Privacy Policy

“Even a stick fires once a year” (Stick) for Android and iOS.
Effective October 13, 2026.

In short

There is no sign-up: the app never asks for your name, email or phone number and does not use location services. To run the game, our server keeps an anonymous record of your game. To see how many people play, the app sends anonymous usage statistics to PostHog and to Google Analytics for Firebase (see “Analytics”). If the app crashes, a crash report goes to Firebase Crashlytics (see “Crash reports”). The app shows Google AdMob ads: a banner at the bottom of the screen and, sometimes, a full-screen ad when you return to the app. Google's ads SDK collects the data described under “Ads”. On iPhone, a one-time No ads purchase turns the ads off (see “Purchases”).

What our server stores

On first launch the server creates a game record containing:

• a random identifier and a hash of a secret key. The key itself stays on your device, in secure storage. On Android, a copy of it is included in the app's data backup if Google backup is turned on. The same key is your recovery code: the app shows it in the menu so you can save it yourself;
• your time zone as an offset from UTC (for example, +3 hours), so that each day starts at your midnight;
• the date the game started and a secret random number that decides which days the stick fires;
• for every day you tap the stick: the day number, the result (shot or misfire), what fell out of the barrel and the time of the tap.

With every tap the app also sends the hemisphere (northern or southern), which it works out from the phone's region, so that finds match the season. The hemisphere itself is not stored, though a saved find shows which season it was for you that day.

This data is used only to run the game: counting days and years, deciding the shots and showing your stats. We don't link it to your identity, don't use it for advertising and don't share it with anyone.

Where the server runs

The server and its database are hosted on Cloudflare (Workers and D1). Cloudflare processes your device's IP address to deliver requests, but our code does not store it. To choose the analytics policy, the server uses Cloudflare’s connection-based country signal. The country is not saved in the game record; GPS and device location permissions are not used. Cloudflare's policy: cloudflare.com/privacypolicy.

Analytics

To see how many people play and come back, the app sends usage statistics to PostHog (PostHog Inc., servers in the US) and to Google Analytics for Firebase (Google LLC). Both services process this data on our behalf. On first launch each of them creates its own random anonymous identifier on your device, and the app sends it along with:

• events and their time: installing and updating the app, opening and backgrounding it, tapping the stick (the result, the game day, what fell out of the barrel and whether it was the first), seeing the connection error screen, turning the reminder on (with the chosen hour) or off and opening the app from the reminder, opening the share sheet (with the game year), opening the menu, opening the album of finds, viewing and saving the recovery code (by copying or sending it), restoring from a code or failing to (with the reason), seeing Google Play's offer of a new version of the app and the answer to it, and the new version downloading, failing to download and being restarted into, opening the No ads card, buying it, restoring it (whether the purchase was found) and failing to (with the App Store's error code). The recovery code itself is never sent to analytics;
• events Google Analytics records by itself: first launch, updating and removing the app, clearing its data, operating system updates, time spent in the app and its screens changing, and an app_exception event on a crash (see “Crash reports”);
• information about your device and the app: device model and manufacturer, screen size, operating system and app versions, language and time zone;
• your country and city, which PostHog and Google estimate from your IP address. The IP address itself is not stored.

Analytics does not receive your advertising ID and is not linked to your game record on our server. We only look at it as aggregate statistics and don't use it for advertising. You can enable or disable both services in Menu → Analytics. Your choice is saved on your device and is independent of advertising consent or a No ads purchase. Disabling stops usage-statistics transmission and discards PostHog’s unsent queue; data already sent is not automatically deleted.

The app uses regional rules for limited usage statistics without advertising profiling. In the European Economic Area, the UK, Switzerland, Argentina, Chile, Colombia, Peru, Uruguay, China, Malaysia, Turkey and Vietnam, the app asks separately for analytics consent before enabling it. In other countries, including Georgia, the US and Brazil, these statistics are enabled by default to improve the game; you can disable them in the menu. If the country cannot be determined, analytics remains off until you make an explicit choice. The app checks the region again when it returns to the foreground if you have not made an explicit choice. PostHog's policy: posthog.com/privacy. How Firebase handles data: firebase.google.com/support/privacy.

Crash reports

If the app crashes, it sends a crash report to Firebase Crashlytics (Google LLC). Google processes the reports on our behalf. A report contains:

• the place in the app's code where it crashed, and the time;
• information about your device and the app: device model, operating system and app versions, screen orientation, free memory and disk space;
• the last events from “Analytics” before the crash, with their parameters;
• a random installation identifier that Crashlytics creates on your device.

Crashlytics also marks a crash with an app_exception event in Google Analytics.

We use the reports only to find and fix bugs. They never contain the recovery code and are not linked to your game record on our server.

Ads

A Google AdMob banner is shown at the bottom of the screen, and a full-screen ad may appear when you return to the app. The Google Mobile Ads SDK built into the app may collect:

• your device's advertising ID (where available) and other device and app identifiers;
• your IP address, which can be used to estimate your approximate location;
• information about your device and the app, ad impressions and clicks, crash and performance data.

Google uses this data to serve and measure ads, for analytics and to prevent fraud. How Google uses data from partner apps: policies.google.com/technologies/partner-sites. You can manage ad personalization in Google's My Ad Center (myadcenter.google.com) and in your device settings, for example by deleting or resetting your advertising ID.

On iPhone, the app asks once for permission to track (App Tracking Transparency). If you don't allow it, your device's advertising identifier (IDFA) is not shared and ads are not personalized with it. You can change your choice in iPhone Settings → Privacy & Security → Tracking.

If you bought No ads, the ads SDK never starts: no ads, no requests to Google for them, no consent form and no tracking prompt.

In the European Economic Area, the UK and Switzerland, the app asks for your consent through Google's consent form before showing ads. You can change your choice at any time with the “Ad settings” link below the calendar page.

Purchases

On iPhone you can buy No ads once. Apple handles the payment through the App Store: we never see your payment details or Apple ID. The app only learns from the App Store whether the purchase exists, and remembers that answer on your device. Apple's policy: apple.com/legal/privacy.

Sharing

We don't sell data. Data on our server is not shared with anyone. Usage statistics are processed by PostHog and Google on our behalf, as described under “Analytics”, and crash reports by Google, as described under “Crash reports”. Data collected by the ads SDK goes to Google as described under “Ads”. Purchases are handled by Apple, as described under “Purchases”.

Retention and deletion

Your game record is kept for as long as the service runs: the game is designed to last a hundred years. Only you hold the key to it: on your device, in your Android backup and wherever you saved your recovery code. Without the key, the record cannot be linked to you or your device, and if the key is lost, the game cannot be restored. We keep usage statistics in PostHog only as long as we need them for analysis. In Google Analytics, data tied to a device identifier is kept for 2 months, after which only aggregate statistics remain. Crashlytics keeps crash reports for 90 days. For any question about your data, including deletion, email the address below.

Children

The app is intended for adults, not children. We do not knowingly collect data from children.

Changes

If this policy changes, the new version will be posted on this page with a new date.

Contact

Privacy questions: magicilusha@gmail.com