you personally:

• data of the game server wallet, banner, and Clock Tower (section 4): chronite and key balances, items obtained, run sessions, and pull history, linked to a random player ID. In the weekly tower leaderboard, other players see a generated name, floor, and time, never your player ID;
• data collected by advertising networks in order to serve ads (section 5). Ads are shown only when you tap the rewarded-video button;
• anonymous gameplay statistics the Game sends to the AppMetrica analytics service (section 6): how far players get, where they lose most often, which upgrades they pick. This data is used to tune difficulty and balance.

2. What data is processed, and on what basis

The Game processes no payment data: it currently has no in-app purchases.

Device permissions. The Game requires internet access and network state information; without them ads cannot load. In the Huawei AppGallery version, the Huawei ad SDK additionally declares permissions to query the list of installed apps and to install apps: these are part of that SDK and are used by the advertising system itself; the Game does not call them.

The Game never requests access to location, camera, microphone, contacts, photos, files or call logs.

3. What is stored on your device

These files live in the app's internal storage, are never uploaded anywhere, and are removed together with the Game:

The Game has no cloud saves for game progress — run progress, talents, and regular gold never leave your device. Chronites, keys, and banner items are stored on the game server (section 4). The statistics in section 6 are not game progress.

4. Game server (chronites, keys, items, and Clock Tower)

In Game versions featuring the banner, chronites, Game+ tiers, and Clock Tower mechanics, the Game communicates with its own server to protect high-value in-game assets against tampering and to power the weekly leaderboard.

What is stored on the server:

• Wallet: randomly generated player ID, access token, random installation token, chronite and key balances, lifetime earned/spent counters, creation timestamp;
• Transaction ledger: each credit and debit record (for completing an act or watching an ad, buying keys, performing gacha pulls, reaching Clock Tower milestones 10 / 20 / 30 / 40, or first-time clearance of a Game+ tier), amount and timestamp;
• Campaign run sessions: random run session ID, last submitted act number and timestamp — used to prevent duplicate reward claims;
• Clock Tower runs (endless_runs): random run token, week ID, start and completion timestamps according to server time, floor reached, duration, and an implausible-result flag. Start and completion times are recorded by the server to filter out implausibly fast runs: such runs are not counted and do not enter the leaderboard;
• Weekly best results (endless_best): the player's best record for each week (floor reached, duration, run token, recorded timestamp). Records of past weeks are not automatically erased when a new week begins;
• Banner guarantees (pity): pull counters used to calculate guaranteed high-rarity drops;
• Item inventory: awarded equipment items and their rolled stats;
• Pull history: records of items obtained and pull timestamps.

Clock Tower weekly leaderboard. Players can view the public weekly leaderboard, showing the top 100 results of the week and your own entry. Each entry contains a generated name, floor reached, completion time, and rank. Your player ID (user_id) and any other details about you are never sent to the leaderboard and are not visible to other players. Player names are not stored in the database: the server computes them on the fly from your player ID using cryptographic hashing (HMAC) in a format such as "Brass Pendulum #4821". It is impossible to recover your player ID from this name. Custom names cannot be entered.

What the server does NOT store: your name, email address, phone number, advertising identifier (GAID/OAID), permanent device identifier (Android ID), device model, or IP address. Server functions do not log player IP addresses; the cloud hosting infrastructure may observe connection metadata solely during active network transmission, and the Game does not retain it.

Where data is hosted: the server is hosted on Yandex Cloud (Russia), processing data solely on behalf of the developer as an infrastructure provider.

Offline operation: without an active internet connection, no data is transmitted to the server, operations are queued locally on the device, and chronites or pulls are not processed until connectivity is restored.

5. Advertising

The Game uses:

• Yandex Mobile Ads — in all versions of the Game;
• Petal Ads (Huawei Ads) — in the Huawei AppGallery version only;
• VK Ads (formerly myTarget) — in the RuStore version only. It is connected through Yandex Mobile Ads mediation: the request goes to Yandex, which then decides whether to serve its own ad or pass the impression to VK Ads.

To select and deliver ads, and to prevent fraud, these networks may process:

• the device advertising identifier (GAID on devices with Google services, OAID on Huawei devices) — a non-permanent identifier you can reset or limit in your device settings;
• technical device information: model, OS version, language, region, connection type, screen resolution;
• IP address;
• ad delivery data: which ads were shown, whether they were watched to the end, whether they were clicked. The Yandex ad SDK reports such technical ad events to the AppMetrica analytics service (owned by Yandex) — this is part of how the ad network itself works. For the gameplay statistics the Game sends there on its own, see section 6.

The Game's developer does not receive this data and has no access to it — it goes directly to the advertising networks and is processed under their own terms; links are in section 7.

