Privacy Policy – Mafiosi: Heist Empire

Last updated: 4 October 2026

This policy explains what personal data the game Mafiosi: Heist Empire ("the game") processes on iPhone, iPad and Android, why, and what rights you have. It applies to the game and its support channels. It is written for the Swiss Federal Act on Data Protection (nFADP / revDSG), the EU and UK General Data Protection Regulation (GDPR / UK GDPR) and comparable laws.

This policy is available in English, German, French, Korean, Portuguese (Brazil) and Malay. The game itself is in English, German and French; where this policy names a setting, it uses the English name.

1. Who is responsible

TomicSwissTech, Inh. Tomic Grenzstrasse 25, 9430 St. Margrethen Switzerland VAT no.: CHE-192.510.580 MWST E-mail: info@tomicswisstech.ch

We ("we", "us") are the controller for the processing described here. We have not appointed a data protection officer (not required for us). We have not appointed a representative in the EU or in the United Kingdom (Art. 27 GDPR / UK GDPR). Wherever you live, you can contact us directly at info@tomicswisstech.ch.

2. The short version

• No registration. The first time you start the game, it creates a game account automatically, without your name. We never ask for your name, e-mail address or phone number.
• Your game data is stored in Switzerland. Cloud save, leagues and leaderboards run on servers in Zurich (hosting provider: Supabase).
• Gameplay statistics only with your consent. They are off until you switch them on in Settings > Privacy > Share gameplay statistics, and you can switch them off at any time (§3.5).
• Ads. The game shows ads through Unity LevelPlay with the ad networks ironSource Ads and Unity Ads (all run by Unity). They process device data to deliver and measure ads. In the EEA, the UK and Switzerland, ads are personalised only with your consent. On iPhone and iPad, the advertising identifier (IDFA) is used only if you allow tracking.
• Delete everything in the game: Settings > Delete my data. For a copy of your data, write to us (§7.3).
• We do not sell your data and we do not use it for anything other than running, improving and financing the game.

3. What we process, why, and on what legal basis

The legal bases under the GDPR / UK GDPR are given in brackets: contract (Art. 6(1)(b), providing the game you asked for), consent (Art. 6(1)(a)), legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). Swiss law does not require a legal basis for every processing step, but we apply the same standards to all players.

3.1 Your game account (created automatically)

When the game starts for the first time, it creates on your device a random device ID (a number generated by the game, not a hardware identifier) and a random secret. Both are stored in your device's secure storage (iOS Keychain or Android Keystore). With them the game registers an account with our server: a random account ID and an internal login name derived from the device ID. The login name is not an e-mail address, and no e-mail is ever sent. Our authentication service stores only a hashed form of the secret. Purpose: cloud save, leagues, leaderboards, restoring the same account on this device. Basis: contract.

3.2 Your player profile

Account ID, a generated display name (for example "Silent Tony 481", not chosen by you), platform (iOS/Android), app version, the country and language set on your device (the region setting, not your location), the mask and capo you have equipped, your consent choices with their dates, the device ID of §3.1 and technical timestamps. Purpose: running the game and leagues, choosing compatible settings and content, splitting statistics by platform and country. Basis: contract (display name, equipment); legitimate interests (technical data); legal obligation (proof of your consent choices).

3.3 Cloud save

A compressed copy of your save file, a checksum of it, a progress score, a version number and the device ID of §3.1. The save file contains your progress, items and settings, your privacy choices, the list of your purchases (store transaction and product IDs, dates, what was credited, and the price and currency, so that each purchase is credited exactly once and can be restored on your other devices) and the last five ads you saw (ad network, ad ID and time, so that you can report one). Purpose: keeping your progress and purchases safe and in sync across your devices. Basis: contract.

3.4 Leagues and leaderboards

For every story or replay job you finish online: job number, the "Take" (in-game money earned), racket income, bonus multiplier, run duration and the highest job reached. Also your weekly league group, rank, tier, rewards and leaderboard scores (Daily Score, Vault Rush, Empire Value). Other players see only your generated display name, your mask and capo icons, your score and your rank. Automated fair-play checks can mark an implausible result "under review" (see §10). Purpose: weekly Family Ranking leagues with real players, leaderboards, fair play. Basis: contract; legitimate interests (preventing cheating).

3.5 Gameplay statistics

Only with your consent. The game sends gameplay statistics only after you turn on Settings > Privacy > Share gameplay statistics. The switch is off until you turn it on, in every country. Your answer about personalised ads never turns statistics on.

