Manga Craft — Privacy Policy

Effective 19 September 2026 · Version 1.4 Oddly Effective LLC

What changed in 1.4. Four corrections, so this page says exactly what the game does. The advert library starts the first time you ask for a sponsor page, not when the game opens. Layers never receives your Story Code: it tells installs apart by a random ID it makes on your phone. Layers does not count the app being opened. On Android, Layers receives the install referrer from Google Play — which store listing or link an install came from. Sections 1, 3, 6 and 11 are corrected; the full list is in section 21.

What changed in 1.3. This page now describes the new version of the game. It adds our own small game server (Supabase), which the game uses for four things: friend codes and the rewards they earn, notes you asked for (for example, "your trees are planted"), the Real World record, and error reports. It explains the Delete local data button in Settings, and that playing together live now uses a short Gate Key instead of a Story Code. The full list is in section 21.

What changed in 1.2. Section 12 now says what the age question changes: a player under 13 gets child-directed advert requests only, and the share-loop counter (Layers) is never started for them. Sections 1, 5, 6 and 11 now say the advert library starts when the game opens, after the age question, rather than only when a page is requested. The full list is in section 21.

What changed in 1.1. The game now has sponsor pages: an advert you can choose to watch in exchange for in-game money. Version 1.0 of this page said there were no adverts, and promised that if that ever changed the page would be updated before the version containing them was released. This is that update. The adverts are non-personalised for everybody, in every country, with no way to turn personalisation on — so nothing in section 3 below has been taken away. Section 11 says exactly how it works.

Manga Craft is a voxel sandbox game published by Oddly Effective LLC. We built it to collect as little as we possibly can, and this page says exactly what it touches, why it touches it, who else sees it, and how long anyone keeps it.

We have written this in plain language rather than legal boilerplate, because a privacy policy nobody can read protects nobody. Where the law requires specific wording, that wording is included and marked.

If anything on this page does not match what the app actually does, this page is wrong and we want to hear about it: start@oddlyeffective.com

Contents

1. The short version
2. Who we are
3. What we never collect
4. What stays on your device
5. What leaves your device, and to whom
6. The complete data table
7. Purchases and subscriptions
8. Notifications
9. Playing with a friend
   • 9A. Our game server
10. Crash reports
11. Advertising
12. Children
13. How long anything is kept
14. Security
15. Your rights
16. For people in the EEA, UK and Switzerland
17. For people in California
18. For people in other US states
19. International transfers
20. Our sub-processors
21. Changes to this policy
22. Contact

1. The short version

We do not ask who you are. There is no account, no sign-up, no email address, no password, no username. We cannot identify you and we do not try to.

The app talks to these services and no others:

• Apple or Google, to take a payment
• RevenueCat, to remember what you bought so we can unlock it again
• OneSignal, to send you a notification — only if you allow it
• Unity Gaming Services, to connect you to a friend — only if you choose to play together
• Google AdMob, for the sponsor pages — it starts the first time you ask for one, never before
• Layers, to count whether sharing a Story Code brings a new reader in — see section 3
• Our own game server (Supabase), for friend codes and their rewards, the notes you asked for, the Real World record and error reports — see section 9A

Everything else — your worlds, your photographs, your progress, your settings — stays on your phone and is deleted when you delete the app.

About the adverts. There are sponsor pages, and you decide whether one ever plays. You press a button, an advert runs, you get in-game money. There is no banner, nothing at a loading screen, and nothing that starts on its own. Every one of them is non-personalised: it is chosen by where you are in the world and nothing about you. We do not read your advertising identifier and we do not build a profile of you.

There is one measurement SDK, and it counts one thing: whether a shared Story Code brought somebody new into the game. It is described in full in section 3. There is no chat. We do not sell or share your personal information, and we never have.

2. Who we are

Oddly Effective LLC is the data controller for the purposes of this policy.

We are a small studio. Privacy questions are read and answered by a person, not a ticketing robot, and we aim to reply within a few days and are required to within thirty.

