LuLu’s is a single-player cooking game. You don’t make an account, and the game never asks for your email address, phone number or contacts. This policy explains the little data that does move around when you play (and when you email us), who handles it, and the choices you have. We’ve tried to write it the way we make the game: plainly.
The short version
- No accounts, no sign-in, and no analytics or tracking tools of our own.
- Your progress is saved only on your device. We can’t see it, and deleting the app deletes it.
- Videos are optional. They come from Google AdMob, and you choose to watch each one. Where the law requires it we ask for consent first, and Apple’s tracking prompt lets you say no.
- When you finish a video, Google confirms the reward to our server using a random code made by the app, never your name, advertising identifier or progress. We use it only to check rewards and prevent fraud, and delete it after 90 days.
- Purchases are made through Apple. RevenueCat helps us keep track of what you’ve bought. Nobody here ever sees your payment details.
- We never sell your information for money. If you allow tracking, personalized ads through AdMob may count as “sharing” under some privacy laws; saying no in Apple’s prompt or Google’s consent message turns that off.
Who we are
LuLu’s is made by Machette Labs (“we”, “us”), a small independent studio. We are responsible for this policy. You can reach us any time at support@machettelabs.com.
What stays on your device
Everything the game remembers is stored in the app’s own storage on your device: your tips, rank and progress, upgrades, decorations, outfits, unlocked dishes, your regulars’ stamp cards, your settings, and the name you type on your name tag.
- It is never sent to us. Our only server checks video rewards (see below) and never receives your progress, so we cannot see it, back it up or recover it.
- Settings → Progress → Reset progress wipes your progress (your name tag and settings stay). Deleting the app removes everything.
Optional videos (Google AdMob)
LuLu’s is free to play. In a few places you can choose to watch a short video for a reward, for example bonus tips in the Shop or double tips after a good night. Nothing ever plays unless you tap to watch it. These videos are provided by Google AdMob and the ad networks that fill its requests.
When a video is requested or shown, Google and those networks may receive:
- your device’s advertising identifier, but only if you allow tracking in Apple’s prompt;
- your IP address and an approximate location derived from it;
- basic device and app information (such as model, operating system version, language and the app’s version);
- ad interaction and diagnostic data (such as whether a video loaded, played or was finished);
- the random install code and video code described in the next section, and which bonus the video is for, so Google can confirm your reward to us.
We ask first. Before the first video, the game shows Google’s consent message wherever the law requires one, and then Apple’s App Tracking Transparency prompt. You can say no to either. Rewards work the same either way; the videos you see may just be less personalized.
Google acts as an independent controller of the data it receives. Learn more in how Google uses information from apps that use its services and Google’s privacy policy.
Checking video rewards
To make sure every video reward is real, the game checks it with our own small server before handing it out. Here is everything involved:
- The first time you open the app, it makes a random install code. It is not your device’s advertising identifier, and it isn’t linked to your name, email, Apple Account or anything else about you. Resetting your progress keeps it; deleting and reinstalling the app makes a new one.
- Each time a video is loaded, the app makes a new random video code for it.
- When you finish a video, Google AdMob sends our server a confirmation, signed so we can tell it really came from Google. It contains the install code, the video code, which bonus it was, the ad unit and ad network that showed it, the reward, the time and Google’s transaction ID.
- The app then sends our server the same two codes to check that the reward was confirmed, and hands it to you. If the check can’t finish right away, the app tries again later, for example the next time you open it.
We use these records only to confirm rewards and prevent fraud, such as rewards claimed without a video being watched. They are never sold, never used for advertising or tracking, and we never link them to anything else about you. They are stored on Cloudflare, the service that hosts our server, and deleted automatically after 90 days. Like any web host, Cloudflare receives your device’s IP address when the app connects; the reward records we keep don’t include it. Learn more in Cloudflare’s privacy policy.
Purchases (Apple and RevenueCat)
Everything you can buy in LuLu’s is optional. Purchases are made and paid for through Apple’s App Store under your Apple Account. We never receive your card number, billing address or Apple Account details.
We use RevenueCat, a service that helps apps manage and restore in-app purchases. It acts on our behalf and receives:
- a random, anonymous app user ID created on your device (it is not linked to your name or email);
- your purchase history for LuLu’s and the App Store receipt that proves it;
- basic device and app information, such as the operating system, app version, and App Store storefront and currency.
