Astra Idle Privacy Policy

Most privacy policies are written to be survived rather than read. This one is written to be read. It describes exactly what Astra Idle collects, who it goes to, why, and what you can do about it — in that order, in plain language, with the boring parts kept boring and the important parts kept honest.

If you only read one section, read The short version.

The short version

Question	Answer
Do you know who I am?	Not by name. Never your email, password, or real name. By default you are just a random ID.
What’s the ID?	An anonymous player ID generated on first launch, so your save and your display name follow you.
I saw a Sign in with Apple button.	Optional. It ties that random ID to your Apple account — but still tells us no name and no email.
Do you show ads?	Yes — rewarded ads you choose to watch, plus interstitials and banners.
Do you track me across other apps?	Only if you tap “Allow” on Apple’s tracking prompt. Tap “Ask App Not to Track” and we don’t.
Do you sell my data?	No. We have never sold personal information and have no plans to.
Can I get my data deleted?	Yes, from inside the game — Settings → Delete Account wipes it. Or email us and we’ll do it.
Is this game for kids?	No. Astra Idle is rated for players 13 and over and is not directed to children.
Do you read my location / photos / mic?	No. The app never requests them.

What this policy covers

This policy applies to the Astra Idle mobile game on iOS, and to the pages of astanstudio.com that describe it.

It does not apply to anything operated by someone else — the Apple App Store, the advertisers whose ads appear in the game, or any site you reach by following a link out of the game or this site. Those are governed by their own policies, which we do not control and are not responsible for. See Third-party services.

Who we are

Astra Idle is made and operated by Shlomi Astangelov, an independent developer based in Israel, trading as Astan Games (“we”, “us”, “the studio”). Astan Games is a trading name, not a separate company — the studio is one person, and that person is legally accountable for everything described here.

App bundle ID: com.asta.astraidle
Contact for anything in this document: ceo@astanstudio.com

For players in the European Economic Area and the United Kingdom, Shlomi Astangelov is the data controller for the personal data described here.

What Astra Idle collects

Astra Idle is playable without signing in to anything. You never enter an email address, a password, a phone number, or your real name — the game never asks. What it does collect falls into ten buckets.

1. Your anonymous player ID

On first launch the game signs you in anonymously through Unity Gaming Services and receives a player ID — a random string generated for you, not derived from your Apple ID, your email, or your device’s owner.

That ID is the spine of everything else: it’s what your cloud save is filed under, what your display name is attached to, and what ties your analytics events together. It is a pseudonymous identifier, and because your gameplay data is filed against it, we treat all of it as personal data even though it never names you.

Unless you link Sign in with Apple, described next, that ID is not connected to any account that could identify you. If you do link, the ID stays exactly as pseudonymous to us — we still learn no name and no email — but it becomes tied to your Apple account, which is what lets your save survive a new phone.

You can optionally link your progress to your Apple ID so a reinstall or a new phone doesn’t cost you your run. This is entirely opt-in. Decline it and the game plays identically, forever.

When you use it, here is precisely what happens:

Apple shows you its own sign-in sheet and returns an identity token — a signed credential proving you control that Apple ID.
We ask Apple for nothing else. The game requests the token only. It does not request your name and does not request your email address, so Apple never sends them and we never hold them. There is nothing to leak, nothing to sell, and nothing for us to hand over if we’re ever asked.
The token is passed straight to Unity Gaming Services, which binds your Apple ID to your player ID. We do not store the token ourselves.

One consequence worth understanding before you tap it. If the Apple ID you choose is already linked to a different Astra Idle player, the game will sign you into that account — the older, established one — and the anonymous progress on your current device is left behind. This is almost always what you want (it’s how you recover a save). But if you have progress on a fresh device and link an Apple ID that already has a game on it, the two are not merged — the existing account wins. Check which Apple ID you are signing in with before linking on a device whose progress you care about.

You can unlink at any time — see Your choices.

3. Your display name — the one part you type

If you set a name for The Cosmic Ladder, that name leaves your device: we store it on your anonymous player account, alongside a #1234 discriminator added automatically to keep names unique, so it survives a reinstall. No other player currently sees it — the leaderboard runs on your device, as The leaderboard explains.

This is the only free-text field in the game. Please don’t put your real name, your email, or anything else identifying in it — put a space wizard name in it. Names are checked on the device before they’re submitted — character rules, length limits, and a filter covering profanity and impersonation — and we reserve the right to change or remove any name that is abusive, hateful, impersonating, deceptive, or unlawful, without notice. You can change it at any time.

