Privacy Policy: Before the Gust

Effective date: October 11, 2026

Last updated: November 7, 2026

This Privacy Policy explains what information the game Before the Gust (the "Game") collects, why, how it is used and shared, and the choices and rights you have. It is written in plain English. Asetral ("we", "us", "our") makes and publishes the Game.

This policy covers the Game only. Our marketing website has its own policy at https://asetral.com/privacy, and our other apps have their own documents on https://asetral.com/app-policies.

This policy is published at https://asetral.com/app-policies/before-the-gust/privacy. The Terms of Use for the Game are at https://asetral.com/app-policies/before-the-gust/terms. You can also open both from the Game's settings.

Summary

• We do not sell your personal information for money.
• The Game has no chat, no player-to-player messaging, no public profiles, no leaderboards, no location features and no in-app purchases.
• The desktop and web versions keep everything on your device.

1. Who we are (the data controller)

Asetral is an independent studio working across software, digital marketing and media production.

For the purposes of data protection law, including the EU and UK General Data Protection Regulation ("GDPR") where it applies and the Turkish Personal Data Protection Law No. 6698 ("KVKK"), Asetral is the data controller for the personal data processed through the Game, as described in this policy.

• Controller: Asetral, Turkey
• Privacy contact: contact@asetral.com
• Website: https://asetral.com
• Phone: +1 318 724 8799

We have not appointed a representative in the EU or UK.

2. Scope

This policy applies to every version of the Game:

• the Android app (package com.beforethegust.app), distributed through Google Play;
• the desktop app for Windows, macOS and Linux, including builds distributed through stores and download sites such as the Microsoft Store, itch.io, Game Jolt and Flathub; and
• the web version, played in a browser, installed as a web app, or played on game websites such as itch.io, Game Jolt, CrazyGames and Poki.

The Game is not yet available on every platform listed. This policy applies to whichever versions you use. Stores and game websites are run by other companies, which have their own privacy policies (see section 8).

3. Data that stays on your device (all versions)

The Game saves the following only on your device. We cannot see it and it is not sent to us:

• Game progress and in-game items: unlocked and cleared levels, stars, mastery tiers, the last level you played, achievements, daily-puzzle streak and the date of your last daily clear, your best practice-yard result, a pending hint credit, per-level failure counts used to offer a hint, your power-up inventory and daily-gift streak (the date of your last claim), your coins and hearts with the day's counters for rewarded ads and replay payouts, and which tutorials, coach cards, Guide pages, object-info notes and story cards you have already seen.
• Settings: sound on or off, volume, reduced motion, haptics, battery saver, simulation speed and control preferences.
• Android crash note: if the app crashes, it writes the time, app version and the top of the error stack trace to a small file (last_crash.txt, at most 8 kB, replaced each time) in the app's private storage. It stays on your phone and is not sent by the app. It is removed when you clear the app's storage or uninstall.
• Desktop app only: the window size, position and full-screen state, and save backups. Once a day, when the app starts, it copies the game's saved data (the browser storage inside the app's data folder) into a save-backups folder inside the same app data folder, and keeps the five newest days. This protects your progress if the app or computer crashes. The backups stay on your computer and are never sent anywhere. If the app's window process stops unexpectedly, the app reloads itself (at most three times a minute); nothing is sent.

Where it is stored:

• Android: in the app's private storage on your phone.
• Web: in your browser's local storage for the site you play on (keys starting with structure_web_). The installable web version also uses a service-worker cache to keep the game's own files (code, images, sound effects and music) available offline. That cache contains no personal data. Some music and ambient sound files are cached for up to 30 days.
• Desktop: in the app's data folder on your computer, typically %APPDATA%\Before the Gust on Windows, ~/Library/Application Support/Before the Gust on macOS and ~/.config/Before the Gust on Linux. Store and sandboxed builds (for example Microsoft Store or Flathub builds) may keep this folder in a different place managed by the operating system.

Android device backup: if you have turned on Android's own device backup, Android may back up some of the app's settings to your Google account and restore them when you reinstall. Game progress, achievements, coins, hearts and the power-up inventory are excluded from this backup (on every supported Android version). Android's backup is provided by Google under its own terms, and you control it in your phone's settings.

