Privacy policy

1. Who we are

Grow Raiders is a game made and published by Venture Deals, Co., a company in California, USA ("we", "us"). This policy covers the Grow Raiders app for iPhone, the Android version when it is released, and this website, growraiders.com. We are responsible for the personal information described here.

Our Privacy Officer is the person in charge of protecting personal information. You can reach them at privacy@growraiders.com.

2. What we collect and why

The game collects only what it needs to run and to keep Raids and purchases fair.

• Your anonymous login

  What

  A random login id that the app creates the first time you open it (it is not your phone's serial number, advertising identifier or any other hardware id), the random account id and account name our server gives your Grow Op, and the session keys that keep you signed in. The app keeps the login id in your iPhone's Keychain, so your Grow Op comes back if you delete and reinstall the app on the same iPhone. The Keychain copy stays on that iPhone and isn't moved to a new one.

  Why

  To sign you in without an email or password, and to keep your Grow Op yours.

  Who can see it

  Us and our hosting provider. Other players see the random account name when they Raid your Grow Op, or in their Raid summary when you Raid theirs.

  How long

  Until you delete your Grow Op.

• Your date of birth

  What

  The date of birth you enter once, on first launch.

  Why

  To check that you are 18 or older, which you must be to play. Our server also works out whether you are 21 or older; no feature in this version of the game uses that.

  Who can see it

  Our server, and the few people who run it, who look at it only when they need to for support (for example when you ask us to review the age check) or for a legal reason. It is never shown to other players, never sent back to the app, never written to our logs, and the app forgets it once it has been sent.

  How long

  Until you delete your Grow Op. If the date shows you are under 18, see Children and minors.

• Your game

  What

  Your Grow Op (its layout, Buildings, Strains, Buds, Cash, Nutrients, Kief and Seeds), the Raids you make and receive with their Replays (the record of each Raid), Missions, Rep, your Inbox, your Shop history, and when each change happened. Our server also notes Raids and Missions whose results don't add up, so we can look for cheating.

  Why

  To run the game, save your progress, find Raid targets and check every Raid result on our server.

  Who can see it

  When another player finds your Grow Op as a Raid target, they see it with its Grow House level, your Rep and your random account name, and after a Raid they see what it won or lost. A saved copy of your Grow Op's layout (a Pool Snapshot) may be used as a Raid target for other players when no live target is free; raiding it never takes anything from you.

  How long

  Until you delete your Grow Op. Replays can't be opened after 30 days.

• Purchases

  What

  For each purchase: the store's transaction ids, the product, the quantity, the time, whether it was a real or a test purchase, your random account id (attached to the purchase so it reaches your Grow Op), what we delivered and any refund. Apple sends us a signed record of each transaction, which our server checks, and tells our server about refunds.

  Why

  To deliver each purchase exactly once, restore purchases, handle refunds (including taking back refunded Kief), prevent fraud, and keep the records that accounting and tax rules require.

  What we never get

  Your name, email address, Apple Account details or payment details. Apple handles payment.

  How long

  We keep purchase records after your Grow Op is deleted. See How long we keep it.

• Technical information and server logs

  What

  When the app connects, our servers receive your IP address and basic details of each request. Our server logs record a request id, your account id, which game action was called, how long it took and any error code. They never contain your date of birth, purchase receipts or secrets. Our web proxy keeps no log of ordinary game requests; requests our rate limiter turns away, and the proxy's own error lines, are logged with the IP address and the path. We also keep daily counts, such as how many of each Shop offer were bought, that contain no personal information.

  Why

  To keep the game running, limit abuse (for example, too many requests from one address), fix problems and protect the service.

  How long

  Logs are kept only as long as needed for security and troubleshooting: the proxy's log lines are overwritten as new ones arrive (at most 100 MB is kept). The daily counts hold no personal information.

3. What we don't collect

• Your name, email address, phone number or postal address (unless you write to us).
• Your contacts, photos, camera, microphone or precise location. The app doesn't ask for location permission.
• Your advertising identifier. The app doesn't track you across other companies' apps or websites and never shows Apple's "Allow tracking" prompt.
• Anything for ads. There are no ads and no advertising SDKs in the game.
• Payment details. Apple (and later Google) handle payment.
• Social media accounts. This version has no social or email sign-in.
• Messages or names. This version has no chat, no Crews and no grower names. If a later version adds them, we'll update this policy first (see Changes to this policy).

4. How we use it

• Running the game: signing you in, saving your Grow Op and syncing it with our server.
• Checking that you are old enough to play.
• Raids, Missions and Replays: finding targets, checking every result on our server and settling what was stolen and won.
• Purchases: delivering, restoring and refunding them, preventing fraud, and accounting and tax.
• Support: answering you when you write to us.
• Security: protecting the game, our players and our servers, and finding and fixing problems.
• Legal: meeting our legal obligations and enforcing our Terms of Service.

We don't use your information for advertising, to build marketing profiles, or to sell you anything outside the game.

Automatic decisions

Two decisions are made automatically, without a person. The age check closes the game for an account whose date of birth is under 18. And our server checks every Raid and Mission result: a result that doesn't follow the game's rules isn't counted. If you think an automatic decision was wrong, write to support@growraiders.com and a person will review it.

