Privacy Policy

Last updated: September 30, 2026

This policy explains how Pedro Armando Manfredi ("PokiePocket", "we", "us") handles information in the PokiePocket mobile application, public website, and browser game. PokiePocket is an entertainment-only social-casino game. Its virtual coins have no cash value, cannot be redeemed, and do not represent real-money gambling or a prize.

Information we handle

Account and authentication

An account is required for production gameplay on mobile and on the web. On mobile, you may use email and password, Google, or Apple sign-in. The browser game supports email and password or Google sign-in. Firebase Authentication and the selected identity provider process identifiers needed to authenticate you, such as a Firebase user ID, email address or private relay address, sign-in provider, email-verification status, and authentication/security metadata. We do not receive your Google or Apple password.

Cloud account, commerce, and Ranked data

The protected backend may process your Firebase user ID and:

• server-authoritative virtual-coin balance, account version, VIP or remove-ads entitlement status;
• a generated default public Ranked alias or an optional public nickname you choose, season participation, spin commands, results, scores, leaderboard position, allowance, timestamps, and immutable replay receipts/ledgers; and
• product and store transaction identifiers, receipt and verification data, entitlement state, fulfillment, reversals/refunds, and limited ownership records when you make an in-app purchase. Apple or Google processes payment details; PokiePocket does not receive your full payment-card number.

Ranked play is available only when an approved policy and active season are configured and your signed-in account and app pass the required eligibility and security checks. Ranked outcomes, balances, and entitlements are calculated or verified by the server. The app cannot submit a score, purchase claim, random result, or local Practice balance as authoritative cloud data. A public nickname you choose, or the generated default alias if you do not set one, may appear on Ranked leaderboards.

Information stored on your device

Practice-mode coins and progression, level and XP, achievements, streak and claim timestamps, game statistics, local jackpot state, settings, onboarding state, and limited Practice-transfer receipts are stored locally on your device. Practice data is not cloud-synced and cannot enter Ranked scoring. It normally remains until you clear the app's storage or uninstall the app; deleting your cloud account does not by itself erase this device-only data.

Website and browser storage

Public pages are static and do not load the game, advertising, optional analytics, or third-party fonts. Netlify, our website hosting provider, handles network requests and associated technical information, such as IP addresses and request metadata, to deliver and protect those pages. See Netlify's Privacy Statement. Browser play is not currently available on the public website. When enabled, Firebase Authentication uses browser storage to keep your sign-in session. The game uses local browser storage for Practice progress and preferences. Private browsing, storage limits, clearing site data, or changing browsers can remove this progress; it is not a cloud backup.

The browser game uses Firebase App Check with Google reCAPTCHA Enterprise to help distinguish legitimate requests from abuse. This security service may process browser, device, network, and interaction signals. Its operation is described in Google's Privacy Policy and Terms of Service. Optional website analytics and advertising are not enabled. Essential account, security, and Practice storage are not a mechanism for submitting trusted leaderboard scores.

Essential service and security data

Firebase and platform services may process technical information needed to provide and protect the app, such as app and OS version, platform, locale, network/IP information, App Check attestation, request timestamps, and security or abuse signals. Firebase Remote Config may be contacted for app configuration. We use this information to operate authentication, secure backend requests, prevent replay or fraud, enforce account deletion, and maintain service reliability.

Optional usage and diagnostics

"Share usage and diagnostics" is off unless you affirmatively enable it in the mobile app. These optional integrations are disabled in the browser game. If enabled on mobile, Firebase Analytics, Crashlytics, and Performance Monitoring may process app interaction events, screen names, crash/error details, performance traces, device/OS/app information, and a Firebase user identifier. The app does not send the email argument it receives to Analytics. You can turn this option off at any time in Settings → Privacy; the app then disables further collection by these integrations and clears the diagnostic identity it controls.

Mobile notifications, advertising, and reward verification

• Push notifications: production mobile builds can register for push notifications. Registration requires a signed-in account, an affirmative in-app request, the notifications setting, and operating-system permission. To deliver messages to the right account, Firebase Cloud Messaging and our backend may process a random installation ID, push token, Firebase user ID, platform, app and OS versions, locale, and time zone. You can turn notifications off in the app and in your device settings.
• Advertising: production mobile builds are configured for Google Mobile Ads banner, interstitial, and rewarded video ads. Ads are requested only when the account and app configuration allow them and Google's User Messaging Platform says they may be requested. The UMP consent form is shown when required; when Google requires a privacy-options entry, it is available under Settings → Privacy. Google Mobile Ads and its consent tools may process IP address (which can indicate general location), advertising and other device identifiers (including Android's advertising ID and App Set ID, and Apple's advertising identifier when available and permitted), ad impressions, app interactions such as taps and video views, and diagnostic or performance information. These data may be used for ad delivery, advertising and analytics, measurement, and fraud prevention or security.
• Reward verification: for rewarded ads, the app is configured to use a Firebase user ID, ad impression and transaction identifiers, and verification data with Google Mobile Ads, RevenueCat, and our Firebase backend. RevenueCat is used for rewarded-ad verification; its automatic device-identifier collection and SDK diagnostics are disabled in our configuration. Our backend verifies reward evidence and keeps reservation, cooldown, and replay protection records before deciding whether to credit cloud coins. An ad completion message from the device alone does not grant coins. RevenueCat's internal proof units are not spendable gameplay coins.

