What the game keeps about your garden, where it is kept, what leaves your phone, and how to have it deleted. Short version: your garden stays on your phone. The game sends anonymous play statistics, with no name and no identifier of you or your phone, and you can turn them off in Settings.
Tales of the Sanctuary is a single-player garden game: you tend a pond of koi, raise bonsai, rake a sand garden and watch the seasons and the weather go by. It is published on Google Play by the developer onebitdev. This policy covers the Android app.
The data controller is Dioniso Reale (publishing as onebitdev), an individual developer based in Italy, reachable at nathanreven@gmail.com. There is no company and no data protection officer, and no personal data is sold or shared. The game has no account and no advertising. The only thing we receive is the anonymous play statistics described in section 3, which cannot be tied to you.
The game keeps your progress so that your garden is still there tomorrow. All of it is written to a small database in the app’s private storage on your phone. The table names what is in it, so you can hold the app to it.
| What | Kept where | Detail |
|---|---|---|
| Your garden | Your phone only | The objects you placed and where, your koi (their names, genes, ages and the register of varieties you have seen), your bonsai and how you cared for them, your sand-garden designs, the koban (the game’s coins) you have earned and the daily gifts you have claimed. |
| Settings | Your phone only | Whether sound is on, the pace you chose for the garden’s clock, which pond you dug, the language you chose, and whether anonymous statistics are on. |
| The garden’s clock | Your phone only | The moments at which the garden started and changed pace, so that seasons, weather and ages carry on while the app is closed. They are timestamps from your phone’s clock; nothing about where you are. |
| Postcards | Your phone only | A picture of your garden, made only when you ask for one. It is kept in the app’s temporary cache until you share it or Android clears it. See the next section for what happens when you share. |
| Account, name, email | Not collected | There is no sign-in and no account. The game never asks for your name or email address. |
| Anonymous play statistics | Sent to us, anonymous | How long sessions last, where the time goes, what is done and how far gardens come, with no name and no identifier. Section 3 lists every field. A few counters that make them possible (the day the statistics started, how many sessions there have been, lines waiting to be sent) stay on your phone. You can turn them off in Settings → Anonymous statistics. |
| Crash reports and advertising identifier | Not collected | The game includes no crash-reporting library and never reads the advertising identifier or any other identifier of your phone. When something breaks we only know if you tell us. |
| Location, contacts, photos, microphone, camera | Not collected | The game never requests these permissions and has no access to them. |
| Advertising and purchases | None | There are no ads and no in-app purchases in this version. No payment information is ever handled by the game. |
Because all of this lives on your phone, we cannot read it, restore it or lose it for you.
Two things: the anonymous play statistics described below, and a postcard, if you decide to share one. The game does not upload your garden or your progress and does not download content; the fonts, sounds and pictures it uses are inside the app.
To learn where new players get stuck and what they enjoy, the game sends short summaries of play to a database of ours on Google Firebase (Cloud Firestore), stored in the European Union. Each summary is one of three kinds of line:
Every line also carries the app’s version, the operating system (Android), the language the game is set to, the date, and whether it comes from a test device: our own test phones, or the devices Google uses to test every new version before it is released (recognised, on the phone itself, by a copy of the game installed from somewhere other than Google Play). Lines from test devices are left out of the figures. The time the line arrives is set by the server.
What is never sent: your name, your koi’s names or anything you typed, any identifier of you, your phone or your installation (no device ID, no advertising ID, no account, no random ID kept to recognise you), your location, your contacts, and the contents of your save. Two lines are never linked to each other, so no one can follow one player through them. As with any connection to the internet, the request reveals your IP address to Google’s servers while it is delivered; it is not stored with the statistics and we never see it.
Turning them off. Open Settings in the garden and switch off Anonymous statistics. Nothing more is sent from then on, and any lines still waiting on your phone are deleted.
You can also send out a postcard. When you tap Condividi (“Share”), the game paints the postcard as an image and hands it to the Android share sheet. You choose where it goes — a messaging app, an email, your gallery, or nowhere. Whatever you choose receives that picture under its own privacy policy; we receive nothing.
The postcard shows your garden, the date on the garden’s calendar and a verse. It carries no name, no location and no identifier. Do not add anything you would not want the person you send it to see.
These are the permissions Android lists for the app, and what each is for. None of them is a “dangerous” permission that Android asks you to approve.
The game never asks for the microphone, camera, location, contacts or notifications.
The game includes no advertising or tracking service and no analytics library. One service receives data on our behalf, and two things outside the game are worth knowing about because they are Google’s and not ours.
Your garden stays on your device and we do not receive it. To the extent that keeping your progress on your own phone counts as processing, it is done to provide the game you installed (performance of a contract).
The play statistics are designed to be anonymous: they carry no identifier and cannot be linked to you or to each other. To the extent they could still be considered personal data, they are processed on the basis of our legitimate interest in understanding how the game is played so that we can improve it, used only by us, only in aggregate, and never for advertising or profiling. You can object at any time by switching them off in Settings.
Sharing a postcard happens only when you choose to, and you can stop simply by not sharing.
There is no account to delete. To remove everything the game has stored:
We cannot delete your garden for you, because we never had it. The anonymous statistics carry nothing that would let us find the lines that came from your phone, so a request to delete “your” statistics would have nothing to act on. Switching them off in Settings stops them and deletes any lines still waiting on your phone; lines already sent are deleted after 24 months.
The save lives in storage that Android keeps private to the app: other apps cannot read it without special access to the phone. It is not encrypted beyond the protection Android gives that storage, so anyone who can unlock your phone and open its data could see it. It contains nothing more sensitive than the state of a garden, but keep the usual care of your phone.
No system is perfectly secure, and nothing here promises otherwise.
The game is meant for players aged 13 and over. It has no ads, no chat, no links to other players and no purchases, and it collects no personal data from anyone: the play statistics are anonymous for every player, and can be switched off in Settings.
If you are a parent or guardian and have a question about the game, write to nathanreven@gmail.com.
Depending on where you live, you may have the right to a copy of the data held about you, to have it corrected or deleted, to object to or restrict its processing, and to take it elsewhere. Your garden is on your phone and can be seen and removed there, as described in section 8. The statistics we receive carry no identifier, so we cannot find, copy or correct the ones that came from you; you can object to them at any time by switching them off in Settings.
You are always welcome to write to nathanreven@gmail.com with any question. If you are in the EEA and think your data has been handled badly, you can complain to your national data protection authority; in Italy that is the Garante per la protezione dei dati personali.
The game makes no automated decisions about you.
If a future version adds something that changes this picture — an account, cloud saves, advertising, analytics, purchases — this policy will be updated before that version reaches you, and the date at the top will change with it. Material changes will be announced in the app.
Tales of the Sanctuary — privacy
onebitdev (Dioniso Reale)
nathanreven@gmail.com
Italy
Write in English or Italian; both are read by the same person.