Privacy Policy — Driftile

Effective date: 2026-08-18
Last updated: 2026-09-27
Published at: https://driftile.com/privacy/
Applies to: the Android application com.bakerly.driftile distributed on Google Play, and the iOS application of the same name distributed on the App Store.

This policy is written by Omar Diar Bakerly (trading as Bakerly Apps) ("we", "us"), Herwarthstraße 63, 47137 Duisburg, Germany.

Feature status

Some sections of this policy describe features that may not be switched on in the version of the app you have installed. Each section below is marked. A section marked NOT ACTIVE describes nothing that is happening today.

Changed on 20 August 2026. Accounts, profiles, friends and notifications were previously marked not active in the Android app and were live only in the browser version. They are now active in both, and this table was updated the same day the Android build carrying them was submitted.

Changed on 7 September 2026 — the browser version is gone. The game used to run at driftile.com/play and this document said so in five places. It does not any more: that page serves no game, only links to the two stores, and every sentence here that offered a browser as an alternative has been corrected rather than softened. iOS took its place in the line above, because the app ships on both stores.

Worth stating plainly, because a privacy policy is read for what it permits: retiring the browser version removes a way to play, not a way for us to collect. Nothing new is gathered and nothing that was gathered has changed hands.

Changed on 27 August 2026, and the two rows changed in opposite directions. Section 3.10 describes something the app has done since migration 0116 and this document did not mention: Quick Play tells the server which boards you were dealt and which you beat. Section 3.11 is the reverse — a mode that does not exist, written now so that building it later is a row in the table above rather than a rewrite of this document, and so that no sentence elsewhere in it has to be walked back on the day it ships.

Changed on 27 August 2026, later the same day. Section 3.12 is new, and unlike 3.10 it describes something that did not exist before today: More → Help → Send feedback. The intake was built on the server two weeks earlier and nothing in the app could reach it; the form is what makes it real, and this section had to land in the same commit as the form rather than after it.

1. The short version

You can play the whole game without signing in. The campaign, the builder, Curiosities and the solver all run on your device, offline, and none of them needs an email address or a password.

Playing without signing in is not the same as us holding nothing. The game creates a player account for you automatically the first time it reaches the internet — see the paragraph on friends below and section 3.7 — and a set of figures about how you have played is kept against it from your first game. Your name and your email address are not part of that, because we have never been told them. What is, and what leaves your device without an account, is listed in section 3.

If you choose to sign in, that changes, and it is worth reading section 3.5. An account exists so your game follows you to another phone, and making that work means keeping a copy of it on our server: your email address, and the progress the app would otherwise hold only on your device — every level you have solved, your best moves, your stars and streaks, your play statistics, the hints and jokers you own, the levels you have built (including the ones you never published), and your settings.

Publishing a level to Community is public. The board and the nickname on your profile are shown to everyone who browses it.

The journey leaderboard is public too. Every player can see your nickname — a random Guest name until you choose one — your picture and how far along the journey you are. One switch in Settings → Privacy shows you there as "Player" to everybody but your friends instead. Section 3.14.

You can delete all of it from inside the app — Settings → Delete account — and uninstalling removes what is on the phone.

We do not sell personal data. We have never sold personal data. There is no analytics SDK in the app — the collector described in section 5 is our own. The game does show advertising through Google AdMob: rewarded video you choose to watch, and occasional full-screen ads between levels. Section 7 is what that means and what AdMob receives.

Friends, and which version has them. Driftile has a friends feature: adding people you know, comparing progress with them, and playing the same puzzles against each other. That needs an identity for every player, so the app creates a player account for you automatically, with no sign-up and no email, and keeps a copy of your progress on our server from the first time you play rather than only after you sign in.

This is switched on in every version — the Android and iOS apps alike — since 20 August 2026. It was true of the browser version too, until that was retired on 7 September 2026. Sections 3.7 and 3.8 describe exactly what it means, and they apply to you. An earlier version of this paragraph said the feature was switched off in the Android app; that stopped being true on the date above and this sentence was corrected on 6 September 2026.

2. What the app stores on your device

All of the following is written to your device's local storage by the app.

This table is what is stored on the phone. It is not a promise that none of it leaves. An earlier version of this section said that if you were not signed in everything here stayed on the device and was not transmitted to us. That was wrong, and it was the most misleading sentence in this document; it was corrected on 6 September 2026. What actually leaves the device without an account is your daily puzzle result, which Quick Play boards you were dealt and beat, a rating or report or result on a Community level, and the figures held against the player account in section 3.7 — each of which has its own subsection in section 3, and none of which carries your name or email because we have not been told them.

If you are signed in, most of this table is also copied to your account on our server, because that is what cloud save is — the point of an account is that this data survives losing the phone. Section 3.5 lists exactly which of these rows travel and which never do.

Three of these are ids we make up: the guest id, the community key and the daily solver code. They are random, they are not derived from anything about you or your phone, and none is ever shown to another player.

• The guest id never leaves the device.
• The community key leaves it only as a hash — that hash is what lets you take down a level you published from the device you published it on, and what your ratings and Quick Play record count under.
• The daily solver code is sent with a daily result, and unlike the other two it is sent as the value rather than a hash: our server mixes it with a secret and with the date before storing anything, so what is kept cannot be read back into the code your phone holds. Section 3.0 is why it exists — so that two phones behind one router count as two people.

Nothing in this table is your name or your email address, and without signing in we have never been told either. What we do have without them is the pseudonymous player account in section 3.7: an identifier our server generates, which the figures listed there are held against. It is not a username, it is never shown to you, and it identifies you to nobody — but it is an id we assign, so the earlier version of this paragraph, which said there was none, was wrong and was corrected on 6 September 2026. Signing in remains optional and the whole game works without it — see 3.5.

The game also holds the last 50 gameplay events (for example "level started") in memory to power an internal debug view. This is never written to storage and is discarded when the app closes.

3. What leaves your device

The campaign, Curiosities and the solver are contained in the app and run offline. These things reach our server, and each has its own subsection below:

Of those, three happen without you asking for them: the daily puzzle, crash reports and the version-and-settings check. A fourth — the player account in 3.7 — is created and kept up to date automatically as well, and it does not require you to sign in. Everything else on the list is something you started.

An earlier version of this paragraph said that only the first three happened without an account. That has not been true since 20 August 2026, and it was corrected on 6 September.

The app requests the Android INTERNET permission and uses it for the above. The features in sections 5, 7 and 8 would also use it if they were switched on.

3.0 The daily puzzle

The daily puzzle is fetched from our server rather than generated on your phone, so opening it makes a request. That request carries nothing about you: it asks for today's board and nothing else.

When you solve it, your result is sent automatically — you are not asked first. What is sent is:

• the date of the puzzle
• the number of moves you used, and the swipes that produced them

We keep the swipes so the server can check that they really do solve that day's board, and so a result can be re-checked later if the checking itself is ever found to be wrong.

If you are signed out, that is all — no name, no account, no device identifier, and nothing that links one day's result to another's.

There is also a second record, written against your player account. It carries the date, your move count and your swipes; it is written only when you finish the day's board; it is linkable from one day to the next, deliberately, because a streak is the whole point of it; and deleting your data removes it. The anonymous record above is unaffected and still counts you exactly once.

What it is for, stated accurately. It exists so that a board comparing your result with your friends' can be shown. That board is currently switched off — it was built and then taken out of the app on 20 August 2026, on the judgement that showing the social side before anybody has friends is backwards. The record is still written, so that the board has a history to show rather than starting empty on the day it returns.

