@mpgd/cli 0.56.0 → 0.58.0

package/templates/notifications-overlay/common/src/platform/capacitorNotifications.ts

@@ -3,6 +3,7 @@ import {
   createCapacitorNotificationServiceProvider,
   loadCapacitorNotificationSdks,
   openCapacitorNotificationSettings,
+  readCapacitorAdvertisingPushRenderer,
 } from '@mpgd/adapter-capacitor/notifications';
 
 import { starterNotificationTopics } from './notifications';
@@ -38,9 +39,8 @@ export async function createStarterCapacitorNotifications(
       ...sdks,
       // Android channel names the player sees in system settings, in the
       // device language. The provider creates a channel only for the topics
-      // mapped to Android; `mpgd-advertising` is named for the day an
-      // advertising topic is mapped there, in a channel of its own the
-      // player can turn off.
+      // mapped to Android; advertising has `mpgd-advertising`, a channel of
+      // its own the player can turn off.
       channels: korean
         ? {
             'mpgd-service': { name: '알림' },
@@ -54,6 +54,11 @@ export async function createStarterCapacitorNotifications(
           },
       advertisingOptOutTitle: korean ? '수신거부' : 'Unsubscribe',
       openSettings: openCapacitorNotificationSettings,
+      // Android: the shell renders advertising pushes with the opt-out
+      // action when its messaging service is the kit's renderer, which
+      // `mpgd target init capacitor --providers notifications` declares; the
+      // backend sends advertising only to such an installation.
+      advertisingRenderer: readCapacitorAdvertisingPushRenderer,
     }),
   ];
 }

package/templates/notifications-overlay/common/src/platform/notificationBackend.ts

@@ -16,6 +16,7 @@ import type {
 import {
   createNotificationRuntime,
   createNotificationRuntimeStorage,
+  type NotificationRuntimeBackend,
 } from '@mpgd/platform/notifications-runtime';
 import type { TargetConfiguredGateway } from '@mpgd/target-config';
 
@@ -56,8 +57,8 @@ export interface StarterWorkerNotificationInput {
  * Worker. A Reddit game's backend is its Devvit server: the opt-in, the
  * consent records, and the sends live there, and the Worker serves no
  * `reddit` target. A runtime over the Worker would send the game's session
- * header to a backend that cannot use it, so Reddit keeps no backend here,
- * as before R1, until the Devvit server has a runtime client of its own.
+ * header to a backend that cannot use it, so Reddit gets the hosted backend
+ * below instead (`createStarterHostedNotificationBackend`).
  */
 const targetsWithoutWorkerBackend: ReadonlySet<string> = new Set(['reddit']);
 
@@ -140,6 +141,114 @@ export function createStarterWorkerNotificationBackend(
   }
 }
 
