Privacy Policy

Effective 9 September 2026

This policy explains what Florine's Heart collects, why it is needed, where it is stored, and the choices available to you. The current release does not use advertising, analytics, or third-party tracking SDKs.

1. Who is responsible

Florine's Heart is operated by the developer named on its Google Play listing. Privacy and data requests can be sent to main.kspace@gmail.com.

2. Data used without an account

An account is not required. The app creates a random installation identifier and sends that identifier, the platform type (web or Android), and a last-seen time to our server. This lets the service distinguish installations without using your name, email address, advertising ID, or hardware serial number.

Your sound mixes, settings, reading and listening position, activity history, levels, and other progress are stored locally on your device. They are not uploaded as a cloud save unless you choose to sign in.

3. Optional Google sign-in and sync

If you sign in with Google, Google provides your email address and a stable Google account identifier. We use them only to create or find your Florine's Heart account. We never receive your Google password. Your save is then stored on our server so it can be restored and merged across your devices. Sign-in is optional and the core app remains available without it.

4. Notifications

Notifications are off until you enable them. Browser reminders require a push endpoint, encryption keys, your chosen reminder time and categories, and your IANA time zone (plus a temporary compatibility offset). Android reminders are scheduled locally on the device. You can disable reminders in Settings or in your browser or Android settings. Disabling browser reminders removes the subscription from our server.

Optional purchases

Where paid worlds are available, Android payments use Google Play. Google handles payment details; we do not receive your card number. We send Google a hashed identifier for your Florine's Heart account and receive the product, purchase token, order and payment status, purchase time, and country code. Our server uses these records to provide purchased content, restore it on your linked devices, and handle refunds. A purchase requires sign-in; the Tavern remains available without an account.

Deleting your account removes its purchase links from our database. Google retains its own payment records under its policies. We retain minimal refunded-transaction markers to prevent a refunded purchase from being redeemed again.

5. Offline downloads and local storage

The app can save audio and artwork in browser or Android WebView storage for offline use. It also uses local storage and IndexedDB for settings, saves, and session information. You can remove offline content or reset local progress from Settings. Your operating system or browser may also remove cached files when storage is critically low.

6. Infrastructure and technical records

Cloudflare provides hosting, content delivery, databases, storage, security, and browser push processing. Like other internet services, Cloudflare may process network information such as IP address, request time, requested path, browser information, and security signals to deliver and protect the service. Google processes the optional sign-in flow. We do not sell personal data or use it to build advertising profiles.

7. Why we process data

To provide local use, optional account sync, and requested notifications.
To verify and restore optional purchases and process purchase cancellations or refunds.
To keep the service secure, prevent abuse, diagnose failures, and maintain availability.
To comply with legal obligations and respond to valid legal requests.

Depending on your location, these purposes rely on providing the service you requested, legitimate interests in operating and securing it, your consent for optional notifications, and applicable legal obligations.

8. Retention and deletion

Local saves remain until you reset them, clear app data, or uninstall the app.
Synced account data remains until you delete the account.
Browser push subscriptions remain until disabled, expired, or deleted with the account.
Inactive anonymous device registrations are removed after 12 months.
Short-lived authentication state and sessions expire automatically.

Security and network records controlled by our infrastructure providers follow their applicable retention practices. Information may be retained longer only where required by law, fraud prevention, dispute resolution, or the protection of legal rights.

9. Your choices and rights

You can export your local save, reset local data, disable notifications, or use the app without an account. Signed-in users can clear synced progress or permanently delete their account and associated server data from Settings or at the account deletion page. You may also ask to access, correct, export, restrict, object to, or delete personal data where applicable by emailing us. You may complain to your local data-protection authority.

10. Security and international processing

Data is encrypted in transit using HTTPS. Access to account data is protected by opaque session tokens, and server inputs are validated and rate-limited. Cloudflare and Google operate globally, so data may be processed outside your country under the safeguards they provide and applicable law. No internet service can guarantee absolute security.

11. Age

Florine's Heart is intended for adults and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so it can be removed.

12. Changes

We will revise this policy before introducing materially different data use, such as advertising, and update the effective date. Material changes will be shown in the app or store listing where appropriate.

13. Contact

Privacy questions and requests: main.kspace@gmail.com.