Privacy policy

Thwack

Android and iOS game com.crackoncloud.thwack, published by crackoncloud · Last updated 28 September 2026

1. What the game stores on your device

All of it lives in app-private storage — a local database and a settings file — readable by Thwack and not by other apps. Uninstalling takes every bit of it with you.

• Your progress: each level's stars, best score, the number of attempts and when you first and last cleared it, the shots of your best result, and the stars on each chapter
• A log of your recent shots on each level — the angle, the power, when you tapped, the score and whether the goal was met — kept to the last fifty per level
• Your Daily results: each day's challenge, your score and stars, and your streak — the current run, your best, any freezes and the last day you played
• Your statistics: totals of damage, destruction and wreck, shots fired, levels won and skipped, your biggest hit, your best level, your longest airtime, the payloads you have launched and the collectibles you have found
• Your car skins and when each was earned, the skin and sticker on your car, and your best score in the Test Yard with its seed
• Your Ghost and skip banks, and the moment each last refilled
• Your settings: sound, music, engine sound, haptics, reduce motion, slow motion, screen shake, impact words, the aim arc, the cinematic camera, skip intro, colour-blind colours, the pedal's side, assist controls and their step sizes, the Daily reminder switch, and the two diagnostics switches
• Which coach tips and new-piece cards you have already seen, the screen you were last on, the date of first launch, whether the rating sheet has been shown, and how many levels you have cleared since the last ad
• Whether Thwack Unlocked has been bought, as last reported by the store. It is kept device-local.

None of it identifies you, because none of it is asked for. There is no name, no email, no profile and no sign-in anywhere in this game, and the one field a player can type into — the Test Yard's seed, which takes digits only — never leaves the device. There is no in-app button that deletes your progress: it goes when the app is uninstalled or its data is cleared.

The backup file

Settings › Backup › Export writes one file, thwack-backup-<date>.json, through the system's own file picker, to wherever you point it — a folder on the phone, a drive app, a cable. It holds each level's stars, best score and attempts, your Daily results and streak, your statistics, the car skins you earned by playing, and which coach tips you have seen. It does not carry your settings, the diagnostics switches, the unlock, your shot log or your Ghost and skip banks.

The file is plain, readable JSON — not encrypted, not signed — so treat it as you would any other file you keep. The app never reads it again unless you choose it in Settings › Backup › Import, and an import merges: stars, best scores and statistics keep the higher of the two, attempts are added together, and a file that is not a Thwack backup is refused. Nothing you have is lowered by it. Thwack has no way to send the file anywhere; where you put it, and who else can read that place, is up to you and the app you saved it with.

Your device's own backup

On Android, the game allows the platform's own backup, so if you have Android backup switched on, your device may copy the app's database and settings file — including the unlock flag and your diagnostics choices — into your Google account backup along with everything else on the phone. That is Android's backup of your device, made with your own account and governed by Google's terms — we neither see it nor hold a key to it. On iOS the same is true of an iCloud or an encrypted local device backup. Turning device backup off, or excluding the app from it, stops that copy being made.

2. Permissions, and exactly what each one is for

Permission	What Thwack does with it
Vibrate	The buzz under a hit. Granted at install, never asked for, and idle while the Haptics setting is off.
Internet Network state Wi-Fi state	No level needs a connection: every one is shipped in the app, and the Daily is built on the device. It is here for the store — the purchase, the restore, Android's in-app update check and the rating sheet — for the crash and usage reporting in §3, which the two switches in Settings › Diagnostics turn off, and for the ads in §4. The Wi-Fi state permission is declared by the ad libraries, which read the connection type for an ad request.
Advertising ID Android only	Read by the ad SDK to serve and measure the ads in §4, and used for nothing else. Google's own analytics collection of it is switched off in the build, so this identifier is the ad SDK's and no one else's. A device that has bought Thwack Unlocked never starts that SDK, so nothing reads it there.
Privacy Sandbox ad ID and attribution Android only	Declared by Google's analytics library. The game does no ad attribution of its own, and that library runs only while Usage data is on (§3).
Install referrer	Declared by the libraries in §3 and §4, to ask Google Play which link the game was installed from.
Wake lock	Declared by Google's analytics library, to finish sending a batch of usage events while Usage data is on.
Billing Check licence	Billing is Google Play's, for the one purchase in §5. Check licence is declared by the ad library; the game's own purchase check does not use it.

