Washline privacy policy
Last updated: 13 October 2026
1. Who we are
Washline (in the Netherlands: Waslijn) is a mobile game by Toob ("we"). Toob is the controller for the processing described in this policy, except where an advertising or analytics partner is a controller in its own right (see section 5).
Toob (sole proprietorship / eenmanszaak), operated by Tobias Hesselink, based in the Netherlands, Chamber of Commerce (KvK) number 88227677, VAT ID NL004565523B51.
Contact and privacy questions: support@washlinegame.com
2. In short
- You do not need an account. Your progress (levels, coins, lives, settings) is stored on your own device. We do not run a server that stores your game progress. If iCloud is available on your device, a copy is also kept in your own iCloud account, which we cannot access (section 3).
- The game is free and shows ads from Google AdMob. For that, and for statistics and crash reports, we use the Google software listed below. We use no other ad networks.
- Where the law requires it (EEA, UK, Switzerland and certain US states) we ask for your consent on first launch, through the Google consent screen. We start statistics, crash reports and remote game settings only after you agree (or where no consent is required). On iPhone and iPad you also decide, later in the game, whether the app may track you. You can change your choices at any time.
- Game Center (optional) is run by Apple: if you are signed in, achievements and scores go to Apple, not to us.
- The game is intended for players aged 13 and over. If your device tells us you are under 16 (see "Age signal from your device" below), we switch off statistics, crash reports, personalised ads and the tracking prompt.
3. What data we process, and through whom
We do not collect your name, email address or phone number and we do not ask you to sign in. The data below is processed automatically by the built-in software (SDKs) of the parties named. The exception is support email, which you send yourself.
| Part | Party | Data | Purpose |
|---|---|---|---|
| Game progress and settings | Your device only | Level progress, coins, lives, boosters, settings, language, and your age range as reported by your device (see below; stored locally only) | Making the game work. Not sent to us |
| Advertising | Google (AdMob, Google Mobile Ads SDK). Rewarded, interstitial and banner ads; no other mediation networks | Advertising ID (IDFA on iOS after your permission; otherwise app- or developer-bound identifiers; on Android the Android advertising ID), IP address and the approximate location derived from it, device and OS information, ads shown and interaction with ads (such as taps and video views), app launches, diagnostic and performance data (crash logs, launch time, hangs), your consent choice | Showing and measuring ads, preventing fraud and abuse, personalising ads if you consent |
| Consent | Google User Messaging Platform (UMP) | Your consent choice (stored on your device) and the associated technical consent string. UMP is shown on first launch in the EEA, UK, Switzerland and US states where this is required | Recording your choice and passing it to Google's advertising software |
| Statistics | Google Firebase Analytics | Random app instance ID (on iOS the advertising ID or, if that is not available, the vendor ID), in-game events (such as level started or won, boosters used, ad shown, purchase event with product name, opening the app from one of our notifications with the notification type and hours since it was sent), device, OS and app version, language, approximate location from the IP address | Improving the game, tuning difficulty and balance |
| Crash reports | Google Firebase Crashlytics | Error report (stack trace), the state of the app at that moment, device and OS data (such as model and OS version), Crashlytics installation UUID and Firebase installation ID. Collected only after you consent to statistics | Finding and fixing errors |
| Game settings | Toob (hosted by Cloudflare, Inc., our hosting provider) | At every start the game downloads a small public settings file (https://washlinegame.com/config.json), also without consent. The file is the same for every player and contains no personal data. The request carries no cookies, no advertising or device ID and no account; Cloudflare, like any web host, sees your IP address and the time of the request in its logs. If that address cannot be reached, the game fetches the same file from our own website toob.nl (also served through Cloudflare), where the same applies | Adjusting game settings (such as coin prices and ad frequency) and switching off a faulty feature quickly (safety and stability) |
| Time check | Google (google.com, a standard connectivity address) | Once at start and when the app returns to the foreground (at most every 10 minutes) the game sends an empty request and reads only the date and time in the reply, to keep timers and daily rewards fair when the device clock is changed. No cookies, no body and no identifiers are sent; Google sees your IP address like any web server. This happens after the consent screen has been handled | Fair timers and daily rewards |
| Purchases | Apple App Store or Google Play (the game uses Unity's purchasing software, which works on your device and sends no data to Unity) | Payment and payment details are handled solely by Apple or Google. We receive no payment details. The purchasing software processes the product and purchase confirmation on your device to deliver and restore purchases | Delivering and restoring purchases |
| Progress copy (iCloud) | Apple (iCloud key-value storage), in your own iCloud account | A copy of your game progress: levels, coins, lives, boosters, which purchases you own, settings and a random installation ID. Only if you are signed in to iCloud and iCloud is on for apps | Restoring your progress on a new device. We cannot read it; it is not sent to us |
| Achievements and leaderboards | Apple (Game Center) | Only if you are signed in to Game Center: achievements you unlock and your scores (levels completed, daily puzzle results) are sent to Apple under your Game Center account. Leaderboards may show your Game Center name to other players. We receive no personal data from it | Achievements and leaderboards |
| Support email | You, by email from your own mail app | Only if you tap Contact support: your email address and what you write, plus the app version, iOS version, device model, language and a short installation ID (8 characters, generated by the app, not an advertising ID). You can edit or delete these lines before sending | Answering your question and fixing problems |
By default we set the maximum ad content rating in AdMob to Teen (T). If your device indicates you are 13 to 15 we additionally mark ad requests as "under the age of consent" and use non-personalised ads; if you are under 13 we mark them as child-directed and limit them to rating G (see the next paragraph).