4. Your game progress

Your save file — worlds unlocked, Cosmic Level, Skill Points spent in The Constellation, Star Evolution stage, Lab research, card collection, currency balances, prestige history, settings — is written to your device and mirrored to Unity Cloud Save so a lost or replaced phone doesn’t cost you your run.

The save blob is encrypted and signed before it leaves the device (AES for confidentiality, HMAC for integrity). That’s partly anti-cheat and partly your privacy: what’s stored in the cloud is not readable as plain game state.

5. The leaderboard

The Cosmic Ladder is a lifetime leaderboard with weekly payouts, and Cosmic Anomalies run daily boards. Today all of them run entirely on your device: the board ranks you against a roster of virtual players the game generates locally, and your score is never sent to us. It does not leave your phone.

Your display name is the exception, and the reason it appears above as something we collect. When you set a leaderboard name we store it on your anonymous player account so it survives a reinstall — but no other player sees it, and no other player sees your score or the cosmetics attached to your row.

Names are still filtered against a blocklist before they are accepted, and we may change or remove a name that is offensive, impersonates someone, or contains personal information.

If we ever turn on a shared, online leaderboard, we will update this policy and tell you in the game before your name becomes visible to anyone else.

6. Gameplay analytics

We use Google Firebase Analytics to understand how the game is actually played — which upgrades players stall on, where a difficulty wall lands, whether a new feature gets used at all.

Events cover things like session start and end, prestige events, purchases, upgrade taps, ad views, tutorial progress, and screen navigation. Every event carries your player ID, so a single player’s journey through the game is reconstructable in our dashboards. Firebase also collects standard technical context automatically:

Collected	Not collected
Device model, OS version, app version, language	Your name or email
Country / coarse region (derived from IP)	Precise GPS location
A Firebase-generated app instance ID	Contacts, photos, calendar
Session length, crash-adjacent performance signals	Anything typed outside the display-name field

7. Advertising

Astra Idle shows ads through Google AdMob — rewarded video (opt-in, the ones that double a reward), interstitials between runs, and banners. We record which ad placements were shown and what revenue an impression generated.

Whether those ads are personalised depends entirely on your answer to the prompts described in Your choices:

If you allow tracking, AdMob may use your device’s advertising identifier (IDFA) to build an interest profile and target ads across apps.
If you don’t, you still see ads — contextual, non-personalised ones — and no IDFA is used.

Two other identifiers are in play regardless of that answer. Apple’s vendor identifier (IDFV) — which is specific to us and resets when you delete our apps — and a Firebase app-instance ID, both used to tell one install apart from another rather than to name you.

Approximate location. The game never asks for location permission and never calls a location API — but every network request carries an IP address, and our ad and analytics providers derive an approximate location from it, roughly city or region level, to choose relevant ads and to break reporting down by country. We are telling you this because it is genuinely happening, even though no location prompt ever appears.

Either way, Apple’s SKAdNetwork may report an install or conversion back to an advertiser. SKAdNetwork is Apple’s privacy-preserving attribution system: it is deliberately aggregated and delayed so that it cannot identify you individually. Astra Idle declares the SKAdNetwork identifiers of the ad networks its provider works with; that list changes when the ad SDK is updated.

Ad content is not ours. We choose the placements; the network chooses the advert. We do not control, endorse, or vet what an individual ad shows, and interacting with one takes you into that advertiser’s hands.

8. Purchases

In-app purchases are processed by Apple, through Unity IAP. Astra Idle sells gem packs, a Remove Ads unlock, and permanent star-dust multipliers.

We never see your payment details. No card number, no billing address, and none of the Apple account details behind the payment — not the email it bills to, not the name on it. What the app receives is a receipt confirming a purchase completed, which it validates before granting the item, plus a record of which product you own so entitlements like Remove Ads survive a reinstall. Refunds, billing history, and subscription management all live in Apple’s hands, not ours.

What we do record is that a purchase happened — which product, its value and currency, and a transaction identifier — filed against your player ID. That goes to our analytics, and it may also be used for advertising measurement: to understand which campaigns bring in players who go on to buy, and to build audiences with our ad partners. Where that counts as tracking, it happens only if you allowed tracking on Apple’s prompt.

