Privacy Policy
Effective date: 24 August 2026 · Last updated: 24 August 2026
This policy explains what Paper Meteor does with your information when you play our games. It applies to every game we publish, on every platform we publish them on. Section 12 lists the games it currently covers and sets out anything specific to each one.
Throughout this policy, "we", "us" and "Paper Meteor" mean Paper Meteor, the publisher of the games listed in section 12. "Our Games" means those games together with any related websites and support services we run.
1. Summary
This section summarises the policy. It does not replace what follows, and you should read the rest.
- We do not ask you to create an account. We do not know your name.
- Our Games contain no advertising and no advertising software.
- Our Games contain no analytics software and no crash reporting software.
- Your saved game stays on your device. We cannot read it.
- If you buy something, we keep a record that you bought it, so we can give it back to you when you reinstall or change phone. That record is the only personal information we hold.
- If you never buy anything, our games send no information about you to anyone.
- We do not sell your personal information and we never have.
2. Who we are, and who is responsible for your data
Paper Meteor is the data controller for the information described in this policy. That means we decide what is collected and why.
- Controller: Paper Meteor
- Location: Washington State, United States
- Privacy contact: support@papermeteor.com
We do not publish a street address on this page. If you need our postal address for a legal or regulatory purpose, ask at support@papermeteor.com and we will give it to you. Our contact details also appear on our developer page in each store that carries Our Games.
Write to support@papermeteor.com with any question about this policy or about your own information. Section 9 explains what you can ask us to do and how long we take.
3. Information we collect
3.1 Purchase records
If you buy something in one of Our Games, Google Play takes the payment and RevenueCat, Inc. checks the receipt and records what you now own. RevenueCat receives three things:
- the identifier of the product you bought;
- the purchase token that the store issued for that transaction; and
- an anonymous installation identifier that RevenueCat generates on your device.
We use that record for one purpose: to know which content belongs to you, so the game can unlock it and so you can restore it after a reinstall or on a new device.
We never pass a name, an email address or a device identifier to RevenueCat. Our Games use RevenueCat's anonymous installation identifier and nothing else, so the purchase record does not identify you.
3.2 Payment details
We never receive or store your card number, bank details or billing address. The platform store takes the payment and does not share those details with us.
3.3 What we do not collect
Our Games do not collect your name, email address, telephone number, contacts, photographs, files, location, calendar, health data, messages or browsing history. They contain no advertising software and do not read your device's advertising identifier. They contain no analytics software and no crash reporting software.
3.4 Correspondence
If you email us, we hold your message and your email address for as long as it takes to deal with the matter, and for a short period afterwards in case you write again about the same thing.
4. Information stored on your device
Your saved game, which includes your progress, your statistics and your sound and haptics settings, is written to storage on your device. We never receive it and we cannot read it.
Android backs it up for you. Our Android games allow Android Auto Backup. If you have device backup switched on, Android copies the app's data to your own Google Drive and restores it when you set up a new device. That backup belongs to you. We have no access to it and no way to request it. You can switch backup off for all apps in Android Settings, under Google, then Backup, and you can delete an existing backup from Google Drive under "Backups".
Deleting the local save does not cancel a purchase. See section 9.1.
5. Why we process your information, and our lawful bases
For players in the United Kingdom and the European Economic Area, the UK GDPR and the EU GDPR require us to name a lawful basis for each thing we do with your information.
| What we do | Information used | Lawful basis |
|---|---|---|
| Unlock content you have bought, and restore it on a new device | Purchase record (section 3.1) | Performance of a contract, Article 6(1)(b) |
| Detect and prevent fraudulent or invalid purchases | Purchase record (section 3.1) | Legitimate interests, Article 6(1)(f): protecting our revenue and other players |
| Keep records of a sale for tax and accounting | Purchase record (section 3.1) | Legal obligation, Article 6(1)(c) |
| Answer your support or privacy enquiry | Your email address and message | Legitimate interests, Article 6(1)(f): responding to people who contact us |
We do not rely on consent for any of the above, and we do not carry out automated decision-making or profiling.
6. Who we share your information with
We do not sell your personal information. We do not share it for advertising. We do not disclose it to anyone except the service providers named below, who process it on our instructions and under written terms.
| Provider | What they do for us | Where they process | Their privacy policy |
|---|---|---|---|
| Google LLC | Operates Google Play and takes payment for in-app purchases | United States and other countries | policies.google.com/privacy |
| RevenueCat, Inc. | Validates purchase receipts and records which content you own | United States | revenuecat.com/privacy |
We may also disclose information where the law requires it, where a court orders it, or where we need to establish or defend a legal claim. If we sell or transfer the business, information covered by this policy may transfer with it, and this policy will continue to apply until we publish a replacement.
7. International transfers
Paper Meteor is a United States business, and Google and RevenueCat both process in the United States. If you play one of Our Games in the United Kingdom, the European Economic Area, or anywhere else outside the United States, your purchase record reaches servers in the United States.
United States law does not offer the same protections as UK and EU data protection law, and no adequacy decision covers the United States in general. We reduce what that exposure amounts to by holding as little as we can: an anonymous installation identifier and a list of products, with no name, no email address and no device identifier attached to it. Google and RevenueCat encrypt that information in transit and at rest, and they process it only on our instructions and under written terms.
