Heist Flow Privacy Policy

How Pan Games Oy collects, uses and protects personal data in Heist Flow: Color Sort Puzzle, our mobile game on the Apple App Store. It follows the EU General Data Protection Regulation (GDPR), Finnish data protection law and US state privacy laws.

Last updated: 27 October 2026

This policy covers the Heist Flow game only. Our website has its own privacy policy at https://thepangames.com/privacy-policy. To delete your Heist Flow data, follow the steps at https://thepangames.com/heist-flow/data-deletion.

In short

• The game shows no ads. It never asks for your name or email address, and it cannot use your camera, microphone or location.
• Your progress is saved on your device. The game also creates a random game ID, which you can see on its SETTINGS page.
• To measure our ads on Facebook and Instagram, the game sends Meta a few events, such as finishing your first level. These events carry no game ID. Meta gets your device's advertising identifier only if you allow tracking when iOS asks. Choosing Ask App Not to Track does not stop the events themselves. Deleting the app does.
• Apple handles every payment. We never see your card or any other payment details. When you buy, the Unity software that connects the game to the App Store also sends Unity a record of the purchase.
• The game includes analytics tools from GameAnalytics and Google, but the current version never switches them on, so they send nothing.

1. Data Controller

The data controller responsible for the processing of personal data in Heist Flow is:

• Name: Pan Games Oy
• Business ID: 3427311-1
• Address: Veijolantie 51, 08150 Lohja, Finland
• Email: gokhan@thepangames.com

We have not appointed a data protection officer. Please send all privacy questions and requests to the email address above.

2. What Personal Data We Collect

Your game ID and the data saved on your device

When you first open the game, it creates a random game ID of 32 letters and numbers. The ID is not made from your name, your Apple Account or any identifier of your device. You can see it on the SETTINGS page. To open it, tap SUPPLIES on the City screen, or BOOSTERS during a level, and then tap SETTINGS.

The game saves the following in its own storage on your device:

• your progress: levels played and completed, stars and best results, attempts, your City and raids, the boosters you have earned, and the tutorials you have seen
• when you first opened the game, and the days you came back
• your sound and vibration settings
• your game ID, and counters the game keeps of your play sessions and actions
• which events have already been sent to Meta, so that each one is sent only once
• while a booster you bought is being used, a short-lived note so that it is not lost if the game closes

This data stays on your device, except where this policy says otherwise below. Deleting the app deletes it. If you install the game again, it creates a new game ID. A backup of your device may still hold a copy.

Ad measurement with Meta

We advertise Heist Flow on Facebook and Instagram, which are run by Meta. The game includes Meta's software development kit (the Meta SDK) so that we can see which ads lead people to install and play the game. Meta's automatic event collection is switched off. The game sends Meta only these events:

• that the game was started, each time it starts
• that you completed your first level
• that you completed levels 3, 5, 10 and 20
• that you built your first building in the City
• that you came back to the game on the day after you first opened it
• when you buy boosters: the amount and currency of the purchase, after our server has confirmed the purchase with Apple

The level, City and return events are sent at most once per installation. The purchase event is sent once for each purchase. None of these events carries your game ID, your name, a purchase receipt or a transaction number. The game sends them whether or not you allow tracking.

Like any internet connection, these events reach Meta together with your device's IP address. The Meta SDK may also add basic information about your device and the app, such as the device model, the iOS version, the app version and a random identifier it creates for the app installation. Meta receives your device's advertising identifier only if you allow tracking (see section 3).

Meta may use information it receives from apps such as Heist Flow to provide measurement services and targeted ads, under its own terms and its Privacy Policy. If you allow tracking, Meta may also combine it with information from other companies' apps and websites. If you choose Ask App Not to Track, the game tells Meta so, and Meta limits how it uses the events, for example to aggregated ad measurement. From Meta we receive only reports with totals, such as results per campaign, country and day, not data about individual players.

The game does not use Facebook Login. It never asks you to connect a Facebook or Instagram account.

Purchases and Sign in with Apple

When you buy boosters in the game (packs of Extra Bay, Pick Van and Shuffle, or the Continue Run offer that can appear when a run is blocked), Apple processes the payment through the App Store. We never receive your card number, bank details, billing address or Apple Account password.