9. Crash and diagnostic data

When the game crashes we collect the crash through Unity Cloud Diagnostics: the stack trace, the device model and OS, the app version, and the state immediately before the failure. This is how bugs get found and fixed.

10. Configuration, segmentation and experiments

The game fetches its live settings from Unity Remote Config at launch, which means your device tells our config service enough about itself (platform, app version, player ID) to receive the right configuration back.

This same mechanism lets us tailor parts of the game to groups of players and run A/B tests — for example showing a different starter offer to a brand-new player than to a long-time one, or trialling two tutorial flows to see which works better. See Personalisation and profiling for what that means for you and how to object.

What Astra Idle never collects

Stated explicitly, because the absence matters as much as the presence. The app does not request, and cannot access:

Precise or background location — no location permission is declared at all, and no location prompt ever appears. (An approximate location is still derived from your IP address by our ad and analytics providers — see Advertising.)
Camera, microphone, or photo library
Contacts, calendars, reminders, or health data
Your email address, phone number, or real name — including via Sign in with Apple, which we deliberately configure not to request them
Any other app on your device, or your browsing history
Biometrics, or your Apple ID password — Apple handles authentication; the game never sees a credential
Server-sent push notifications — the reminders the game sends (Lab job finished, offline earnings capped) are scheduled locally on your device. Nothing about them leaves your phone, and there is no push server.

Astra Idle also has no chat, no messaging, and no friend list — and with the leaderboard running on your own device, no player-to-player visibility of any kind. Nothing you do in the game is shown to another player.

Why we’re allowed to do this (legal bases)

For players in the EEA and UK, the GDPR requires us to name a lawful basis for each purpose:

What	Purpose	Legal basis (GDPR Art. 6)
Anonymous ID, save data, cloud sync	Running the game you asked to play	Contract (6(1)(b))
Sign in with Apple link	Letting you recover your save	Contract (6(1)(b)) — and you chose to link
Purchases and entitlements	Delivering what you paid for; fraud prevention	Contract (6(1)(b)); legal obligation for tax records
Purchase events in ad measurement	Knowing which campaigns bring in players	Consent (6(1)(a)) — same prompt as personalised ads
Approximate location from IP	Choosing relevant ads; reporting by country	Consent (6(1)(a)) for ads; legitimate interests for reporting
Leaderboard display name	Keeping the name you chose across reinstalls	Contract (6(1)(b))
Crash diagnostics	Keeping the game from breaking	Legitimate interests (6(1)(f))
Anti-cheat and save-integrity checks	Keeping leaderboards honest	Legitimate interests (6(1)(f))
Non-personalised ads	Funding a free game	Legitimate interests (6(1)(f))
Segmentation and A/B testing	Improving and balancing the game	Legitimate interests (6(1)(f)); consent where required
Personalised ads and cross-app tracking	Higher ad revenue per player	Consent (6(1)(a)) — and only consent
Analytics	Understanding and improving the game	Consent (6(1)(a)) where required

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they don’t override them — and you can object at any time using the contact details below, in which case we will stop unless we have compelling grounds not to.

Where consent is the basis, you can withdraw it at any time and we stop. Withdrawing consent doesn’t undo processing that already happened lawfully, and it never locks you out of the game.

Personalisation, segmentation and profiling

We may group players into segments based on in-game behaviour — how new you are, whether you’ve spent money, whether you’ve stopped playing — and use those segments to vary offers, ad frequency, onboarding, or in-game copy. We may also assign players at random to A/B test variants.

Two commitments about this:

It never produces a legal or similarly significant effect on you. It changes which cosmetic bundle is on the shop screen, not your rights, your access to the game, or anything outside it. This is not automated decision-making of the kind GDPR Article 22 restricts.
Prices are not personalised to punish you. Segments may change which offer you’re shown; we do not use them to charge different people different amounts for the same item.

You can object to segmentation by emailing us, and we will exclude your player ID from it.

Your choices, and how to use them

Apple’s tracking prompt (App Tracking Transparency)

On first launch, iOS asks whether Astra Idle may track you across other companies’ apps and websites. This is Apple’s prompt, not ours, and your answer is binding on us.

“Ask App Not to Track” → no IDFA, no cross-app tracking, non-personalised ads only.
“Allow” → AdMob may use your IDFA to personalise ads.

Change your mind any time: Settings → Privacy & Security → Tracking, or Settings → Astra Idle.