3. What we never collect

This list is deliberately specific, because vague privacy policies hide things.

• No identity. No name, email address, phone number, postal address, password, username, date of birth or government identifier. The game never asks for any of them and has no field in which to type them.

• No precise location. We do not request location permission, do not read GPS, and do not perform IP geolocation ourselves. RevenueCat, OneSignal and Google AdMob each derive an approximate location — a country — from your IP address; see section 6. That is a country, not a position, and we cannot see a map.

• No contacts, photos, files, microphone, camera, calendar, health or motion data. The app requests none of these permissions. If your phone ever asks you to grant one of them for Manga Craft, something is wrong and you should tell us.

• No advertising identifier. The IDFA on iOS and the Advertising ID on Android are never read, and this is still true now that there are sponsor pages. On Android the app strips the advertising permissions out of its own manifest, by both routes that exist: the Google Play services one (AD_ID) and the newer Privacy Sandbox one (ACCESS_ADSERVICES_AD_ID, and with it ACCESS_ADSERVICES_TOPICS and ACCESS_ADSERVICES_ATTRIBUTION). The identifier cannot be read even by the advertising SDK, and the app takes no part in interest topics or attribution reporting. On iOS the App Tracking Transparency prompt is never shown, and without it the IDFA is unavailable to us — we have nothing to ask for, because we ask only for non-personalised adverts, which do not use it.

• One measurement SDK, and only for the share loop. This paragraph said "no analytics SDK of any kind" until 13 September 2026. That is no longer true and we are not going to leave it standing. The app now includes Layers, and it exists to answer a single question: when somebody shares their Story Code, does that bring a new reader in?

  What it counts is four steps — a share made, a friend's code typed, a friend arriving, and a reward paid in in-game money — and, once per install, which link or store listing the install came from. It does not count the app being opened. The identity attached to all of it is a random ID the Layers library makes on your phone, which is gone when you delete the app. It is not your name, your email, an account or your Story Code: the Story Code is never sent to Layers.

  On Android no advertising identifier is sent, and that is enforced rather than promised. The app strips AD_ID out of its own manifest (below), so Google Play Services returns the all-zero placeholder; the SDK's own code turns that placeholder into nothing and never attaches it. We have checked this in the built app, not in the documentation.

  On iOS it does read two things we should name: the IDFV — an identifier Apple gives to this app on this device, which is reset when you delete the app — and whether App Tracking Transparency has been granted, which for this app is always "not asked", because we never show that prompt.

  We still do not know how many people opened the backpack screen. There is no Firebase Analytics, no Google Analytics, no AppsFlyer, no Adjust, no Amplitude, no Mixpanel and no Unity Analytics. Nothing measures how you play. One thing measures whether sharing works.

• No chat, and no user-generated text shared with anyone. There is no text chat, no voice chat, no comments and no profiles. The only things you can type are a player name (up to 16 characters) and names for your worlds. World names stay on your phone. Your player name is shown to a friend while you play together (section 9), and goes nowhere else — so use a nickname, never your real name.

• No biometrics, no fingerprinting. We do not build a device fingerprint and do not attempt to recognise you across apps or installs.

• No sale of personal information, and no sharing for cross-context behavioural advertising, as those terms are defined under California law. We have never done this and have no plans to.

4. What stays on your device

All of the following is written into the app's own private storage on your phone. It is not transmitted to us, it is not backed up to our servers, and there is no cloud save. It is removed when you uninstall the app.

• Your worlds — including each world's Story Code, every block you have placed or broken, what is in your bag and your chests, and where you were standing when you last closed the game
• Your progress — inventory, level, experience, achievements, unlocked recipes, and your in-game currency balance
• Your settings — graphics quality, controls, audio volumes, field of view, and which once-only notes you have already seen
• The birth year you enter at the age gate. This is written to your device's local settings and is never transmitted anywhere, to us or to anyone else. Its only job is to keep the app from enabling anything age-restricted.
• Photographs you take in Photo Mode — saved as ordinary image files in the app's own folder. We never see them. If you want to share one, you share it yourself.