+/**
+ * A backend the target's own server hosts, set by the target's gateway
+ * builder for its config target: on Reddit, `createDevvitNotificationsBackend`
+ * from `@mpgd/adapter-devvit` over the Devvit server bridge
+ * (`buildGateways/reddit.ts`). The server answers for the request's
+ * logged-in Reddit user, so the game sets no session of its own. The
+ * backend is created on first use, so a game whose target exposes no
+ * notifications provider (Reddit's gated beta before approval) sends
+ * nothing.
+ */
+let hostedBackend:
+  | {
+      readonly configTarget: string;
+      readonly create: () => NotificationRuntimeBackend;
+      created?: NotificationRuntimeBackend;
+      /** The factory threw once: notifications stay off, and the failure is logged once. */
+      failed?: true;
+    }
+  | undefined;
+
+/**
+ * Sets the backend `configTarget`'s own server hosts, as a factory called on
+ * first use; `undefined` clears it.
+ */
+export function setStarterHostedNotificationBackend(
+  configTarget: string,
+  create: (() => NotificationRuntimeBackend) | undefined,
+): void {
+  hostedBackend = create === undefined ? undefined : { configTarget, create };
+}
+
+/**
+ * The backend `configTarget`'s own server hosts, created on the first call;
+ * `undefined` when none was set for this config target, or when its factory
+ * threw (logged once; not called again until a new factory is set).
+ */
+export function resolveStarterHostedNotificationBackend(configTarget: string): NotificationRuntimeBackend | undefined {
+  if (hostedBackend === undefined || hostedBackend.configTarget !== configTarget) {
+    return undefined;
+  }
+  if (hostedBackend.failed === true) {
+    return undefined;
+  }
+  try {
+    hostedBackend.created ??= hostedBackend.create();
+  } catch (error) {
+    // A backend that cannot be created turns notifications off, never the game.
+    hostedBackend.failed = true;
+    console.error('[notifications] the hosted notifications backend could not be created.', error);
+    return undefined;
+  }
+  return hostedBackend.created;
+}
+
+export interface StarterHostedNotificationInput {
+  readonly backend: NotificationRuntimeBackend | undefined;
+  /** This target's topics, each with its mapping. */
+  readonly topics: readonly NotificationTopicDeclaration[];
+  readonly defaultLocale: string;
+  /** Logs a message, once per gateway and message. */
+  readonly log: (message: string, error?: unknown) => void;
+}
+
+/**
+ * The notifications runtime over a backend the target's own server hosts
+ * (Reddit: the Devvit server's notifications service), when the target
+ * exposes a notifications provider and its gateway builder set the backend.
+ * Otherwise `undefined`.
+ *
+ * The runtime keeps its registration state in the platform storage and
+ * starts here. It learns the player from the backend, which reads the
+ * session the server answers, so the settings screen shows the reminder
+ * switches once a logged-in Reddit user is known; a logged-out viewer is
+ * asked to log in first. It runs without a registry entry comparison: the
+ * provider and the server's service come from the same adapter and
+ * deployment, and the entry lives in server code the webview does not load.
+ */
+export function createStarterHostedNotificationBackend(
+  platform: TargetConfiguredGateway,
+  input: StarterHostedNotificationInput,
+): StarterNotificationBackend | undefined {
+  const provider = platform.notificationsV2;
+  const { backend } = input;
+  if (provider === undefined || backend === undefined) {
+    return undefined;
+  }
+  try {
+    const runtime = createNotificationRuntime({
+      provider,
+      backend,
+      catalog: input.topics,
+      defaultLocale: input.defaultLocale,
+      storage: createNotificationRuntimeStorage({ storage: platform.storage }),
+      onError(error) {
+        console.error('[notifications]', error);
+      },
+    });
+    runtime.start().catch((error: unknown) => {
+      console.error('[notifications] the runtime could not start.', error);
+    });
+    return { runtime, listConsent: () => backend.listConsent() };
+  } catch (error) {
+    // A configuration the runtime refuses turns notifications off, never the game.
+    input.log('[notifications] the notifications backend could not be created.', error);
+    return undefined;
+  }
+}
+
 /**
  * Whether the game-services URL may carry the session's credentials: any
  * absolute http(s) URL outside production builds, and in production the

package/templates/notifications-overlay/common/src/platform/notifications.ts

@@ -4,9 +4,12 @@ import type { TargetConfiguredGateway } from '@mpgd/target-config';
 
 import notificationTopicsJson from '../../notifications/topics.json';
 import {
+  createStarterHostedNotificationBackend,
   createStarterWorkerNotificationBackend,
+  resolveStarterHostedNotificationBackend,
   type StarterNotificationBackend,
 } from './notificationBackend';
+import { onStarterAccountDeleted } from './deleteAccount';
 import { resolveStarterServerSession } from './serverSession';
 import { routeNotificationOpens, type NotificationOpenRoutes } from './notificationOpens';
 import {
@@ -23,9 +26,13 @@ import {
  * The starter topics' purposes follow the notifications RFC (open question 1):
  * `daily-ready` and `streak-at-risk` are `requested` reminders the player
  * turns on, `friend-challenge` is `service`, and `events` is the sample
- * `advertising` topic, mapped to iOS only: an Android FCM push cannot carry
- * the opt-out action the Korean rules require yet. A topic whose copy offers a reward, a benefit, or a
- * promotion is advertising: declare it so, never `requested`.
+ * `advertising` topic. On Android an FCM notification cannot carry the
+ * opt-out action the Korean rules require, so the shell renders advertising
+ * pushes itself (`mpgd target init capacitor --providers notifications`
+ * declares the kit's renderer, and `notifications/deployment.json` sets
+ * `shellRendersAdvertising`); the backend sends one only to an installation
+ * whose shell has the renderer. A topic whose copy offers a reward, a
+ * benefit, or a promotion is advertising: declare it so, never `requested`.
  */
 export const starterNotificationCatalog = notificationTopicsJson as NotificationTopicCatalog;
 
