Blacktop GM › Privacy policy

Blacktop GM Privacy Policy

Version 1.0 · Effective 7 October 2026 · Publisher: Petar Otovic (Morava) · Contact: contact@morava.dev

1. Who we are and what this policy covers

Blacktop GM ("the game" or "the app") is published by Petar Otovic, an independent developer based in Serbia who publishes under the name Morava ("we", "us", "our"). This policy explains what information the game handles, why, who it is shared with, how long it is kept, and the choices and rights you have.

It applies to:

• the Blacktop GM app for Android (package com.morava.blacktopgm) and for iOS (bundle com.morava.blacktopgm), in every version we publish;

• the optional Blacktop GM online account and the teams you keep on our server;

• any message you send us at the contact address below.

It does not cover Google Play, the Apple App Store, Sign in with Apple or Google Sign-In, or the advertising partners named in section 5. Each of those is run by its own company under its own privacy policy, which we link to where it is relevant.

Effective date: 7 October 2026 · Last updated: 7 October 2026 · Version: 1.0

Data controller (where the EU or UK GDPR applies): Petar Otovic, 18106, Serbia.

Contact for privacy questions and requests: contact@morava.dev

2. The short version

Blacktop GM is an offline game first. Everything you build in it lives on your own device, and we collect as little as the game needs to work.

• Your franchises stay on your phone. Saves, game logs, your GM tokens, your Pro unlock and the "tour seen" flag are files in the app's private storage. They never leave the device unless your phone's own backup (Google Backup or iCloud) copies them, which you control. We cannot see or open them.

• No analytics, no trackers, no crash reporting. The game contains no analytics, attribution, crash-reporting or social SDKs. It does not ask for your location, contacts, camera, microphone, photos or files.

• Ads are optional and rewarded. The only ads in the game are rewarded videos you choose to watch for an in-game perk. They are served by Google AdMob, whose software collects your device's advertising ID, IP address and basic device details to show and measure the ad. In the EEA, UK and Switzerland we ask for your consent before any of that happens, and you can say no and keep playing.

• Purchases go through Google Play or the App Store. We never see your card number or billing details. The store tells the game what you bought, and that record stays on your device.

• The online account is optional. If you sign in with Apple or Google, we keep your account ID, the email the sign-in provider gives us (Apple can give a relay address), when the account was created, whether it holds Pro, and the teams you send to our server (the city, team and GM names you type, the crest, jersey and GM face you design, and the staff and roster you build). Our server is hosted by Supabase on Amazon Web Services in the United States.

• We do not sell your personal information, and we do not send you marketing.

• Not for children under 13. The game is made for adults and teenagers, and we do not knowingly collect personal information from anyone under 13 (or under the age of digital consent where they live).

• You are in control. You can opt out of personalised ads, delete your saves by deleting the game, and delete your online account and teams from inside the game or by emailing us. Sections 11 and 12 list your legal rights in full.

3. Information we collect, and where it comes from

We collect information in five ways. Most of it is handled by the game on your device and never reaches us.

3.1 Information that stays on your device

The game writes these files to its own private storage on your phone. They are not sent to us or to anyone else by the game. We cannot read them. Your phone's operating system may include them in a device backup (Google Backup on Android, iCloud Backup on iOS) under your own backup settings and the privacy policy of Google or Apple.

• Franchise saves: the city, team name and GM name you type, the crest, jersey and GM face you design, and every player, result, contract, post and statistic the game generates for that franchise.

• Game logs: the play-by-play of each game you have played.

• Purchase record: whether Pro is unlocked and how many GM tokens you hold.

• Roster templates you save, and a flag recording that the first-time tour has been shown.

Deleting the game deletes all of these. The game has no cloud save, so we cannot recover them for you.

3.2 Advertising information (Google AdMob)

The only ads in Blacktop GM are rewarded videos: nothing plays unless you tap a button to watch an ad for an in-game perk. The ads are served by Google AdMob, a service of Google LLC. When an ad loads or plays, Google's Mobile Ads software inside the game collects and sends to Google:

• your device's advertising identifier (Google Advertising ID on Android; IDFA on iOS, and only if you allow tracking when iOS asks);

• your IP address, from which Google derives an approximate location (country or city level);

• device and app details: device make and model, operating system version, language, screen size, carrier or network type, the game's package name and version, and an app set ID that links apps from the same developer on your device;

• ad interaction data: which ads were shown, viewed to the end, clicked or closed, and diagnostic data about ad loading;

• your consent choices for advertising, where we ask for them (stored on your device and read by Google's software).