5. Who we share it with

We don't sell your personal information, and we don't share it with anyone for advertising. We share it only as described here.

Service providers

These companies process information for us so the game and website can work:

• DigitalOcean (hosting)

  Our game servers and database run in DigitalOcean's San Francisco data center in the United States. Everything the game stores on our side is stored there.

• Apple (App Store)

  Apple distributes the app, takes payment for purchases, sends us signed purchase records and tells us about refunds. Apple's own privacy policy covers what Apple collects when you use the App Store.

• Google (Google Play, later)

  When Grow Raiders comes to Android, Google Play will do the same for purchases made there.

• Unity Technologies (game engine and purchase library)

  Grow Raiders is built with Unity. When you make or restore a purchase, Unity's in-app purchase library sends Unity information about it: the transaction ids and the store's signed receipt, your random account id, the product, your iPhone's identifier for vendor (an id Apple gives each app maker, which is the same only across that maker's apps), a Unity installation id and a session id. Current versions of this library don't let us switch this off. The Unity engine also sends Unity basic hardware statistics, such as your device model and operating system version. We've switched off the engine's crash and diagnostics reporting. Unity's privacy policy describes how Unity uses this information.

• GitHub (this website)

  This website is hosted on GitHub Pages. Like any web host, GitHub receives visitors' IP addresses and request details.

• Our email provider

  The company that hosts our support and privacy mailboxes receives the emails you send us.

Other players

Other players can see your Grow Op, its Grow House level, your Rep and your random account name when they Scout or Raid it, and your random account name in their Raid summary when you Raid them. They never see your date of birth, login id or purchases.

When the law requires it, or to protect people

We may disclose information if a law, court order or government request requires it, or when we believe it is needed to protect the safety of a person, to investigate fraud or abuse, or to protect our rights and our players.

If our business changes hands

If Venture Deals, Co. or Grow Raiders is merged, sold or reorganized, the information may move to the new owner, who must keep protecting it as this policy describes.

6. How long we keep it

• Your Grow Op, game data, Replays, date of birth and login: until you delete your Grow Op. Copies in our backups are gone within 30 days after that. Replays can't be opened after 30 days.
• Purchase records: kept for as long as we operate Grow Raiders, including after you delete your Grow Op. A purchase can be refunded or restored long after it was made, the same purchase must never be delivered twice, and tax and accounting laws require sales records to be kept (generally for at least 7 years). After deletion, these records are linked only to your former random account id. So is a short purchase review record, if your Grow Op had one: the number of refunds and notes on purchases that needed a closer look (for example one bought on another Grow Op), which we keep to prevent refund fraud. Store notifications about a purchase are kept for 60 days.
• Server logs: only as long as needed for security and troubleshooting.
• Emails you send us: as long as needed to help you. Records of privacy requests are kept for 24 months, as California law requires.

7. Deleting your Grow Op

You can delete your Grow Op and its data in the app: open Settings, tap Delete my Grow Op, read what will be deleted and tap Continue, then type DELETE and tap Delete forever. This deletes, at once, your Grow Op, your Strains, Buds, Seeds, Cash, Nutrients and Kief, your Rep, Raids and Replays, your Missions and Inbox, your date of birth and your login, and the app forgets the login too. Purchase records are kept as described above. Deleting the app from your phone does not delete your data on our servers.

If you no longer have the device, you can ask us by email. The delete account page explains both ways and what is kept. A deletion we make for you runs the same steps as the one in the app.

8. Your rights and how to use them

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy, in a common format you can take elsewhere;
• correct information that is wrong;
• delete your information (the app does this for you; see above);
• stop using your information, by withdrawing your consent. The game can't run without the information it needs, so withdrawing consent means deleting your Grow Op.

How to ask: write to privacy@growraiders.com and include your account ID: Settings shows it in the Support row (8 letters and numbers after "ID"), and an email started with Get help in Settings already contains it. If you bought anything in the game, you can also include the Order ID from Apple's receipt email.

How we check it's you: the game has no names, email addresses or passwords, so we find your Grow Op by its account ID or by the Order ID of a purchase made on it (we look the order up with Apple), and we confirm the request with details only the owner of the Grow Op would have, such as that Order ID or what is in the Grow Op. If we can't find or confirm the Grow Op, we'll tell you. A copy of your information comes as a JSON file, a common format that computers can read. Because your date of birth decides whether you can play, we may decline a change to it that we can't verify.

When we answer: within 30 days. If we need more time, as some laws allow, we'll tell you why within those 30 days. We won't treat you differently or charge you for using these rights.

9. United States and California

Notice at collection (California)

This section is our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the last 12 months we collected these categories of personal information, from you and your device and from Apple, for the purposes in How we use it:

• Identifiers

  Examples

  Login id, account id and account name, IP address, store transaction ids; and, sent by Unity's library to Unity, the identifier for vendor and a Unity installation id.

  Disclosed to

  DigitalOcean, Apple, Unity Technologies.

