Privacy Policy

Effective October 22, 2026

This Privacy Policy is published by 10X Ventures LLC (“10X Ventures,” “we,” “our” or “us”), a California limited liability company in the United States. 10X Ventures develops and publishes Harbor Heist, a game for iPhone, iPad and Android (App Store bundle ID xyz.10xv.cast; Google Play package xyz.tenxv.cast). This policy covers the game on every platform and this website. It explains what information we collect, how we use and share it, and the choices you have. Where the two platforms differ, this policy says so.

Information we collect

You can play Harbor Heist as a guest, with no name or email address. We collect:

• Identifiers: a random player ID the game creates on first launch and keeps in your device’s keychain, so a reinstall on the same device returns to the same game account; the ID of that account on our game servers; a random install ID the game uses for analytics and crash reports; on iPhone and iPad, Apple’s identifier for vendor (IDFV) and, only if you allow tracking, the advertising identifier (IDFA); on Android, the device’s advertising ID, which you can reset or delete in your device settings; and the push notification token your device issues when you allow notifications.
• Gameplay data: your captain name and portrait, harbor progress, coin and bait balances, catches and trophies, and the results of your casts, raids and heists, stored on our game servers so your progress stays with you.
• Usage and diagnostic data: the screens and features you use, when sessions start and how long they last, tutorial steps, performance samples such as frame timing, error events, crash reports, and your device model, operating system and version, language and app version.
• Purchase data: when you buy something in the game, the item, its price and currency, the store country, and the store’s transaction ID or purchase token. Apple (on iPhone and iPad) or Google Play (on Android) processes every payment; we never receive your card details.
• Approximate location: your country or region, which our servers and service providers derive from your IP address, and your store country and device region, which the game reads to decide whether to show the privacy card described below. We do not collect precise location.
• Advertising attribution data: on iPhone and iPad, Apple’s attribution token for Apple Search Ads and Apple’s aggregated install reports (SKAdNetwork and AdAttributionKit), described below.
• Support messages: your email address and anything you choose to send when you contact us.

How we use your information

• Running the game: saving your harbor, delivering rewards and purchases, matching raids and heists between captains, and keeping play fair
• Finding and fixing crashes, and measuring and improving the game’s performance, stability and design
• Measuring which advertising brings players to the game
• Sending notifications you have allowed, such as a reward that is ready
• Answering support requests and meeting our legal obligations

We do not sell your personal information.

Service providers

These providers receive the data described on this page to perform their service for us:

• Microsoft Azure PlayFab: our game servers. They hold your game account, progress and balances, run raids and heists between captains, store your push notification token, and (planned) hold friends, gifts and teams.
• Layers: game analytics and advertising attribution, described below.
• Sentry: crash and error reporting on every platform. When the game crashes, freezes or logs an error, Sentry receives a report with the crash log or error and its stack trace, your device model, operating system and version, the app version, the harbor you were on, the names of the last game events before the problem and the random install ID. Sentry also counts app sessions, which tells us how often the game runs without a crash. We switch off Sentry’s collection of personal data in the game, take your device’s own name out of every report, and send no screenshots or screen captures. Reports carry no names, email addresses, photos or Facebook data.
• RevenueCat: in-app purchases on every platform. RevenueCat receives your game account ID (it is your customer ID at RevenueCat), the purchase receipt from the App Store or the purchase token from Google Play, the product, its price, currency and store country, and basic device and app information. Our game server checks each purchase with RevenueCat before granting it, and a regular check compares RevenueCat’s records with your game account so that no paid purchase goes missing.
• Apple (iPhone and iPad): the App Store and in-app purchase payments, Sign in with Apple, App Tracking Transparency, Apple Search Ads attribution, SKAdNetwork and AdAttributionKit, and push notifications through the Apple Push Notification service.
• Google (Android): Google Play and Google Play Billing payments, and push notifications through Firebase Cloud Messaging. When you allow notifications, the Firebase SDK creates an installation ID and a push token for Harbor Heist on your device, and Google receives them with basic device and app information to deliver notifications. Harbor Heist uses Firebase for push notifications alone: Firebase Analytics is switched off in the Android app, and its advertising ID collection with it.
• Amba: a small set of game settings the game downloads when it starts. The request carries the game’s own app key and no player identifier; Amba receives your IP address to answer it.
• Meta Platforms (planned): app events for advertising measurement, through the Facebook SDK in the game and through Layers’ server connection to Meta (the Conversions API), and Facebook Login if we offer it.
• Cloudflare (planned): delivery of downloadable harbor art. It receives your IP address to serve the files.

