Your privacy
Last updated: 18 October 2026 · Publisher: Hamza Lhioui
Who is responsible
Kiro’s River is developed and published by Hamza Lhioui. For privacy requests or support, contact support@kirosriver.com. This notice describes the iOS and Android game, its online features, the website at kirosriver.com.
Playing and saving your progress
Game progress, discoveries, preferences and local scores are stored on your device. Linking an account does not upload or synchronize your local gameplay progress. Clearing app storage can remove those saves. Device backups are controlled separately by your platform settings. The game does not display advertisements. Online features use an internet connection and the providers described below. Playing without a linked account does not mean that all play is anonymous to our online providers: a game identifier can be created when online services connect.
Game identity and account recovery
Unity Authentication assigns a game player identifier and maintains authentication credentials used to recognize your game identity. Online leaderboard and purchase requests use that identity. Android offers Sign in with Google and iOS offers Sign in with Apple. Existing Unity Player Accounts can be recovered through a browser sign-in page. The selected provider handles sign-in credentials and account information; Unity Authentication processes the provider association and identifiers. Unity Player Accounts also processes the email used to register. The game uses authentication tokens and the account association; please never send passwords, sign-in codes or tokens to support. A linked account is required before buying a river so its ownership can be recovered on the same store platform. Recovering another account changes the online identity used for purchases and leaderboard activity; local game progress remains on the device. Store purchases remain separate between platforms.
Public leaderboard
Eligible scores are submitted to the online leaderboard with your game identifier and player name. If a submission fails, the game stores the pending score locally and retries when it can connect. Other players can see your displayed name, score and rank. Choose from the game’s nature-themed aliases; the game does not offer a free-text public name field. A numeric tag helps distinguish players with the same alias. A default alias is displayed until you choose one. Unity Authentication, Cloud Code and Leaderboards support this feature. We use its information to maintain rankings, associate entries with players and check score submissions. Public display of your nickname and score is part of the leaderboard feature.
River purchases and restoration
Google Play processes Android payments and Apple processes iOS payments. We do not receive your payment-card number from the game's purchase flow. The game and our Unity-hosted purchase service process product identifiers, transaction evidence such as purchase tokens, purchase status and a game-account association to verify payment, grant river access, restore ownership and handle cancellations or refunds. We retain a server-side purchase ledger and account mapping for these functions. Purchase notifications travel through Google Cloud Pub/Sub; a Cloudflare worker schedules processing by the Unity service. A signed ownership record is also cached on your device. This cache contains the game identity, store and river entitlements; it is not a cloud backup of your gameplay progress. Unity's IAP 5.4+ service documents collection of player, installation and session identifiers, device information, approximate location/country, purchase history, and crash, diagnostic and performance information for service functionality and analytics. Its SDK documentation also lists email processing. Precise GPS location is not requested by the game. Provider processing is described in Unity's privacy information. We do not enable advertising or third-party advertising measurement in this game.
Service providers and technical information
Unity provides game authentication, account linking, online rankings, purchase integration and server-side storage and processing. Google provides Android distribution, payment processing and purchase-notification infrastructure. Cloudflare provides website hosting, registration storage and the scheduled purchase-processing worker. Technical requests can expose network information, including IP addresses, to the services receiving them. Providers may keep operational and security logs under their service arrangements. Provider information: Unity privacy policy (https://unity.com/legal/privacy-policy), Google privacy policy (https://policies.google.com/privacy), and Cloudflare privacy policy (https://www.cloudflare.com/privacypolicy/).
Website download-button measurement
When you activate an App Store or Google Play button on our website, we count the click to understand which promotions and page positions help players find the game. We store daily totals in Cloudflare, grouped by the destination store, button position and public campaign/source labels from the link you followed. Untagged visits are recorded as direct/untagged. Campaign labels are also included in the outgoing Google Play link. Please do not put personal information in campaign tags. This counter does not use cookies, browser storage, fingerprinting or visitor identifiers. We do not store IP addresses, user agents, full referring URLs or individual click histories in the counter. Network providers still process requests as described above. We honour browser Do Not Track and Global Privacy Control signals by not counting those clicks. Totals measure clicks, not distinct people or completed installations; reports are accessible only through the publisher’s authenticated Cloudflare account. Aggregate totals may be retained for historical comparisons.
Support
When you contact support, we receive your email, message and attachments you choose to send. We use them to answer requests and investigate issues. Email is handled through Cloudflare and the publisher's Google mailbox. Please do not send passwords, payment credentials, raw purchase tokens or unnecessary personal details.
Retention and deletion
We keep account, leaderboard and purchase-entitlement records while the account is active so online features and ownership recovery work. Following a verified deletion request, we remove associated personal data except specifically required legal records. Request deletion of your Kiro’s River account at https://kirosriver.com/delete-account or through Settings → Your Account → Delete Account (under Account options in newer versions) in the game. This opens a support-assisted request, not immediate automatic deletion. We verify control of the account before acting. A public nickname alone is insufficient. We explain any specific record we must retain, its purpose and retention period. Account deletion can affect recovery of paid content; a refund is a separate store process. Clearing local storage or uninstalling the game does not by itself delete server records. Your wider Unity Player Account is separate from your Kiro’s River data. You can manage it at https://player-account.unity.com/. Deleting that provider account does not automatically erase the game's records; contact us for those records. Conversely, a request to delete Kiro’s River data does not ask us to delete your wider Unity account. If you previously opted into our registration programme, earlier records may include your email, optional phone model, registration time and consent version. We remove active registration records and associated Google Group membership within 90 days after the programme closed, or earlier on request. Existing private removal links still delete website registrations; contact support from your registered address if you have lost your link or want associated membership or retained exports removed. Website registrations and Google-held records are separate; Google controls its own service records. Routine support correspondence is removed within 12 months after resolution, except records needed for specific legal obligations. Provider backups and logs have separate retention arrangements; active-record deletion does not necessarily erase existing backups immediately.
Teens and parents
Kiro’s River is intended for ages 13 and older, not children under 13. Contact us if a child has submitted personal information so we can investigate and handle it appropriately.
Your rights and choices
Contact support@kirosriver.com to request access, correction or deletion. Depending on your location, you may also have rights to restriction, objection, portability and complaint to a data-protection authority. You can withdraw consent for an earlier optional registration without affecting the lawfulness of earlier processing. We use account, ranking and transaction information to provide the game services you use and fulfill purchases; we use security and support information to operate and protect those services, and consent for earlier optional registrations. Service providers may process information outside your country. Applicable legal bases, safeguards and any legally required retention depend on the processing concerned.
Changes
We update this notice when our practices change. The revision date above identifies this version.
Provider information: Unity · Cloudflare · Google