Google uses this to pick, show, cap, measure and bill ads, to detect fraud, and, where you have consented or where the law allows it, to show you ads based on your interests. Google may share some of this with its advertising partners for the same purposes (see section 5). We receive only aggregated reports from Google: how many ads were shown and what they earned. We never receive your advertising ID or IP address from Google.

3.3 In-app purchases

Pro and GM token packs are sold through Google Play Billing on Android and Apple's App Store (StoreKit) on iOS. Google or Apple takes your payment under its own terms and privacy policy. We never receive your card or bank details. The store sends the game a purchase confirmation (product name, purchase or order token, purchase state and time), which the game records on your device as described in 3.1. Google and Apple also show us order records in our developer dashboards (order number, product, country, date, amount and currency, and refund status) so that we can handle refunds and keep accounts.

3.4 Online account and online teams (optional)

You can play Blacktop GM without an account. If you choose to sign in, we and our hosting provider Supabase store:

• Account data: a random account ID we create; the email address Apple or Google gives us (with Sign in with Apple you can choose to hide your email, in which case we receive an Apple relay address); which provider you signed in with and that provider's ID for you; and, from Google Sign-In, the name and profile picture link Google attaches to its sign-in token, which the game does not display or use; when the account was created and last signed in.

• Profile data: whether the account holds Pro and how many teams it may keep.

• Teams you send to the server: the city, team name and three-letter short name, the country you pick, the team colours, the crest and jersey you design, the GM name you type and the GM face you design, the coaching staff you create, and the roster of fictional players you build, with the time the team was created and the version of the creation rules it passed.

• Security logs: our hosting provider records sign-in and server requests with your IP address, device type and time for a short period to keep accounts secure and to diagnose faults.

The GM name, city and team name are free text. If you type your real name or other personal details there, we will hold them as part of your team. Please do not include other people's personal information.

3.5 Messages you send us

If you email us for support, a refund question or a privacy request, we receive your email address, your message, any attachments you include, and anything we need to ask you to confirm your identity.

3.6 What we do not collect

The game does not collect your precise location, contacts, calendar, photos, files, camera or microphone input, health or fitness data, biometric data, messages, browsing history, or any government, financial or payment account numbers. It does not read other apps on your device except as noted in 3.2 for advertising. It does not let you upload photographs: faces, crests and jerseys are drawn inside the game.

Summary

4. Why we use information, and our legal bases

We use personal information only for the purposes below. Where the EU GDPR, UK GDPR or Swiss law applies, the table also gives the legal basis we rely on for each purpose.

Where we rely on legitimate interests, we have weighed them against your interests and rights and concluded they are not overridden, because the processing is limited, expected, and under your control. You can object at any time (section 11).

No marketing. We do not send marketing email or push notifications, and we do not use your information for marketing.

No automated decisions about you. We make no decisions with legal or similarly significant effects on you by automated means. The game's own simulation acts only on fictional players. Google may build an interest profile from your advertising activity to pick ads, but only where you have consented or opted in as described in section 5.

Providing information is voluntary. You can play the whole game without an account and without watching ads. You need an account only for the online features, and the information in 3.4 is needed to provide them. If you do not provide it, we cannot offer you those features.

5. Advertising and your choices

What you will see. Blacktop GM shows rewarded video ads only. The game never shows an ad you did not ask for: an ad plays only after you tap a button offering an in-game perk in return for watching it. There are no banner, interstitial, app-open or native ads.

Who serves them. The ads come from Google AdMob. Google and the advertising partners it works with may serve two kinds of ad:

• Non-personalised (limited) ads are chosen from the game you are in, your language, and the approximate location derived from your IP address. They do not use your advertising identifier to build a profile of you.

• Personalised ads are chosen using your advertising identifier and the interests Google infers from your activity across apps and sites that use its advertising services. Google shows them only where you have allowed it, as set out below.

The partners that may receive your data for personalised ads are those on Google's ad technology partners list. How Google uses the data is described in How Google uses information from sites or apps that use our services. We never pass your name, email address or account ID to Google's advertising systems.

European Economic Area, United Kingdom and Switzerland. Before the game requests its first ad, it shows a consent notice from Google's User Messaging Platform, a consent management platform certified by Google under the IAB Europe Transparency and Consent Framework. You can accept, reject, or choose purpose by purpose and partner by partner. Your choice is stored on your device as a consent string that Google and the listed partners read. If you do not consent, Google serves only limited ads that do not use your advertising identifier, and some rewarded ads may not be available; the rest of the game works exactly the same. You can change or withdraw your choice at any time inside the game under OFFICE → PRIVACY OPTIONS. Withdrawing consent does not affect what was done before you withdrew it.