Buying boosters requires Sign in with Apple. It keeps the boosters you buy safe and lets you restore them on another device. When our purchase server is in use, the game asks you to sign in when you open the shop (including the shop that opens when you tap a booster you have run out of during a level), tap CONNECT TO APP STORE on the Continue Run offer, or tap RESTORE PURCHASES or RECOVER. The game asks Apple for no name and no email address. Our purchase server checks Apple's confirmation of the sign-in and stores:

• a keyed one-way code (a hash) made from the identifier Apple gives us for your sign-in, instead of the identifier itself
• a random account number that we create, and the time the account was created

To check each sign-in, our server also creates a one-time code. It holds no information about you, expires after three minutes, and is deleted when it is used or when the next sign-in on our server starts.

When the game connects to the App Store, and again before each purchase, it gives Apple your account number or a one-time purchase number. Apple includes it in its record of the transaction. This links Apple's record of the purchase to your account on our server.

After a purchase, the game sends our server Apple's signed record of the transaction. Our server checks it with Apple and stores:

• the transaction number, the product and pack, and the boosters it gave you
• the price and currency Apple reports, the time, and whether it was a test purchase
• each purchase you start: the pack, which version of the shop offers you saw, and the time
• refunds and revoked purchases, and the notices Apple sends us about them
• your booster balance: the boosters you have bought, earned and used, and any booster use that was cancelled and given back
• the number of levels you have won and the booster tutorials you have seen, so that the boosters you earned by playing can be restored along with the ones you bought

This lets you get the same boosters back after you reinstall the game, or on a new device signed in with the same Apple Account. If Apple refunds a purchase, Apple tells our server, and the boosters left from that pack are removed. Apart from the number of levels you have won and the tutorials you have seen, our server holds no information about how you play and no information about your device. Your purchase records are not linked to your game ID.

Signing in gives the game a session key that expires after one hour and is kept only in the app's memory. When our purchase server is in use, the game also asks it for the current shop settings when the game starts and when you return to it. That request contains no account details.

Some of this data comes from Apple: the confirmation of your sign-in, the records of your purchases and the notices about refunds.

Unity's purchase software

The game uses software from Unity Technologies to connect to the App Store. Each time you start a purchase, a purchase fails, or a purchase is paid or completed, this software sends Unity a record of it. The record contains the product, its price and currency, the transaction number, the result, Apple's signed record of the transaction and your App Store receipt (these include the account number or one-time purchase number described above), the app version, when the app was installed, an identifier that iOS gives the app on your device (the identifier for vendor), and basic device information such as the device model, iOS version, language settings and storage size. Like any internet connection, it also reaches Unity with your IP address. This happens whether or not you allow tracking. We do not receive these records. Unity handles them under its own terms and its Privacy Policy.

Game analytics (GameAnalytics and Google Firebase)

The game includes analytics software from GameAnalytics and from Google (Google Analytics for Firebase). The current version of the game never switches it on: it does not ask you to agree to game analytics, and these tools send nothing.

Game settings from Google Firebase Remote Config

We may use Google Firebase Remote Config to change game settings, such as the shop and offers, without a new app version. When we do, the game checks Google's servers for new settings when it starts and when you return to it, at most once an hour. This happens whether or not you allow tracking. Google receives the technical data it needs to answer, such as your IP address and a random identifier that Firebase creates for the app installation.

Crash reports and other technical data

The game contains no crash reporting service. If you have turned on Share With App Developers in iOS Settings (under Privacy & Security, then Analytics & Improvements), Apple may share crash reports from the game with us.

The game is built with the Unity engine. Unity's analytics, crash reporting and ads services are not used. Unity's purchase software still sends the purchase records described above. The engine's option to send hardware statistics to Unity is switched on. If the engine sends them, Unity Technologies receives information about the device's hardware and operating system over an internet connection, which also reveals the device's IP address. Unity uses this information under its own privacy policy. We do not receive it.

When you contact us

If you email us, we process your email address, your message and anything you include in it, such as your game ID or an Apple order ID.

What we do not collect

The game does not ask for your name or email address, and it cannot use your camera, microphone or location. It shows no ads. It contains no ad-serving software and no attribution tool other than the Meta SDK. Raids in the game are played against computer-controlled rivals, so no data is exchanged with other players.

