Privacy policy
Torpedo: Sea Battle 2 Player (iOS) and playtorpedo.com. Last updated October 9, 2026.
This policy explains what the Torpedo app and this website collect, who receives it, and the choices you have. It is Torpedo’s own copy of the Torpedo section of the Appalex policy at appalex.hu/privacy, extended with this website. We comply with the EU General Data Protection Regulation (GDPR) and applicable US privacy laws.
1. Who we are
Appalex Limited (Appalex Kft.) (“we”, “us”)
1012 Budapest, Logodi utca 48. A. lház. 1. em. 2. ajtó, Hungary
Company registration: 01-09-433441 · Tax number: 32612600-2-41
Email: info@appalex.hu · Phone: +36 70 213 3578
Data protection contact: info@appalex.hu
2. In short
- Torpedo has no sign-up or login and never asks for your real name (your display name can be anything), email, phone number, contacts, photos or precise location.
- The game shows ads through Google AdMob and partner ad networks. Ads are personalized only if you allow it.
- We use Google Analytics for Firebase, Crashlytics and Remote Config to run and improve the game, and RevenueCat for purchases.
- We do not sell your personal data for money. Some US state laws treat advertising data sharing as a “sale”; you can opt out (section 10).
- This website sets no cookies and runs no analytics or ads.
3. What the app collects and who receives it
No account. The app creates a random ID when it is first opened. It identifies the install, not you, and is synced through your own iCloud so a new device keeps the same ID.
| Service | What it receives | Why |
|---|---|---|
| Google AdMob with the User Messaging Platform (Google LLC, USA) | The app-specific device identifier (IDFV); the advertising identifier (IDFA) only if you allow tracking; coarse location derived from your IP address; ad requests, impressions, clicks and the revenue of each ad; device and diagnostic information; your consent choices. | Showing ads that keep the game free, measuring them, preventing ad fraud, and asking for and storing your consent where the law requires it. |
| Ad networks through AdMob mediation: AppLovin, Unity Ads, Meta Audience Network, Liftoff Monetize (Vungle), Mintegral, Pangle, InMobi, ironSource | When their software starts with the ad SDK and when they bid for an ad: the IDFV; the IDFA only if you allow tracking; coarse location derived from your IP address; device, network and app information; ad requests, impressions and clicks; your privacy choices (EU consent signals, a US “do not sell or share” choice, and whether you are a minor). | Bidding for and showing ads, measuring them and preventing ad fraud, each under its own privacy policy: AppLovin, Unity, Meta, Liftoff, Mintegral, Pangle, InMobi, ironSource. |
| Google Analytics for Firebase (Google) | Gameplay and shop events (for example battles started and finished, rewards claimed, offers seen, purchases and refunds with their value), ad impressions with their revenue, the Apple Ads campaign that led to the install, the random app ID, the Firebase app instance ID, device model, OS and app version, language, and country or region derived from your IP address. | Understanding how the game is played, balancing it, fixing problems and measuring our own advertising. Purchases are also reported to Google Ads as conversions, but only when ad signals are allowed (section 4). |
| Firebase Crashlytics (Google) | Crash reports and other diagnostics (stack traces, device model, OS version, free memory and disk), the random app ID and the Firebase installation ID. | Finding and fixing crashes. |
| Firebase Remote Config (Google) | The Firebase installation ID, app version, language and country. | Tuning game settings and running experiments (for example offer prices or ad frequency) without an app update. |
| RevenueCat Inc. (USA) | Your App Store transactions (product, price, currency, dates, renewal status) under the random app ID; the Apple Ads attribution token; the IDFV; the Firebase app instance ID; and each AdMob ad load, impression, click and paid event. | Confirming what you own, restoring purchases, managing the Admiral Club subscription, and measuring revenue from purchases and ads. RevenueCat forwards purchases and renewals to Google Analytics under the Firebase app instance ID. |
| Apple Inc. (USA) | In-app purchases made through the App Store; Game Center (your Game Center name, matches, scores, achievements); your progress saved in your iCloud; your answer to Apple’s age range check. When you play a friend in a room, the app saves an “I’m in the room” note in Torpedo’s iCloud database at Apple, filed under a scrambled form of the room code: your display name (your Game Center name if you haven’t chosen one; a neutral name such as “Sailor 4821” for children), whether you made or joined the room, whether your phone will be told when your friend arrives, the time and the app version, plus a random ID that iCloud gives your Apple Account in Torpedo (the same in every room; it doesn’t show your name or Apple Account). Anyone who has the room code can read the note. Your request to be notified, which contains the room code, stays with your Apple Account. | Payments, online and turn-based play, leaderboards, syncing your progress, letting your friend’s device know you’ve arrived in the room, and age-appropriate protections. Apple handles this data under its own privacy policy, except the room note, which Apple stores for us (see section 7); we never receive your payment details or your Apple Account. |
| AdAttributionKit / SKAdNetwork (Apple) | A small conversion value (for example “finished the first battle” or “made a purchase”) that Apple adds to an anonymous, Apple-signed report, only when an ad led to the install. | Measuring which ad campaigns work, without identifying you. |
Stays with you. Your rank, medals, statistics, battle history, coins, pearls, layouts and settings are stored on your device and in your own iCloud storage. Nearby battles are sent directly between the two devices. The age range you share through Declared Age Range stays on the device; only the resulting “child” or “under the age of consent” flag reaches ad requests.