That is the whole list, apart from two that do nothing you would notice: one Android's own support library defines for the app's private use, and one Amazon-device attestation permission declared by Chartboost's ad-measurement code. The ad libraries also declare that they may check whether the Facebook app, or certain apps used to root a phone, are installed; the game itself never lists your apps, and there is no permission to read the list of everything installed. There is no notification permission, because the game never pushes anything at you — no notification is scheduled or sent; no storage permission, because the backup goes through the system picker; and no permission for location, contacts, the camera, the microphone, the phone or all-files access.

3. Crash reports, and Usage data

Two separate switches, both under Settings › Diagnostics. Either can be turned off at any time, permanently, from that screen. They are honoured before anything is collected rather than after: all three collectors ship disabled in the app's own manifest and property list, and are switched on only after the stored choice has been read. A player who turns one off is off from that moment, and stays off across launches. Development builds carry none of it.

Both switches start off in the EEA, the United Kingdom and Switzerland, and on elsewhere. The region is the one in your device's language and region settings, not your location, and a device that names no region at all takes the cautious side and starts off too. Either way the switches are yours, in both directions, from the first launch.

Settings › Diagnostics › Crash reports

When the game crashes, a stack trace, the device model, the operating system version and the app build go to Firebase Crashlytics so the fault can be fixed, under Crashlytics' own installation identifier. Nothing about you, your levels or your shots is attached to it.

Settings › Diagnostics › Usage data

This one switch covers Firebase Analytics and Firebase Performance together. These are the only events the game itself sends, with every parameter listed:

• Which screen is open — the map, the Daily, the Test Yard, the Garage, the Unlock page, the statistics, the settings, the Field Guide, or a level from the journey, the Daily or the Yard
• A level started, with its id, the mode, its act, and its role in the chapter — a lesson, a breather, a spike and so on; a level ended, with the same, whether the goal was met, the stars, the score, the shots fired, your attempts at it and how many seconds it was open
• One shot in ten, picked at random: the level, the mode, the angle, the power, when you tapped, whether the goal was met and the score — so the levels' difficulty can be checked against real play
• A Ghost used or a level skipped, with the level's id; the Daily finished, with its stars and your streak; a car skin earned
• The Unlock page opened, and what led there; a purchase or restore, with its result; and, on Android, a store receipt that failed to verify on the device
• A setting changed, with which setting and its new value
• In one session in twenty, a frame-rate sample while a level plays — frames per second and frame times, with the level's id and act
• Once per launch, how long the app took to start, and which screen it opened on
• Firebase's own automatic events — the first open, a session starting, an app update — and Firebase Performance's automatic measurements: how long the app takes to start and draw its screens, and the timing and size of its network requests, without their contents
• The Firebase app-instance ID, which is what makes two events from one install countable as one session. It is the SDK's own identifier: it names an installation rather than a person, it is reset when the game is reinstalled or its data cleared, and there is no account in this game to join it to. No user ID or user property is ever set. On iOS the collection of the vendor identifier by the analytics library is switched off in the build.

None of what these two switches send is shared with anybody. Nothing here profiles anyone, and nothing is joined to data from any other company or app. The ads in §4 are the one place data goes to a third party, and they carry none of the events above. Everything sent goes over HTTPS. Google acts as our processor for these reports, and their handling of them is covered by Google's own privacy terms.

4. Advertising

Thwack shows ads only to players who have not bought Thwack Unlocked, and only one kind: a full-screen ad, with its sound muted, when you leave a level you have just won — by Next or Back from its result card — once every ten journey levels you clear. There is no banner, no ad during a shot, no ad when the game opens, and none in the Daily or the Test Yard; levels you skip, the Daily and the Yard do not count toward the ten.

Nothing in this game is earned by watching an ad. There are no rewarded ads, so no Ghost, no skip and no level is ever behind one.

Ads also wait until you have played a while: the ad SDK is not started until you have finished the first chapter and the store has answered whether this device owns the unlock. Until then it requests nothing.

Who serves them

The ad is chosen by AppLovin, using its MAX SDK, which holds a quick auction among itself and three other networks whose code is in the app: Meta Audience Network, InMobi and Chartboost. Whichever wins serves the ad.

What is shared

To choose and measure an ad, these companies receive an advertising identifier along with the ordinary technical facts of a request — device model, operating system version, language, connection type, a coarse region worked out from the IP address, and the fact that this app asked for an ad — and then whether the ad was shown or tapped. On Android the identifier is the Google advertising ID, which you can reset or delete in the system settings; the ad SDK may also read the app set ID, which is shared only among one developer's apps. On iOS it is the vendor identifier, which is reset when you delete the app. The SDKs also report their own performance and their own crashes to their makers. The app holds no location permission of any kind.