We have no ability to read any of this, and we cannot recover it for you if you lose it. That is the trade-off of a game that does not require an account.

5. What leaves your device, and to whom

Only these services ever receive anything, and several of them only if you choose to switch that feature on.

Nothing else in the app makes a network request that carries information about you.

6. The complete data table

This is every piece of information that leaves the device, what it is for, who receives it, and whether it can identify you.

On IP addresses. An IP address is treated as personal data under EU law, so we name it here honestly rather than hiding it. Every service in this table sees one, because every network request carries one — that is how RevenueCat, OneSignal and Google AdMob each work out which country you are in, as the rows above say. What differs is what happens next:

• Unity Relay uses it to route packets between two players during a session you started. We never see it, never store it, and it is not retained after the session ends.
• RevenueCat, OneSignal and AdMob derive a country from it and do not pass it to us.
• We never receive, log or store an IP address ourselves, from any of them.

An earlier version of this page said the IP address was used "only to route packets between two players". That was too narrow and it is corrected here.

7. Purchases and subscriptions

Payments are handled entirely by Apple (App Store) or Google (Google Play) under their own privacy policies. We never see your card number, your billing address, your bank, or your legal name. We receive only a confirmation that a purchase succeeded.

To know which purchases and subscriptions to unlock for you, the app uses RevenueCat, a purchase-management service. RevenueCat receives:

• a random identifier the app generates for your installation, not linked to you
• your purchase and subscription receipts as issued by Apple or Google
• your device model, operating system version and app version
• a country derived from your IP address, so prices display in the right currency

RevenueCat does not receive your name, your email address or your payment details. Their privacy policy: https://www.revenuecat.com/privacy

Managing or cancelling a subscription is done through your Apple ID or your Google account, not through us. We cannot cancel a subscription on your behalf and we cannot issue a refund — those are the store's to give. Refund requests go to Apple or Google.

8. Notifications

Notifications are entirely optional. The game asks once; if you decline, nothing in this section ever happens, and the app works normally without them.

If you allow them, the app uses OneSignal to deliver them. OneSignal receives:

• a push token issued by Apple or Google — the address a notification is delivered to. It is meaningless outside the push system and is revoked the moment you turn notifications off.
• your device model and operating system version, so a notification renders correctly
• your language and timezone, so a message arrives at a reasonable hour in a language you read
• a country derived from your IP address

OneSignal does not receive your name or email address, because we do not have them to give.

Notes our server sends for you. A few notes are about your own things: "your trees are planted" after a Real World pack, "your daily gift is ready" or "your suit loan ends tomorrow" after you leave the game, and "your Light Tracing trial ends in two days". For these, the game tells OneSignal your RevenueCat app user ID (a random number, section 7) so a note can reach this phone, and asks our game server to schedule the note. Every word of every note is written on our server — the game only asks for one of a short fixed list. Nothing is sent unless you allowed notifications and left the Game updates switch in Settings on.

Live Activities (iPhone). When the trees from one of your Real World packs are planted, iOS can show it on the lock screen and in the Dynamic Island. It uses the same OneSignal connection and nothing more.

You can turn notifications off at any time in your phone's settings, or in the game's own options. Doing so revokes the token and stops all of the above. OneSignal's privacy policy: https://onesignal.com/privacy_policy

9. Playing with a friend

Manga Craft can be played entirely alone, and is by default. Nothing in this section happens unless you deliberately open your world to a friend (Pause › Play Together) or join someone else's with the short Gate Key they give you. (A Story Code is different: it makes your own copy of the same world on your own phone, with nobody else in it.)

