Privacy Policy for Mechanica
Last updated: 9 September 2026
This policy explains what Mechanica collects, why, and what you can do about it. It covers the Mechanica mobile game on iOS and Android.
1. Who we are
Mechanica is made by Cito Studio, registered in Amsterdam, the Netherlands, Chamber of Commerce (KvK) number 42136766. We are the data controller for the information described here.
You can reach us about anything in this policy at contact@citostudio.nl.
2. The short version
You sign in with an Apple or Google account and pick a username. We store your game progress under an account number, not under your name. We measure how the game is played so we can improve it, we show ads, and we sell optional purchases. We do not sell your data, and we never see your payment details.
The rest of this page is the detail.
3. What we collect, and why
Your account
Signing in with Apple or with Google gives us an account identifier from that provider, and, depending on the provider and the choices you make when you sign in, an email address. We hold these as your account record, which is how we recognise you when you come back and on another device.
Your game progress itself is stored under an account number. The only name in it is the username you choose, which you pick yourself and which does not have to be your real one.
Your game progress
Everything you do in the game: your workshop, your crew, your jobs, your cash and coins, your skills and safeguards, and a ledger of every change to your balances. This is the game. Without it there is nothing to come back to.
Your device, and technical information
Stored alongside your game record:
- which platform you are on, iOS or Android
- your device model and operating system version
- the app version you are running
- your language
- the country your connection appears to be in, as a two-letter country code
The country code is worked out on our servers from the network address your device connects with, and only the country is kept. Your network address itself is not stored with your game record. It appears in our server logs, as it does with any internet service, and those logs expire.
A device identifier, for referral abuse only
When you enter a friend's invitation code, your device supplies an identifier: identifierForVendor on iOS, the App Set ID on Android. We send it once, and our server stores only a SHA-256 hash of it. The identifier itself is never stored.
It exists for one purpose: stopping one person claiming referral rewards over and over from the same device. It is deliberately not your advertising identifier, it is never used for advertising, it is never linked to an ad profile, and it is never sent to our analytics.
How the game is used
We collect usage analytics through Google Analytics for Firebase: which screens you open, which steps you finish, where you stop. These records carry your Firebase account number, so they are linked to your account.
They also carry a set of descriptions of your progress, and every one of those is a band rather than an exact figure. Your coin balance is recorded as a range such as "10 to 24", never the number. The same is true of your cash, your job count, and the rest.
Your advertising identifier, your App Set ID and the device hash above are never sent to analytics.
Crash reports
If the game crashes we receive a diagnostic report through Firebase Crashlytics: what went wrong, the device, the operating system version, and your Firebase account number, so we can tell whether one player hit a problem twenty times or twenty players hit it once.
Notifications
If you allow notifications, your device gives us a push token so we can tell you a timer has finished or a job is waiting. Turning notifications off in your system settings stops this.
Advertising
The game shows ads between some actions, and offers ads you can choose to watch for a reward. Ads are served by Google AdMob, which also mediates Unity Ads. Ad networks are separate companies and use your information for their own purposes, including measuring and targeting ads. Their handling of your data is governed by their own policies:
- Google: https://policies.google.com/privacy
- Unity: https://unity.com/legal/game-player-and-app-user-privacy-policy
On iOS we ask whether you allow tracking, using Apple's App Tracking Transparency prompt. If you say no, we do not use the advertising identifier (IDFA) and you will still see ads, they are just less relevant. You can change your answer at any time in iOS Settings.
On Android, ads may use the advertising ID, which you can reset or delete in your Android settings.
Purchases
Coin packs, the starter pack and subscriptions are sold through the App Store and Google Play. Those stores take your payment. We never see your card details. We use RevenueCat to check that a purchase is real and to keep track of what it entitles you to, identified by the same Firebase account number.
We record that a purchase happened, what it was, and its value, so we can grant what you bought and show it in your history.
Achievements
If you are signed in to Game Center or Play Games, the game reports your achievement progress to that service so your badges appear where you expect them. If you are not signed in, nothing is reported and nothing breaks. This is Apple's or Google's service, under their policies.