If you’re in the EEA or UK, you’ll also see a consent form powered by Google’s User Messaging Platform before ads load, covering ad and analytics purposes under GDPR and the ePrivacy rules. You can reopen it from the game’s settings to change your answers.

Everything else

You want to…	Do this
Stop seeing ads entirely	Buy the Remove Ads unlock
Unlink your Apple ID	Revoking in Settings → Apple Account → Sign in with Apple stops Apple sharing the credential. To remove the link on our side too, email us
Remove your display name	Clear it in game settings, or email us and we’ll delete it
Opt out of segmentation / A/B testing	Email us with your player ID
Turn off reminders	Settings → Notifications → Astra Idle, or the in-game toggle
Stop apps requesting tracking	Settings → Privacy & Security → Tracking — turning this off zeroes your advertising identifier
Delete everything	Settings → Delete Account, in the game. Or see Your rights below
Change your consent answers	Settings → Privacy options reopens the consent form (shown where the law requires it)

We honour Global Privacy Control and similar opt-out signals where the law requires us to treat them as a valid opt-out request.

We do not sell personal information, and we do not share it for cross-context behavioural advertising beyond what the ad choices above describe. We do use service providers, who process data on our instructions:

Company	What they do for Astra Idle	Their policy
Google (Firebase)	Gameplay analytics	policies.google.com/privacy
Google (AdMob/UMP)	Serving ads, measuring them, collecting EEA/UK consent	policies.google.com/technologies/ads
Unity Technologies	Anonymous sign-in, Apple account linking, cloud save, leaderboards, remote config, crash reporting, IAP plumbing	unity.com/legal/game-player-and-app-user-privacy-policy
Apple	App distribution, Sign in with Apple, payment processing, SKAdNetwork attribution, the rating prompt	apple.com/legal/privacy

We may also disclose data where we believe in good faith it is necessary to: comply with a law, regulation, subpoena, court order, or lawful government request; enforce our terms; investigate suspected cheating, fraud, or abuse; protect the rights, property, or safety of our players, the public, or the studio; or establish or defend legal claims.

If the studio — or Astra Idle on its own — is ever sold or handed over to someone else, player data would move as part of that transaction, and this policy would continue to apply until replaced by one you are told about in advance.

Where your data goes

The studio itself is in Israel, which the EU and the UK both recognise as providing an adequate level of data protection — so data reaching us directly needs no further transfer safeguard. Our providers operate globally, so your data is also processed on servers in the United States and elsewhere outside the EEA and UK. Where data leaves the EEA or UK, the transfer relies on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision, as implemented in each provider’s data-processing terms. You may request details of the safeguards that apply to a specific transfer.

How long we keep it

Data	Retention
Cloud save + player ID	While you play, and for 24 months after your last session, then deleted
Apple ID link	Until you unlink it or your account is deleted
Display name	Until you change or clear it, or your account is deleted (scores aren’t stored)
Analytics events	Up to 14 months, per Firebase’s retention setting, then automatically purged
Crash reports	Up to 90 days
Purchase records	As long as tax and accounting law requires — typically 7 years

Delete requests are honoured ahead of all of these, except records we are legally obliged to keep (chiefly purchase and tax records) and anything we need to retain to establish or defend a legal claim.

Your rights

Everyone, everywhere — whatever your country’s law says, we will honour these: ask what we hold about you, get a copy, have it corrected, have it deleted, or object to how it’s used.

EEA and UK (GDPR): you have the rights of access, rectification, erasure, restriction, portability, and objection, plus the right to withdraw consent and the right to lodge a complaint with your national supervisory authority. In the UK that’s the ICO.

California (CCPA/CPRA): you have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined, so there is nothing to opt out of. We will never discriminate against you for exercising a privacy right; the game plays identically either way.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others with comprehensive privacy laws) grant comparable rights, including the right to appeal a refused request. We apply the same process to all of them: if we refuse a request, reply to our decision and we will reconsider it.

How to actually exercise them

The fastest route is in the game: Settings → Delete Account. That erases your cloud save and closes the account itself, without waiting on us and without having to prove who you are — you are already signed in. Use it if deletion is what you want.

For anything else — a copy of your data, a correction, an objection, or a deletion you would rather we handled — email ceo@astanstudio.com with the subject line “Privacy request” and include your player ID, which you’ll find in the game under Settings → About.