We would rather tell you that than describe a purpose the app is not currently serving. If the board does not return, this record stops being written; either way it is removed when you delete your account, and nothing else reads it.

If you are signed in, the result is recorded against your account for as long as the row stays attributable, currently seven days, so that deleting your account can take it with it. This is a deliberate trade: it was previously tied to a code derived from your network address instead, which made everyone in one household, office or school count as a single player — the second person to solve was folded into the first and never appeared.

For signed-out results, our server derives a short code from your IP address and a random code your device generated, mixed with a secret and with the date. It exists for one purpose: so that one person counts once in "how many people solved today's puzzle", however many times they play it.

The device part was added because the address alone is not one person. Two phones in a house share an address, and on a mobile network a great many strangers share one — so without it, everybody behind a single connection was counted as a single player and the number was quietly too low. The random code identifies nothing and unlocks nothing; it exists so that two phones are two.

Because the date is part of it, the code is different every day and two days of results cannot be connected to each other. What is stored is the mixed result, never the address it came from, and it is replaced with random data on a daily schedule — the same nightly purge that clears the account link above.

Your IP address is also used, in the same hashed and peppered form, to rate-limit abuse of the server. It is never stored raw and we cannot recover it.

This is the figure shown on the daily screen — how many people solved today — and it is the only reason any of it is collected. Nothing in it ranks you against anybody — a count is a count, and the code that produces it cannot be read backwards into a person.

Where the game does compare one player with another it says so in that feature's own section, and there are three: the shared daily board among friends, in 3.8; the journey leaderboard, in 3.14; and — if it is ever built — the rating in 3.11. This paragraph used to end with the sentence "there is no leaderboard, no ranking, and no comparison between players", which was true of the daily count and read as a promise about the whole game.

If you are offline, the daily puzzle cannot be fetched and nothing is sent.

3.1 The Share button

If you tap Share on a daily puzzle result, the app hands a short block of text to your device's system share sheet or clipboard:

Driftile #223
🟥🟥⬜🟦
🟥⬛⬜🟦
⬜⬜🟨🟦
6 moves — optimal

That is the entire contents. Where it goes next is decided by you — whichever app you pick receives it, and that app's own privacy policy applies from that point. We never see it and we do not log that you shared.

3.2 Android backup

Android may include the app's saved data in the automatic backup it makes to your own Google Drive, under your own Google account. This is a Google operating-system feature, not something we operate. We have no access to those backups and cannot read them.

You control this under Settings → Google → Backup on your device. Turning Android backup off stops it.

3.3 Level share codes

A level you build can be turned into a short code (42 characters for the largest board) that describes the puzzle itself — board size, where the pieces start, where the walls are. It contains nothing about you: not your name, not your device, not when you made it. The code is handed to your device's share sheet or clipboard only when you tap Share code, and where it goes next is your decision. We never see it.

3.4 Google Play itself

When you install or update from Google Play, Google records that installation against your Google account and may collect crash and performance data through the Play Store and Android itself. That is Google's processing under Google's Privacy Policy, not ours, and it happens for every app on the store. We receive only aggregated, anonymous statistics from Google Play Console — installation counts, country totals, crash-rate summaries and similar — which cannot be traced back to an individual by us.

3.5 Signing in and cloud save

You can play everything — the campaign, the daily puzzle, Curiosities, the builder — without an account. Signing in is entirely optional and exists for one reason: so your progress follows you to another device.

If you do sign in, you give us an email address. We send it to Supabase, our server provider, who mails you a sign-in code through Resend, our mail provider. We hold the address so we can recognise you next time, and it is not used for anything else — no newsletters, no marketing, and it is never sold or shared.

You may also sign in with Google, in which case Google tells us the email address on the account you pick, and nothing else.

What cloud save copies to our server. From the moment you are signed in, the app keeps your account in step with your device. What is held there is:

• every level you have completed, your best move count for each, your stars, how many times you played it, and whether you solved it without an undo or a hint
• the highest level you have unlocked and the one you last played, including the half-finished position on the board if you left mid-level
• your daily streak, your longest streak and your daily results — for each date you played, your move count, the puzzle's optimal count, and the sequence of swipes that solved it
• your lifetime statistics — total moves, undos, restarts, hints used, levels skipped, dead ends reached and time spent playing
• which of the in-game awards you have earned, and which of their rewards you have already collected
• which of this week's daily goals you have met and what you have collected from the weekly chest
• how many hints and jokers you own, and how many you have ever earned and spent
• the free daily hints you have left and when they last refilled
• the name you chose to appear under on leaderboards and beside published levels
• what you have bought, so a purchase is not lost with the phone
• your settings: appearance, board style, tile material and sound
• every level you have built, including drafts you have never published, and every community level you have played, with your best move count on it
• which twist explanation cards you have been shown, and which store offers you have already been shown — so a new phone does not repeat either

That last one surprises people, so it is stated plainly: an unpublished draft is still copied to your account. It is not visible to anyone else and it is not published by being synced — it is there so that building a level on one phone and finding it on another works at all. Deleting the level deletes it from the account too.

What is never sent. Nothing about the device itself — no advertising ID, no phone model, no network operator, no contacts, no location. Nor your cached friends list: that is other people's data, it is read from the server every time the list opens, and the copy kept on your device exists only so the list still works with no connection.

Your nickname is sent when you publish a level or rate one, and — where the friends feature is switched on — with your profile, which the app keeps up to date so the people you have added see current figures rather than stale ones. Section 3.7 lists everything that profile contains.

Two people, one phone. If somebody else signs in on your device, the game clears the previous player's data from the phone first rather than merging the two accounts together. Their game stays safe on their own account.

Legal basis (EEA/UK): performance of a contract you asked for (Art. 6(1)(b) GDPR) — you cannot have progress that follows you between devices without something to recognise you by.

Deleting it: Settings → Delete account. This removes the account, the email address, the cloud save and everything listed above. It also takes down any levels you published, because after the account is gone there is nothing left to prove they were yours, and it detaches your daily results. The copy on the phone in your hand goes too — progress, settings and the levels you built are cleared and the app restarts with a new, empty account. Until 5 September 2026 the device was deliberately left alone; for anyone who had never signed in that made the button do nothing they could see, because for them the copy on the device is the account. https://driftile.com/delete-account/ lists the few things on the phone that outlast it and why.

You can also request deletion without installing the app — see section 11.

3.6 Community levels

Publishing a level sends it to our server so other players can find it. What is sent is the level itself — board size, piece positions, walls — along with the title you gave it and the nickname on your profile, which is shown to everyone who sees the level. Choose a nickname you are comfortable being public; it does not have to be your name, and the game does not ask for your name anywhere.

Rating or reporting a level sends the level's id, your rating or the reason you picked, and a code identifying you. That code exists so that one person counts once — it stops the same person rating a level fifty times. If you are signed in it is derived from your account; if you are not, it is derived from the random per-device Community key in section 2. Either way what the server stores is a hash of it and never the value.

Deleting your account removes your ratings and your reports, and the affected levels' averages are recalculated without your vote. Clearing the app's data resets the device code instead, which leaves the old rows in place rather than deleting them — so the reliable route is Settings → Delete account.

Corrected on 6 September 2026. This paragraph previously said the code was "tied to no account and to nothing else about you" and offered clearing the app's data as the only remedy. Both were wrong: the code is account-derived when you are signed in, and deletion has reached ratings and reports since migration 0166. The published data-deletion page had it right and this section did not.