4. Your choices
- App Tracking Transparency. After a few battles, never at launch and never during your first session, Torpedo explains why it asks and then shows Apple’s tracking prompt. If you don’t allow tracking, the IDFA is never read and Google’s ad signals (ad storage, ad user data and ad personalization) stay off, so ads are not personalized and purchases are not sent to Google Ads. Change this any time in iOS Settings › Privacy & Security › Tracking, or in Torpedo’s Settings › Privacy.
- Privacy Choices (EEA, UK, Switzerland and US states with privacy laws). Where the law requires it, Google’s consent form asks how ads and analytics may use your data. Your answer controls Google Analytics storage and ad personalization. Change it any time with the Privacy Choices row in Torpedo’s Settings › Privacy. Until you answer in these regions, Google Analytics stores nothing and receives only cookieless, anonymous pings (Google consent mode).
- US-state opt-out. If you live in a US state with a consumer privacy law, the same Privacy Choices row lets you opt out of the “sale” or “sharing” of your personal information and of targeted advertising. After an opt-out, Torpedo turns Google’s ad signals off, whatever you answered to the tracking prompt.
- Remove Ads. Buying Remove Ads, or an Admiral Club subscription, turns off ads between battles, banners and launch ads. Reward videos remain optional.
- Analytics and crash reports are part of how we run the game and have no separate switch. Outside the EEA, UK and Switzerland, Google Analytics runs for everyone; inside those regions, it follows your Privacy Choices answer. Crashlytics runs for everyone.
- Deletion and access. In Torpedo, open Settings › Support › Contact Support: the email it prepares to info@appalex.hu already contains your random player ID. Write “Delete my data” (or “Send me my data”) and send it. Within 30 days we have the data for that ID deleted from Google Analytics and RevenueCat (or sent to you) and confirm by email; crash reports expire on their own after 90 days. Deleting the app and turning off iCloud for Torpedo removes your game data from your devices and your own iCloud storage. Room notes aren’t linked to your player ID. If Torpedo couldn’t delete yours (section 7), email info@appalex.hu with the room code and we will delete the note, or send it to you, within 30 days. We can’t delete the request to notify you: it stays with your Apple Account, and Torpedo removes it the next time you open the app.
5. Children
Torpedo is rated 9+. Where available, it asks iOS for your age range through Apple’s Declared Age Range feature (never your birth date). If you are declared to be under 13, Torpedo:
- shows only child-directed, non-personalized ads rated G (General Audiences), with AdMob’s child-directed treatment for the Children’s Online Privacy Protection Act (COPPA);
- serves those ads from Google AdMob alone: the other ad networks listed above are not started and receive no ad requests;
- never shows the tracking prompt and never reads the IDFA;
- keeps Google’s ad signals off, so purchases are not reported to Google Ads;
- shows no automatic offer pop-ups.
Players declared to be 13 to 17 get ads tagged as under the age of consent, and every ad network is told not to sell or share their data. Analytics and crash reports are used only to run, secure and improve the game. If you believe we have collected personal information from a child under 13 without these protections, email info@appalex.hu and we will delete it promptly. In the EEA, we follow the age of digital consent of your country (13 to 16).
6. Legal basis (EEA, UK, Switzerland)
Consent for personalized advertising, the advertising identifier and Google Analytics storage (GDPR Art. 6(1)(a)); legitimate interest for non-personalized advertising that keeps the game free, for crash reports, fraud prevention, Remote Config and ad and purchase measurement (Art. 6(1)(f)); contract performance for purchases, restoring them and game features (Art. 6(1)(b)); legal obligation for keeping purchase records (Art. 6(1)(c)).
