WAX BANDITS
Privacy Policy
Last updated: 19 October 2026
This policy explains what information Wax Bandits (the "game") collects, why, who we share it with, and the choices you have. The game is made by Uprise Studios Ltd ("we", "us"), which is the data controller for the information described here.
Uprise Studios Ltd
3rd Floor, 86–90 Paul Street
London EC2A 4NE
United Kingdom
Contact: hello@uprisestudios.co.uk
The short version
- You don't create an account or give us your name, email or phone number to play.
- The game gives you an anonymous player ID so your vaults, progress and purchases are kept on our servers.
- Ads are optional: you only see one when you choose to watch it for a reward. Ads are only personalised if you are 18 or over and agree to it.
- We never sell your information.
What we collect and why
| Information | Why | Legal basis (UK/EU GDPR) |
|---|---|---|
| Anonymous player ID, created when you first open the game | To recognise your game on our servers and keep your progress | Contract (providing the game) |
| Game data: vaults you build, raids you play (including the moves needed to replay and check them), gold, wax, gems, Crowns, stars, upgrades, Heist Pass and achievement progress | To run the game, matchmake raids, show replays to vault owners, and check raid results on our servers | Contract |
| Purchase records: product, order ID and the store receipt (we never see your card or payment details) | To check a purchase with Google Play or the App Store, deliver it once, and handle refunds | Contract; legal obligation (tax and accounting records) |
| Your answer to the age question and your ad consent choices | To decide whether ads may be personalised and whether analytics may be collected | Legal obligation |
| Gameplay analytics: events such as raids started and finished, upgrades, purchases and ad rewards, with device model, operating system, country and app version | To understand how the game is played, balance it and fix problems | Consent |
| Advertising data (handled by our ad partners): advertising ID, IP address, device and network information, and ad interactions | To have rewarded ads ready, show the ones you choose to watch, confirm you finished them so we can grant the reward, limit how many you can watch, and prevent fraud. Our ad partners' software starts when the game opens, so it collects this even if you don't watch an ad | Consent for personalised ads; legitimate interests for non-personalised ads, reward checks and fraud prevention |
| Install referrer (Android): the vault code in a share link, if you installed the game from one | To open the vault your friend shared | Legitimate interests |
| Technical logs: IP address and request details when the game or our website contacts our servers | Security, abuse prevention and fixing errors | Legitimate interests |
What stays on your device
Vault drafts you haven't published, your settings, and raid clips you make stay on your device. A clip or vault link only leaves your device when you choose to share it, and then it goes to the app or person you pick. Our vault link pages show a vault's code, level and trap count, not who owns it.
Who we share information with
We use these service providers, which process information for us or as independent controllers under their own policies:
- Unity Technologies (Unity Gaming Services: player ID, game data storage, server code, configuration and analytics; and Unity LevelPlay for rewarded ads). Unity privacy policy
- Ad networks that LevelPlay uses to fill the ads you choose to watch, which may include Unity Ads, ironSource Ads and Google AdMob. The current list is in the consent screen the game shows you.
- Google (Google Play billing and purchase checks, the User Messaging Platform consent screen, and the advertising ID). Google privacy policy
- Apple (App Store purchases, on iOS). Apple privacy policy
- Cloudflare (hosts our website and vault link pages, and passes ad reward confirmations to our servers). Cloudflare privacy policy
We may also disclose information if the law requires it, or to protect players and the game from fraud and abuse.
Some of these providers process data outside the UK and EEA, including in the United States. Where they do, they use safeguards recognised by UK and EU law, such as the UK International Data Transfer Addendum, Standard Contractual Clauses or the UK-US data bridge.
Your choices
- Ads: ads only play when you tap to watch one. Where your region gives you the choice (including the UK and EEA), you can change your ad consent choices at any time from the Privacy screen on the game's home screen. If you are under 18 or don't consent, any ads you watch are not personalised. You can also reset or delete your advertising ID in your device settings.
- Analytics: only collected if you consent, and you can withdraw consent in the same place.
- iOS: if we ever ask to track you across other companies' apps, it will be through Apple's App Tracking Transparency prompt, and you can say no.
How long we keep it
We keep your game data for as long as you play, and delete it when you ask us to (see below). Purchase records are kept for as long as tax and accounting law requires (in the UK, six years). Analytics data and server logs are kept by Unity and Cloudflare for the periods set in their own policies, and are not used to identify you beyond your player ID.
Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your information, object to or restrict how we use it, and withdraw consent at any time. To make a request, email hello@uprisestudios.co.uk with your player ID, which is shown on the game's Privacy screen. Because the game has no account, the player ID is how we find your data, so please include it. We will reply within one month.
Deleting the game from your device does not delete the data on our servers; email us to have it deleted.
If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk). In the EU, you can complain to your local data protection authority.
Children
Wax Bandits is not directed at children under 13, and we do not knowingly collect personal information from them. Players under 18 never receive personalised ads. If you believe a child under 13 has given us information, contact us and we will delete it.
Security
Information is sent over encrypted connections. Game data is stored by Unity Gaming Services, and only our server code can change your wallet, inventory and published vaults.
Changes
If we change this policy, we will update the date at the top. If a change is significant (for example, a new kind of data or a new purpose), we will tell you in the game before it takes effect.
Wax Bandits · Tiny Thieves – Big Heists