Blocking a player. A level's flag also offers Block this player. Doing so sends us the anonymous publisher code shown on that level — the same code that makes a name on a card tappable — together with your own random code or your account. We keep that pair so the block can be applied on our side: nothing by that publisher is sent to your device again, including anything they publish later. It is one-way and silent — the person you blocked is not told, and nothing about what they see changes. You can see who you have blocked, and undo it, under Settings → Blocked players. Blocking works without an account; if you are signed in, the block belongs to your account and follows you to another device.

Playing a level from Community also tells the server that it was played, so the play count is right. That request says which level, and the same random code as above — because the count is meant to be people, and a server that cannot tell two visits apart counts the same person twice. One person adds at most one to a level's count every two days, and a level's own author never adds to it at all. If you are signed in, your account is what the server recognises instead of the code. What other players see is the number by itself; the count never shows who is in it.

Drafts are not published. A level only becomes visible to other players when you tap Publish. If you are signed in, drafts are still copied to your account as part of cloud save (section 3.5) — that is a private backup, not a listing.

Taking it back down: a published level's ⋯ menu has Take down. Deleting the level from your device takes it down too.

3.7 Your player account

ACTIVE, in the Android and iOS apps alike. This was written before either had it, so that it was in the policy ahead of the feature rather than behind it; since 20 August 2026 it describes both.

What it is. The app will create an account for you the first time it can reach the internet. There is no sign-up screen, no email, no password and nothing to agree to, because there is nothing for you to decide: it is an identifier our server generates, and it exists so that features involving other people are possible at all.

Why every player and not only the ones who want friends. Because the alternative is three different kinds of player — one whose game is entirely on their phone, one who has an identity because they added a friend, one who signed in — and a game that has to behave differently for each is a game that will eventually behave wrongly for one of them.

What is held against it. A short list of figures, and nothing else:

• your nickname, your picture and your frame
• your friend code, which is public by design and is how people add you
• levels solved, stars, chapters finished, perfect chapters, awards
• your longest streak, your current streak, and how many daily puzzles you have solved
• which days your game reached our server, and for each of them: the platform and app version, and your running totals that day — levels solved, time played, hints and jokers spent, dead ends reached and puzzles solved. One line per day. Only the levels-solved figure is ever shown to another player, and only on the journey leaderboard (section 3.14); the rest belongs with the play figures below and is shown to nobody
• your rating and your best rating (conditional) — only if ranked play is built, and section 3.11 is what it would mean
• who may see the above — section 3.8
• and, kept separately and shown to nobody, the play figures described below

Added on 27 September 2026. The line about days has been true since 20 August 2026 (which days), 27 August (the platform, app version and level count on each) and 27 August again (the running play totals), and this list did not say so. It is how we count how many people played on a given day and whether they came back, and it is shown to nobody. Once the journey leaderboard ships (section 3.14), its levels-solved figure is also what that board's This week tab counts from — the one way any of it is ever shown.

Your built levels, your drafts, your purchases and your settings are not part of it — those are the cloud save described in section 3.5, they require signing in, and they cannot exist for an account that has no email address attached to it.

And a second, separate set of figures that is not part of the profile above: how you have played. Total moves, undos, restarts, hints used, hints earned and spent, jokers earned and spent, your current hint and joker balance, dead ends reached, time spent playing, how far over the optimum you have finished, and how many daily puzzles you have solved. These are sent from your device on launch and merged into a running total.

They are never shown to another player, and that is deliberate rather than incidental. They describe how you play rather than how far you have come, and two of them count the things the shop sells — so they are kept in a separate table that the profile your friends see cannot read from, and section 3.8 says so again from the other side. We use them to find out whether the game is too hard, whether hints are priced sensibly, and whether a change made things better or worse.

This applies whether or not you have signed in, because the figures are held against the player account described here rather than against an email address. They go when you delete your account.

Corrected on 6 September 2026. This paragraph previously said the opposite — "Never sent, and there are no columns on our server that could hold them: hints used, jokers used, and your total moves." That was wrong from the day the figures started being collected. The design decision it was describing is real and is unchanged: these numbers stay off your public profile. Keeping them off the profile is not the same as not collecting them, and this document should never have said it was.

What it is not.

• It is not a login. You are never asked for anything and never see it.
• It contains no email address and nothing you typed, other than a nickname if you set one.
• It is not linked to any advertising identifier, and it is not used to build a profile of you for advertising. See section 7.
• It cannot be recovered on its own. It lives on this phone; if you lose the phone, that account is gone. Signing in with an email address is what makes your progress recoverable, and that is the only thing signing in is for once this ships.

What signing in changes. The first time you sign in, your account id is stamped onto this player record, permanently joining the two. That is what makes Delete account able to reach it, and it is why deleting your account removes this as well. We also store a second value derived from your account id, so that levels you played or rated while signed in and while signed out can be recognised as the same person — which is what lets a friend's best time on a level appear beside it, and what lets deletion find all of it.

Deleting it. Settings → Delete account works whether or not you ever signed in. It removes the account, everything held against it, and any levels you published. Uninstalling removes the copy on your phone but not the copy on our server, so if you want both gone, delete the account first — the same sentence that applies to a signed-in account today.

Offline. The game still plays with no connection. The account is created the first time the app reaches our server and the game does not wait for it.

3.8 Your profile, and friends

ACTIVE, in the Android and iOS apps alike. It was written before either had it, so that it was in the policy ahead of the feature rather than behind it; since 20 August 2026 it describes both.

Your profile. A page carrying your nickname, your picture and frame, and a set of figures about how you have played:

• levels solved, stars earned, chapters finished, perfect chapters
• awards collected
• your longest streak, and how many daily puzzles you have solved

Levels you have published are a separate, public page, and the setting below does not cover them. A published level carries your nickname and picture by design — that is what publishing is — and anybody browsing Community can open the publisher page behind it to see that person's levels, how often they have been played and how they were rated. The way to withdraw a level from that page is to take it down, from the level's own menu; see section 3.6.

What is never on it, for anybody. How many hints you used, how many jokers you used, and your total move count. Those describe how you play rather than how far you have come, and two of them are things the shop sells.

Your current streak is shown to friends only, never publicly. It is the one figure that can go down, and a number that can be lost in front of strangers is a different thing from one seen by people you chose.

Who can see it. A setting in the app, with three choices: just you, your friends, or everyone. **The default is *your friends***, so your profile is not visible to a stranger unless you choose it — the journey leaderboard, below, is the exception. You can change it at any time, and changing it to "just you" hides your name, your picture and every figure above from that moment — on your profile page, in your friends' lists, on the shared daily board, beside levels you have played, and on the journey leaderboard. Your friends stay your friends; they simply stop seeing the numbers.

The journey leaderboard is the one place a stranger can see you without your publishing a level or choosing "everyone": every player can see your nickname, your picture and how far along the journey you are, whether your setting is "your friends" or "everyone". Settings → Privacy → Show my name on the leaderboard turns that off, and you appear there as "Player" to everybody but your friends; "just you" keeps you off it entirely. Nothing else on this page changes, and your profile itself stays where your setting puts it. Section 3.14 is the whole of it.

One exception, stated rather than buried: in a round you have joined, the other players see your name and picture if your setting is "everyone", or if they are your friends and your setting is "your friends". Anybody else in the round — and anybody at all if you are set to "just you" — sees a placeholder instead.

