Legal
Privacy policy
What HEATSINK collects, who receives it, how long it is kept, and how you get rid of it. In the order those questions actually get asked.
The short version
HEATSINK has no accounts, no logins and no sign-up. It never asks for your name or your email address, and it carries no analytics and no crash reporting, so nothing in it measures how you play.
Two things leave your phone. Ad requests go to Google, which is how a game with no purchase and no paid continues is paid for. A score goes to our own server if you post one to the daily board, under a handle the game generates rather than a name you give. Everything else, your progress, your unlocks, your settings and your best runs, stays on the device and is deleted with the app.
Who is responsible
HEATSINK is made and published by Structured Cloud Studios, an independent game studio in Mississauga, Ontario, Canada. We are the party responsible for the information described on this page, which is what the GDPR calls the data controller and what Canadian law treats as the organisation accountable for it.
Everything on this page is answered at support@structuredcloudstudios.com. It is a real address, read by the people who make the game, and it is the same one the stores list for support.
What HEATSINK collects
Four things. This is all of them, and the fourth never leaves your phone.
Advertising identifier and ad request data
Your device advertising identifier (the Android advertising ID, or Apple's IDFA when you have allowed tracking), your IP address, your device model, operating system version, language and region, and which ads were shown, watched or tapped.
- Why
- To fill the ad slots, to stop you being shown the same ad over and over, to measure whether an ad worked, and to detect fraudulent traffic. Advertising is what pays for the game, and it is why retry is free.
- Who receives it
- Google, as the operator of AdMob. Google's own software inside the app collects it and sends it to Google directly. We never receive it: our console shows totals, not people.
- How long it is kept
- By Google, on Google's retention schedule rather than ours. We hold none of it, so we cannot delete it on your behalf. The section on advertising below is how you reach it yourself.
Your daily board entry
The score, the date of the seed it was set on, a handle assigned to you, and a few figures the run itself produced: how long it lasted, how accurate you were, and how it ended. Also a random identifier the game generates the first time you play and stores on your device, which is what lets a returning player keep their entry without an account. The handle is one word and one number. You do not choose it, and neither it nor the identifier is built from your name, your email address or your advertising identifier, or connected to an account, because there is no account.
- Why
- To rank the day's runs. Everyone playing on a given date is dealt the same rack and the same 2 weapons, which is the only condition under which a board means anything, and a board needs the scores in one place to be a board.
- Who receives it
- Nobody. It sits on servers we run, and it is not sold, shared or sent anywhere else.
- How long it is kept
- At most 2 days. The board holds today and yesterday, and when the day rolls over the older one is deleted outright. Nothing is archived, so there is no history of your play for anyone to ask us for.
Server records
When the game talks to our server to post or fetch a board, the server notes that a request happened, when, and roughly where from. Not your IP address itself: that is turned into a fingerprint which cannot be turned back into an address, and the address is never written down.
- Why
- To keep the board working, and to stop it being flooded with scores that were never played. The fingerprint is used for that and nothing else.
- Who receives it
- Nobody outside the studio.
- How long it is kept
- The fingerprint is discarded within a day. Your IP address is not kept at all.
Your progress, on the device
Progress through the 60 stages, unlocked weapons and modules, your settings including the reduced motion and audio ones, and your own best scores.
- Why
- So the game remembers where you were.
- Who receives it
- Nobody. It is written to the app's own storage on your phone and it is never sent to us.
- How long it is kept
- Until you delete it. Uninstalling the game removes all of it, and there is no cloud copy to survive that.
What it does not collect
Stated as plainly as the rest, because the absence of a thing is not something you can check for yourself from outside the app.
- No account, no login, no password and no email address. The daily board works the moment you open the game.
- No analytics SDK and no crash reporting SDK. Nothing counts your sessions or reports which stage you stopped playing on.
- No access to your contacts, photos, camera, microphone, calendar or files. The game does not ask for those permissions, so it cannot be granted them by accident.
- No precise location. An ad request carries an IP address, from which a country or a region can be estimated, and nothing finer than that is available to anyone.
- No purchase history and no payment details, because there is nothing to buy.
- No selling of personal information for money. Not now, and if that ever changed it would be a material change, handled the way the section on changes below describes.
Advertising, and how to turn personalisation off
HEATSINK shows ads, and Google's AdMob serves them. Some are rewarded ads you choose to watch; others appear between runs. Advertising is what pays for a game with no purchase, no energy meter and no paywalled continue, and retry is free and instant whether or not you ever watch one.
In the EEA, the UK and Switzerland, the game shows Google's consent form before it loads a single ad, and asks whether you agree to personalised advertising. Say no and you still get the whole game, with non-personalised ads instead. You can change that answer whenever you like: Settings, Privacy, Ad consent in the game reopens the same form.
On iOS, Apple's App Tracking Transparency prompt decides whether the IDFA is available at all. Decline it and the ads are non-personalised. You can change your mind later under Settings, Privacy and Security, Tracking.
On any device, you can reset or delete the advertising identifier itself: on Android under Settings, Privacy, Ads, on iOS by turning off Allow Apps to Request to Track. That breaks the link between what you have been shown before and what you are shown next.
What Google does with an ad request is set out in how Google uses information from sites or apps that use its services and in the Google privacy policy. We have no more access to it than you do.