Thwack does not ask for App Tracking Transparency permission on iOS. The prompt is never shown, so the IDFA — the identifier that would let advertising follow you across other companies' apps — is never available to the SDK, and attribution is left to Apple's own SKAdNetwork, which reports installs without identifying a person. In Apple's terms the app does not track you, which is why its privacy manifest declares no tracking.

Where AppLovin reports that the device is in a region covered by the GDPR and no choice has been recorded, the app tells it there is no consent for personalised advertising, so ads there are non-personalised: chosen from the request itself rather than from any profile of you. The app shows no consent form of its own, and turns off AppLovin's. Before Meta's code starts, the app also switches on Meta's Limited Data Use option, which Meta applies where US state privacy laws call for it.

Each of these companies handles what it receives as its own controller, under its own privacy policy linked above, not as our processor. We receive no advertising data back beyond aggregate counts of ads shown and revenue earned, which name nobody. The ads are never given your progress, your shots, your statistics, or anything from §1 or §3 — the ad request carries none of it.

Turning them off

Buying Thwack Unlocked removes them. This is not a setting that hides an ad after it loads: on a device that owns the unlock the ad SDK is never initialised, so it is never asked for an ad and never reads an identifier, and a purchase made mid-session stops it. (AppLovin's and Meta's libraries each run a small start-up hook when any app that carries them launches, on every device; it prepares a thread and a lifecycle tracker, does not initialise the SDK, and does not reach the network.)

You can also limit what the identifier is worth without buying anything: Android's Settings › Privacy › Ads lets you delete the advertising ID outright, and iOS's Settings › Privacy & Security › Tracking is already moot here because Thwack never asks. Ads still appear either way; they simply have less to go on.

5. Buying Thwack Unlocked

The unlock is one purchase, once — a non-consumable — made through Google Play Billing on Android or StoreKit on iOS. Both run in the store's own process, not in ours: the game never sees or stores a card, a billing address or a store account name. There is no server of ours in the path. On Android the signed purchase is checked against the app's licensing key on your own device, and on iOS StoreKit verifies it; nothing about either check leaves the phone. The entitlement is then cached locally, which is also why a purchase keeps working with no connection, and the store is asked again each time you come back to the game.

The unlock also removes every ad in §4, which is the one thing it takes away rather than adds. Restoring on a new device asks the store, not us; Restore is on the Unlock page, under More. What the store collects in the course of a purchase is governed by Google's or Apple's privacy policy, not by this one. No level is behind the purchase, so nothing you have played becomes unplayable if a store ever fails to answer.

The rating sheet, and updates

Once — after you have cleared forty levels, earned three stars on at least one, and had the game three days — the store's own rating sheet may be offered as you leave a level you won. It is Google's or Apple's sheet: we never see whether you rated, or what you wrote. On Android the game also asks Google Play whether a newer version is available when you come back to it.

6. What you can do with your data

• Turn either switch off in Settings › Diagnostics. Collection stops from that moment. Reports already sent can be deleted on request — write to the address in §9.
• Delete or reset the advertising ID in Android's Settings › Privacy › Ads, which is a system control and applies to every app. On iOS there is nothing to reset, because Thwack never asks for tracking permission and so never has the IDFA. What the ad companies hold is theirs to delete, under the policies linked in §4.
• Buy Thwack Unlocked if you would rather the ad SDK never ran at all — see §4.
• Export a backup from Settings › Backup. It is your data, in a file you hold, and this page lists everything in it.
• Uninstall, or clear the app's data. That removes everything the game kept on the device. Because we never held a copy, there is no server-side record of your progress to ask for the deletion of.

7. Children

Thwack is a cartoon physics game for teenagers and adults and is not directed at children under 13. It has no social features, no messaging, no user profiles and no accounts, and it asks no one for a name, an email address or any other personal detail, at any age. Because it is not a child-directed app it is not in Google Play's Designed for Families programme, and the ads in §4 are ordinary advertising rather than the child-safe kind that programme requires. If you are setting the game up for a child, buying Thwack Unlocked removes the ad SDK entirely.

8. Changes to this policy

If what the game stores or sends changes, this page changes with it and the date at the top is updated. Anything that would move an answer here — a new ad network, an identifier of any kind, a tracking prompt, a cloud copy of your progress, a push service, or a third-party framework this page does not name — is a change to the product's own promises, not merely to its wording, and it is announced here before it is relied on.

9. Contact

Questions about this policy, or about anything Thwack stores: support@crackoncloud.com