Corrected on 27 September 2026. This said the other players see the name and picture "you chose everyone or friends for", which read as though a stranger in a round sees a "your friends" player's name. They do not: the server shows it only to actual friends (room_state through private.player_visible). A round is entered by

typing a code somebody read out, so the people in it are not necessarily people you have added.

Another exception, if ranked play is ever built. A rating leaderboard is a public list by definition, and the wrong way to ship one is to decide that a new mode overrides the setting above. So the rule is stated here in advance: the setting is not overridden — the mode asks. (The journey leaderboard in section 3.14 is different, and says why: it shows a nickname, which starts as a random name, and a count of levels.) Your first ranked puzzle asks you once whether to appear on the board, the answer is remembered and changeable, and saying no does not cost you the mode. Your rating still counts, you still see it, your friends still see it if your setting lets them, and your row on the public board is a rating with no name and no picture beside it. Section 3.11 is the rest of it.

Friends. You have a friend code: eight characters, generated once, and yours for as long as the account exists. It is shown on your own Friends screen and it is meant to be shared — post it, read it out, send it to somebody. It identifies you to people who already have it and it authorises nothing: holding your code lets somebody ask to be your friend, and nothing else.

Somebody enters your code, sends you a request, and you accept or decline. Nothing is shared with them until you accept. Declining is permanent — that person cannot send you another request — and you can remove a friend at any time from their profile.

There is no search and no directory. Your code is matched exactly or not at all; nobody can find you by typing your name, and the only list of players is the journey leaderboard (section 3.14), from the version that carries it, where a stranger's row opens nothing but a way to report or block them. Nothing else exists to be browsed. A code that matches nobody and a code that is malformed give the same answer, so the feature cannot be used to work out which codes exist.

Your friends list — who you have added — is held on our server, because both sides have to see it. It is not shown to anyone but the two of you and it is never sold, shared or used for advertising.

Requests are kept while they are outstanding, and a declined one is kept as the record of that refusal — that is what stops the same person asking again. Both go when you delete your data.

The older one-time invite codes still exist alongside this: which code you issued, when, and who used it. They stop working after a fortnight or once used, whichever is first, and they are deleted when you remove that friend, when you delete your data, or within thirty days of expiring.

Playing together. When you play a round with friends, everyone plays the same puzzles and the results are compared. Your swipes are sent so the server can check the result is real, and then discarded — what is kept is which board, how many moves, and when. It carries your nickname because a scoreboard without names is not a scoreboard.

The shared daily is the one place your swipes are kept rather than checked and dropped, so a result can be re-checked later if the checking itself is ever found to be wrong. That record is described in section 3.0.

Leaving. You can remove a friend at any time, which removes the connection for both of you. Deleting your account removes your profile, your friends list and your results from any rounds you played.

3.9 The version and settings check

Every time the app opens, it asks our server two things: whether a newer version has been published, and what settings the game should run on — how long you have to be stuck before it offers you a free hint, how often adverts may appear, and so on. It is one request and every player gets the same answer.

The request says nothing about you. It carries no account, no nickname, no device id and no progress; there is nothing in it to say who is asking. As with any request over the internet, our server sees the address it came from and the time it arrived, and keeps that in its logs. We do not use it to work out where you are — see section 5.

It happens in kids mode as well, and that is deliberate: it is how a child's phone finds out that an update is available, including one that fixes something important. Nothing about the child, or about the session, is sent.

Before 26 August 2026 this was a request for a file on a different host. Moving it to our own server means one fewer company sees that your device opened the app.

3.10 Quick Play

ACTIVE. Quick Play is the door on Home that deals you a board straight away at one of four difficulties. The boards are held on our server rather than in the app, so opening it makes a request, and that request is not anonymous — it carries a code, and it is the only part of Quick Play that says anything about you.

What is sent, and why there is a code at all. Two calls:

• Opening a difficulty asks for the next batch of boards. It sends the difficulty, how many boards it wants, and the code below. The server marks those boards as dealt to you.
• Beating a board tells the server which board it was, with the same code. That is the whole message: not your moves, not your swipes, not how long you took, and no score.

The reason is only this: so a board you have already solved is not dealt to you again. Your device already knows what you solved and already refuses to repeat one — the phone is where that rule is enforced — but a phone cannot follow a person. Reinstall the app, or open the game on a second device, and without this record the difficulty starts dealing boards you finished last week.

The code. If you are signed in it is derived from your account. If you are not, it is derived from the random per-device Community key in section 2 — the same code that already stops one device rating a level fifty times. Either way what the server stores is a hash of it and never the value itself, and it is not shown to another player. A device with no code is not an error: the server simply cannot remember anything about it, and the game plays exactly the same.

Nothing in Quick Play is ranked, scored, published or compared with anybody else. Your results are on your phone (and in your cloud save, if you signed in), and there is no Quick Play leaderboard. Offline, Quick Play still deals from what the app already has and sends nothing.

Added to this policy on 27 August 2026. The behaviour is older than the paragraph — it shipped with migration 0116 — and this document did not describe it. Nothing about it changed when the description was added.

3.11 Ranked puzzles, and the rating leaderboard

NOT ACTIVE. Nothing in this section is happening in any version of the game today: there is no ranked mode, no rating, and no rating leaderboard. It is written in advance, like sections 3.7 and 3.8 were, so that building it is a change to the table at the top of this document rather than a rewrite of the document — and so that no sentence elsewhere in it has to be walked back on the day it ships.

What it would be. A mode where solving a puzzle moves a single number up or down, the way a chess puzzle rating does: solve something harder than your rating and it rises, fail something easier and it falls. A leaderboard would show who is highest.

What would be sent, when you play a ranked puzzle:

• which puzzle it was, and when
• the moves you made, and the swipes that produced them
• whether you solved it, and how long you took
• the rating before and the rating after

The swipes are there for one reason, and it is the same reason the daily keeps them: a rating is worth cheating for, and the only honest way to award one is for the server to replay the moves and check they really solve that board. A rating handed out on the app's word would be a rating anybody could type.

What would be held against your player account — section 3.7 lists it as a conditional row: your rating, your best rating, and how many ranked puzzles you have played. Not how many hints you used, and not your total moves — those two are excluded from your profile today (section 3.8) because they describe how you play and because the shop sells one of them, and ranked play does not become the reason to start collecting them. Ranked puzzles would not offer hints at all, which is what keeps that true.

Who would see your name. A leaderboard is a public list, so this is the part worth settling in advance rather than at build time:

• The visibility setting in section 3.8 is not overridden. Ranked play would not get to publish a name that was set to "friends". The journey leaderboard in section 3.14 is the one board that shows nicknames without asking, and says why.
• You would be asked once, the first time you play a ranked puzzle, whether to appear on the board by name. The answer is remembered and can be changed at any time.
• Saying no would not cost you the mode. Your rating counts, you see it, your friends see it if your setting lets them, and your row on the public board is a rating with no name and no picture beside it.
• Your rating would never be shown beside a level you published, or anywhere else your nickname already appears, unless you had said yes.

Cheating, and what we would do about it. Replaying the moves catches a score that was not played. It does not catch a player who solves with a solver in the other hand, so a rating may be voided or reset, and an account removed from the board, where the evidence says it was not earned by playing. That is a processing purpose in its own right — preventing fraud in a competitive feature — and it is why a ranked attempt's swipes are kept for a period (section 10) rather than checked and dropped the way a friendly round's are.