@@ -56,7 +63,11 @@ export type { StarterNotificationBackend } from './notificationBackend';
  * reminder, advertising, or night switch, because nothing could record them.
  *
  * Reddit gets no Worker backend: its notifications backend is the Devvit
- * server, which keeps the opt-in, the records, and the sends. The Worker
+ * server, which keeps the opt-in, the records, and the sends. The runtime
+ * there runs over the backend `buildGateways/reddit.ts` sets
+ * (`createDevvitNotificationsBackend`, through
+ * `setStarterHostedNotificationBackend`), which needs no game session: the
+ * Devvit server answers for the logged-in Reddit user. The Worker
  * serves the Android, iOS, and Apps in Toss providers and binds a device to
  * the session its `Authorization` header names, through its
  * `GAME_SERVICES_NOTIFICATIONS_AUTH` binding to your identity service
@@ -68,6 +79,18 @@ export type { StarterNotificationBackend } from './notificationBackend';
 export function createStarterNotificationBackend(
   platform: TargetConfiguredGateway,
 ): StarterNotificationBackend | undefined {
+  // Only a hosted backend set for this config target; other targets keep the Worker path.
+  const hosted = platform.notificationsV2 === undefined
+    ? undefined
+    : resolveStarterHostedNotificationBackend(platform.configTarget);
+  if (hosted !== undefined) {
+    return createStarterHostedNotificationBackend(platform, {
+      backend: hosted,
+      topics: starterNotificationTopics(platform.configTarget),
+      defaultLocale: starterNotificationCatalog.defaultLocale,
+      log: (message, error) => warnOnce(platform, message, error),
+    });
+  }
   return createStarterWorkerNotificationBackend(platform, {
     baseUrl: import.meta.env.VITE_MPGD_GAME_SERVICES_URL,
     mode: import.meta.env.MODE,
@@ -111,6 +134,15 @@ function starterNotificationBackend(platform: TargetConfiguredGateway): StarterN
     backend = createStarterNotificationBackend(platform);
     if (backend !== undefined) {
       backends.set(platform, backend);
+      const { runtime } = backend;
+      // After an account deletion the device stops registering for the
+      // deleted player (the server already removed its endpoints), and the
+      // next session gets a fresh runtime.
+      const stop = onStarterAccountDeleted(async () => {
+        stop();
+        backends.delete(platform);
+        await runtime.unregister();
+      });
     }
   }
   return backend;