Apple devices. On iOS, Google can read your device's advertising identifier (IDFA) only if you allow tracking when iOS asks "Allow Blacktop GM to track your activity across other companies' apps and websites?". If the game does not ask, or you decline, the identifier is not available and ads are not personalised with it. You can change this at any time in Settings → Privacy & Security → Tracking. Apple's SKAdNetwork lets advertisers measure installs from ads without identifying you.

United States. In California, Colorado, Connecticut, Virginia, Texas, Oregon and the other states with privacy laws, you can opt out of personalised advertising, which those laws may call a "sale", "sharing" or "targeted advertising", inside the game under OFFICE → PRIVACY OPTIONS. When you opt out, the game tells Google to apply restricted data processing, so it serves ads without personalisation and does not sell or share your data for that purpose. We also honour the Global Privacy Control signal where the platform passes it to us. Section 12 has the full list of your rights.

Everyone, everywhere. You can also limit personalised ads through your device:

• Android: Settings → Privacy → Ads (or Settings → Google → Ads) → Delete advertising ID, or Opt out of Ads Personalisation. Resetting the ID breaks the link to any profile built with the old one.

• iOS: Settings → Privacy & Security → Tracking → switch off Allow Apps to Request to Track.

• Google account: My Ad Center controls personalised ads across Google's services.

• Industry tools: the Digital Advertising Alliance's AppChoices app in the United States and Your Online Choices in Europe.

Minors. We do not knowingly serve personalised ads to anyone under 18. If the app store signals, or you tell us, that a device is used by a minor, we treat its ads as non-personalised. Section 10 says more about children.

Pro does not change any of this. Buying Pro adds game features; it neither removes nor adds ads, because there are no ads to remove.

6. Who we share information with

We do not sell personal information, we do not share it with data brokers, and we do not give it to anyone for their own marketing. Information reaches other companies only in the ways below.

We may also disclose personal information:

• to comply with the law, a court order, or a lawful request from a public authority;

• to protect rights and safety: to enforce our terms, investigate fraud or cheating, or protect you, us or others;

• in a business transfer: if the game or our business is sold, merged or transferred, the information in this policy may pass to the new owner, who must honour this policy or tell you how it will change;

• with your consent, for any purpose you agree to at the time.

A note for California residents. Allowing Google to use your advertising identifier to personalise ads can count as "sharing" for cross-context behavioural advertising under California law, even though no money changes hands. Section 12 explains how to opt out, and we honour the Global Privacy Control signal. We do not knowingly sell or share the personal information of anyone under 16.

7. How long we keep information

We keep personal information only as long as the purpose in section 4 needs it, and then delete or anonymise it. The periods below apply to each category.

We may keep a copy of information for longer where the law requires it, where it is needed for a legal claim, or in anonymised form that no longer identifies you.

8. Where your information goes (international transfers)

We are based in Serbia. Our server runs in the United States (Amazon Web Services, Virginia region, operated by Supabase). Google and Apple process data in the United States and in other countries where they operate. If you live in the European Economic Area, the United Kingdom or Switzerland, your information therefore leaves those areas.

We protect it with the safeguards the law recognises:

The EU–US Data Privacy Framework was upheld by the EU General Court in September 2025; an appeal to the Court of Justice is pending. If the Framework were ever invalidated, transfers to Google and Apple would continue under standard contractual clauses. You can ask us for a copy of the safeguards we rely on at the contact address in section 15.

For Switzerland (Art. 19 FADP): your information is disclosed to the United States, where the Data Privacy Framework provides adequate protection for certified companies and standard contractual clauses cover the rest, and to Serbia, which is not on the Federal Council's list of countries with adequate protection. For disclosures to Serbia we rely on the exceptions in Art. 17 FADP: the performance of our contract with you for the account and online teams, and your consent when you choose to contact us.

9. Security

We protect the information we hold with measures appropriate to the small amount and low sensitivity of that information.

• Encryption in transit. All traffic between the game and our server, and between the game and Google or Apple, is encrypted with TLS.

• Encryption at rest. Our database and backups are encrypted on disk by our hosting provider, which runs on Amazon Web Services and holds independent security certifications.

• Least privilege. The game ships only a publishable key that lets a signed-in player read their own profile and teams, and nothing else. Every write to the database goes through our server function, which checks the account and validates the team first. Row-level security keeps each account's rows invisible to every other account.

• No payment data. Card and bank details are handled only by Google Play and the App Store and never pass through the game or our server.

• Limited access. Only the developer can reach the server, protected by multi-factor authentication. Nobody else has access.