We have not appointed a representative in the United Kingdom or the European Union. Our processing is occasional, involves no special category data, and carries little risk to you, which is the ground on which Article 27 of each regulation excuses a representative. Write to support@papermeteor.com and we will answer a request from anywhere.
8. How long we keep your information
| Information | Retention |
|---|---|
| Purchase record | For as long as the purchase remains valid. Our purchases are permanent unlocks, so we hold these indefinitely unless you ask us to delete the record. |
| Records of a sale required for tax and accounting | For the period our tax and accounting law sets, which runs to seven years from the end of the relevant financial year. |
| Support and privacy correspondence | Twelve months from the date the matter closes. |
| Your saved game | Held on your device, not by us. It goes when you delete it or uninstall the game. |
9. Your rights
9.1 Deleting your saved game
Our Games each carry a reset in the Settings screen. In Moonbrew it is Settings, then Reset progress, and it erases your progress, your statistics and any game in flight.
A reset keeps your purchases, because resetting a save is not a request for a refund. Uninstalling the game removes everything held locally, though a copy may remain in your own Google Drive backup until you delete it there. Restoring your purchases from the in-game shop works either way.
9.2 Deleting your purchase record
Write to support@papermeteor.com and we will delete your customer record from RevenueCat. Deleting it may stop "Restore purchases" from working, because nothing will remain to show what you own. Google Play holds its own record of your order, separate from ours. To have that deleted, contact Google.
9.3 Rights under the UK GDPR and the EU GDPR
If you are in the United Kingdom or the European Economic Area, you have the right to ask us to:
- confirm whether we hold information about you, and give you a copy of it;
- correct information that is wrong or incomplete;
- delete information, where we have no continuing reason to hold it;
- restrict what we do with it while we look into a dispute;
- send a copy to you or to another provider in a portable format; and
- stop processing that we carry out under legitimate interests, where your situation gives you a reason to object.
Write to support@papermeteor.com. We answer within one month, and we will tell you if a request is complex enough to need longer. We do not charge for this. In practice we hold an anonymous identifier and a list of products, so there is rarely much to send.
9.4 Rights for residents of California and other US states
We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding twelve months. We do not process personal information for targeted advertising, and we do not collect sensitive personal information.
In the twelve months before the date of this policy we have collected one category of personal information listed in the CCPA: commercial information, meaning records of products you purchased. Section 3 explains where it comes from, section 5 explains why we hold it, and section 6 names who receives it.
If you live in California, Colorado, Connecticut, Virginia or another state with comparable law, you may ask us to tell you what we hold, to delete it, or to correct it. Write to support@papermeteor.com. We will not treat you differently for asking. If we refuse a request, you may appeal by replying to our answer, and we will review it.
Paper Meteor operates from Washington State. We collect no consumer health data of the kind the Washington My Health My Data Act governs, so we publish no separate consumer health data policy. Washington has no general consumer privacy statute, and we extend the rights in this section to Washington residents on the same terms as everyone else.
9.5 Complaints
Please raise a complaint with us first, at support@papermeteor.com. You also have the right to complain to a data protection regulator.
- United Kingdom: Information Commissioner's Office, ico.org.uk
- European Economic Area: the supervisory authority for the country you live in.
- California: the California Privacy Protection Agency, cppa.ca.gov
10. Security
Our Games send purchase information over encrypted connections. Google and RevenueCat encrypt that information in transit and at rest on their systems. We hold no database of players ourselves, which removes the largest risk to your information, and we keep access to the RevenueCat dashboard limited to people at Paper Meteor who need it.
No system resists every attack. If a breach affects your information and creates a risk to you, we will tell you and the relevant regulator within the time the law allows.
11. Children
Our Games are not directed at children under 13, and we do not knowingly collect personal information from them. We collect no personal information from players of any age beyond what section 3 describes.
If you believe a child has bought something without permission, Google Play's refund process is the quickest route, and you can also write to us. If you believe we hold information about a child, tell us at support@papermeteor.com and we will delete it.
12. The games this policy covers
| Game | Platform | Store identifier | Purchases | Advertising | Analytics |
|---|---|---|---|---|---|
| Moonbrew | Android | com.moonbrew.game | Yes, one-time unlocks | None | None |
Moonbrew requests three Android permissions and no others: INTERNET and ACCESS_NETWORK_STATE, which it uses to reach Google Play and RevenueCat when you buy or restore a purchase, and com.android.vending.BILLING, which lets it offer in-app purchases at all. It asks for no access to your camera, microphone, location, storage or contacts.
We add a row to this table whenever we release a game. If a future game collects anything this policy does not describe, we will say so in its row and update the sections above before that game goes on sale.
13. Changes to this policy
We update this policy when what we collect changes. When we do, we change the effective date at the top and publish the new version before the change reaches players. Adding advertising or analytics to a game would be that kind of change, and it would also change what we declare on that game's store listing.
We keep previous versions and will send you one on request.
14. Contact
Paper Meteor
Washington State, United States
support@papermeteor.com
We answer privacy mail at that address. Section 2 explains how to get our postal address if you need it.