What is sent. When statistics are on, the game sends gameplay events to our server, for example: session start and end, tutorial steps, job and room progress (result, stars, Take, Greed Choice, perks picked), in-game currency earned and spent, which offers were shown, clicked or closed, purchases (product, price, currency, a hashed transaction reference), ads watched and the ad revenue per ad, your consent and notification settings, and occasional performance samples (frame rate, memory, device model) and error codes. The events contain no free text and no advertising identifiers. They are linked to your account ID, so they are pseudonymous, not anonymous. We use them only in aggregated form: to balance difficulty and the economy, to find and fix problems and to decide whether the game is good enough to keep developing. Basis: your consent (Art. 6(1)(a) GDPR and the corresponding rules of other laws). You can withdraw it at any time with the same switch: the game then stops sending events and deletes the ones still waiting on your device. Events already sent are kept as described in §6, unless you delete your data (§7.1).

3.6 Security and abuse prevention

When the game connects, our servers see your IP address. Our authentication service (Supabase Auth) stores, with each sign-in session of your device, the IP address and the technical description of the app and system that comes with each connection (user agent). The game does not end sessions by itself, so they are kept until you delete your data (Settings > Delete my data, or by e-mail, §7.2), which deletes them. Sign-in events (for example a new or renewed session) are also recorded in a security log of the authentication service, which can contain the IP address; we keep it for at most 7 days. To stop mass account creation we store, for 2 days, a keyed hash (HMAC with a secret key) of your IP address and of its network range, which cannot be turned back into the address. We also keep rate-limit counters per account for 2 days. Our hosting provider keeps short-lived technical logs, which contain IP addresses (see §6). We do not use your IP address to find out where you are. Basis: legitimate interests (security and stability of the service).

3.7 Data on your device

Your save file (with up to three backups) and your settings are stored on your device; a copy of the save is also your cloud save (§3.3). The timing data the game uses against clock cheating, including the time since your device last restarted, never leaves the device: the cloud copy of the save leaves it out.

3.8 iCloud (iPhone and iPad only)

If you use iCloud, the game also mirrors your save to your own iCloud account (key-value storage run by Apple) so that purchases and progress are available on all your Apple devices. We cannot access your iCloud data.

3.9 Game Center (iPhone and iPad only)

If you use Game Center, Apple processes your Game Center profile, scores and achievements under Apple's privacy policy. The game reads your rank on the device to give bracket rewards. Your Game Center identity is not sent to our server.

3.10 Purchases

In-app purchases are processed by Apple (App Store) or Google (Google Play). We never see your payment details. We receive transaction and product IDs on your device to deliver the purchase, and sales reports from the stores without your identity. The list of your purchases is part of your save and cloud save (§3.3). If gameplay statistics are on (§3.5), purchase events are included as described in §3.5. Basis: contract.

3.11 Advertising

From your second session, the game shows rewarded ads that you choose to watch for a bonus (for example to double a reward). From day 3 and job 12, whichever comes later, it also shows occasional full-screen ads when you return from a won job: at most one every three jobs and four a day, never after a lost job, and never again once you have made any purchase.

Our mediation partner Unity LevelPlay and the ad networks it uses in this game, ironSource Ads and Unity Ads (all run by the Unity group, §4), receive technical data from your device: IP address (and a coarse location derived from it), device model, operating system, language, advertising identifiers (IDFV on iOS, and the IDFA only if you allowed tracking; on Android the advertising ID / app set ID), how you interact with ads, and information about how you use the game as far as their software records it. They use it to deliver ads, limit how often you see them, measure performance and prevent fraud. ironSource Ads also sells ad space programmatically: advertisers' buying platforms connected to it can receive this data in a bid request under Unity's rules. In the EEA, the UK and Switzerland, ads are personalised only if you accepted in the consent form; on iPhone and iPad, the IDFA is used only if you allow tracking; elsewhere, on Android, ads may be personalised with the advertising ID unless you delete it (§7.1). Unity acts as an independent controller under its own privacy policy. We tell the ad partners that the game is not directed at children. Basis: consent for personalised ads and for tracking (EEA, UK, Switzerland, and iOS worldwide); legitimate interests (financing a free game) for non-personalised ads where the law allows it.

3.12 Consent form and tracking prompt

In the EEA, the UK and Switzerland the game asks for your consent with its own consent form (Accept or Reject) before the first ad, in your second session. If you reject, you still see ads, but they are not personalised. The game decides whether the form applies from your app store country, your device's region setting and its time zone: if any of them points to the EEA, the UK or Switzerland, or none of them is known, it asks. It does not use your IP address or your location for this. Your answer is stored with your settings (on your device, in your cloud save and, with its date, in your player profile, §3.2) and passed to Unity LevelPlay, which passes it on to the ad networks. You can change it at any time in Settings > Privacy options. On iPhone and iPad, after a short explanation, iOS asks whether the game may track you (App Tracking Transparency). There is no reward for saying yes, and the game works the same either way.