Apart from the reward records described above, that anonymous purchase record is the only information about you that we can look at. Learn more in RevenueCat’s privacy policy.
What Apple shares with us
If you’ve chosen to share analytics with app developers in your device’s settings, Apple may give us anonymous, combined statistics about how LuLu’s is used and any crashes. These never identify you. You can turn this off in Settings → Privacy & Security → Analytics & Improvements.
If you email us
If you write to support@machettelabs.com, we receive your email address and whatever you put in your message, such as your device model. We use them only to reply and to sort out your question, and we keep the conversation only until it’s resolved. We never add you to a mailing list.
Everyone who touches your data
| Who | What they receive | Why |
|---|---|---|
| Your device | All your game progress and settings | So the game remembers you. Nobody else receives it. |
| Google AdMob and its ad networks | Advertising identifier (only if you allow tracking), IP address, device info, ad interactions, and the random install and video codes | To show and measure the optional videos you choose to watch, and to confirm their rewards to us |
| Our reward server, hosted by Cloudflare | Random install code and video code, which bonus, ad unit and ad network, reward, time and Google’s transaction ID. Cloudflare also sees your IP address while the app connects; we don’t keep it | To confirm video rewards and prevent fraud. Deleted after 90 days |
| RevenueCat | Anonymous app user ID, purchase history and receipts, basic device info | To confirm and restore purchases |
| Apple | Your purchase and payment, under Apple’s own policy | To sell and deliver the app and its in-app purchases |
| Us, if you email | Your email address and message | To answer you |
We never sell your information for money, and nobody beyond the services above receives it. If you allow tracking, the personalized ads AdMob shows may count as “sharing” under some privacy laws; saying no in Apple’s prompt or Google’s consent message turns that off.
Google, RevenueCat and Cloudflare may process the data they receive in countries other than the one you live in, under their own safeguards for those transfers. If Machette Labs or LuLu’s is ever sold or merged, this policy would still apply to anything handled under it, and we would say so here first.
Children
LuLu’s is a gentle game suitable for all ages, but it is not directed at children under 13, and we do not knowingly collect personal information from them. Ads are limited to content rated for general audiences. If you believe a child has sent us personal information, for example by email, contact us and we will delete it.
Your choices and rights
- Tracking: turn it off any time in your device’s Settings → Privacy & Security → Tracking.
- Videos: simply don’t watch them. Nothing in the game requires one.
- Consent message: to change the answer you gave in Google’s consent message, delete and reinstall LuLu’s; the game will ask again before the next video. Deleting the app also deletes your progress.
- Reward checks: they happen only when you finish a video, so if you don’t watch videos, nothing is checked. Deleting and reinstalling LuLu’s gives you a new install code (and deletes your progress), and old reward records are deleted after 90 days.
- Your progress: reset it in the game’s Settings → Progress, or delete the app to remove everything it stored.
Where a law asks us to name a legal basis: personalized ads rely on your consent, checking video rewards relies on our legitimate interest in handing out only real rewards and preventing fraud, purchases rely on our contract with you (so we can deliver and restore what you bought), and answering your emails relies on our legitimate interest in helping you.
Depending on where you live, you may have the right to ask what personal information is held about you, to have it corrected or deleted, to object to or restrict how it’s used, or to opt out of personalized advertising, which some laws describe as “selling” or “sharing”. Because we hold almost nothing ourselves, the quickest way to use most of these rights is through the settings above. For anything held by RevenueCat on our behalf, or an email you’ve sent us, write to support@machettelabs.com and we will answer within 30 days. Reward records are tied only to a random install code that we can’t connect to you, so we can’t look yours up by name or email; they are deleted automatically after 90 days. We will never treat you differently for asking. You can also complain to your local data protection authority, though we’d love the chance to fix it first.
Security and retention
Your progress is protected by your device’s own security. Data sent to Google, RevenueCat and our reward server travels encrypted, and Google signs each reward confirmation so nobody else can fake one. Game data stays on your device until you reset it or delete the app. Reward records are deleted automatically after 90 days. Support emails are kept only until your question is resolved. Google, RevenueCat and Cloudflare keep what they receive according to their own policies, linked above.
Changes and contact
If this policy changes in a way that matters, we’ll update this page and the date at the top before the change applies to you. Questions about privacy, or anything else: support@machettelabs.com.