The optional Share usage and diagnostics setting controls Firebase Analytics, Crashlytics, and Performance Monitoring. It does not control ads or push notifications; those features use the consent and operating-system choices described above. The public website and browser game do not serve ads.

Why we use information

We use information to create and secure accounts; provide cloud balances and eligible game features; verify and fulfill any enabled store transactions; operate fair, server-controlled Ranked play; provide support; prevent fraud, abuse, duplicate fulfillment, and replay; comply with law; and, only with your choice where required, understand usage and diagnose crashes or performance.

Where applicable law requires a legal basis, these activities rely on performing our agreement with you, our legitimate interests in security and service operation, compliance with legal obligations, or your consent for optional collection. You may withdraw consent without affecting earlier lawful processing.

Sharing and service providers

We do not sell personal information. We share information only as needed with:

• Google Firebase for Authentication, App Check, Cloud Functions, Firestore, Remote Config, and—only after opt-in—Analytics, Crashlytics, and Performance Monitoring;
• Google and Apple when you choose their sign-in services;
• Netlify for public website hosting and delivery;
• Apple App Store or Google Play for in-app payments, receipts, verification, restoration, refunds, and entitlement administration;
• Firebase Cloud Messaging and Google for push notifications when you enable them and grant operating-system permission;
• Google Mobile Ads and its User Messaging Platform for consent-gated mobile advertising; and
• RevenueCat for rewarded-ad verification, as described above. Its privacy notice explains its data handling.

These providers may process information under their own terms and privacy notices. We may also disclose information when legally required, to protect users or the service, or as part of a business reorganization subject to appropriate safeguards. We do not allow a provider to use PokiePocket data for purposes inconsistent with this policy.

Relevant provider notices include the Google Privacy Policy, Firebase privacy information, and Apple Privacy Policy.

Retention and deletion

We retain active account and cloud game records while needed to provide the service. When account deletion completes, the backend deletes the cloud account profile, balances and entitlements, Ranked player/leaderboard records, and push installation records. It keeps a limited deletion tombstone and may retain immutable transaction-ownership and command-receipt records only as needed to prevent duplicate payment, fraud, or replay and to meet legal, tax, accounting, or dispute obligations. These retained records are not displayed as a profile. We do not promise a fixed retention period where the applicable purpose or law determines it.

Optional analytics and diagnostics are retained according to our configured provider settings and then deleted or de-identified. Support correspondence is retained only as long as reasonably needed to resolve and document the request. Device-only Practice data remains until you clear app storage or uninstall. Browser-only Practice data remains until you clear this site's storage, your browser removes it, or you use an available local reset control. Clearing site storage does not by itself delete your cloud account.

Your choices and rights

Depending on where you live, you may have rights to access, correct, obtain, delete, restrict, or object to processing of your personal information, and to withdraw consent or appeal a decision. You can:

• turn optional usage and diagnostics off in Settings → Privacy;
• manage operating-system permissions and any available ad privacy choices;
• delete your account in Settings → Account → Delete account; or
• use the instructions at Account deletion.

Account deletion may require recent reauthentication. It does not cancel an App Store or Google Play subscription; subscriptions must be managed separately in the relevant store. We may need to verify your identity before acting on a web or email request. Never send us your password, authentication token, or full payment details.

Children

PokiePocket is not directed to children. You must meet the minimum age shown in your app store and any higher age required by local law. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

International processing and security

Our providers may process information in countries other than yours. Where required, we use recognized transfer mechanisms and safeguards. We use access controls, encrypted transport, server-side authorization, App Check, and restricted database rules, but no service can guarantee absolute security.

Changes

We may update this policy when the app, providers, or legal requirements change. We will change the date above and provide additional notice when required.

Contact

Data controller/publisher: Pedro Armando Manfredi
Publisher country: Spain
Privacy and support email: info@clutchdeveloper.com

Publisher identity, country and contact were confirmed on September 25, 2026.