  Kept

  Until you delete your Grow Op; transaction ids with purchase records.

• Characteristics of protected classifications

  Examples

  Your age, from your date of birth.

  Disclosed to

  DigitalOcean (hosting only).

  Kept

  Until you delete your Grow Op.

• Commercial information

  Examples

  Purchase records: what you bought, when, and any refund.

  Disclosed to

  DigitalOcean, Apple, Unity Technologies.

  Kept

  As long as we operate Grow Raiders.

• Internet or other electronic network activity

  Examples

  Your game activity, Raids, Replays and server logs.

  Disclosed to

  DigitalOcean; Unity Technologies (purchase events and hardware statistics).

  Kept

  As described in How long we keep it.

• Sensitive personal information

  Examples

  Your anonymous login and the session keys that sign you in to your Grow Op.

  Use

  Only to sign you in. We don't use or disclose it for anything else, so the right to limit its use doesn't apply.

  Kept

  Until you delete your Grow Op.

We don't collect precise geolocation, biometric information, audio or video, employment or education information, and we don't create profiles about you.

No selling or sharing. We don't sell personal information or share it for cross-context behavioral advertising, and we haven't in the last 12 months. We don't knowingly sell or share the personal information of anyone under 16.

Your California rights

California residents have the right to know what personal information we collect, use and disclose (including the specific pieces), to delete it, to correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for using these rights. Since we don't sell or share personal information and use sensitive information only for permitted purposes, there is nothing to opt out of or limit. Use the steps in Your rights. You can also ask through an authorized agent: we'll ask for your signed permission and still confirm the request with you.

Global Privacy Control. We don't sell or share personal information, and neither the game nor this website uses cookies or trackers, so there is nothing for a Global Privacy Control signal to switch off. If you send one, we treat it as a request to opt out anyway.

Do Not Track. This website doesn't track visitors over time or across other websites, so it doesn't change what it does when your browser sends a Do Not Track signal.

Shine the Light. We don't disclose personal information to third parties for their own direct marketing.

Other states

Residents of other US states with privacy laws can use the same rights. If we decline your request, you can appeal by replying to our answer with "Appeal" in the subject. We'll answer the appeal within 45 days, and if we still decline, you can contact your state's attorney general.

10. Canada and Quebec

We handle personal information of players in Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25).

• Consent. By playing, you consent to the collection, use and sharing described in this policy, for the purposes it names. You can withdraw consent at any time by deleting your Grow Op.
• Person in charge. The person in charge of the protection of personal information is our Privacy Officer, at privacy@growraiders.com.
• Your rights. You can access and correct your information, get it in a structured, commonly used format, withdraw consent, and be told about decisions made automatically about you and have a person review them (see Automatic decisions).
• Outside Quebec and Canada. Your information is stored and processed in the United States (see Where it's stored).
• Privacy incidents. If an incident involving your information creates a risk of serious harm, we will tell you and the authorities the law requires us to tell, and we keep a record of incidents.
• Complaints. Please write to us first. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information du Québec.

11. Children and minors

Grow Raiders is for adults 18 and older and is rated 18+ on the App Store. We don't knowingly collect personal information from anyone under 18, apart from the age check itself.

If someone enters a date of birth that shows they are under 18, the game doesn't let them play and no Grow Op is created. We keep only the anonymous login and the date entered, so the game gives the same answer the next time the app opens on that device; the game opens on their 18th birthday. The screen they see says the check was automatic and how to ask a person to review it, links to this policy, and has a Delete this record button that deletes the login and the date at once. A parent or guardian can also ask us to delete it at privacy@growraiders.com.

If we learn that a player is under 18, for example from an email, we close their Grow Op and delete their information, except purchase records the law requires us to keep. If you believe someone under 18 is playing, please tell us.

12. Security

• All traffic between the app and our servers is encrypted with TLS.
• Only the game's own interface is open to the internet. The database and our internal game service run on a private network and accept connections only from our servers, and our admin console can be reached only through an encrypted connection to the server, by the people who run it.
• Your date of birth is never sent back to the app or shown to other players. Only our server, and the few people who run it, can read it.
• Secrets such as server keys are kept out of the app and out of our code.

No system is perfectly secure, but we work to protect your information and fix problems quickly.

13. Where your information is stored

Our servers are in the United States (DigitalOcean, San Francisco). If you play from Canada, your information is transferred to, stored and processed in the United States, where it may be accessible to courts and authorities under US law. Our service providers may process information in other countries under their own safeguards.

14. This website

growraiders.com is a plain website with no cookies, no analytics, no trackers, no forms and no content loaded from other sites. Its host, GitHub, receives your IP address and request details, as described in GitHub's privacy statement. Links to the App Store take you to Apple's website, which is covered by Apple's privacy policy.

15. Changes to this policy

If we change this policy, we'll update the effective date at the top. If a change matters to how we handle your information, for example a version of the game that adds chat or names, we'll tell you in the game or on this page before it takes effect.

16. Contact us

Privacy questions and requests: privacy@growraiders.com (Privacy Officer, Venture Deals, Co., California, USA).
Help with the game: support@growraiders.com.