Effective date: 7 October 2026
App: Upgrader (com.upgrader.upgrader), Android and iPhone (iOS)
Developer contact: narodniy.team@gmail.com
This policy applies only to the Upgrader app and describes all the data the app receives, uses, stores and shares. The Russian version of this page is the original; this is its translation.
Upgrader is a game that simulates upgrading items. Everything inside the game, including the balance and the items, is fictional and has no value outside the app. Real money is not accepted, paid out or awarded. Items cannot be bought for money, sold, exchanged, or withdrawn to Steam or any Valve game.
The app was created independently. It is not affiliated with, endorsed by or sponsored by Valve Corporation. Counter-Strike, CS2 and the item names are trademarks of their respective owners.
The app shows rewarded video ads. They are provided by the Yandex advertising network, and its software development kit (SDK) runs from the first launch, even if you have not signed in and have not watched a single video.
If the phone is located in Ukraine, ads in the Android app are provided by Unity LevelPlay mediation (Unity Technologies) instead of Yandex, and everything said below about the ad network applies to it. The app determines the country on the phone itself — from the mobile network, the SIM card or the region in settings — and does not send it anywhere: it is needed only to choose the ad network.
The ad network learns your device's advertising identifier, details about the device and the IP address. We do not decide what this data includes: the network collects it under its own rules in order to show ads. We receive no information about you from it and do not link ad impressions to your game account.
On Android you can reset or delete the advertising identifier in the phone settings, under Privacy → Ads.
In the iPhone version, videos are shown only by the Yandex advertising network. Its SDK (with Yandex AppMetrica analytics built in) receives device details, ad impression data and the IP address. It receives the advertising identifier (IDFA) only if you allowed tracking in the system prompt “Allow this app to track your activity?” — the game asks once. Declining does not limit the game in any way.
You can change the permission at any time: Settings → Privacy & Security → Tracking.
Apart from what is described above, we collect nothing. Your progress — balance, items, statistics, upgrade history — is stored only in your device's memory and is not sent anywhere. Deleting the app erases it completely.
There is one exception: a launch counter. Every two minutes the app sends our server a short signal: a random number it makes up at launch, the word “Android”, “iOS” or “browser” and — if you watched ads for a case — how many such cases you have opened since the previous signal. The signal contains nothing else: no device identifier, no advertising identifier, no information about what you do in the game. The random number lives only in the app's memory and disappears with it — the next launch makes up a new one, and two launches cannot be linked to each other.
What we keep from the signal. For the first five minutes the server holds the number in memory to count how many copies of the game are open at once; the result is a record like “thirty people were playing at 21:40”, which contains neither you nor your device. In addition, one row per launch is saved: the same random number, the date, the platform word and how many ad-rewarded cases were opened. It is needed for exactly one thing — to tell “a thousand videos were watched by a thousand people” from “they were watched by forty”; the total number of videos cannot distinguish these two cases. The row is kept for thirty days and then deleted. It cannot identify you, your device or another launch of yours: the random number exists nowhere else and there is nothing to match it against.
As with any internet request, the server sees the sender's IP address: we do not record it in the log of these requests and do not store it anywhere.
Signing in is optional: the single-player game works fully without it. When you sign in with Google, we receive from Google and store:
This data is needed to recognise you at the next launch and to move your progress between devices. The password to your Google account is not passed to the app and is not available to us.
On iPhone you can sign in with Apple instead of Google. The game does not request your name or e-mail address from Apple: Firebase Authentication receives only an identifier of your Apple ID for this app. After that, everything works as with Google sign-in — the same online mode and the same cloud save.
Together with the account data, your game progress is uploaded to the cloud: balance, list of items, win and loss statistics, upgrade history.
Signing in with Google or, on iPhone, with Apple opens online mode: duels, friends, the leaderboard. Online mode runs on our own server, which stores a separate player record:
Your e-mail, name and profile photo are not on this server. It knows you by the identifier and the nickname — and by nothing else.
If our server cannot be reached from your network, the app connects to it through a relay server in the European Union. The relay stores no game data and only forwards requests to our server in Moscow over an encrypted connection; like any server, it sees the IP address of the connection and passes it on to our server. This does not change where or how your data is stored.