How to clear local data:

• Android: Settings > Apps > Before the Gust > Storage > Clear storage, or uninstall the app.
• Web: clear the site data (local storage and cached files) for the site where you play, in your browser's settings.
• Desktop: uninstalling may leave the data folder behind, including the save-backups folder. Delete the whole folder listed above to remove everything. Deleting only the game's saved data inside the app does not remove the backup copies.

4. Data collected by the Android app

The Android app uses services from Google to show ads, understand how the Game is played, find crashes, protect our backend and, if you choose, sign you in and sync your progress. When you use the Android app, the information below is sent over encrypted (HTTPS/TLS) connections to Google, which processes it for us.

4.1 Gameplay analytics (Google Analytics for Firebase)

What: events about how the Game is played, with the details listed here:

Google Analytics for Firebase also automatically collects standard information such as first open, sessions, screens viewed and engagement time, together with the app version, device model, operating-system version, language, approximate country or region (derived from your IP address), an app-instance identifier and, where available, your device's advertising ID.

These events are not linked to your account: the Game does not send your account ID, email address or name to Analytics.

Why: to see which levels are too hard, too easy or unpopular, and to improve the Game.

Your control: the switch Share anonymous usage and crash data in the Game's settings turns Analytics and crash reports (section 4.2) off. While it is off, the app does not collect or send them.

Web version: Analytics is off until you turn on Share anonymous usage data in the settings. It is off by default everywhere, and turning it off again stops collection. The web version has no crash reports, and the desktop app never sends Analytics.

4.2 Crash reports (Firebase Crashlytics)

What: when the app crashes or hits certain errors (for example a failed cloud-save sync), a report is sent containing technical details such as the stack trace, time of the crash, app version and build type, device model, operating-system version, available memory and disk space, whether the device is rooted, and installation identifiers created by Firebase. If you are signed in and the usage and crash data switch is on, the report also contains your account ID (a random string, not your email address).

Why: to find and fix bugs.

4.3 Advertising (Google AdMob and Google User Messaging Platform)

The Android app shows ads served by Google AdMob:

• a banner on the settings, statistics, achievements and shop screens (never during a level, on a result card or on the main menu);
• occasional full-screen (interstitial) ads when you return to the level list after playing, at most about once every three and a half minutes and never during a level; and
• optional rewarded ads: if you choose "watch an ad" (in the shop, in settings or when you run out of hearts) and finish it, you get a reward such as hearts, coins, a free power-up or a hint credit that reveals the goal zones on your next level. Watching is never required.

What: Google's Mobile Ads SDK automatically collects your IP address (which can be used to estimate your general location), interactions with the app and the ads (such as app launches, taps and video views), diagnostic and performance information, and device identifiers such as the Android advertising ID and app set ID. On supported Android versions, Google may also use Android's Privacy Sandbox advertising features (Topics and Attribution), which you can manage in your phone's settings.

Consent: in the European Economic Area, the UK and Switzerland, the app uses Google's User Messaging Platform to ask for your choices about how your data is used for ads. Ads can be personalised (based on your interests) or non-personalised (based on context, such as the app itself), depending on your choices and on where you live.

Why: ads pay for the free Game. Google uses this data to show ads, measure them, limit how often you see them and prevent ad fraud.

Note: under Google's terms, Google and its advertising partners may also use this data for their own purposes, as described at https://policies.google.com/technologies/partner-sites.

4.4 Optional account and cloud save (Firebase Authentication and Cloud Firestore)

Signing in is optional. Without an account, the whole Game works and your progress stays on your phone.

If you choose to create an account or sign in:

• Email and password: Firebase Authentication stores your email address and a protected (hashed) form of your password. We never see your password. If you tap "forgot password", Firebase sends a reset email to that address on our behalf.
• Sign in with Google: Google shares your Google account's email address and basic profile (name, profile picture link and Google account ID) with Firebase Authentication. The Game may show your email address or name on the account screen. It does not use your profile picture.
• Firebase Authentication also records your account ID, when the account was created and last used, and, for security and abuse prevention, the IP address and device/browser information used to sign in.
• Cloud save: while you are signed in, the Game saves a copy of your game progress in Cloud Firestore: the progress items listed in section 3 (unlocked and cleared levels, stars, mastery tiers, last level played, achievements, daily streak and last daily date, best practice result, pending hint credit, which tutorials and coach cards you have seen) and the time of the last update. Your coins and hearts go into a second Cloud Firestore document: how many you have, when the last heart came back, and the day's counters for rewarded ads and replay payouts. Your settings are not uploaded.
• Each account can read and write only its own cloud save. Nobody else can see it.
• Your power-up inventory, daily-gift state, Guide and tutorial flags and settings are not uploaded; they stay on the device.