When you do, the app uses Unity Gaming Services — specifically Relay and Authentication — to connect the two devices. For the duration of that session:

• Unity Authentication issues an anonymous player ID: a randomly generated value tied to the installation, not to you. No email, no account, no sign-in.
• Unity Relay handles the IP addresses of both players in order to route the connection between them. This is how any online game works; there is no way to connect two devices without an address to send packets to.
• Game state — which blocks changed, where each player is standing, the player name each of you chose and which suit each of you wears — passes between the devices through that relay.

There is no chat, no voice and no profiles. The only things your friend learns about you are the player name you chose and what you build.

None of this is retained by us after the session ends. We operate no game servers of our own and store no session records. Unity's policy: https://unity.com/legal/game-player-and-app-user-privacy-policy

A word of caution about Gate Keys. A Gate Key lets someone into your world while it is open. It contains nothing about you, but anyone who has it can join while the gate is open. Share it only with people you actually want in your world, the same way you would treat the code to any private room.

9A. Our game server

We run one small server of our own, on Supabase. It holds no names, emails or accounts — only the random numbers described below. The game uses it for four things:

• Friend codes. When you share a page, the game tells the server "this world's Story Code is shared by this player" (the random RevenueCat app user ID, section 7). When somebody joins with your code, the server notes that you are owed a reward, and pays it to you in in-game money the next time you open the game. If they later make their first purchase, the server checks that purchase with RevenueCat before paying your bonus. Rewards are only ever in-game money, never real money. The friend's code is also saved on the new player's RevenueCat record, so the reward survives a reinstall.
• Notes you asked for — see section 8.
• The Real World record. After a Real World purchase, the store's own server notice reaches our server through RevenueCat. Seven days after the sale is final, the server pays the supplier (1ClickImpact) to do the work, records the supplier's reference and gives the pack a Receipt Code. The public record at mangacraft.world/impact shows Receipt Codes and totals only — never a transaction ID. The game can show you your own packs by asking about your own transaction IDs; the server answers for those and nothing else.
• Error reports — see section 10.

It also reads, without sending anything about you, a short list of switches we can change without releasing a new version (for example, a maintenance notice).

Delete local data. Settings › Delete local data wipes the game on your phone and asks our server to forget you: pending notes are cancelled and your OneSignal user is deleted. Friend-reward records hold only random numbers; if you want those removed as well, write to us (section 22) and we will delete them.

10. Crash reports

When the game hits an error, freezes, or crashes, it sends us a short error report of its own. A report contains: the error message and where in the game's code it happened, what the game was doing at the time, how long it had been open, the app version, the phone model, the operating-system version and the graphics chip, and a random number that changes every time the game is opened. It never contains your name, email, any device or advertising identifier, your Story Code, your purchases or anything you typed. If the phone is offline, the report waits on the phone and is sent the next time the game opens.

Reports are stored in our own database (Supabase) and read only by us. We use them for exactly one thing: fixing whatever went wrong.

Separately, if you have enabled "Share with App Developers" on iOS, or the equivalent usage-and-diagnostics setting on Android, Apple or Google may pass us anonymous crash logs. That part is controlled entirely by your phone's settings, not by us.

11. Advertising

Manga Craft has sponsor pages, and nothing else. A sponsor page is a video advert that plays only because you pressed a button asking for one, and pays you in-game money when it finishes. Google AdMob supplies it.

Every advert is non-personalised, for everybody, everywhere. This is not a setting and there is no way to turn it on — not in the app, not by region, not for anyone. The advert you see is chosen from where you are in the world and the language your phone is set to, and from nothing about you. We never give an advertiser a profile of you, because we have not got one.

What there is not. No banners. No interstitials. No advert at a loading screen, on the death screen before you have read it, at the start of a session or at the end of one. No advert that begins on its own. No advert anywhere in the menus. Three places in the game offer one and all three are a button you have to press.