Deleting it. Settings → Delete account would remove your rating, your attempts and your row on the board, as it removes everything else held against your player account.

Kids mode would not have it, along with ads, sign-in, community levels and friends — see section 9.

Legal basis (EEA/UK): performance of a contract you asked for (Art. 6(1)(b) GDPR) for the rating itself, which cannot exist without a record of your attempts; our legitimate interest in a competitive feature that is not overrun by cheats (Art. 6(1)(f)) for the verification and the checks above. Appearing on the public board by name is consent, asked separately, refusable, and withdrawable at any time.

3.12 Sending us feedback

ACTIVE, and only when you write something and press Send. More → Help → Send feedback.

What is sent. Six things, and this is the complete list:

• What you typed. Up to 1,000 characters, exactly as you wrote them.
• Which of the four buttons you chose — something is broken, an idea, a level, or something else.
• The version of the app, which build it is (Android or iOS) and the language the app is set to. The screen tells you it is attaching these, under the Send button, before you send anything.
• The same player code described in section 3.7. What is stored is a hash of it, never the value, and it is not shown to anybody. It is there so that several messages from one person can be seen to be from one person, and so that the limit below can be applied at all.
• How many levels you have solved, read off your player account. It is one number and it is there for triage: "the game is too hard" means something different from somebody on level 4 and somebody on level 400.
• A level code, if you are writing about a specific level — the board itself, so we can open the thing you are describing. Only attached when you started the message from a level.

Corrected on 6 September 2026. This list said "four things" and named the first four. The two above were being sent as well. Neither is sensitive — a level count already shown to your friends, and a board — but a list that calls itself complete has to be.

What is not sent, and what you should not type. There is no field for your name, your email address, or any other way to reach you, and there is not going to be one. We cannot write back — this is a one-way box, deliberately — so the screen asks you, at the top and before you start, to leave your email address, your name and anything else personal out of the message. Please do. Nothing can tell what you have typed until a person reads it, so a message is only as private as what you chose to put in it.

Who reads it. A person here, and nobody else. It is not published, not shown to other players, not used to advertise to you, and not passed to anyone outside Omar Diar Bakerly (trading as Bakerly Apps). It is read, given a status — new, read, actioned or dismissed — and used to decide what to fix and what to build next.

Automatic checks. Your message goes through the same word filter as the rest of the game. It only marks a message for attention; it never refuses one, and nothing you write is rejected or silently dropped because of it.

How often. Four messages an hour. Beyond that the screen asks you to try again in a little while, so that one device cannot fill the inbox.

Deleting it. Settings → Delete account removes your feedback along with everything else held against your player account. Because there is no contact field and no reply channel, a message is not connected to you by anything other than that code — which is why deleting the account is the way to withdraw one, and why we cannot look up "your" message for you if you ask about a specific one.

Kids mode does not have it, along with ads, sign-in, community levels and friends — see section 9.

Offline, the message is not queued. The screen says it did not send and keeps what you wrote, so nothing is lost and nothing is sent later without you.

Legal basis (EEA/UK): our legitimate interest in hearing from the people who play the game and in fixing what they tell us is broken (Art. 6(1)(f) GDPR). Sending is entirely your choice, every time, and nothing about the game changes if you never do.

3.13 The daily gift wheel

ACTIVE, and only when you spin it. The wheel is the free daily gift on Home: you watch a video if you choose to, and it pays out something — hints, a joker, a board look on loan, an hour without ads.

The spin is decided on our server rather than on your phone, because a prize decided locally is a prize anybody can pick. So a spin sends the same player code as the rest of this section, and what is stored is the day, which of the day's spins it was, and what it paid out.

Why it is stored at all: so that the three-a-day limit can be applied, and so that a prize already granted is not granted twice by a retried request. It is not shown to another player, there is no wheel leaderboard, and nothing about it is used for advertising.

Nothing on the wheel is a gamble. You are not buying a spin and there is no currency between you and the odds — it is a free gift whose contents vary. The terms say the same thing in their section 11.

Deleting it. Settings → Delete account removes it with everything else held against your player account.

Legal basis (EEA/UK): performance of a feature you asked for by spinning the wheel (Art. 6(1)(b) GDPR).

Added to this policy on 6 September 2026. The wheel is older than the paragraph and this document did not mention it. Nothing about how it works changed when the description was added.

3.14 The journey leaderboard

ACTIVE from version 1.2.0 of the game.

What it is. A board every player can open, ranking players by how far along the journey they are — the number of journey levels they have solved. It shows the players at the top, the few just ahead of you and just behind you, and your own position. Two more tabs use the same figures: This week, which ranks by how many journey levels were solved since Monday 00:00 UTC, so a player who started last month can lead it; and Friends, which is you and the people you have added.

What it shows about you: your nickname, your picture and frame, how many journey levels you have solved, how many of them since Monday, and your position. Nothing else — not your streak, not your stars, not the hints or jokers you used, and nothing from the separate play figures in section 3.7.

Almost nothing new is collected for it. The level count is already part of your player account (section 3.7), and the weekly figure is worked out from the levels-solved column of the per-day record that section describes; none of that record's other columns is read for it. Two things are added to your player account: when your count last went up — so that two players on the same count are ordered by who got there first — and, only if it ever happens, a removal from the board with its reason. What is new is who can see the counts.

Everybody is on it, by nickname. Every player can open the board, and every player is on it except a profile set to just you — under the nickname you chose, or the random Guest name the game gives everybody until they choose one, with your picture and frame. For the default setting, "your friends", this is the first place a stranger can see your nickname and picture without your publishing a level, and we would rather say that plainly than bury it.

How you are told. In this policy, which the store listing and More → Privacy policy link to; beside the nickname field in your profile, which says the name is public on the leaderboard; and, for everybody who had the game before the board existed, by a notice the first time they open version 1.2.0, which says what changed. Until a player has opened that version, their row shows as "Player" to everybody but their friends, with no name and no picture — they are counted, and no stranger can tell who they are.

Changing it. Settings → Privacy → Show my name on the leaderboard turns your name and picture off there at once: you stay on the board as "Player", and your profile and your friends are untouched — your friends still see you by name on the Friends tab, as they do everywhere else. Setting your profile to just you keeps you off every board entirely.

Why it does not ask first. What it shows is a nickname — which starts as a random name, and which the nickname field tells you is public before you change it — a picture from the game's own set, and counts of levels. Nothing on it can be used to reach you, and one switch hides your name from it. That is the balance a leaderboard in almost every game strikes, and it is the one we chose. We weighed it with younger players in mind: the default name is random, a nickname cannot hold contact details, nobody can search for, message or befriend anybody from the board, and kids mode has no board at all.

Nobody can be reached through it. There is no search. A stranger's row opens no profile, no friend request and no message — only a way to report the name or the result, or to block that player. It is the same block as on a friend's page: it ends any friendship, refuses their friend requests and takes them off your board, and Settings → Blocked players undoes it. (Hiding someone's Community levels is a separate block, offered on any of their levels.) A row shown as "Player" carries nothing to report, and opens nothing. A friend's row opens their profile, as it does everywhere else.

Your nickname. Because the board can show it to strangers, the nickname field says that it is public, and it refuses email addresses, phone numbers and links.

Test accounts are kept off it. Our own automated checks create players that are not people; those never appear. The phones of the people helping us test the game belong to real players, and they appear like anybody else.