These providers may process data on servers in the United States and other countries. We may also disclose information when the law requires it, or to protect our rights, our players and the game.

Accounts and sign-in

• Guest play: the game signs in to our game servers with the random player ID described above. No name, email or password is needed.
• Sign in with Apple (iPhone and iPad): where the game offers it in Settings, we receive only the identifier Apple assigns to your Apple Account for Harbor Heist. The game asks Apple for no name and no email. We use the identifier to sign you in and restore your harbor on another device. When you delete your account, we ask Apple to revoke Harbor Heist’s access.
• Captain name and portrait: other players see them in raids and heists, and (planned) in crews, teams and tournaments. Captain names pass an automatic filter before other players see them.
• Facebook Login (planned, if we offer it): the game would ask Facebook for your public profile (name, profile picture and the app-scoped ID Facebook assigns to Harbor Heist), your email address and the list of your Facebook friends who also play Harbor Heist. We would use them to sign you in, restore your harbor, find friends who play and show your first name and photo to those friends. You could disconnect Facebook in the game’s Settings at any time, which deletes this data from our servers. The steps are on the account deletion page.
• Reports and blocks (planned, with crews): if you report or block another captain, we store your player ID, theirs, the reason you chose and the time, to review the report and keep blocked captains apart. These records are deleted with your account.
• Notifications: the game schedules its own reminders on your device, and no data leaves the device for them. When you allow notifications, your device also gives the game a push token, from the Apple Push Notification service on iPhone and iPad or from Firebase Cloud Messaging on Android. We store the token with your game account and use it only to send game notifications, such as a heist on your harbor, a raid on your lake or a friend joining your crew. Switch Alerts off in the game’s Settings, or turn notifications off in your device settings. The token is deleted with your account.

Analytics, measurement and consent

• Layers: receives game events (sessions, tutorial steps, casts, raids, heists, building and harbor progress, screens, performance samples and, once the store opens, purchases with their amount and currency), device and app information (device model, operating system, app version and language), the random install ID and your game account ID once you are signed in. On iPhone and iPad it also receives the IDFV, Apple’s Apple Search Ads attribution token and, only if you allow tracking, the IDFA. On Android it also receives your device’s advertising ID, as described below. Layers may derive a coarse location (country or region) from your IP address. We use Layers to understand how players play and return, and to measure which advertising brings players to the game.
• Apple SKAdNetwork and AdAttributionKit (iPhone and iPad): when you install Harbor Heist after seeing an ad, Apple may send the ad network an aggregated, anonymized report that an install happened, with no identifier for you or your device. A copy of each report goes to Layers.
• Apple Search Ads (iPhone and iPad): the game reads an attribution token from Apple and passes it to Layers, which uses it to learn from Apple whether an Apple Search Ads campaign led to the install.
• Meta app events (planned): Harbor Heist will send app events to Meta, such as installs, app launches, tutorial completion, harbor milestones and purchases, so we can measure our advertising on Facebook and Instagram. Meta receives the IDFA only if you allow tracking, and we keep Meta’s automatic event logging switched off.
• Privacy card in the EEA, the UK and Switzerland: when you play from the European Economic Area, the United Kingdom or Switzerland (based on your store country and device region, and in every case where the game cannot tell), Harbor Heist shows a YOUR PRIVACY card when it first starts: “We count taps to improve the game and to measure our ads.” Until you answer, the game’s events wait on your device and nothing goes to Layers or Meta. If you tap NO THANKS, those events are dropped and Layers and Meta receive no analytics, no advertising measurement and no advertising identifier. Crash reports to Sentry are covered under legitimate interests below. If you tap OK, analytics and advertising measurement start. You can change your answer at any time in the game’s Settings, PRIVACY CHOICES.
• App Tracking Transparency (iPhone and iPad): Harbor Heist shows Apple’s tracking prompt once per install, when the dock first opens. In the EEA, the UK and Switzerland it asks only after you tap OK on the privacy card. Your IDFA reaches Layers (and, planned, Meta) only if you allow tracking. You can change your answer at any time in iOS Settings, Privacy & Security, Tracking.
• Advertising ID on Android: Android shows no tracking prompt. Layers receives your device’s advertising ID for install attribution, in the EEA, the UK and Switzerland only after you tap OK on the privacy card, and never once you have deleted the ID. You can reset or delete it at any time in your device settings (Settings, Google or Privacy, Ads).
• In-game ads: Harbor Heist shows no in-game advertising.
• This website: sets no cookies and runs no analytics or advertising code, and its fonts and images come from this site alone. The company that hosts it processes your IP address and the details of each request to deliver pages and protect the site.