What is sent, and when. The advert library starts the first time you ask for a sponsor page — never before, and never for a page you did not ask for. From then on Google AdMob receives your device model, your operating system and app version, your language, and the country your connection appears to be in. If you told us you are under 13, every request is marked as directed to a child, and Google then serves only adverts suitable for children. It also uses an identifier for that one advert, so that it is counted once, paid for once, and so that advert fraud can be detected. That identifier names an advert, not a person, and it is not linked to you.

What is not sent, ever. Your advertising identifier — the IDFA on iOS, the Advertising ID on Android. On Android the app does not even declare the permission needed to read it. On iOS the App Tracking Transparency prompt is never shown, because we are not asking to track you and a non-personalised advert does not need it.

RevenueCat's part in it. RevenueCat does not supply adverts and does not choose them. It is told that a view completed, which of the three places it happened in, and what the advert paid, so that advert money and subscription money appear as one number in one dashboard, and so that the game can be sure a view really finished before paying you. It receives nothing about you that it does not already have from section 6.

Subscribers see none of it. If you subscribe to the Monthly or Yearly Pass, no sponsor page is ever offered and the advertising SDK is never asked for one. The buttons that would offer a page are not shown at all, and pressing a roadside board tells you there is nothing on it.

It costs us money to do it this way. A non-personalised advert earns roughly a third to a half less than a targeted one in most countries. We decided that was the right trade and we are telling you so you know it was deliberate rather than accidental.

12. Children

Manga Craft is not directed at children under 13.

We know a blocky building game attracts younger players regardless of intent, so we have built the app so that there is nothing for a child to give away: no account, no chat, no profile, no advertising identifier, and no way to type anything that reaches another person.

If the age question says a player is under 13, two things change on that device:

• The measurement SDK (Layers, section 3) is never started. Nothing about how that player shares or plays is counted.
• Every advert request is marked as directed to a child, so Google AdMob serves only adverts suitable for children. The sponsor pages stay non-personalised, as they are for everybody, and are requested at a content rating no higher than the game's own.

The age gate on first launch asks for a birth year, with no year filled in for you. That year is written to your device's local settings and is never transmitted — not to us, not to any third party. The app uses the answer only on the device, for the two changes above.

We do not knowingly collect personal information from children under 13, in the sense of the United States Children's Online Privacy Protection Act (COPPA), nor from children under 16 in the sense of the GDPR. Since we do not collect personal information from anyone, there is nothing for us to have collected.

If you are a parent or guardian and you believe a child has somehow provided personal information to us, write to start@oddlyeffective.com and we will investigate and delete anything found. In practice, everything a child does in this game stays on the device they did it on, and uninstalling removes it.

13. How long anything is kept

We hold no personal database of our own. There is no customer list, because there are no customers we can name. Our game server holds only the random numbers in section 9A.

14. Security

We reduce risk mainly by not holding anything worth stealing. There is no user database to breach, because there are no user accounts.

Beyond that: all network traffic between the app and the services named here uses encryption in transit (TLS). The services we rely on — Apple, Google, RevenueCat, OneSignal, Unity — maintain their own security programmes, which you can read about in their policies linked in section 20.

No system is perfectly secure. If you find a vulnerability in Manga Craft, please tell us at start@oddlyeffective.com before telling anyone else, and we will work with you.

15. Your rights

Because we hold no personal information that identifies you, there is generally nothing for us to export, correct or delete on our side. In practical terms:

We will answer any privacy request within 30 days, and we will not charge you for it or treat you differently for having asked.

16. For people in the EEA, UK and Switzerland

Oddly Effective LLC is the controller of the limited data described in this policy.

Legal bases. Under the UK and EU General Data Protection Regulation we rely on:

The consent notice. If you are in the EEA, the UK or Switzerland, the first launch shows Google's consent notice before any advert is ever requested. It lists the advertising vendors and what each does, and your answer is stored on your device and honoured on every request afterwards. You can reopen it and change your answer at any time.

We show it even though our adverts are non-personalised, because Google requires a certified consent platform for these regions regardless, and because you are entitled to see the vendor list whichever kind of advert it is. If you decline, no sponsor page is ever requested and the buttons that offer one say so; nothing else in the game changes.