• Breach response. If a breach puts your rights at risk, we will tell the relevant supervisory authority within 72 hours and tell you without undue delay, as the law requires.

No system is perfectly secure. Keep your device's operating system up to date, protect your Apple or Google account with a strong password and two-factor authentication, and tell us at once if you think your account has been misused.

10. Children

Blacktop GM is made for adults and teenagers. It is rated for ages 13 and over and is not directed at children under 13. It has no features that appeal mainly to young children, and we do not market it to them.

Under 13 (United States, COPPA). We do not knowingly collect personal information from children under 13. Do not create an online account, send us a message, or watch ads if you are under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it as quickly as we can. If you are a parent or guardian and believe your child has given us personal information, contact us at contact@morava.dev and we will delete it.

Under the age of digital consent (EEA, UK, Switzerland). Where the GDPR applies, children below the age of digital consent in their country (between 13 and 16, depending on the country; 13 in the United Kingdom) cannot consent to personalised advertising or create an account without a parent or guardian. If you are below that age, use the game without an account and do not accept personalised ads. If we learn we hold an account for a child below that age without parental consent, we will delete it.

Under 16 and under 18 (US states). We do not sell or share the personal information of anyone we know to be under 16, and we do not show personalised ads to anyone we know to be under 18. Where a state law requires parental or the minor's own consent for targeted advertising, we treat the absence of that consent as an opt-out.

Age signals from the app stores. Some places, including Texas, Utah, Louisiana and California from 2027, require Google Play or the App Store to tell apps a user's age category. If we receive such a signal, we use it only to apply age-appropriate protections: switching off personalised ads and blocking account creation where required. We never use it for advertising, analytics or profiling, we do not share it, and we do not keep it longer than needed to apply those protections.

Parents. Google Play and the App Store offer family controls that can block purchases, restrict apps by rating and manage a child's device: Google Family Link and Apple Screen Time.

11. Your rights in the EEA, the United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, you have these rights over the personal information we hold about you. All of them are free to exercise.

• Access: a copy of your information and an explanation of how we use it.

• Rectification: correction of anything inaccurate or incomplete.

• Erasure: deletion of your information, including your whole account and every team on it. You can do this yourself inside the game under OFFICE → ONLINE → DELETE ACCOUNT.

• Restriction: a pause on our use of your information while a dispute about it is resolved.

• Portability: your account data and online teams in a machine-readable format (JSON), to keep or to give to another service.

• Objection: you can object at any time to processing based on our legitimate interests (section 4). We will stop unless we have compelling grounds that override your interests. You can object to any direct marketing, although we do none.

• Withdrawal of consent: you can withdraw consent to personalised advertising at any time under OFFICE → PRIVACY OPTIONS, and consent to anything else by contacting us. Withdrawal does not affect what was done lawfully before it.

• Automated decisions: we make none that have legal or similarly significant effects on you, so there is nothing to opt out of.

Information we get from others. When you sign in, Apple or Google sends us the account data listed in section 3.4: an identifier, your email address or relay address, and, from Google, your name and profile picture link. This is the only information about you that we receive from a source other than you or the game.

How to exercise a right. Email contact@morava.dev from the email address on your account, or write to the address in section 15. If we cannot tell that the request comes from the account holder, we will ask you to confirm it, for example by signing in or replying from the account email. We answer within one month. For complex or numerous requests we may take up to two further months, and we will tell you within the first month if so. We keep a record of each request for 24 months.

Advertising data held by Google. Google is a separate controller of the advertising data described in section 3.2. You can exercise your rights over it directly with Google through Google's privacy policy and My Ad Center. We will help you if you contact us.

Complaints. If you are unhappy with how we handle your information, we would like to put it right: write to us first, and we will acknowledge your complaint within 30 days and tell you the outcome. You also have the right to complain to a supervisory authority at any time:

• in the EEA, the authority of the country where you live, work or where the problem happened: list of EU data protection authorities;

• in the United Kingdom, the Information Commissioner's Office: ico.org.uk/make-a-complaint;

• in Switzerland, the Federal Data Protection and Information Commissioner: edoeb.admin.ch.

12. Your rights in the United States

California (the CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island give their residents rights over personal information, and Oklahoma, Louisiana, Alabama and Vermont follow in 2027 and 2028. Most of these laws apply only to businesses above a size threshold that we may not meet. We honour the rights below for every United States resident regardless. This section is also our California notice at collection and our disclosure under the California Online Privacy Protection Act.

Personal information we have collected in the last 12 months

We do not collect protected classifications, biometric information, audio or visual recordings, professional, employment or education information, precise geolocation, or sensitive personal information: we never hold passwords, government identifiers, financial account numbers, health information or precise location. Section 7 gives the retention period for each category.