3.13 Notifications

Reminders are local notifications scheduled by your device. They are off until you allow them, and each type can be turned off in Settings. No push token is created or sent to us.

3.14 Share card

If you tap Save Image or share the "Port Vesta Gazette" card, the image goes to your photo library or the app you choose, through your device's share sheet. The game never reads your photos.

3.15 Support e-mails and "Report an ad"

If you write to us, including through Settings > Contact support or Report an ad (which opens a pre-filled e-mail that you send yourself), we process your e-mail address, the content of your message and the details it contains (for example the Support ID, app version, or which ad you reported). Our mailbox is hosted by Microsoft 365 (§4). Basis: legitimate interests (answering you, ad quality); contract where it concerns a purchase.

3.16 Offers and game settings

The game decides on your device which offer it shows, based on your progress in the game: jobs cleared, days since installation, days away, two lost boss jobs in a row, and whether you have bought anything before. For example, players who have already paid see a different "Backup Crew" pack, and a player who returns after 7 or more days away sees a one-time welcome-back pack. The rules are the same for everyone, use no data from outside the game, and have no legal or similarly significant effect. There are no offers in your first session and none during a job. We also test game settings (for example difficulty, rewards, prices in Gold or the timing of offers) by showing different versions to groups of players. The group is calculated from your account ID and stays the same while a test runs. If gameplay statistics are on (§3.5), which offers were shown, tapped, closed or bought is recorded as described there and evaluated only in aggregate. Basis: contract (running and improving the game); legitimate interests (testing game settings); for the statistics, your consent (§3.5).

3.17 Information stored on or read from your device

Swiss telecommunications law (Art. 45c of the Telecommunications Act, FMG/LTC) and the EU ePrivacy rules require us to tell you what the game stores on or reads from your device:

4. Who receives data

We do not sell personal data. Authorities receive data only where the law obliges us.

5. Transfers abroad

Your game data is hosted in Switzerland. Some recipients in §4 are located in, or may access data from, other countries, notably the USA, Ireland/EU and Israel. The EU/EEA, the UK and Israel are recognised by Switzerland (and by the EU) as providing adequate protection. For the USA we rely on the recipient's certification under the Swiss-US and EU-US Data Privacy Framework where it exists, or otherwise on the standard contractual clauses approved by the European Commission and recognised by the Swiss FDPIC (for Supabase: the SCCs with the Swiss addendum in its data processing agreement). You can ask us for a copy of the safeguards.

6. How long we keep data

7. Your choices and rights

7.1 Controls in the game

• Settings > Delete my data: deletes your game account and all related server data (profile, cloud save, league and leaderboard entries, statistics, sign-in sessions) in one step, then resets the game on this device and in your iCloud. It needs an internet connection. Purchases stay with your Apple ID or Google account and can be restored with Restore Purchases. Other devices signed in to the same iCloud account keep their local copy until you delete it there too. Entries in the security log and the hosting provider's technical logs (§6) are not deleted at once; they expire within 7 days.
• Settings > Privacy options (shown in the EEA, the UK and Switzerland): change your ad consent.
• Settings > Privacy > Share gameplay statistics: switch statistics on or off at any time. They are off until you switch them on. The switch always shows whether statistics are being sent.
• Tracking (iOS): iOS Settings > Privacy & Security > Tracking.
• Advertising ID (Android): Android settings > Privacy > Ads (reset or delete the advertising ID).
• Notifications: per type in the game's Settings, or in your device settings.

7.2 Delete your data without the app

If you no longer have the game installed, write to info@tomicswisstech.ch with the subject "Mafiosi: delete my data" and, if you still have it, the Support ID shown at the bottom of Settings. We delete the account and all related server data within 30 days and confirm by e-mail. Without a Support ID we may not be able to find your account, because we store no name, e-mail or phone number. Inactive data is then removed under the retention periods in §6.

7.3 Your rights

Under the nFADP and the GDPR you can request access to your data, correction, deletion, restriction of processing and data portability, and you can object to processing based on legitimate interests. You can withdraw consent at any time. This does not affect processing before the withdrawal. Write to info@tomicswisstech.ch. For a copy of your data, include your Support ID (shown at the bottom of Settings): we send you the data we hold about your account in a machine-readable format (JSON). We answer within 30 days and may ask for your Support ID to find your account.