Your rights under the GDPR are to access, rectify, erase, restrict, object, and to data portability, plus the right to withdraw consent at any time without affecting processing already carried out. Exercise any of them by emailing start@oddlyeffective.com.

We are honest that these rights have limited practical content here: we cannot produce a copy of "your data" because we hold none that identifies you. We will say so plainly rather than sending you an empty file.

Automated decision-making. There is none. No profiling, no scoring, no automated decision that produces legal or similarly significant effects.

Complaints. You have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your national data protection authority. We would rather you told us first, but it is your right either way.

17. For people in California

Under the California Consumer Privacy Act as amended by the CPRA:

Categories of personal information collected in the last 12 months:

Sources: directly from your device, and from Apple or Google when a purchase completes.

Business purposes: delivering purchases, restoring them, sending notifications you asked for, connecting co-op sessions, fixing crashes, and showing a sponsor page when you ask for one. Nothing else.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We never have, and adding the sponsor pages has not changed it. "Sharing" under the CPRA means disclosing personal information for cross-context behavioural advertising — advertising targeted using information about you gathered across apps or sites. Our adverts are non-personalised by construction: no advertising identifier is read, no profile is built, and nothing about you is used to choose what you see. That is the definition not being met, not a loophole being used.

There is therefore no "Do Not Sell or Share My Personal Information" link, because there is nothing to opt out of. If that ever changes, we will add one before it does.

Your California rights are to know, delete, correct, opt out of sale or sharing, limit use of sensitive information, and not to be discriminated against for exercising any of them. Email start@oddlyeffective.com. We do not require an account to make a request, and we will not create one in order to verify you.

18. For people in other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have broadly similar rights to those described in sections 16 and 17 — to access, correct, delete, and to opt out of targeted advertising, sale, and profiling.

We do not conduct targeted advertising, do not sell personal information, and do not profile. Requests go to the same address: start@oddlyeffective.com.

19. International transfers

Oddly Effective LLC is based in the United States. The services named in section 20 process data in the United States and, in some cases, in other countries where they operate infrastructure.

If you are in the EEA, the UK or Switzerland, the limited technical data described in this policy is transferred to the United States. Where a transfer requires a safeguard, our processors rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and several participate in the EU-US Data Privacy Framework. The current position for each is stated in that processor's own policy, linked below.

20. Our sub-processors

The complete list. If one is added, this page is updated before the version that adds it ships.

That is the whole list.

The sixth entry is new, and this paragraph used to deny it existed. Until 14 September 2026 this section said Layers "is switched OFF at the build level… it never runs, never initialises, and sends nothing", and that it was "listed nowhere above because a sub-processor that receives nothing is not a sub-processor." Every word of that is now wrong. MC_LAYERS went into both platforms' build defines on 13 September 2026 (LOOP L2), so the code that starts it is compiled in and it does run.

Section 3 was corrected the same day and this section was not. That is exactly the failure this policy promises not to commit, so it is recorded here rather than quietly repaired: for one day, two sections of this page contradicted each other, and the one you are reading was the false one. What Layers receives is in section 6, and the full account of what it counts — and what it is prevented from reading — is in section 3.

21. Changes to this policy

If a future version of Manga Craft collects something not described here, this page will be updated before that version is released, and the effective date and version number at the top will change.

Where a change is significant — a new category of data, a new processor, or advertising — we will additionally tell you inside the app, and where the law requires it, ask you first.

We will not make a change quietly and hope you do not notice. If you ever find that the app does something this page does not describe, that is a mistake on our part and we want to be told.

Version history

22. Contact

Oddly Effective LLC — United States

Privacy and support: start@oddlyeffective.com

A person reads this address. Our full registered business address is on file with the App Store and Google Play and is shown on our store listings; if you need it in writing for a formal request, ask and we will send it.