Your rights

• Know and access: the categories and specific pieces of personal information we hold, where it came from, why we use it, and who we disclose it to.

• Delete: everything we hold about you. Account deletion is built into the game (section 15).

• Correct: inaccurate information.

• Opt out of sale, sharing, targeted advertising and profiling: see below. We sell nothing and profile nobody; the only activity covered is personalised advertising.

• Limit the use of sensitive personal information: not needed, because we collect none.

• Portability: a copy of your account data and teams in a machine-readable format.

• A list of the specific third parties we have disclosed personal information to, for Oregon residents and anyone else who asks: Google LLC, Supabase, Inc., Apple Inc. and United Internet d.o.o. (unlimited.rs).

• No discrimination: we will never deny you the game, charge a different price or give you a different experience because you exercised a right. Rewarded ads remain available to everyone, personalised or not.

• Appeal: if we refuse a request, you can appeal (see below).

Do Not Sell or Share My Personal Information

We do not sell personal information. The only "sharing" or "targeted advertising" is personalised advertising through Google (section 5). To opt out, open OFFICE → PRIVACY OPTIONS → Do Not Sell or Share My Personal Information in the game. The game then tells Google to apply restricted data processing for your device, and we will not ask you to opt back in for at least 12 months. We honour the Global Privacy Control and other opt-out preference signals where the platform passes them to us. We do not sell or share the personal information of anyone we know to be under 16, and we do not show personalised ads to anyone we know to be under 18.

How to make a request

Email contact@morava.dev, or delete your account inside the game. We respond within 45 days; if we need longer we will tell you within that time and take at most 45 more days. Requests are free unless they are plainly excessive. To protect your information we verify requests: for account data, by having you sign in or reply from the email on your account; for anything else, by matching what you tell us against what we hold. An authorised agent may make a request for you if they show us your signed permission, and we may still confirm the request with you directly. We keep a record of requests for 24 months.

Appeals. If we refuse a request, reply within 60 days with the word "Appeal" and your reasons. We will answer in writing within 45 days (60 days in Texas and Louisiana) with our decision and the reasons for it. If we still refuse, you can complain to your state attorney general: find your attorney general. California residents can contact the California Privacy Protection Agency or the Attorney General.

Other California and state notices

• Do Not Track: Blacktop GM is a mobile app and does not receive browser Do Not Track signals; it honours the Global Privacy Control as set out above. Google may collect information about your activity across apps and over time for advertising, as described in section 5.

• Shine the Light (Civ. Code §1798.83): we do not disclose personal information to third parties for their own direct marketing.

• Nevada: we do not sell covered information.

• Texas: we do not sell sensitive personal data.

• Effective date and updates: at the top of this policy. We review it at least every 12 months.

13. What the app store labels say

Google Play's Data safety section and Apple's App Privacy details are filled in to match this policy, including data collected by the Google Mobile Ads software inside the game. This table is the same information in the stores' own categories. "Linked to you" means the store treats it as identifying you; "tracking" is Apple's term for linking data about you with data from other companies' apps and sites for advertising.

All data in transit is encrypted. Everything we hold about an account can be deleted from inside the game (section 15). The data Google collects for advertising is governed by Google's privacy policy and deleted or anonymised on Google's schedule (section 7).

Google Play account deletion link: https://morava.dev/blacktop-gm/delete-account/

14. Changes to this policy

We will update this policy when the game's data practices change, when the law changes, or at least once every 12 months when we review it. The current version is always at https://morava.dev/blacktop-gm/privacy/ and inside the game under OFFICE → PRIVACY POLICY. The effective date and version number at the top tell you when it last changed.

If a change materially reduces your rights or expands how we use personal information already collected, we will tell you before it takes effect with a notice inside the game and, for account holders, by email to the address on the account, and we will ask for your consent again where the law requires it. Continuing to use the game after a change takes effect means the new policy applies, except where consent is required.

15. Contact us

For any question about this policy, to exercise a right, or to delete your account or data:

• Email: contact@morava.dev

• Post: Petar Otovic, 18106, Serbia

• Account deletion: inside the game under OFFICE → ONLINE → DELETE ACCOUNT, or by email to the address above from the email on your account. You can also request deletion of your data at https://morava.dev/blacktop-gm/delete-account/.

We answer within 30 days (45 days for California requests, extendable once by a further 45 days with notice). If you are in the EEA, UK or Switzerland and are not satisfied with our answer, section 11 explains how to complain to your data protection authority.