One thing worth saying plainly, because the word is alarming and the law means something narrow by it. We do not sell your information and nobody pays us for it. Under California's CPRA and several other state laws, showing you a personalised ad still counts as sharing it for cross-context behavioural advertising. Declining personalisation, by either route above, is the opt-out, and it works whether or not the law where you live gives you the right to demand it.
The daily board
Endless mode runs on a daily seed. Everyone who plays on a given date is dealt the same rack and the same 2 weapons from the 15 day rotation, and the board is where those runs are compared.
There is no account behind it. You are assigned a handle, one word and one number, and it is posted with the score. The handle is random: it is not derived from anything about you or your device, and it is never given to the ad SDK. The board and the ads have no identifier in common.
So that a returning player keeps their entry without an account, the game generates a random identifier the first time you play, stores it on your device, and sends it with a score. It is not built from your name, your email address or your advertising identifier, it is never given to the ad SDK, and deleting the app deletes it.
Because the board holds 2 days, an entry deletes itself. If you want yours gone sooner, the next section says how.
This website
Separate from the game, and much smaller. Neither form below is on this site: both are on the studio site, a link away from here, and this is what each does with what you type into it.
Mailing list signups
We store the address, and the time, IP address, browser user agent and page of the signup. Canada's anti-spam law requires consent to be provable rather than merely claimed, and that record is the proof.
- Why
- So we can tell you when a game has a release date and when it is out. Nothing is sent until you click the link in the confirmation email, so an address typed in by somebody else never receives anything.
- Who receives it
- Nobody outside the studio. The list is ours, and it is not rented, sold or shared.
- How long it is kept
- Until you unsubscribe, which every email we send carries a link for. After that we keep the record that you unsubscribed, so we can show the request was honoured and so a later signup is a fresh consent rather than a silent restore.
Contact form messages
Your name, your address, your message, and the IP address it was sent from, which travels with the message so an abusive sender can be blocked.
- Why
- To answer you.
- Who receives it
- Nobody outside the studio.
- How long it is kept
- In our mailbox, for as long as the conversation is useful. Ask and we will delete it.
No cookies
This site sets none at all, so there is nothing here for you to accept or dismiss. No analytics cookie and no advertising cookie, because there is no analytics and no advertising on it. No third-party script runs on any page, and the typefaces are served from our own domain rather than fetched from anyone else's.
Children
HEATSINK is not directed at children under 13, or under 16 where local law sets the age there, and is not listed in either store's children or families category. We do not knowingly collect personal information from a child.
If you are a parent or guardian and believe a child has given us something, write to support@structuredcloudstudios.com and we will delete it and tell you that we have.
Your rights, and how to use them
Wherever you live, you may ask what we hold about you, ask for it to be corrected, ask for a copy, ask us to delete it, or object to a use of it. The route for all of them is one email to support@structuredcloudstudios.com.
We answer within 30 days. If we need longer we will say so, and why, before the 30 days are up.
For the daily board specifically: send us the handle printed on your entry and we will remove it. The handle is the part of an entry you can actually read, which is why it is what we ask for, and there is no account behind it to look you up by instead. An entry you leave alone is deleted within 2 days anyway.
Everything else the game holds is on your phone rather than with us. Deleting the app deletes it, and we could not retrieve it if you asked us to.
These rights have different names depending on where you live: access, rectification, erasure, portability, objection and withdrawal of consent under the GDPR and the UK GDPR; access and correction under PIPEDA in Canada; the right to know, delete, correct and opt out under California's CCPA and CPRA and the equivalent state laws. We charge for none of them and we will not treat you differently for using one.
If you think we have handled your information badly, tell us first, because we would rather fix it. You can also complain to a regulator without asking us at all: the Office of the Privacy Commissioner of Canada, the Information Commissioner's Office in the United Kingdom, or your national supervisory authority in the EEA.
Why we are allowed to do this
The legal basis for each use, which the GDPR and the UK GDPR require us to state and which everybody else is entitled to read anyway.
- Running the game, and the daily board in it
- Our legitimate interest in providing the game you installed, and in a board that is not trivially cheatable.
- Personalised advertising, and reading or writing anything on your device for it
- Your consent, given through Google's consent form and withdrawable at any time from the game's settings.
- Non-personalised advertising
- Our legitimate interest in funding a game that is free and has no paid continues, together with your consent wherever local law requires it for the device storage those ads use.
- Keeping server records, and blocking abuse of the board
- Our legitimate interest in a board that stays up and stays honest.
- Answering a message you sent us
- Our legitimate interest in replying to somebody who wrote to us.
- Sending mailing list email
- Your consent, confirmed by the link in the confirmation email and withdrawable from every message we send.
- Keeping the consent record behind a signup
- Our legal obligation under Canada's anti-spam legislation, which requires consent to be provable.
- Keeping the site and its forms working, and blocking abuse of them
- Our legitimate interest in a site that is not a spam relay.
Changes to this policy
This version takes effect on 31 August 2026. When it changes, the date at the top of this page changes with it and the new version replaces this one here.
If a change is material, meaning it alters what is collected, who receives it or what it is used for, we will say so before it takes effect: in the game, and to the mailing list. We will not quietly widen this document and rely on you rereading it.
Contact
Questions about this policy, requests about your information, and anything else on it:
Structured Cloud Studios
Mississauga, Ontario, Canada
support@structuredcloudstudios.com
Something here unclear, or something you want deleted?
One address, read by the people who made the game. Ask what we hold, ask for it to go, or ask what a sentence on this page means.