Why: to let you keep and restore your progress across devices and reinstalls.

4.5 App and device integrity (Firebase App Check with Google Play Integrity)

What: the app asks Google Play Integrity to confirm that requests come from a genuine copy of the app on a genuine device, and receives a short-lived token that is sent with requests to our Firebase services.

Why: to protect our backend and your cloud save from abuse and fake traffic.

4.6 Permissions

The Android app asks for no permissions that show a prompt. It uses:

• Internet and network state: for ads, analytics, crash reports, sign-in and cloud save;
• Vibrate: for haptic feedback; and
• permissions that Google's libraries add automatically, such as access to the advertising ID, Android's Privacy Sandbox advertising features and Google Play's install referrer.

The app does not use your location (GPS), camera, microphone, contacts, photos or files, except a file that you yourself choose when exporting or importing progress (section 5).

5. Features you control (all versions)

• "Copy diagnostics": when you tap it, the Game copies a short text to your clipboard: app version and build, platform, device description (on the web this is your browser's user-agent string), operating system, screen size, whether you are in a level, the game mode, level ID and number, attempts, sound and volume settings, reduced-motion and simulation-speed settings, whether analytics is configured in that build, and the time. It contains no name, email address, account ID or saved progress. Nothing is sent anywhere. It only reaches us if you choose to paste it into a message to us.
• Sharing a daily result: when you tap share, the Game passes a short plain-text line (daily level number and title, streak, achievement count) to your device's share menu or clipboard. The Game itself sends nothing. Whatever app you share to handles it under its own policy.
• Export and import progress: you can save your progress to a file (JSON) in a place you choose and load it again later. The file stays wherever you put it. We do not receive it.
• Thumbs up or down: on the Android app this vote is sent as the level_feedback analytics event (section 4.1). On the desktop and web versions it is not sent anywhere or saved. It is not linked to your name or account and is not shown to other players.
• Contacting us: if you email us, we receive your email address, your message and anything you attach (for example pasted diagnostics). We use it only to reply and to deal with your request.

6. What we do NOT collect

• We do not collect your real name, postal address, phone number, date of birth, payment details or government ID.
• We do not collect precise location, contacts, photos, audio or messages.
• The desktop version of the Game includes no analytics, no advertising SDKs, no accounts and no cookies. It does not send gameplay data, diagnostics or identifiers to us. The desktop app is built to load only its own files and does not contact our servers.
• The current web builds include no advertising SDKs, set no cookies and do not turn on sign-in, cloud save or analytics. The web code can offer optional sign-in (email or Google) and cloud save through Firebase when it is built with Firebase settings. If a web build does, the account and cloud-save data described in section 4.4 are processed as in the Android app, you can delete your account in the web settings, and analytics runs only if you opt in. We will update this policy before such a build is released.

7. How and why we use data, and our legal bases

Note on analytics and crash reports: in the EEA, the UK and Switzerland, the Android app does not start analytics or crash reports until you have answered Google's consent form, and uses them only if you agree. Elsewhere they start on, and in both cases the switch Share anonymous usage and crash data turns them off at any time. Where the law requires consent for storing or reading information on your device, we rely on your consent (GDPR Art. 6(1)(a)); otherwise on legitimate interests (Art. 6(1)(f)).

We do not use your data for automated decisions that have legal or similarly significant effects on you. We do not use it to build profiles of you, except the ad personalisation done by Google if you allow it.

8. Who receives data (service providers and platforms)

We share data only with the providers below, and only as described in this policy.

Service providers that process data for the Android app:

• Google (Firebase): Analytics, Crashlytics, Authentication, Cloud Firestore and App Check. For Firebase, Google acts as our processor. Privacy and security information: https://firebase.google.com/support/privacy. Google Privacy Policy: https://policies.google.com/privacy.
• Google (AdMob, User Messaging Platform, Play Integrity): ads, consent and integrity checks. How Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites. How Google uses data for advertising: https://policies.google.com/technologies/ads. Google Privacy Policy: https://policies.google.com/privacy.