Age signal from your device (iOS 26 and later). Where the law or Apple requires it (for example in certain US states), the game asks Apple for your age range through Apple's "Declared Age Range" feature. In some regions Apple supplies the range automatically because the law requires it; in others Apple shows a system screen where you (or your parent or guardian) decide whether to share it (under 13, 13 to 15, or 16 and over). We receive only that range and how it was set (for example "declared by a parent"), never your birth date, name or Apple ID. We store it on your device only, not in your iCloud copy, and we do not put it in our statistics. Where it is not required we do not ask and treat you as a general audience aged 13 and over (we can switch on asking all players at first launch remotely).
What the range does: if you are 16 or over, nothing changes. If you are 13 to 15, we treat you as a teenager: no personalised ads, no statistics (Firebase Analytics), no crash reports, no "Tracking" prompt, and ads limited to the "under age of consent" setting. If you are under 13, the same applies, and ads are also treated as child-directed and limited to rating G. If the law requires the age range but your device cannot or does not give it, we also treat you as a teenager. On earlier iOS versions, or where Apple's service is not available or not required, we treat you as an adult unless we change that setting remotely.
We do not use your device location (GPS) and do not ask for access to it. Local notifications (for example "your lives are full again", or a reminder after you have not played for a while, up to 30 days) are scheduled on your device itself and only shown after you agree. We send at most one a day and, by default, not during the night (21:00 to 09:00). They do not use a server.
4. Purposes and legal bases
For each processing activity we rely on a legal basis under the General Data Protection Regulation (GDPR).
| Processing | Legal basis |
|---|---|
| Personalised ads and reading or writing advertising IDs and similar data on your device | Consent (Article 6(1)(a) GDPR; for access to your device Article 11.7a of the Dutch Telecommunications Act, implementing the ePrivacy Directive). You give it through the consent screen (Google UMP) and, on iOS, the system prompt "Tracking" (shown later in the game). You can withdraw consent at any time |
| Non-personalised ads, fraud prevention and measuring ads | Where UMP is shown, consent to the purposes you accept there; Google processes this data for those purposes. Elsewhere, Google's legitimate interest in preventing fraud and measuring ads (Article 6(1)(f) GDPR). In the EEA, UK and Switzerland, Google acts as controller for its own advertising purposes |
| Statistics (Firebase Analytics) | Consent (same consent screen). Without consent we do not start these statistics |
| Crash reports (Crashlytics) | Consent (Article 6(1)(a) GDPR; for access to your device Article 11.7a of the Dutch Telecommunications Act), through the same consent screen. Without consent we do not start them. Where no consent is required (outside the EEA, UK, Switzerland), they run on our legitimate interest in a stable, well-tuned game (Article 6(1)(f) GDPR); you can object (section 8) |
| Settings file and time check | Legitimate interest (Article 6(1)(f) GDPR) in adjusting the game, being able to switch off faulty features quickly and keeping timers fair. Nothing is stored on your device apart from the downloaded settings file itself, and no identifier is read from it |
| Delivering and restoring purchases | Performance of a contract (Article 6(1)(b) GDPR) |
| Email contact with support | Legitimate interest: answering your question and fixing problems with the technical details you include |
| Progress copy in iCloud | Performance of a contract (Article 6(1)(b) GDPR): keeping your progress safe is part of the game. You can switch it off in your device's iCloud settings. Apple stores the data; we do not process it |
| Game Center (achievements, leaderboards) | Performance of a contract (Article 6(1)(b) GDPR) for a feature you choose to use by signing in to Game Center. Apple is responsible for this processing under its own privacy policy |
| Legal obligations (such as bookkeeping) | Legal obligation (Article 6(1)(c) GDPR) |
Where the consent screen is not required (outside the EEA, UK, Switzerland and the relevant US states), the app does not show it; the choices of your device (such as "Tracking" on iOS) still apply.
Personalised offers and automated decisions. Some special offers in the game are shown based on how you play (such as levels played, earlier purchases, or whether you watch ads). This happens on your device and does not need statistics or consent. The price of every product in the shop is the same for everyone in your country. We take no decisions about you with legal or similarly significant effects based solely on automated processing (Article 22 GDPR).