Ad personalisation is your choice. On first launch the Game asks whether the advertising networks may use your device advertising identifier to pick more relevant ads:

• if you agree — the networks may use that data to select ads;
• if you decline — every network is told to disable personalisation, and you see non-personalised ads;
• until you answer — the decline setting applies.

You can change your mind at any time: Settings → the relevant-ads toggle. The networks are also given a content rating: the Game carries a 12+ rating (China 12+, Brazil A14, other regions 12+), and ads unsuitable for that age should not be shown.

6. Gameplay statistics (AppMetrica)

The Game sends anonymous gameplay statistics to the AppMetrica analytics service (owned by Yandex). This data is used to tune difficulty and balance, and to assess the effectiveness of advertising campaigns.

What the service collects on its own, without the Game's involvement:

• the fact that the Game was installed, and which ad you came from if you arrived through advertising;
• app launches, their duration and frequency;
• technical information: device model, OS version, Game version, language, and approximate country and region derived from your IP address;
• crash data: technical information about where the Game terminated with an error.

What the Game sends as its own events:

• start and end of a run: game mode (campaign or Clock Tower), outcome, act reached, room number, floors cleared (in tower), duration, in-game currency earned;
• entering and completing a room: game mode, tower floor number, room type, act number, health remaining, time elapsed;
• defeat: the act, room and wave where it happened;
• defeating an act boss;
• picking one card out of three: the options offered and the choice made — for Parts, room rewards and permanent Legacy bonuses;
• purchasing a node in the talent tree;
• watching a rewarded video ad.

The statistics do not contain your name, email, phone number, any text you have typed, the contents of your device, or data about your location: location collection is disabled in the Game. Country and region are approximated by the service from your IP address.

Your device advertising identifier (GAID / OAID) is passed to AppMetrica only if you agreed to ad personalisation (see section 5). If you declined or have not answered, the identifier is not passed.

The developer has access to this data in the form of reports. It cannot be tied to a particular person: the Game holds no information identifying you.

7. Who receives your data

Data is never sold and is shared with no one except the companies listed below, each of which processes it under its own policy:

Game server infrastructure. The database and backend wallet services are hosted on Yandex Cloud (Yandex Cloud LLC, Russia). Yandex Cloud operates strictly as a cloud hosting provider processing data on instructions from the developer. Player data is not sold or shared with third parties.

Transfers outside your country of residence. Yandex and VK are Russian companies; Huawei is a Chinese one. By installing the version of the Game for the corresponding store, you accept that the data listed above may be processed in those countries under the policies of the named companies.

Beyond this, data may be disclosed where required by law or in response to a valid request from a competent public authority.

8. How long data is kept

• On your device — until you reset progress in Settings or uninstall the Game. No automatic retention periods apply.
• On the game server — wallet, inventory, pull history, Clock Tower runs, and weekly best records are retained until a deletion request is received. Your entries in past weekly leaderboards remain (name, floor, time) until account deletion. Please note: resetting progress in Settings or uninstalling the Game removes only local files and does not delete data from the server. Reinstalling the Game creates a new separate wallet with a new random ID, leaving the old one inaccessible. Full deletion of server data is handled upon request (section 9).
• By the advertising networks and AppMetrica — for the periods set by their own policies (links in section 7). The developer does not control those periods.

9. Your rights and how to exercise them

• Change your ad personalisation decision: Settings → the relevant-ads toggle. It takes effect immediately and is passed to every network, AppMetrica included.
• Reset your advertising identifier: in your device settings, under privacy or ads. After a reset neither the ad networks nor the analytics recognise you any more.
• Delete data from your device: Settings → reset progress permanently deletes game progress and run history. Uninstalling the app removes every file listed in section 3.
• Delete data from the game server: send an email to hourloop.support@gmail.com with the subject "Account deletion" and provide your Player ID. You can find your ID in the game: Shop tab → History subtab (displayed at the bottom of the screen; tapping the line copies the ID to your clipboard). Requests are fulfilled within 30 days: your server wallet, transaction ledger, run sessions, guarantee counters, pull history, items, Clock Tower runs, and records in all weekly leaderboards will be permanently deleted. Detailed instructions and deletion procedures are available on the account deletion page.
• Ask a question or submit a request about data processing: write to the address in section 12.
• Contact the recipients directly: rights regarding data processed by Yandex, Huawei and VK are exercised through them; the procedure is described in their policies, linked in section 7.

10. Children

The Game is not specifically directed to children: it targets a general audience and carries an official age rating of 12+ based on its content, not on its intended audience. It collects no personally identifying information. The "child-directed app" flag is not sent to the advertising networks; the 12+ content rating is sent instead (section 5).

11. Changes to this policy

If the set of services used by the Game changes, this policy is updated and the date at the top is revised. The current version is always available at this address.

12. Contact

Studio contact and privacy inquiries: nemedistudio@gmail.com

Hourloop player support: hourloop.support@gmail.com