Stores and game websites: we may distribute the Game through the platforms below. When you download or play there, the platform collects data under its own privacy policy, as an independent controller. This may include your account on that platform, downloads and purchases, and, on game websites, its own ads, cookies and analytics. We do not control this and it is not covered by this policy:

• Google Play: https://policies.google.com/privacy
• Microsoft Store: https://www.microsoft.com/en-us/privacy/privacystatement
• itch.io: https://itch.io/docs/legal/privacy-policy
• Game Jolt: https://gamejolt.com/privacy
• Flathub: https://flathub.org/privacy-policy
• CrazyGames: https://www.crazygames.com/privacy-policy
• Poki: https://poki.com/en/privacy

If you play the web version on a site that we run ourselves, our hosting provider processes standard technical request data (such as IP address, browser type and the files requested) to deliver the site and keep it secure.

Others: we may disclose information if required by law or by a valid request from public authorities, to protect our rights, users or the public, or as part of a merger, acquisition or sale of assets (in which case this policy will continue to apply to your data).

We do not sell your personal information for money. See section 13 for California.

9. International transfers

Google processes data on global infrastructure, including in the United States; Firebase Authentication runs only in US data centres. We are based in Turkey. This means your data may be processed outside your country.

• From the EEA, UK and Switzerland: Google LLC is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework (https://www.dataprivacyframework.gov/). Google also offers standard contractual clauses in its data processing terms. Where a transfer to us in Turkey is needed (for example when we read a deletion request or access the Firebase console), we rely on the safeguards and grounds available under GDPR, such as standard contractual clauses or, where applicable, the transfer being necessary to provide the service you asked for.
• From Turkey: transfers abroad are made under Article 9 of KVKK (as amended in 2024): where the Personal Data Protection Board has decided that the country offers adequate protection; otherwise on the basis of appropriate safeguards such as a standard contract (which we notify to the Board within the time the law requires), and only for transfers that are occasional and not repeated, on your explicit consent or another ground the law lists.

10. How long we keep data

11. Deleting your account and data

• Delete your account and cloud save: email contact@asetral.com with the subject "Delete my Before the Gust account" from the email address you signed in with (or tell us that address). We will delete your Firebase Authentication account and your cloud save without undue delay and within 30 days of a verified request. That deadline is the longest the GDPR (one month) and KVKK (30 days) allow, apart from extensions the law permits. We may ask you to confirm the request from that email address to protect your account.
• In the app (fastest): open the account screen (the account button on the main menu) while signed in and tap Delete account, then confirm. This immediately deletes your cloud save and your account. If Firebase asks for a recent sign-in first, sign in again and repeat. Progress stored on your device is not touched.
• Without the app: use the request page at https://asetral.com/app-policies/before-the-gust/delete-account (it explains the same email request as above, so you do not have to reinstall the app).
• Analytics and crash data are not linked to your account, so we usually cannot find them for a specific person. They expire automatically (section 10). Crash reports that include your account ID expire within 90 days.
• Signing out does not delete anything. Your progress stays on your phone.
• To remove local data, see section 3.

12. Your choices

• Ads: in the EEA, UK and Switzerland, you make your ad choices in Google's consent form when the app asks. You can reopen the form at any time with Ad privacy choices in the Game's settings (shown wherever the form applies). You can also reset or delete your advertising ID, or opt out of ad personalisation, in your phone's settings (for example Settings > Google > Ads or Settings > Privacy > Ads, depending on your phone), and manage Privacy Sandbox ad features there.
• Analytics and crash reports: turn Share anonymous usage and crash data off in the Game's settings. The desktop version collects nothing; the web version collects analytics only if you opt in.
• Account: optional; you can sign out at any time and ask us to delete it.

13. Your rights

You can contact contact@asetral.com at any time to exercise the rights below. We may need to confirm your identity first, for example by asking you to write from the email address on your account. We will not treat you differently for exercising your rights.

Portability and copies: to get a copy of your game progress, use Export progress in the app (More options on the web). It saves a JSON file where you choose. For anything else we hold about you (account data, cloud save), email us and we will send it in a common electronic format.

EEA and UK (GDPR / UK GDPR): you can ask for access to your data, correction, deletion, restriction of processing, data portability, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing that already happened. You can also complain to your local data protection authority (EEA list: https://edpb.europa.eu/about-edpb/about-edpb/members_en; UK: the Information Commissioner's Office, https://ico.org.uk/make-a-complaint/).

