Sandbox City Privacy Policy

Last updated: August 3, 2026

1. Who we are

Sandbox City is provided by Yilmaz Kiymaz, trading as Salted Caramel Games, based in Germany ("we", "us", or "our"). Salted Caramel Games is a publishing trade name and not a separate legal entity.

For privacy questions or requests, contact privacy@yilmazkiymaz.com. Legally required business-address information may be provided through the website's legal notice or imprint.

2. Scope

This policy explains how Sandbox City collects, uses, shares, and protects information when you play the game on mobile, desktop, or the web, or use its related online services. Platform operators and third-party services used by the game may process information under their own privacy policies.

3. Information we process

Depending on your device, settings, location, consent choices, and how you use the game, we and our service providers may process:

Device and app information: device model, operating system, app and engine version, language or locale, display and graphics information, storage or performance characteristics, IP address, country or coarse location, and network information.
Identifiers: platform player or account identifiers, vendor or installation identifiers, Firebase and Crashlytics identifiers, session identifiers, and an advertising identifier such as IDFA or Android advertising ID when permitted by your device settings and applicable consent.
Gameplay and interaction data: sessions, startup and scene events, missions, in-game actions, owned items, virtual currency, preferences, customization and build state, ad interactions, and other product-interaction events.
Purchase information: product and item details, price, purchase method, transaction identifiers, fulfilment and restore status, and limited receipt or signed-transaction information used by the platform store and Unity to process and validate purchases. We do not receive your payment-card details; the platform store processes billing.
Advertising information: ad impressions, clicks, rewards, ad unit, placement, mediation or network and waterfall details, advertising revenue and precision, and consent, do-not-sell or share, or tracking-authorization state.
Diagnostics and performance: crash reports, exceptions, stack traces or minidumps, logs and breadcrumbs, startup or scene timing, frame-rate and performance information, and network-request metadata. Embrace is configured not to capture tap coordinates or startup screenshots; WebView query parameters are stripped.
Cloud-save data: saved-game snapshots containing gameplay progress, virtual currency, missions, entitlements, transaction fulfilment state, settings, customization, and build data when a supported platform cloud-save service is available.
Privacy choices and communications: consent selections, tracking permission, opt-out state, and information you send when contacting us.

We do not intentionally ask you to provide sensitive personal information in the game.

4. How we use information

We use information to:

operate the game, authenticate platform services, provide cloud save, fulfil and restore purchases, maintain entitlements, and deliver rewarded ads;
show, limit, personalize, and measure advertising, subject to your device settings and applicable consent;
understand game usage, balance features, measure shop and purchase funnels, and improve the game;
diagnose crashes, monitor startup, performance and network reliability, and prevent fraud or abuse; and
comply with law, enforce our terms, protect users and services, and respond to privacy requests.

Where applicable law requires a legal basis, we rely on performance of our contract to provide requested game features, our legitimate interests in operating and improving the service, consent for activities such as personalized advertising where required, and compliance with legal obligations. You can withdraw consent for future processing through the available controls, without affecting processing already performed lawfully.

5. Advertising and tracking choices

Sandbox City uses AppLovin MAX to mediate advertising from multiple partners. Advertising services may receive identifiers, IP-derived coarse location, device and app information, ad and product interactions, diagnostics, and advertising data to deliver ads, limit repetition, measure results, prevent fraud, and, when permitted, personalize ads or link activity across apps and websites.

On iOS, you can deny or later change tracking permission in Settings > Privacy & Security > Tracking. Where available, use Manage Privacy Settings inside Sandbox City to review consent and sale or sharing choices. If personalized advertising is unavailable or declined, you may still see contextual or non-personalized ads.

We do not sell personal information for money. Some disclosures to advertising partners may be considered a "sale," "sharing," or targeted advertising under certain US state laws. You may opt out using the in-game privacy controls, device settings, or by contacting us.

6. Service providers and partners

The exact advertising partner that serves an ad may vary by location, availability, consent, and mediation results.

Advertising and consent

Analytics, diagnostics, configuration, commerce, and platforms

These providers process information for us and, for advertising services, may also act under their own policies and legal responsibilities. Their retention periods and deletion processes differ.

7. Retention

We retain information only for as long as reasonably necessary for the purposes described above, including providing cloud saves and entitlements, fulfilling transactions, diagnosing reliability problems, meeting legal or accounting requirements, and resolving disputes. Retention depends on the type of information and the provider involved. Diagnostic events may be kept for a limited operational period, while purchase fulfilment and cloud-save records may remain for the life of the account or until deletion is requested and permitted by law.

Third-party providers maintain their own retention schedules. Backups and fraud or security records may take additional time to expire after a deletion request.

8. International transfers

We and our providers may process information in countries other than the one where you live. Where required, we use or rely on recognized safeguards for international transfers, such as adequacy decisions, contractual protections, or provider certification frameworks.

9. Security

We use reasonable technical and organizational measures designed to protect information. No storage or transmission method is completely secure, and we cannot guarantee absolute security.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or obtain a copy of your information; object to or opt out of certain processing; withdraw consent; and appeal a denied request. You may also have the right not to receive discriminatory treatment for exercising a privacy right.

Contact privacy@yilmazkiymaz.com to make a request. We may need to verify the request. You can also manage tracking permission in device settings, ad consent and sale or sharing choices through Sandbox City's Manage Privacy Settings control where available, cloud-save data through your platform account or device controls, and purchases through your platform account.

You may lodge a complaint with your local data-protection authority.

11. Children

Sandbox City is a general-audience game and is not designed or intentionally directed to children under 13. Its content age rating describes the game's content and is separate from this privacy-related audience statement.

We do not knowingly ask children under 13 to provide a name, email address, date of birth, or other direct contact information in the game. Advertising, analytics, diagnostics, platform, and cloud-save providers may nevertheless process device and usage information automatically as described in this policy.

If you are a parent or guardian and believe that a child under 13 has used Sandbox City and personal information has been processed, contact privacy@yilmazkiymaz.com. Please provide enough information for us to identify the relevant installation, platform account, or support record. We will investigate and take appropriate steps, including deletion where required and technically possible.

We do not market Sandbox City as a child-directed service or enroll it in child-specific store programs. We may introduce additional age-assurance and child-specific technical controls in a future version; this policy will be updated when those controls are available.

12. Changes to this policy

We may update this policy when the game, providers, or legal requirements change. We will post the revised policy with a new last-updated date and provide additional notice where required.