You can complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch; in the EU the authority of your country of residence; in the UK the Information Commissioner's Office (ICO).

8. Children and age

The game is meant for players aged 13 and over and is not directed at children under 13. The store page shows its age rating for your country. We do not knowingly collect personal data from children under 13. If you are younger than the age at which you can consent to online services in your country (between 13 and 16 in the EU), ask a parent or guardian before you allow gameplay statistics or personalised ads. A parent or guardian can switch statistics off at any time in Settings > Privacy. Our ad partners are told that the game is not directed at children. Parents who believe a child under 13 has used the game can write to us, and we delete the data.

The game does not currently ask for your age, and it does not estimate your age from how you play. If your platform gives us an age signal (for example Apple's Declared Age Range or Google Play Age Signals), or we add an age question, we will use it only to adapt the game (for example no time-limited offers for players under 18 and non-personalised ads for younger players) and will update this policy first.

9. Security

Connections are encrypted (HTTPS/TLS). Your account secret stays in your device's secure storage. Our database is not publicly reachable, and every access goes through checked server functions that can only read or change your own data. We store no names, e-mail addresses (except support e-mails) or payment details. Access to the server is limited to the owner.

10. Automated fair-play checks

To keep leagues fair, the server automatically checks submitted results against limits derived from the game's rules (for example the maximum possible Take for your progress and account age). An implausible result is marked "under review". It is then hidden from other players' rankings and earns no league reward that week until it is reviewed. This has no legal or financial effect. You can ask us to review it by hand: write to info@tomicswisstech.ch with your Support ID.

11. Additional information for US residents

We do not sell personal information for money. Our ad partners' use of device identifiers for targeted ads may count as "sharing" or "targeted advertising" under some US state laws. You can opt out by turning off tracking (iOS) or deleting your advertising ID (Android). You can use the rights in §7 regardless of where you live.

12. Additional information for other countries

The rights in §7 apply wherever you live. Where the law of your country gives you more, this section adds it; if it conflicts with the rest of this policy, this section prevails for you.

• Canada: under PIPEDA and provincial laws you can access and correct your data and withdraw consent (§7). Quebec: the person in charge of the protection of personal information is Marko Tomic, TomicSwissTech, info@tomicswisstech.ch. Before personal information leaves Quebec, we assess whether it will be adequately protected; the recipients and places are in §4 and §5.
• Australia: we handle personal information in line with the Australian Privacy Principles. Complain to us first, then to the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au.
• New Zealand: you can ask for access to and correction of your information under the Privacy Act 2020 and complain to the Office of the Privacy Commissioner, www.privacy.org.nz.
• Japan: we provide personal data to the recipients abroad in §4 and §5 (Switzerland, the EU/EEA, the USA, Israel) only with measures equivalent to the APPI or on another legal basis. On request we tell you about these recipients, the privacy systems of their countries and our measures.
• South Korea: transfer abroad (PIPA): while you use the game, your data is transferred over the network to the recipients in §4 (country, company, data items and retention as listed in §4 and §6), for the purposes in §3. You can refuse only by not using the game or by playing with your device offline; Settings > Delete my data deletes your data on our server, but the game creates a new account the next time it is online. Under Korean law, processing the personal information of a child under 14 on the basis of consent needs the consent of a legal guardian: if you are under 14, ask a legal guardian to agree before you turn on gameplay statistics or allow tracking. The person in charge of personal information protection is Marko Tomic, info@tomicswisstech.ch. This policy is also available in Korean.
• Philippines: you have the rights of a data subject under the Data Privacy Act of 2012. Our contact for data protection matters is Marko Tomic, info@tomicswisstech.ch. You can complain to the National Privacy Commission, www.privacy.gov.ph.
• South Africa: where POPIA applies, our information officer is Marko Tomic, info@tomicswisstech.ch. You can complain to the Information Regulator, inforegulator.org.za.
• Malaysia: this notice is available in Malay and English. Where the Personal Data Protection Act 2010 applies, you can ask for access to and correction of your data (§7.3).
• Brazil: under the LGPD (Art. 18) you can ask for confirmation and access, correction, anonymisation, blocking or deletion, portability and information about sharing, and you can withdraw consent. You can complain to the ANPD, www.gov.br/anpd. Our contact for data protection matters is info@tomicswisstech.ch. This policy is also available in Portuguese.

13. Changes

We update this policy when the game or the law changes and show the date at the top. If a change needs your consent, we will ask for it in the game.

14. Contact

TomicSwissTech, Inh. Tomic, Grenzstrasse 25, 9430 St. Margrethen, Switzerland. info@tomicswisstech.ch