Your nickname is visible to other players: in the friends list, on the leaderboard, on a challenge card. That is its purpose. Everything else is unavailable to other people — your balance, inventory, e-mail and photo. The nickname can be changed once a month.
Both players receive in-game money for an invited friend, and some people try to exploit this: they create a dozen accounts on one phone and enter codes for themselves. To prevent that, when an invite code is entered we store two attributes — and only for this purpose.
Device identifier. In the Android app we read ANDROID_ID — a value the system issues to our app for this device. It never reaches our database in its original form: the server immediately turns it into an irreversible hash with a secret key and stores only the hash. The hash can tell that “a code has already been entered from this device”, but it cannot identify the device or be matched against any other database — ours or anyone else's. We do not read the advertising identifier, the IMEI or the serial number. In a browser, on a computer and in the iPhone app nothing of the kind is collected at all.
IP address. The address of the last sign-in is stored in the player record, and the address from which a code was entered is stored in the invite record. It is needed solely to tell a real friend's invite from two accounts of one person, and is used for nothing else.
Both records are deleted together with the account.
Our server, like any server on the internet, sees the IP address of the connection and writes it to the request log. Logs are needed to protect against brute force and abuse and are not used for advertising or tracking.
The Google services that provide sign-in and progress storage record technical details of the connection on their own — including the IP address and device details. They need this to protect against password guessing and abuse.
The app has no analytics of its own: we do not track what you do in the game and do not send it anywhere.
| What | Where | Operator |
|---|---|---|
| Account, e-mail, name, profile photo | Firebase Authentication | |
| Copy of game progress | Cloud Firestore | |
| Online profile: nickname, balance, items, duels, friends | our server in Moscow | us |
| Invite anti-abuse attributes: hash of the device identifier and IP address | our server in Moscow | us |
| How many copies of the game are open at once and how many times the game was launched — anonymous counters with no player data | our server in Moscow | us |
Access to a record in the Google database is limited by its rules: only the owner can read and change their data. On our server every request is verified by the signature of the sign-in token — nobody can reach someone else's record under another name.
We do not sell data. Processing is limited to the services that make the app work:
| Service | Purpose | What it receives |
|---|---|---|
| Google Firebase | sign-in and progress storage | account data and game progress |
| Yandex advertising network | showing rewarded videos | advertising identifier, device details, IP address |
| Unity LevelPlay | showing rewarded videos on Android phones in Ukraine | advertising identifier, device details, IP address |
| Steam Community Market | reference prices of items | anonymous requests with no data about you |
| Steam CDN | item images | anonymous requests with no data about you |
Other players see only your nickname — and nothing else.
The data of a signed-in user is kept for as long as their account exists in the app. We do not delete it after a set period and do not archive it: the record lives until you ask for it to be deleted.
On a deletion request we erase the account, the progress document and the online profile on our server — within 30 days. Backups may contain the data for up to 30 more days after that; then they are overwritten automatically.
In the iPhone version there is no waiting: the account is deleted at once, in the game itself — see “Your rights”.
Guest-mode data is not stored on servers at all — it stays only on the device and disappears with the app. The only exception is the anonymous launch counter described above: a row with a random number, the date and the platform is kept for thirty days and is not linked to you or your device.
On Android the app itself asks only for internet access and network state.
Along with it, the installation package includes permissions added by the SDKs from Google, Yandex and Unity: the advertising identifier, access to Google Play services, keeping the processor awake while a video loads, installation source details and fingerprint sign-in if your Google account uses it. We do not use these capabilities directly — the SDKs request them themselves.
The device identifier mentioned above is read without any permission: the system issues it to the app itself, and there is nothing to ask for.
In the iPhone version the app asks for one permission — tracking (App Tracking Transparency, see “Advertising on iPhone”). Declining does not limit the game in any way.
The camera, microphone, location, contacts and files are not requested.
The app's age rating is assigned by the store you installed it from and is shown on the app's page there. The app is not designed for children, and we do not knowingly collect their data. If you are a parent and believe that a child has given us data, write to us — we will delete it.
We may update this policy. Significant changes will be reflected in the effective date above and, where necessary, announced in the app's description.
For any questions about data and for deletion requests: narodniy.team@gmail.com