We need that ID because it is the reliable way we can find your data — there is no email or username to look you up by. If you linked Sign in with Apple we may be able to locate you that way as well, but the player ID is unambiguous and far faster. Without either, we cannot identify your records, which is a real consequence of building the game account-free. We may ask for additional information to verify that a request is really yours, solely to protect you from someone else deleting your save. We’ll respond within 30 days (extendable to 90 for complex requests, and we’ll tell you if that happens). It costs nothing, though we may decline requests that are manifestly unfounded or repetitive.

If something goes wrong

If a breach of security leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of your personal data, we will assess it promptly, notify the relevant supervisory authority where the law requires it — within 72 hours of becoming aware, under GDPR — and tell affected players directly where the breach is likely to result in a high risk to their rights.

Children

Astra Idle is not directed to children. It is intended for players aged 13 and over — 16 and over in EEA countries that set the digital-consent age at 16.

The game shows advertising, uses analytics, and may use an advertising identifier with your permission, which makes it unsuitable for a child audience. It is not published in Apple’s Kids Category.

We do not knowingly collect personal information from a child under 13. If you believe a child has been playing and we hold their data, email ceo@astanstudio.com and we will delete it promptly. Parents and guardians: Apple’s Screen Time and Ask to Buy controls let you restrict installs and in-app purchases at the device level.

Security

Save data is encrypted and integrity-signed on your device before it is uploaded. Traffic between the game and its backends runs over TLS. Exactly one person — the developer — can reach our analytics and backend dashboards, and that access is protected by multi-factor authentication.

That said, and stated plainly: no method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. You send data to us at your own risk. What we can promise is that the amount of data worth stealing from us is deliberately small — there are no passwords to leak, no email addresses to harvest, and no payment details to lose, because we never collect any of them.

Your responsibilities

A privacy policy is a two-way street. To keep your own data safe:

Keep your device secure. Anyone with access to your unlocked phone has access to your game.
Don’t put personal information in your display name. We store it, and if we ever switch on an online leaderboard it is the one thing other players would see.
Don’t share your player ID publicly. It’s the key we use to identify your records for deletion and support requests.
Tell us promptly if you think your account has been compromised.

Third-party services and links

The game and this site contain advertising, and may contain links to sites and services we don’t operate. We are not responsible for the content, security, or privacy practices of any third party, including advertisers, ad networks, Apple, or any site reached from an ad or link. Their handling of your data is governed by their policies, not this one, and we make no representation or warranty about them. Review their policies before providing them with anything.

The limits of this policy

This policy explains our privacy practices. It is not a contract for the game itself, does not grant rights beyond those the law gives you, and does not create any third-party beneficiary rights.

Except where the law says otherwise, we provide the game and this policy on an “as is” basis and disclaim implied warranties to the fullest extent permitted. Nothing in this policy limits or excludes: your statutory privacy rights; our liability for death or personal injury caused by negligence; our liability for fraud or fraudulent misrepresentation; or any other liability that cannot lawfully be limited. Where any provision of this policy conflicts with a mandatory right you hold under your local law, your local law wins and the rest of this policy continues in full force.

If any part of this policy is found unenforceable, that part is severed and the remainder stands. Our failure to enforce a provision is not a waiver of it. This policy is written in English; a translation is provided for convenience only and the English text governs in the event of a conflict.

The game is still changing

Astra Idle is in active development. Features described here may change, be removed, or be replaced, and new features may introduce new processing. When that happens we will update this page — and where a change requires your consent, we will ask for it rather than assume it.

Changes to this policy

When this policy changes materially, we’ll bump the version number and the dates at the top of this page — they always describe the text you are reading — and record what changed in Version history below. For significant changes — a new category of data, a new purpose, a new class of recipient — we’ll tell you in the game before the change takes effect.

Continuing to play after a change takes effect means the updated policy applies to you, except where the law requires your fresh consent, in which case we will ask for it. Older versions are available on request.

Contact

Questions, requests, complaints, or corrections to this page:

ceo@astanstudio.com

We read everything sent there, and a privacy request will not get lost in the support queue — put “Privacy request” in the subject and it gets routed straight to a human who can action it.

Version history

Version	Date	What changed
1.1	6 August 2026	Corrected the leaderboard section: the board runs locally, scores never leave the device, and display names are stored but not shown to other players.
1.0	4 August 2026	First published version.