7. How long we keep data
- Google Analytics for Firebase: event-level data for at most 14 months; aggregated reports that identify no one may be kept longer.
- Firebase Crashlytics: crash reports and their identifiers for 90 days.
- Firebase installation IDs (Remote Config): until deleted on request; then removed from Google’s systems within 180 days.
- RevenueCat: purchase records and the identifiers and ad events linked to them for as long as needed to provide and restore your purchases, and purchase records as required by tax law (up to 10 years); deleted earlier on request where the law allows.
- Room notes (section 3): Torpedo deletes your note and the request to notify you when the battle starts or you leave the room. If iOS closed Torpedo while the room was open, it deletes them the first time you open Torpedo at least 30 minutes later; if you were offline, the next time you open it. If that never happens (you delete Torpedo first), the note stays until you ask us to delete it, and the request to notify you stays with your Apple Account.
- Google AdMob: under Google’s own retention policy (policies.google.com/technologies/retention).
- Ad networks bidding through AdMob: under each network’s own privacy policy (section 3).
- This website’s server logs: see section 11.
Google’s use of data from apps that use its services: policies.google.com/technologies/partner-sites. RevenueCat: revenuecat.com/privacy. Apple: apple.com/legal/privacy.
8. Security
All data is encrypted in transit (HTTPS/TLS). Only authorized people at Appalex can access the analytics, purchase and crash dashboards. We review access regularly. If a data breach occurs, we notify the supervisory authority within 72 hours and affected users where the risk is high.
9. Your rights
You have the right to access, correct, delete, restrict and port your personal data, to object to processing based on legitimate interest, and to withdraw consent at any time. On request we provide your data within 30 days in JSON or CSV. We do not make automated decisions with legal or similarly significant effects. Write to info@appalex.hu, ideally through Torpedo’s Contact Support so your player ID is included.
10. US state privacy rights and “Do Not Sell or Share”
Residents of California and other US states with consumer privacy laws (for example Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have the right to know, delete and correct their personal information, to opt out of its sale or sharing and of targeted advertising, and not to be discriminated against for using these rights. We do not collect sensitive personal information. To appeal a decision on your request, reply to our answer with “Appeal” in the subject.
In the last 12 months, Torpedo has disclosed the following categories to Google for advertising, which some US state laws treat as a “sale” or “sharing”: identifiers (IDFV, and the IDFA if you allowed tracking), internet or other electronic network activity (ad interactions, gameplay and purchase events) and coarse geolocation derived from the IP address. We do not sell or share the personal information of anyone we know to be under 16 without the required consent; players declared to be under 13 get only child-directed, non-personalized ads.
To opt out:
- in Torpedo, open Settings › Privacy › Privacy Choices and opt out of the sale or sharing of your personal information;
- in iOS Settings › Privacy & Security › Tracking, don’t allow Torpedo to track you;
- or email info@appalex.hu with the subject “Do Not Sell or Share”, ideally through Torpedo’s Settings › Support › Contact Support, which adds your player ID.
After an opt-out, Torpedo stops sending ad signals to Google for personalized advertising and ad conversions; you will still see non-personalized ads.
11. This website
playtorpedo.com sets no cookies, runs no analytics, shows no ads and has no forms. It is hosted by Vercel Inc. (USA), which processes the technical data any web server needs to deliver a page (IP address, browser user agent, the page requested and the time) to serve the site and protect it from abuse, under Vercel’s privacy policy. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Links to the App Store take you to Apple, whose privacy policy applies there. If you email us, we use your email only to answer you.
12. International transfers
Some processors are outside the European Economic Area. Google LLC is certified under the EU-US Data Privacy Framework. Transfers to Apple, RevenueCat and Vercel rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914). The ad networks bidding through AdMob use their own transfer safeguards. Details are available on request.
13. Supervisory authority
You can complain to your local data protection authority. Our lead authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11., Hungary, ugyfelszolgalat@naih.hu, +36 (1) 391-1400.
14. Changes and governing law
We may update this policy and will announce material changes in the app. Changes take effect 30 days after posting. This policy is governed by Hungarian law; this does not affect your rights under the data protection laws of your country, including the GDPR and US state privacy laws.
Questions: info@appalex.hu. See also the terms of use.
Version 3.3 · Last updated October 9, 2026