5. Who we share data with
We do not sell data. Data reaches the parties from section 3:
- Google (AdMob and UMP) for advertising and consent. Google may act as a controller for its own advertising purposes, and ads are served by Google's ad network, so advertisers and ad technology providers working with Google (list of providers) may also receive data about the ad request. Read: Google: how Google uses data from apps that use Google services.
- Google (Firebase) as a processor for statistics and crash reports (see Firebase privacy and security).
- Apple or Google Play for payments. The purchasing software from Unity in the game works on your device; no data goes to Unity.
- Apple for iCloud and Game Center, under Apple's privacy policy. We do not receive the data you store in iCloud or Game Center.
- Authorities or other parties only where the law requires it.
6. Transfers outside the EU
Some of these parties are established in, or process data in, the United States or other countries outside the EU/EEA. Google LLC and its wholly owned US subsidiaries are certified under the EU-US, Swiss-US and UK Extension Data Privacy Frameworks; where a transfer is not covered by that, Google relies on the European Commission's standard contractual clauses (SCCs). Apple describes its own mechanisms in its privacy policy. Where we share data with third parties (Google, Apple) we require them to provide the same or equal protection of your data as described in this policy and as required by applicable law.
7. How long we keep data
| Data | Retention |
|---|---|
| Game progress on your device | Until you erase it via Settings > Delete data or uninstall the app |
| Progress copy in iCloud | In your iCloud account until you erase it via Settings > Delete data in the app, or manage it in your device's iCloud settings; otherwise according to Apple |
| Game Center | According to Apple; we cannot delete it. You can manage it in the Game Center settings on your device |
| Firebase Analytics | Event-level data: 2 months. User-level data (such as the app instance ID and its settings): 14 months after your last use, the shortest period Google Analytics offers. Aggregated reports are kept longer but contain no individual data |
| Crashlytics | Stack traces and identifiers 90 days, then removed from live and backup systems (according to Google). Firebase installation IDs are kept until deleted and then removed within 180 days |
| Google (advertising) | According to Google's retention policy; we do not control this. Your consent choice stays on your device, also after Delete data, until you change or withdraw it via Privacy options or uninstall the app |
| Settings file request | We do not use these requests for anything. Cloudflare and the web host of toob.nl keep the IP address and time in their logs according to their own policies |
| Email with support | At most 12 months after we resolve it, including the technical details in the email, unless the law requires longer |
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent you can withdraw it at any time; this does not affect earlier processing.
Send an email to support@washlinegame.com. We respond within one month. Because the game has no accounts, we cannot simply find you in analytics or advertising data. We may ask for extra information (such as your advertising ID), solely to carry out your request.
Do you have a complaint? You can contact the Dutch Data Protection Authority, Autoriteit Persoonsgegevens, or the authority in your own country.
9. Erasing data and changing your choices
In the app (local data):
- Settings > Delete data deletes your progress and settings from this device. This cannot be undone. It also deletes the iCloud copy of your progress, if there is one. Purchased "Remove ads" and season passes can be restored afterwards through Restore purchases. It also removes the Firebase installation ID stored on this device and asks Firebase to delete the installation. If you have allowed statistics, a new ID is created the next time you start the game. Your consent choice stays on your device; change or withdraw it via Privacy options.
- Settings > Privacy options reopens the Google consent screen (UMP privacy options) so you can change or withdraw your choice for personalised ads and statistics.
On your device:
- iPhone/iPad: Settings > Privacy & Security > Tracking, or per app Settings > Waslijn > Allow Tracking.
- Android: Settings > Privacy > Ads, where you can delete or reset your advertising ID.
Data held by third parties: we do not have access to all data that advertising and analytics partners process. You can submit an erasure request to them directly, or ask us to pass it on:
- Google (AdMob and Firebase): ad settings (turn personalised ads off), My Activity and Google's privacy policy.
- Apple (iCloud, Game Center): scores and achievements are held by Apple. Manage them in the Game Center settings on your device or at privacy.apple.com.
- Firebase statistics and crash reports contain no name or account. After you withdraw consent and reset your advertising ID, new data is no longer linked to the old ID.
10. Children
Washline is intended for players aged 13 and over and is not in the kids categories of the app stores. If your device indicates you are under 16, the game limits advertising and measurement as described in section 3. We do not knowingly collect data from children under 13. If you think a child has given us data, email support@washlinegame.com and we will resolve it.
11. Security
Data is sent over encrypted connections (HTTPS) to the parties named. Your game progress is stored locally and protected by your device's security and, if you use iCloud, in your iCloud account under Apple's protection.
12. Changes
We may update this policy, for example when the game gets new features or partners. The current version is always on this page with its date at the top. For important changes we will tell you in the app.
13. Contact
Toob, KvK 88227677, VAT ID NL004565523B51, the Netherlands
support@washlinegame.com