package/templates/phaser-game/README.md

@@ -507,3 +507,75 @@ credentials: Game Services reports `missing_authoritative_backend` or
 backends require both a non-production authority mode and an explicit
 `allowLocalBackend` opt-in, so they cannot manufacture successful production
 purchase, rewarded-ad, or leaderboard ledger results.
+
+### Guest identity
+
+Store purchases on Android and iOS are bound to the player of a server
+session: Google Play's `obfuscatedAccountId` and StoreKit's `appAccountToken`
+are derived from that player's id (`src/platform/commerceAccountBinding.ts`),
+and the backend checks them before it grants. The native shell's local player
+(`android-local-player` / `ios-local-player`) is the same on every install, so
+it binds nothing: Play refuses with `ACCOUNT_BINDING_REQUIRED` and StoreKit
+throws an error naming the missing session.
+
+Point the game at the kit's reference guest identity Worker
+(`apps/game-identity-worker` in mpgd-kit, deployed per
+`docs/CLOUDFLARE_WORKER_DEPLOY.md`):
+
+```sh
+VITE_MPGD_IDENTITY_URL=https://identity.example.com
+```
+
+`src/platform/guestIdentity.ts` then signs the player in during bootstrap: a
+server-issued guest on the first launch, kept with a rotating refresh token in
+the device's Keychain or Keystore, and the same guest on later launches. The
+server player becomes the game services' `playerId` and the purchases'
+binding, and `setStarterServerSession` sends its access token to the
+game-services Worker, which resolves it through the identity Worker's
+bindings. A session the identity service ended (logout, a replayed refresh
+token, or 180 days without play by default) is replaced by a new guest; without a linked
+account that player's purchases stay with the old one.
+
+Offline at launch, the game starts anyway and keeps trying in the background
+(after 5 s, 15 s, 1 min, then every 5 min, and at once when the device reports
+it is online). A purchase or a Restore Purchases tap signs in first; if that
+still fails, the purchase is refused before any store sheet opens (it
+answers `failed` with the retryable diagnostic `STARTER_SESSION_REQUIRED`,
+which the game action coordinator treats as a plain failure; retry with a
+new idempotency key, as for any failed purchase) and the restore control says it could not
+reach the game server and stays tappable as a retry. The purchase, restore,
+and notification services (`src/platform/sessionGatedServices.ts`) come up
+for the server player as soon as a sign-in succeeds, and run the startup
+purchase recovery then; they are never bound to the platform's local
+placeholder, so no purchase or journal record changes owner. Rewarded ads
+stay off for such a run: an ad watched before the session exists could not
+be claimed. The scenes' `player` and `identitySession` are the boot values
+for the whole run (the platform's player when the boot sign-in failed) and
+the server player from the next launch on: key game-owned save data by
+something that does not change, such as the platform storage itself, not by
+`player.playerId`. A native shell only reaches `https:` origins, so test on a
+device or emulator through an https tunnel to a local Worker. Account linking (Sign in with Apple or Google) is not
+part of the reference Worker yet.
+
+### Restore Purchases
+
+The lobby (Phaser) or a corner button (lite) shows **Restore purchases** on
+targets that sell through a store and have a Game Services client. It calls
+`monetizationRecovery.restorePurchases()` (`src/platform/restorePurchases.ts`):
+the store resynchronizes (StoreKit `AppStore.sync()`; Google Play re-reads owned
+items) and every purchase is verified through the backend ledger before anything
+is granted. App Review expects this control while the catalog sells a
+non-consumable such as `REMOVE_ADS`. On the App Store and Google Play a purchase
+is bound to the server player, so without a server session (see Guest identity)
+the button says to connect to the game server instead of restoring; keep it reachable from the game's own
+store or settings screen when you replace the lobby.
+
+A reinstall on Android, a new device, a second device, a logout, or (by
+default) 180 days away make a new guest, and the store then returns the
+purchase's non-consumables bound to the guest that bought them. The kit's
+reference Worker grants a verified restore of such a non-consumable to the new
+guest as well (restore sharing; earlier devices keep it, up to five guests per
+purchase by default), and the control then says **Restored to this device**;
+past the limit it says the purchase is already in use on the maximum number of
+devices. Consumables are never shared. See "Reinstalls and new devices" in the
+kit's `docs/CLOUDFLARE_WORKER_DEPLOY.md` before selling non-consumables.

package/templates/phaser-game/agent/acceptance.md

@@ -67,7 +67,10 @@ the snapshot bounds for persistent controls.
 ## Server session
 
 Verify the game sets its real server-backed session with `setStarterServerSession`
-before `bootstrap()` (a guest backend through `createGuestServerSession`) and does
+before the game services are created (the starter's `guestIdentity.ts` does it
+with `VITE_MPGD_IDENTITY_URL`, a guest backend through `createGuestServerSession`),
+that a store purchase on Android and iOS carries the server player's binding
+(not `android-local-player` / `ios-local-player`), and that the game does
 not rely on the development fallback, which only a game created with
 `--providers notifications` reads. `VITE_MPGD_DEV_NOTIFICATION_SESSION` is local-only evidence:
 a `pnpm build` never signs in with it (its `mpgd-dev` header needs the Vite dev

package/templates/phaser-game/agent/brief.md

@@ -51,10 +51,20 @@ and reconcile existing operations on startup and resume without opening SDK UI.
 
 ## Server session
 
-Set the game's server-backed session with `setStarterServerSession`
-(`src/platform/serverSession.ts`) before `bootstrap()`; with a guest backend use
-`createGuestServerSession(coordinator)`, whose `sessionId` is the stable
-session-family id. For local notifications work only (a game created with
+With `VITE_MPGD_IDENTITY_URL` set (the kit's reference guest identity Worker,
+`apps/game-identity-worker`), `src/platform/guestIdentity.ts` signs the player
+in as a server-issued guest during bootstrap, before the game services read
+the session: it keeps the refresh token in the device's Keychain or Keystore,
+calls `setStarterServerSession` with `createGuestServerSession(coordinator)`
+(whose `sessionId` is the stable session-family id), and binds StoreKit and
+Google Play purchases to the server player. A failed boot sign-in is retried
+in the background and before each purchase or restore; the purchase,
+restore, and notification services come up when it succeeds
+(`src/platform/sessionGatedServices.ts`). Without it the native shell's
+local player binds no purchase, and StoreKit and Play refuse with the reason.
+A game with its own identity service sets its session with
+`setStarterServerSession` (`src/platform/serverSession.ts`) before the game
+services are created instead. For local notifications work only (a game created with
 `--providers notifications`), `VITE_MPGD_DEV_NOTIFICATION_SESSION` on the Vite
 dev server in the `development` mode signs in with an unauthenticated
 development session (`src/platform/developmentServerSession.ts`)