Turkey (KVKK, Article 11): you can ask whether your personal data is processed and get information about it; learn the purpose of processing and whether it is used for that purpose; know the third parties in Turkey or abroad to whom it is transferred; ask for correction of incomplete or inaccurate data; ask for deletion or destruction; ask that third parties who received the data be told about such correction or deletion; object to a result against you that comes only from automated analysis; and claim compensation for damage caused by unlawful processing. Send your application to contact@asetral.com. We will answer within 30 days, free of charge unless the law allows a fee. If you are not satisfied, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, https://www.kvkk.gov.tr/). A Turkish version of this notice is available on request at contact@asetral.com.

Brazil (LGPD): where the Brazilian General Data Protection Law applies, Asetral is the controller, and you may ask us to confirm that we process your data, to access, correct, anonymise, block or delete it, to port it, to know who it is shared with, to withdraw consent, and to review decisions made only by automated means (Art. 18). Our legal bases are those in section 7 (consent, performance of a contract, legitimate interests, legal obligation). Contact for privacy matters: contact@asetral.com. You may also complain to the National Data Protection Authority (ANPD), https://www.gov.br/anpd.

California (CCPA as amended by the CPRA) and other US states with similar laws: you have the right to know what personal information we collect, use and disclose, and to access, correct and delete it, and not to be discriminated against for using these rights. The categories we collect are described in sections 4 and 5: identifiers (account ID, email address, device and advertising identifiers, IP address), internet and app activity (gameplay events, ad interactions), approximate geolocation derived from IP address (by Google, for analytics and ads), and, if you sign in with Google, your name. We collect them from you and your device for the purposes in section 7, and we disclose them to the service providers in section 8.

• Sale: we do not sell personal information for money, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.
• Sharing for cross-context behavioural advertising: the desktop and web versions do not share any personal information. The Android app shows Google AdMob ads, which may use your advertising ID and app activity for personalised advertising. California law may treat this as "sharing". To opt out, delete or reset your advertising ID or opt out of ad personalisation in your phone's settings, and contact us at contact@asetral.com if you want us to take any further step.
• Sensitive personal information: we do not collect it.
• You can use an authorised agent to make a request where the law allows. We may ask the agent for proof of authority.

14. Children

The Game contains no violence, bad language, chat or purchases, but the Android app, which has ads and optional accounts, is intended for people aged 13 and over.

• Android app: the Android app is intended for a general audience aged 13 and over and is not directed to children under 13. We do not knowingly collect personal information from children under 13 (COPPA). In the EEA and UK, if you are under the age at which you can consent to online services in your country (between 13 and 16), please use the optional account only with the permission of a parent or guardian. In Turkey, where the law requires a parent's or guardian's consent, the same applies.
• Desktop and web versions: they collect no personal data, so children can play them without any data being sent to us. Game websites such as Poki or CrazyGames apply their own rules for younger players.
• If you believe a child has given us personal data (for example by creating an account), contact contact@asetral.com and we will delete it.

15. Security

• Data sent by the Android app to Google travels over encrypted connections (HTTPS/TLS). Firebase encrypts stored data in Cloud Firestore, Authentication and Crashlytics.
• Our database rules let each signed-in account read and write only its own cloud save and block all other access.
• Passwords are handled by Firebase Authentication. We never see or store them.
• Firebase App Check helps confirm that requests come from the genuine app.

Data saved on your device (and any exported progress file) is not encrypted by the Game. Anyone with access to your device or file can read it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a data breach that affects you, we will notify you and the authorities where the law requires.

16. Cookies, local storage and similar technologies (web)

The web version of the Game does not use cookies and does not load analytics or advertising scripts. It uses:

• Local storage to save your progress and settings in your browser (section 3). This is strictly necessary for the Game to remember your progress and does not require consent.
• A service-worker cache (for the installable web version) to keep the Game's own files available offline.

Game websites that embed the Game (for example CrazyGames or Poki) may set their own cookies and show their own consent banners. That is covered by their policies, not this one.

17. Changes to this policy

We may update this policy when the Game or the law changes. We will change the "Last updated" date at the top. For important changes, for example a new type of data collection, we will also tell you in the Game or on the store page before the change applies, and ask for your consent where the law requires.

18. Contact

Questions, requests or complaints about privacy:

• Email: contact@asetral.com
• Phone: +1 318 724 8799
• Website: https://asetral.com
• Instagram: @asetralmedia
• LinkedIn: Asetral

Asetral, Turkey.