Legal bases (EEA, UK and Switzerland)

• Contract: running your game account, saving your progress and delivering what you buy.
• Consent: analytics and advertising measurement through Layers and Meta, tracking through App Tracking Transparency on iPhone and iPad, and the advertising ID on Android. You can withdraw consent at any time in Settings, PRIVACY CHOICES.
• Legitimate interests: finding and fixing crashes through Sentry crash reports, keeping the game secure and fair, preventing fraud and keeping the server records needed to run the service.
• Legal obligation: keeping purchase records for tax and accounting, and answering lawful requests.

Age requirements

Harbor Heist is rated 13+ on the App Store and is made for players aged 13 and over. It is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we will delete it. Harbor Heist offers no real-money gambling and no chance to win money or anything of real-world value; bait, coins and every other item in the game are virtual items with no cash value.

Your choices and rights

• Delete your account: in the game, open Settings, then DANGER ZONE, DELETE ACCOUNT. You can also email us. The account deletion page lists what we delete and what we keep.
• Access and correction: email support@harborheist.com with “Harbor Heist” and your captain name. We will help you identify your game account and answer within 30 days.
• Advertising choices: on iPhone and iPad, decline Apple’s tracking prompt or turn tracking off in iOS Settings, Privacy & Security, Tracking. On Android, reset or delete your advertising ID in your device settings. In the EEA, the UK and Switzerland, use Settings, PRIVACY CHOICES in the game.
• Notifications: switch them off in the game’s Settings or in your device settings at any time.

Depending on where you live (for example the European Economic Area, the United Kingdom, Switzerland, Brazil or Mexico), you may have rights to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it, and to lodge a complaint with your local data protection authority. We honor these requests at the address below.

California privacy rights

If you live in California, you have the right to know what personal information we collect, use and disclose; the right to delete it; the right to correct it; the right to opt out of its sale or sharing; and the right to equal service when you use these rights. We do not sell personal information. When you allow tracking and we send app events to an advertising partner such as Meta (planned) to measure our ads, California law may treat that as “sharing” for cross-context behavioral advertising. To opt out, decline the tracking prompt or turn tracking off in iOS Settings, delete your advertising ID on Android, or email support@harborheist.com.

Data retention and security

We keep a game account while it is active, and delete or anonymize it after 24 months of inactivity or when you ask. Analytics data, diagnostic data and crash reports are kept for up to 24 months. Purchase records are kept for as long as tax and accounting law requires. We protect information with encryption in transit and access controls against unauthorized access, alteration or destruction.

Changes to this policy

We will update this policy when the game or the law changes. We post the new version on this page with a new effective date, and when a change is significant we will also tell you in the game.

Contact us

10X Ventures LLC
California, United States

Email: support@harborheist.com

Effective October 22, 2026