package/templates/phaser-game/apps/target-devvit/src/server/bridge.ts

@@ -3,7 +3,9 @@ import {
   bridgeStorageLoadProtocol,
   createBridgeError,
   createCommerceV2UnavailableBridgeError,
+  createNotificationsBackendUnavailableBridgeError,
   createNotificationsV2UnavailableBridgeError,
+  isBridgeNotificationsBackendMethod,
   isBridgeNotificationsV2Method,
   type BridgeRequest,
   type BridgeResponse,
@@ -68,6 +70,16 @@ export interface DevvitBridgeNotificationsHandler {
   request(input: BridgeRequest): Promise<BridgeResponse>;
 }
 
+/**
+ * Serves the nine `notifications.backend.*` bridge methods:
+ * `createDevvitNotificationsBackendBridgeHandler` from
+ * `@mpgd/adapter-devvit/server` over the Devvit notifications service, for
+ * the request's logged-in user.
+ */
+export interface DevvitBridgeNotificationsBackendHandler {
+  request(input: BridgeRequest): Promise<BridgeResponse>;
+}
+
 export interface DevvitBridgeHandlerDependencies {
   readonly redis: DevvitBridgeRedisLike;
   /** Authenticated Reddit user ID from the Devvit request context, never from the payload. */
@@ -91,6 +103,14 @@ export interface DevvitBridgeHandlerDependencies {
    * `unavailable`.
    */
   readonly notifications?: DevvitBridgeNotificationsHandler | undefined;
+  /**
+   * The notifications runtime's backend: consent records, the player's
+   * registration, server reminders, and notices, kept by the Devvit
+   * notifications service. Absent, every `notifications.backend.*` method
+   * answers `NOTIFICATIONS_CONFIGURATION_REQUIRED`, and the webview's
+   * runtime runs without a backend.
+   */
+  readonly notificationsBackend?: DevvitBridgeNotificationsBackendHandler | undefined;
   readonly warn?: ((message: string) => void) | undefined;
 }
 
@@ -129,6 +149,23 @@ export function createDevvitBridgeHandler(
         );
       }
     }
+    // The runtime's backend calls, kept apart from the provider methods above.
+    if (isBridgeNotificationsBackendMethod(input.method)) {
+      if (dependencies.notificationsBackend === undefined) {
+        return createNotificationsBackendUnavailableBridgeError(input, 'Devvit server bridge');
+      }
+      try {
+        return await dependencies.notificationsBackend.request(input);
+      } catch (error) {
+        warn(`devvit notifications ${input.method} failed: ${errorMessage(error)}`);
+        return createBridgeError(
+          input.id,
+          'NOTIFICATIONS_TEMPORARILY_UNAVAILABLE',
+          `${input.method} failed on the Devvit server.`,
+          true,
+        );
+      }
+    }
     switch (input.method) {
       case 'runtime.getCapabilities':
         return ok(input, {

package/templates/phaser-game/gitignore

@@ -18,3 +18,14 @@ apps/*/.env
 .DS_Store
 *.log
 *.ait
+# Signing and store credentials stay out of Git (use mise or CI secrets).
+# google-services.json and GoogleService-Info.plist are committed on
+# purpose: Firebase documents them as non-secret, and release builds run from
+# a pinned Git checkout that needs them.
+*.p12
+*.p8
+*.mobileprovision
+*.provisionprofile
+*.keystore
+*.jks
+*.pepk