Fair play. Journey progress is reported by your app and is not replayed on our server — the terms of service say so plainly. So the board limits what it will rank — never a count above the journey's length, and never a player whose count has grown faster, on average since they first played, than a day's play allows; such a player is left off the Journey and This week boards until the count looks like play — and we may take a player off the board where the numbers say they were not earned by playing. That removes the row from the Journey and This week boards; friends still see each other on the Friends tab. It does not touch the player's game, progress or purchases; the player is told in the app that it has happened and where to write to us about it; and it can be undone.

Legal basis (EEA/UK): our legitimate interest in making the game more engaging by letting players compare their progress, and in keeping that comparison fair (Art. 6(1)(f) GDPR). You can object at any time, and Settings → Privacy → Show my name on the leaderboard is how: it takes effect at once, with no reason needed. Writing to us works too.

Kids mode does not have it — section 9. Nothing from a child using kids mode ever reaches the server to be ranked.

Deleting. Settings → Delete account takes you off every board, along with everything else held against your player account.

4. Permissions

The app does not request location, camera, microphone, contacts, calendar, photos, files, storage, phone state, or nearby devices. It has no code that could use them.

Nine further permissions are declared by the libraries the app is built on, and Android grants all of them at install without a prompt: network-state and wake-lock and foreground-service and the Firebase messaging receiver, which are the plumbing behind notifications and behind knowing whether you are online; a receiver permission the app declares to itself, which grants nothing to anything else; and four that belong to the Google advertising SDK — com.google.android.gms.permission.AD_ID and three ACCESS_ADSERVICES_* permissions covering Android's newer advertising APIs. The data behind all four is the advertising data described in section 7 — there is no additional collection hiding behind them, and none of them lets the app read anything it could not read anyway. We list them because a reader who inspects the app's manifest will find them and should not have to guess.

None of the nine is something you can refuse separately; refusing advertising personalisation is done through the control in section 7.4, and turning off notifications is done as described above.

Notifications, and what refusing costs you

If you refuse, you lose the banner and nothing else that matters. A challenge or an invitation is stored in your account either way, so it is waiting on the Friends tab the next time you open the game — with the count on the tab, exactly as it would have been. With the game open, it still appears the moment it is sent.

What we send you. Two kinds of thing, and we would rather name both than imply there is only one:

1. Something another player did — a friend challenged you, invited you to a round, or sent you a friend request. These are generated by the game itself, from a fixed table of translations, and they are the reason the permission is asked for on the Friends tab.
2. Notices from us about the game — a new event chapter, the levels that drop during it, and, if we build it, a reminder that today's puzzle is waiting. These are written by us and go to everybody; they are not chosen based on anything you have done in the game, and nothing you have played decides whether you get one.

You can stop both at once. Settings → Privacy → Allow notifications deletes this device's token from our server, so nothing is sent at all — which is a stronger thing than Android's own switch, and it is why the control exists inside the game as well as in the system settings. There is deliberately no way to keep one kind and refuse the other; if that ever changes, this section changes with it.

Updated on 23 August 2026. Until that date this section said notifications were used for friend invitations and nothing else, and the in-app prompt said the same. That was true of the app as built, and it stopped being the plan, so both were changed before anything of the second kind was sent.

To send a notification at all we store one registration token for this install, provided by Google's Firebase Cloud Messaging, alongside your player identifier, the two-letter code for the language you read — so the notice is written in your language rather than ours — and your device's clock setting, so a notice arrives at a sensible hour where you are rather than in the middle of your night.

The token identifies a device, not you, and all of it is deleted when you delete your account, when you turn notifications off inside the game, or when the app is uninstalled.

We send Google's delivery service the token and the words of the notice — for a challenge, that is the room or challenge code and the display name of the friend who sent it. Nothing else: no progress, no puzzle history, and no text anybody typed.

5. Analytics — conditional

Status: ACTIVE from 27 August 2026. On unless you switch it off. No analytics SDK is installed; the app posts to a collector we run ourselves. There is no third-party analytics provider.

The control is Settings → Privacy → "Help improve the levels", and it starts on. Turning it off stops transmission immediately and discards whatever was waiting to be sent, rather than sending it one last time. It stays off.

It started off until 19 September 2026, and if you are reading this because you remember that: an installation that already had the switch keeps whatever it was set to. The new default reaches new installations only, and nothing that was switched off has been switched back on.

It was also called "Share anonymous stats" until that day. Same switch, same place, same effect — only the label changed, to say what the data is used for rather than what it consists of. What it consists of is below and has not changed.

Why this is not something we ask you to agree to. What is described below is anonymous in the strict sense — there is no identifier of any kind in it, so there is nothing in this data that is about you rather than about a puzzle, and nothing that could be traced back to you even by us. Nor does the app store or read anything on your device in order to send it: no cookie, no identifier, no file. Those are the two things that would oblige us to ask first, and neither is present. The switch exists anyway, because you should be able to say no to something you would rather not send.

We collect gameplay telemetry only, to find out which levels are too hard and where players stop playing.

What is sent: the name of the event (for example level_completed), and, where relevant: the level identifier, the chapter, your move count, the puzzle's optimal move count, stars earned, how long the level took, how many times you restarted or undid, and — for settings changes — which setting you changed and its new value.

What is never sent: your name, email, phone number, contacts, location, IP-derived precise location, the contents of any message, or any free text you type.

No identifier is attached — not even a random one. Analytics events carry no installation identifier, no device identifier, no advertising ID, no session identifier and no account. The only things sent alongside an event are the app version number and a timestamp. Two people who solve the same level in the same number of moves produce byte-for-byte identical events.

This is enforced in the code rather than promised in this document. The app maintains a fixed list of the properties an event may carry — level identifier, chapter, move count, optimal move count, stars, elapsed time, restart count, undo count, hint count, product identifier, ad placement, which reward a free gift paid out, a short error code, and a settings name and value. Anything not on that list is discarded before transmission, and text values must match a short pattern of letters, digits and punctuation, so free text cannot be sent even by accident.

The practical consequence is that we cannot tell one player from another, cannot count how many distinct people play, and cannot link two events to the same person or device. That is deliberate, and section 10 explains what it means for deletion requests.

Your device's IP address is necessarily visible to the receiving server as a property of any internet connection, as it is for every website you visit. Nothing in the data we send is derived from it, and we do not store it against your events or use it to infer your location.

Provider: none. The collector is part of our own backend, hosted by Supabase (our database and hosting provider, named in section 12), which acts as our processor for it as it does for everything else we store. No analytics company receives this data, and no analytics SDK is bundled in the app.

Legal basis (EEA/UK): none is needed, because this is not personal data — see the paragraphs above on what is sent and what is not, and the practical consequence that we cannot tell one player from another. Where data protection law is concerned with identifiable people, there is nobody identifiable here. Nor does the app store or read anything on your device in order to send it, which is the separate rule that makes ordinary website analytics ask you first; the queue lives in memory for a few seconds and is gone when you close the game.

Because that reasoning is ours rather than yours, the control stays: Settings → Privacy → "Help improve the levels", which you may switch off at any time, worldwide, with no effect on anything else in the game. It is not the advertising form in section 7.4 — that is a separate decision about a separate purpose, and turning one off does not turn the other off.

Retention: individual events are deleted after 45 days. Before then they are counted into daily totals — how many times each event happened, and per level how many attempts, solves and abandonments there were. Those totals are kept indefinitely. They are counts, they contain nothing about any individual, and because the events carry no identifier there is nothing in them to trace back to a person.