3. Tracking and Your Choice in iOS

When you first open the game, iOS asks whether Heist Flow may track your activity across other companies' apps and websites. The game's explanation reads: "With your permission, we measure which ads helped you discover Heist Flow."

• Allow: the Meta SDK may collect your device's advertising identifier (IDFA) and use it with the events in section 2 to link your installation to the Meta ad you saw.
• Ask App Not to Track: the game does not let the Meta SDK collect the advertising identifier, and it tells Meta that tracking is not allowed. Meta still receives the events in section 2, without the advertising identifier, and limits how it uses them, for example to aggregated ad measurement.

No other tool in the game uses the advertising identifier. You can play the whole game whichever you choose.

You can change your choice at any time. The game applies it the next time you return to the game:

• go to Settings, then Privacy & Security, then Tracking, and turn Heist Flow on or off, or
• go to Settings, then Heist Flow, and turn Allow Tracking on or off.

If you turn off Allow Apps to Request to Track (under Settings, Privacy & Security, Tracking), iOS answers Ask App Not to Track for every app, and the game does not show the question.

Ads on Facebook and Instagram. Meta may use information it receives from apps such as Heist Flow to choose which ads it shows you. If you have a Facebook or Instagram account, you can control this in Meta's Accounts Center: open Your information and permissions, then Your activity off Meta technologies. There you can disconnect Heist Flow and turn off future activity. You can also change your ad preferences in Accounts Center. For interest-based ads from many other companies, you can use the Digital Advertising Alliance's AppChoices tool (https://youradchoices.com/appchoices) and, in Europe, Your Online Choices (https://www.youronlinechoices.eu).

4. Purposes of Processing

We process personal data in Heist Flow for the following purposes:

• To run the game and save your progress on your device
• To sell boosters, check purchases with Apple, give you what you paid for, handle refunds and let you restore your boosters
• To measure how well our ads on Facebook and Instagram work
• To change game settings without a new app version
• To keep the game and our purchase server secure, and to prevent purchase fraud
• To answer your messages and handle your privacy requests
• To keep the records that accounting and tax law require

5. Legal Basis for Processing

We process personal data based on the following legal bases under the GDPR:

Contract. Running the game, saving your progress, Sign in with Apple, checking and recording purchases, giving you your boosters, handling refunds and restoring your boosters. This processing is necessary to provide the game and what you buy in it.

Legitimate interest. Measuring our advertising with the events sent to Meta, using Unity's purchase software to connect to the App Store (which sends Unity the purchase records described in section 2), fetching game settings, the engine's hardware statistics if it sends them, and keeping the game and our server secure. The events sent to Meta are few, carry no game ID, and include your advertising identifier only if you allow tracking. Our interest is to reach new players with our ads, to sell boosters through the App Store, to run the game well and to protect it. You can object to this processing (see section 9).

Consent. Use of your advertising identifier for tracking, which you allow or refuse when iOS asks. You can withdraw your consent at any time (see section 3). Withdrawing it does not affect processing that took place before.

Legal obligation. Keeping purchase and refund records where accounting and tax law require it, and answering privacy requests.

Do you have to give us data? No law or contract requires you to give us personal data. You can play without allowing tracking. Sign in with Apple is needed only to buy and restore boosters. Without it you can still play, but you cannot buy. The events sent to Meta, the purchase records that Unity's purchase software sends when you buy, and the technical data that any internet connection reveals, are part of how the published game works. Deleting the app stops them.

6. Who Receives Your Data

Nobody pays us for personal data. Section 10 explains how some US state laws treat the events we send to Meta. We share personal data only with the following recipients:

• Meta (Meta Platforms Ireland Limited and Meta Platforms, Inc., the companies behind Facebook and Instagram): the events and technical data described in section 2, and your advertising identifier only if you allow tracking. Where the GDPR applies, we and Meta Platforms Ireland Limited are joint controllers for collecting these events in the game and sending them to Meta, under Meta's Controller Addendum. We are responsible for informing you about this collection and for having a lawful basis for it. Meta is responsible for what it does with the events after it receives them, under its Privacy Policy. You can use your rights about this data with Meta or with us, and we will pass on requests that concern Meta.
• Apple: processes your payments, your sign-in and refunds under its own terms and its Privacy Policy. Apple receives the account number or one-time purchase number described in section 2. Apple sends us the sign-in confirmations, purchase records and refund notices described in section 2, and crash reports if you have chosen to share them.
• Unity Technologies: the purchase records and device information sent by Unity's purchase software, and the hardware statistics if the engine sends them (see section 2). Unity uses this data under its own terms and its Privacy Policy.
• Google: our email provider (Google Workspace), for the messages you send us, and, if we use Firebase Remote Config, the game settings requests described in section 2. Google processes this data on our behalf. See Firebase privacy information.
• The hosting provider of our purchase server, which processes data only on our behalf.
• Authorities, when the law requires us to disclose data.

Every company listed in this section that receives personal data from us or from the game is bound, by its contract with us or by the terms we have agreed with it, to give that data the same or equal protection as this policy describes and as Apple's App Store Review Guidelines require. Meta, Apple and Unity Technologies also use some data as independent companies under their own privacy policies, as described above.

7. International Data Transfers

Pan Games Oy is based in Finland, in the European Union. Meta, Apple, Google and Unity Technologies process data in the United States and in other countries outside the European Economic Area (EEA). If the hosting provider of our purchase server processes data outside the EEA, the same safeguards apply to it. When personal data about players in the EU or EEA is transferred outside the EEA, we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for companies certified under it, or on the Commission's standard contractual clauses. To get a copy of the safeguards that apply, email gokhan@thepangames.com.

If you play in the United States, your data is processed in the United States. It may also be processed in Finland and in other countries where we or our service providers operate.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy:

• Data on your device: until you delete the app.
• Purchase account and booster balance: until you ask us to delete them, so that you can restore your boosters at any time.
• Purchase and refund records: as long as needed to handle refunds and disputes. Where Finnish accounting law requires us to keep them as accounting records, we keep them for the period it sets: six years after the end of the year in which the financial period of the purchase ended. This applies even if you ask us to delete your account. We use these records for nothing else during that time.
• One-time sign-in codes: these hold no information about you. Each code expires after three minutes and is deleted when it is used or when the next sign-in starts.
• Events sent to Meta: Meta keeps them for the periods set in its own terms. We receive only reports with totals, not data about individual players.
• Purchase records and hardware statistics sent to Unity: Unity keeps them for the periods set in its own terms. We do not receive them.
• Game settings requests to Google: if we use Firebase Remote Config, Google keeps the technical data from these requests for the periods set in Firebase's terms.
• Server logs: our purchase server does not store IP addresses in its database. Any technical access logs are kept only as long as needed for security and troubleshooting.
• Your emails to us: up to 24 months, the same as other messages we receive, unless we need them longer to handle a legal claim.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right to access your personal data and get a copy of it
• Right to request correction of inaccurate data
• Right to request deletion of your data
• Right to restrict processing
• Right to object to processing
• Right to data portability, where applicable
• Right to withdraw consent, where processing is based on consent

Objecting. You can object at any time to processing based on our legitimate interest, including the events sent to Meta. The game has no setting that stops these events for one player, and they carry no game ID or other identifier that lets us pick out your device, so we cannot switch them off for you from our side. Deleting the app stops them. Unity's purchase software sends its records only when you buy. If you have a Facebook or Instagram account, you can also disconnect Heist Flow from your Meta account (see section 3). Write to us about any other processing, and we will stop it unless the law allows us to continue.

Withdrawing consent. You can withdraw your tracking consent in iOS Settings (see section 3).

How to make a request. Email gokhan@thepangames.com. The game does not know your name or email address, so include your game ID (a screenshot of the SETTINGS page is best). If you have bought boosters, also include the order ID of one of your Heist Flow purchases, from Apple's receipt email or your purchase history. Your purchase account is linked to your Apple sign-in, not to your game ID, so we need the order ID to find it. We use these details to find your data and to confirm that the request comes from you. If the details you can send do not let us find your data, we will tell you so. We may ask further questions, but we never ask for passwords or payment details. Requests are free of charge. We answer within one month. If a request is complex, we may take up to two more months, and we will tell you why within the first month. For deletion, see our data deletion page.

Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

10. US State Privacy Rights

This section applies to residents of US states with consumer privacy laws, such as California, Colorado, Connecticut, Texas, Utah and Virginia. It adds to the rest of this policy.

Categories of personal data we collect

How long we keep each category (section 8 has the details):

• Identifiers: on your device until you delete the app; your purchase account until you ask us to delete it; your emails up to 24 months.
• Commercial information: as described for purchase and refund records in section 8.
• Internet or other electronic network activity: we keep none of it on our servers. Meta and Unity keep what they receive under their own terms.

We do not collect sensitive personal information or precise geolocation. This data comes from you and your device, and from Apple. Section 4 lists the purposes.

Selling and sharing. Nobody pays us for personal data. We send the events and technical data described in section 2 to Meta to measure our ads on Facebook and Instagram, and Meta may use them for targeted ads. Under some state laws, such as California's, this can count as "sharing" personal data for cross-context behavioral advertising, or as processing for "targeted advertising". We do not knowingly sell or share the personal data of consumers under 16.

Choosing Ask App Not to Track, or turning tracking off later (see section 3), stops Meta from receiving your advertising identifier. The events in section 2 still reach Meta, and the game has no setting that stops them. Only deleting the app stops them. If you have a Facebook or Instagram account, you can also disconnect Heist Flow from your Meta account (see section 3). The game cannot receive Global Privacy Control, which is a signal sent by web browsers.

Your rights. Depending on your state, you have the right to:

• know what personal data we collect, use and disclose, and get a copy of it
• delete it
• correct it
• opt out of the sale or sharing of your personal data and of targeted advertising, in the ways described above
• not be discriminated against for using these rights

We will not deny you the game, charge you different prices or give you a worse game because you use your rights. If you ask us to delete your purchase account, boosters you bought but have not used can no longer be restored. This is a result of the deletion, not a penalty. We do not use personal data for profiling that produces legal or similarly significant effects.

How to make a request. Email gokhan@thepangames.com as described in section 9. We verify your request by looking up the Apple order ID with Apple and matching it to our records. If you have never signed in with Apple in the game, we hold no data about you that we can find. You can also use an authorized agent. We will ask for your signed permission, and we may ask you to confirm the request directly with us. We confirm receipt within 10 business days and answer within 45 days. If we need more time, we will tell you, and we may extend once by another 45 days.

Appeals. If we decline your request, you can appeal by replying to our answer with the word "Appeal". We will answer within 45 days. If you disagree with our answer, you can contact your state's attorney general.

11. Children

Heist Flow is not directed to children under 13. We do not knowingly collect personal data from children under 13. The game does not ask your age. If we learn that we have collected personal data from a child under 13, we will delete the personal data we hold about that child. A parent or guardian who thinks their child has used the game can contact us with the child's game ID.

In some countries, including EU countries, people under a certain age (between 13 and 16, depending on the country) need a parent's or guardian's permission to agree to data processing. If this applies to you, ask a parent or guardian before you allow tracking.

12. Security

We protect the personal data we process with the following measures:

• The game connects to our purchase server only over encrypted HTTPS.
• We store only a keyed one-way code made from your Apple sign-in identifier, never the identifier itself.
• Session keys expire after one hour and are kept only in the app's memory.
• We keep session keys, Apple sign-in data and signed purchase records out of our server logs.
• We never receive payment details, because Apple processes all payments.
• Apart from the number of levels you have won and the tutorials you have seen, our purchase server holds no information about how you play and no information about your device.

No system is perfectly secure. If a data breach affects your personal data, we will inform you and the authorities as the law requires.

13. Right to Lodge a Complaint

If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the Finnish supervisory authority:

• Office of the Data Protection Ombudsman
• Tietosuojavaltuutetun toimisto
• tietosuoja.fi

You can also lodge a complaint with the supervisory authority in the EU country where you live or work. If you live in the United Kingdom, you can complain to the Information Commissioner's Office (ico.org.uk). In the US, you can contact your state's attorney general.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, and we review it at least once every 12 months. The latest version will always be available at https://thepangames.com/heist-flow/privacy-policy. Before a new version of the game collects data in a new way, we will update this policy and, where the law requires, ask for your consent. If we make significant changes, we will update the "Last updated" date at the top of this page.