package/templates/phaser-game/legal/delete-account.html

@@ -0,0 +1,133 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Delete Your __GAME_TITLE__ Account</title>
+    <style>
+      :root {
+        color-scheme: light dark;
+        font-family:
+          Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+        line-height: 1.6;
+      }
+
+      body {
+        margin: 0;
+        background: Canvas;
+        color: CanvasText;
+      }
+
+      main {
+        box-sizing: border-box;
+        margin: 0 auto;
+        max-width: 760px;
+        padding: 48px 24px;
+      }
+
+      h1,
+      h2 {
+        line-height: 1.2;
+      }
+
+      a {
+        color: LinkText;
+      }
+
+      nav {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 16px;
+        margin: 0 0 32px;
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <nav aria-label="Legal pages">
+        <a href="/privacy/">Privacy</a>
+        <a href="/support/">Support</a>
+        <a href="/terms/">Terms</a>
+        <a href="/delete-account/" aria-current="page">Delete account</a>
+      </nav>
+      <!--
+        Google Play: enter this page's URL (https://<your legal site>/delete-account/)
+        in Play Console > App content > Data safety > "Delete account URL".
+        The page must name the app as the store listing does, let players
+        request deletion without reinstalling the game, and say what is
+        deleted and what is kept and for how long. Starting point, not legal
+        advice: replace every REPLACE marker in square brackets (mpgd legal
+        build and check warn while any remain).
+      -->
+      <h1>Delete Your __GAME_TITLE__ Account</h1>
+      <p>
+        This page explains how to delete your __GAME_TITLE__ account and the
+        data linked to it. __GAME_TITLE__ is published by [REPLACE: developer
+        name exactly as shown on the store listing].
+      </p>
+      <h2>In the Game</h2>
+      <ol>
+        <li>Open __GAME_TITLE__ and go to [REPLACE: menu path, for example the lobby's Delete account button].</li>
+        <li>Tap <strong>Delete account</strong>, read what is deleted, and tap <strong>Delete permanently</strong>.</li>
+        <li>
+          The game deletes your account and signs you out. Anything our server
+          cannot finish at once is completed automatically within
+          [REPLACE: period, for example 24 hours].
+        </li>
+      </ol>
+      <h2>Without the Game</h2>
+      <p>
+        If you no longer have the game installed, you do not need to reinstall
+        it. Send a deletion request to
+        [REPLACE: support email address or request form URL] with the subject
+        "Delete my account" and [REPLACE: what lets you find the account,
+        for example the player ID shown in the game's settings, or the store
+        order number of a purchase made with it]. We delete the account within
+        [REPLACE: period, for example 30 days] and confirm by reply.
+        [REPLACE: what happens to a guest account that has neither, for
+        example "If you cannot give either, we cannot find your account; its
+        data is deleted after N months without play."]
+      </p>
+      <h2>What Is Deleted</h2>
+      <ul>
+        <li>Your player account and every sign-in session on every device.</li>
+        <li>Scores and leaderboard entries.</li>
+        <li>[REPLACE: game progress, if our server stores it; otherwise delete this item.]</li>
+        <li>Rewarded-ad records.</li>
+        <li>Notification tokens, notification settings, and your consent records for advertising messages.</li>
+      </ul>
+      <h2>What We Keep, and for How Long</h2>
+      <ul>
+        <li>
+          <strong>Purchase records</strong> (the product, the store's order or
+          transaction number, and the date) for 5 years from the purchase or its
+          last refund, whichever is later, for payment and supply record
+          obligations [REPLACE: confirm with counsel which apply to you, for
+          example Korea's Act on Consumer Protection in Electronic Commerce].
+          They are kept separately and no longer contain your player ID (the
+          store's own order number still identifies the purchase), and they
+          also stop the same store purchase from being used twice. They are
+          deleted after that period.
+        </li>
+        <li>[REPLACE: anything else the game keeps, such as support messages, with the period.]</li>
+      </ul>
+      <h2>Purchases</h2>
+      <p>
+        Deleting your account does not refund purchases. Items you buy once
+        (such as removing ads) stay owned by your Google Play or Apple
+        account: if you play again, Restore purchases gives them to your new
+        game account as a new record, and the deleted account is never
+        restored. Consumable items (such as coins) are not restored. To ask
+        for a refund, contact Google Play or Apple. A purchase still pending when
+        the account is deleted (waiting for a payment or a parent's approval)
+        is never delivered: Google Play refunds it automatically, but an App
+        Store purchase is not refunded automatically; ask Apple for the
+        refund. [REPLACE: subscriptions, if the
+        game sells any: cancel them in the store first, because billing
+        continues through the store.]
+      </p>
+      <h2>Contact</h2>
+      <p>[REPLACE: support email or form, and the data protection contact if required.]</p>
+    </main>
+  </body>
+</html>