4. What we do not collect
- Your payment details. The stores handle those.
- Your precise location. We derive a country from your connection, and nothing finer.
- Your contacts, your photos, your microphone, or your files.
- Anything you have not given us by playing the game.
We do not sell your personal information, and we do not share it with data brokers.
5. Who else sees it
We use these companies to run the game. They process data on our instructions, except for the ad networks, which act for themselves as well.
| Who | What for |
|---|---|
| Google (Firebase) | Sign-in, database, server logic, notifications, crash reports, analytics |
| Google (AdMob) | Serving ads and measuring them |
| Unity Technologies | Serving ads, through AdMob |
| RevenueCat | Checking purchases and tracking entitlements |
| Apple, Google | The app stores, payment, achievements |
If we add ad networks we will name them here before they run. Two are planned: AppLovin and Mintegral.
6. Why we are allowed to (legal bases)
If you are in the EEA or the UK, the GDPR asks us to name a basis for each use:
- Performing our contract with you: your account, your game progress, your purchases. Without these there is no game to provide.
- Our legitimate interests: usage analytics, crash reports, and referral abuse prevention. We want to know which parts of the game lose people, to fix what breaks, and to stop one person farming referral rewards. We have weighed this against your interests, which is why the analytics carries bands instead of exact figures and why the device identifier is stored only as a hash.
- Your consent: personalised advertising, and notifications. You give it, and you can take it back.
7. Advertising consent, and analytics
In the EEA and the UK we show a consent form the first time you play, asking about advertising. Your answer controls the advertising signals we pass on: whether ad data may be stored, shared with Google's ad products, and used to personalise what you see. Saying no does not remove ads, it makes them generic.
You can reopen that form at any time from the Privacy Statement row in your profile and change your answer.
Usage analytics is not governed by that form, and we want to be plain about it. The consent form is an advertising consent tool. The usage analytics described above is our own product measurement: it tells us which tutorial step loses players and which screens go unused. It is not shared with advertisers and it is not used to build an advertising audience.
If you would rather we did not collect it, write to contact@citostudio.nl and we will stop collecting it for your account, and delete what we hold.
8. How long we keep it
- Your game record for as long as your account exists.
- Analytics for up to 14 months, then it expires automatically.
- Crash reports for up to 90 days.
- Purchase records for as long as tax and accounting rules require, which is longer than the rest and is not ours to shorten.
- Server logs for up to 30 days.
9. Your rights
If you are in the EEA or the UK you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to someone else. You can object to anything we do on the basis of legitimate interests, including the analytics. Where we rely on your consent you can withdraw it, and that does not make what we did before it unlawful.
If you are in California you can ask what we collect, ask us to delete it, and you will not be treated differently for asking. We do not sell or share personal information as those words are used in the CCPA.
Write to contact@citostudio.nl. We will answer within one month.
You can also complain to a data protection authority. Ours is the Dutch Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, and you may instead go to the authority where you live. If you disagree with how we handled something, we would rather hear from you first.
10. Deleting your account
Write to contact@citostudio.nl from the address you signed in with, or tell us your username, and we will delete your account and everything attached to it: your game record, your referral records, and your analytics history. We will confirm when it is done.
Purchase records are the exception. Tax rules require us to keep them, so they are retained without your game record attached.
Deleting the app does not delete your account. Your progress is on our servers so that it survives a new phone.
11. Children
Mechanica is not aimed at children, and we do not knowingly collect information from anyone under 13, or under 16 in countries where that is the threshold. If you believe a child has given us their information, write to contact@citostudio.nl and we will remove it.
12. Where your data goes
We run on Google Cloud in Europe. Some of the companies in section 5 are in the United States, so your information may be transferred there. Those transfers rely on the European Commission's standard contractual clauses, or on the company's certification under the EU-US Data Privacy Framework.
13. Changes
If we change this policy we will update the date at the top. If the change matters, for example a new category of data or a new ad network, we will tell you in the game before it takes effect.
14. Contact
Write to contact@citostudio.nl.
Cito Studio, Amsterdam, the Netherlands. KvK 42136766.