6. Crash and error reporting

Status: ACTIVE. Every release build reports crashes. This is not something you switch on, and at present it is not something you can switch off.

When the app crashes or hits an unexpected error, a report is sent containing: the error and its stack trace, the app version, the Android or iOS version, the device model, your device's language and time zone setting, and a short context object naming the screen or operation that failed.

The same service also receives a session health signal: that the app was opened, and whether that session ended in a crash. It carries no identifier and no content. It is how we can tell a crash that happens to one player in a thousand from one that happens to everybody.

A crash report carries no identifier we assign to you. The reporter is configured with personally-identifying data collection switched off — which means your IP address is not attached to the report and no user record is created — and with performance tracing and session replay disabled.

Crash reports are used to fix bugs and for nothing else. They are never used for advertising or profiling.

A stack trace can pick up incidental detail — a file path, a device name — that nobody intended to send. We do not attach custom keys, breadcrumbs or user identifiers, which is where that normally comes from.

Provider: Sentry, acting as our processor. Legal basis (EEA/UK): our legitimate interest in keeping the app working (Art. 6(1)(f) GDPR), or consent where the provider's implementation requires it. Retention: 90 days, Sentry’s default for error events.

7. Advertising

Status: ACTIVE. The app contains Google's AdMob SDK and shows two kinds of advert: rewarded video, which you choose to watch in exchange for a hint, and interstitials, occasional full-screen adverts shown between levels.

Never during a puzzle, never on the daily puzzle, and never after a level you failed. Buying Remove ads or Complete Edition ends the interstitials permanently; rewarded video remains, because it is optional and it is how you earn free hints.

In Europe, no advert is personalised without your consent. The app asks through Google's consent form the first time it runs. If you refuse personalisation you still get adverts — they are simply chosen without profiling you, and they still pay out the hint. If the form cannot be shown at all, the app requests no adverts of any kind; section 7.4 is the detail.

7.1 What kind of ads

Two kinds, and no others.

Rewarded video, which you choose — you tap a button offering something in exchange for watching a video: a hint, a Joker, a chapter gift, a spin of the daily gift wheel. Declining costs you nothing but the reward.

Interstitials, which you do not choose: occasional full-screen adverts between levels, and one at the end of a finished round with friends. Never during a puzzle, never on the daily puzzle, never after a level you failed, and never in the first fifteen levels of the journey. They are capped per session and per day. Buying Remove ads or Complete Edition ends them permanently.

There are no banners.

Corrected on 6 September 2026. This subsection previously read "Only rewarded video … There are no interstitials, no banners, and no ad you did not ask for." Interstitials shipped before that and the status note directly above this subsection already described them, so the document contradicted itself.

7.2 Who serves them

Google AdMob, and the advertising networks that bid through it. AdMob is operated by Google and its own handling of your data is governed by Google's Privacy Policy and How Google uses information from sites or apps that use our services. A list of the ad partners that may receive data is maintained by Google at https://support.google.com/admob/answer/9012903.

7.3 The advertising ID

To show an ad, the AdMob SDK reads your device's Android Advertising ID (AAID) — a resettable identifier that Android provides specifically for advertising. It may also collect your approximate location (derived from your IP address, at roughly city level), your device model and OS version, and information about how you interacted with the ad.

The advertising ID is not your name and is under your control:

• Reset it: Settings → Google → Ads → Reset advertising ID
• Delete it entirely: Settings → Google → Ads → Delete advertising ID. Android then returns a string of zeros to every app, and ads become non-personalised.
• Opt out of personalisation: Settings → Google → Ads → Opt out of Ads Personalisation

When advertising is enabled, the app declares the AD_ID permission, as Google requires of any app that reads this identifier.

7.4 Consent in the EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, the app shows a consent form the first time it launches, built with Google's User Messaging Platform (UMP) and operating under the IAB Transparency & Consent Framework. It asks separately about personalised advertising and about the other purposes your data may be used for.

• No ad request is made before you answer. Analytics is separate and is governed only by its own switch in section 5; the consent form does not gate it, and never did — the two are about different data and different purposes.
• If you decline personalisation you still get ads, and they still pay out the hint; they are simply chosen without profiling you.
• You can change your answer at any time from Settings → Privacy, which reopens the same form.

Outside those regions the app follows the applicable local rules — including, for residents of US states with such laws, the right to opt out of "sale" or "sharing" of personal information for cross-context behavioural advertising. Use the same Settings → Privacy control, or contact us at [email protected].

7.5 What we get

We do not receive your advertising ID. Our own view of advertising is the aggregate revenue and impression reporting Google gives us in the AdMob console.

8. Purchases

Status: ACTIVE. The billing library ships in the app and real billing is wired — the simulated mode the app used while there was nothing to sell was removed on 5 September 2026, and purchases are verified against the store's own servers before anything is unlocked.

Whether a particular product can be bought right now is a matter of what exists in Google Play and the App Store, not of what the app can do. If you can see a price, it is real. Nothing is charged by us in any case: payment happens inside Google's or Apple's own interface, and section 10 lists what is kept afterwards.

Corrected on 6 September 2026. This note previously said the app was "switched to a simulated mode" and that "no purchase data of any kind is created". The first stopped being true on 5 September; the second stops being true the first time somebody buys something.

Purchases are processed entirely by Google Play Billing. Payment happens inside Google's own interface.

We never see your payment details. We do not receive, store, or have any way to obtain your card number, bank details, billing address, or full name. Google is the merchant of record.

What the app receives from Google is a purchase token confirming that a specific product was bought and is still valid, so it can unlock what you paid for. The app stores the resulting entitlement (for example, "ads removed") on your device so it survives a restart.

Your purchase history, refunds and subscription controls live in your Google Play account: https://play.google.com/store/account. Refunds are handled under Google Play's refund policy.

Restore purchases re-queries Google Play for what your Google account already owns. It does not create any record with us.

9. Children

The game contains no violence and no chat, and no external links other than those in this policy. It is suitable for all ages by content.

It does contain user-made levels: anyone can build a puzzle and publish it, and anyone can browse what others published. A level is a board and a title — there is no free text beyond the title, no images and no messaging — and every published level can be reported from its own menu. Titles are checked before they appear.

The game also lets players connect to each other (section 3.8). That is deliberately built so that nobody can find anybody: a connection can only begin with a link one person sends another, there is no search, and the codes are random rather than sequential so they cannot be guessed. There is still no chat of any kind.

The one list of players is the journey leaderboard (section 3.14), and it is built so that it does not change the sentence above: there is no search, and a stranger's row opens no profile, no friend request and no message — only a way to report the name or block that player. It shows a nickname, a picture and frame from the game's own set, level counts and a position: who is ahead, and never a way to reach them.

However, it is not directed to children within the meaning of COPPA, the GDPR's rules on children's data, or Google Play's Families policy, and it is not enrolled in Google Play's Designed for Families programme. We do not knowingly collect personal information from anyone under 13.

This matters for one practical reason: advertising (section 7) is switched on, and the app uses standard advertising infrastructure that is not permitted in apps aimed at children. If you are a parent and your child uses this app, consider deleting the device's advertising ID (section 7.3), which turns off ad personalisation across every app on the device.

Kids mode is not a contradiction of the paragraph above. The app contains a simplified mode meant for young children, and it does not make the app one that is directed to children. It is a switch in Settings, turned on by the adult who installed the game and left by holding a button rather than by answering a sum. Inside it there are no ads, no sign-in, no community levels, no leaderboard, no ranked play and no friends — nothing for a child to publish, and nothing by which a child can be seen. The account described in section 3.7 is the one belonging to the person who installed the app; it already exists before kids mode is first opened, and handing the phone over does not create a second one. Kids mode does not add anything to what this policy says we collect. It removes almost all of it.

If you believe a child has provided personal information to us, contact [email protected] and we will delete it.

10. Retention and deletion

A player account exists for you from your first game, in every version, whether or not you ever sign in — section 3.7. So uninstalling is not enough to remove everything, and this is the practical difference worth knowing: Settings → Delete account works without an email address, removes the account and everything held against it, takes down any levels you published, and clears the copy on the phone as well. The button is in the same place whether or not you signed in.

An earlier version of this section described a world in which the friends feature could be switched off and uninstalling was sufficient. That stopped being true on 20 August 2026 and this passage was corrected on 6 September.

Why we cannot delete individual analytics or crash records

Because those records carry no identifier of any kind (section 5), there is nothing in them that points back to you, and nothing we could match a deletion request against. We are not withholding a lookup — the lookup does not exist. If you emailed us asking us to delete your events, we would have no honest way to find them, and we will not ask you for extra personal information in order to try, because collecting identifying data to service a privacy request would make the situation worse rather than better.

What you can actually do, and what it achieves:

• Switch it off at Settings → Privacy → Help improve the levels, which starts on. No analytics event is sent once it is off, and anything already queued on your device is discarded rather than sent later. It does not undo what was already received, and nothing can: those records carry no identifier, so there is nothing in them to look yours up by. (This bullet has twice described a different arrangement. Until 27 August 2026 no analytics endpoint was configured and nothing was ever sent; until 19 September 2026 the switch started off and was labelled "Share anonymous stats". Section 5 describes what is sent today and why it is anonymous.)
• Uninstall the app. Everything on your device goes with it, and nothing further is ever sent.
• Records already received are deleted by our provider at the end of the retention period stated above, without any action from you.

If a future version ever does attach an identifier — or introduce an account — this policy will be updated before that version ships, and both an in-app and a web deletion route will be provided, as Google Play requires.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, to withdraw consent, and to complain to a data protection authority.

These rights apply to every player, not only to those who signed in, because a player account exists for everybody (section 3.7). Crash reports are the one exception and carry no identifier, so we could not find yours among them even if you asked (see below).

The route depends on whether we have an email address for you. Without one we cannot recognise you from a message, so the reliable way to exercise these rights is in the app, where the account is already proven to be yours: Settings → Delete account deletes everything, immediately and without asking us. If you have lost the device, we cannot identify the account, and we would rather say so than delete somebody else's game on your behalf.

Getting a copy of your data without an email address. There is no in-app export today — that is a gap and we would rather name it than imply otherwise. Email [email protected] and we will work out what we can honestly send you: for a signed-in account, the cloud save as a file; for an account with no email address, we will need something from inside the app to tie the request to it, and we will tell you what rather than asking you for identity documents. An in-app export is the fix and it is on the list.

If you have an account, those rights bite on everything listed in section 3.5, and the practical routes are:

For anything else, email [email protected]. We respond within 30 days. Except for a deletion request made by email — where we have to know which account to delete, and so will only act on a request from the address on it — we will not ask you for identifying information in order to service a privacy request.

EEA/UK residents may complain to their national supervisory authority; a list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. We are established in Germany, within the EU, so no Article 27 representative is required. There is no statutory obligation to appoint a Data Protection Officer for processing of this scale.

12. International transfers

We are established in Germany and almost everything is held in Europe. Our server is a Supabase project in Frankfurt (eu-central-1); crash reports go to Sentry's European region, also in Germany; and the analytics collector in section 5 is part of that same Frankfurt project rather than a third-party service, so none of those three involves a transfer out of the EEA.

Two things do leave it.

Advertising (section 7). Serving an advert means Google receives your device's advertising ID, the IP address the request came from and the ad interaction — Google is the provider here, and for advertising it acts on its own account rather than purely on ours. Google's own handling, including the countries it processes in and the safeguards it relies on, is governed by Google's Privacy Policy and its EU–US Data Privacy Framework certification. Section 7.3 is how to reset or delete the identifier, and 7.4 is the consent that gates personalisation.

Sign-in codes, and only if you sign in. They are delivered by Resend, a US company, which means your email address is processed in the United States for as long as it takes to send that message. That transfer relies on the European Commission's standard contractual clauses together with the EU–US Data Privacy Framework, as set out in Resend's terms.

If section 8 begins selling, purchase processing sits with Google or Apple on the same basis.

Corrected on 6 September 2026. This section previously said "neither involves a transfer out of the EEA" and treated sections 5, 7 and 8 as things that might be switched on in future. Section 7 has been on since before that date, and section 5's collector is in Frankfurt — so the old text was wrong in both directions at once.

13. Security

On-device data is stored in the app's private storage area, which Android isolates from other apps. All traffic to our providers is encrypted in transit with TLS.

On the server, every table is protected by row-level security: the rules that decide who may read a row are enforced by the database itself rather than by the app asking politely, and they are tested as such on every change. The key that ships inside the app is public by design and grants nothing on its own. Your cloud save is readable only by your own account.

No system is perfectly secure. If you have never signed in, the realistic worst case is that someone with physical access to your unlocked phone learns which puzzle levels you have solved. If you have an account, the data at risk is the list in section 3.5 and the email address you signed in with — no payment details, which are Google's and never ours, and no password, because there is none to steal: signing in is a code sent to your address.

14. Changes to this policy

We will update this page when the app changes, and update the Last updated date. Material changes will be announced in the app before they take effect, and where consent is required we will ask again rather than assume — the mechanism for that is a notice card in the game, driven by a revision number this document carries.

One honest note about the past. Analytics (section 5) and advertising (section 7) were switched on in late August 2026, before that notice mechanism existed — it shipped in early September. So those two were not announced the way this paragraph promises, because at the time nothing could announce them. Both were consent-gated from the moment they shipped: advertising through Google's consent form, analytics through a switch that started off. From here on the mechanism exists and the promise above is one we can keep.

Analytics changed default on 19 September 2026 — the switch now starts on, for the reasons in section 5, and was renamed the same day from "Share anonymous stats" to "Help improve the levels". Consent is not required for it, so this is not a case of assuming one: what changed is a default, and only for installations that had not already answered. An existing setting, including an explicit off, was left exactly as it was.

Previous versions are available on request.

15. Contact

Omar Diar Bakerly (trading as Bakerly Apps)
Herwarthstraße 63, 47137 Duisburg
Germany
Email: [email protected]

For anything privacy-related, email is the fastest route and reaches a person.

16. Provider identification / Anbieterkennzeichnung (Impressum)

Angaben gemäß § 5 DDG (Digitale-Dienste-Gesetz):

Omar Diar Bakerly (trading as Bakerly Apps)
Herwarthstraße 63, 47137 Duisburg
Germany

E-Mail: [email protected]

Verantwortlich für den Inhalt: Omar Diar Bakerly (trading as Bakerly Apps), Anschrift wie oben.

Responsible provider of this app and of this page: the person and address named above. This is the German statutory provider identification and repeats the contact details already given in section 15.

EU-Streitschlichtung: Die Europäische Kommission stellt eine Plattform zur Online-Streitbeilegung bereit: ec.europa.eu/consumers/odr. Wir sind nicht verpflichtet und nicht bereit, an Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle teilzunehmen.