1. Who we are

The game and this website are operated by [Publisher legal name, to be supplied] ("we", "us"), located at [Publisher postal address, to be supplied]. For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the controller of the personal data described here, except where a third party (such as Google or Meta) acts as an independent controller, as explained below.

Privacy questions and requests: [Privacy contact email, to be supplied].

2. Summary

You can play the single-player modes offline without an account. That progress stays on your device.
Online features (multiplayer, friends, leaderboards, coins and rewards) need an account. A guest account is created automatically the first time you go online; you can later add an email or link Google, Facebook or Apple.
The game shows ads through Google AdMob. Where the law requires it, we ask for your consent first.
Coins are virtual. There are no in-app purchases and we do not collect payment information.
We do not sell your personal information for money.
You can delete your account at any time inside the game. See Account Deletion.

3. Information we collect

3.1 Account information

Data	When	Notes
Player ID	Every online account	A permanent 8-digit number that identifies you to other players. A number is never reissued to anyone else.
Display name and avatar	Every online account	The name (up to 20 characters) and in-game avatar you choose. Visible to other players.
Guest status	Guest accounts	Created automatically when you first play online. Until you add an email or link a sign-in provider, the account exists only on the device that created it.
Email address	If you sign up or sign in with email, or a provider shares it	Used to sign in, verify the address, reset your password and send service messages.
Password	Email accounts	Stored only as a salted one-way hash (bcrypt). We cannot see your password.
Verification and reset codes	When you verify an email or reset a password	6-digit codes stored only as a hash. They expire after 15 minutes and can be used once.
Session tokens	While you are signed in	Refresh tokens are stored only as hashes so a stolen database copy cannot be used to sign in.

3.2 Sign in with Google, Facebook or Apple

If you choose to link or sign in with Google, Facebook or Apple (where available), the provider confirms your identity to our server and shares: your account identifier with that provider, and, if available and permitted, your email address, display name and profile picture URL. We never receive your password for those services.

Facebook friends. If you sign in with Facebook and grant the friends list permission, we store your Facebook access token encrypted (AES-256-GCM) so the game can show which of your Facebook friends also play. Meta only returns friends who use the game and granted the same permission. We do not post to Facebook on your behalf. You can remove the connection in the game (Settings, then Account & security) or in your Facebook settings.

3.3 Gameplay, multiplayer and progression

Matches: opponents, mode, arena, the moves made during the match, timing, scores, mistakes and the result. Moves are checked on our server to keep matches fair.
Competitive data: ratings, trophies, rank, win/loss/draw counts, streaks, achievements and medals, mission progress, Daily Challenge and Weekly League puzzle scores, season results and leaderboard positions.
Social features: friend requests, friendships, players you block, game invitations, private rooms and match history with recent opponents.
Presence: whether you are currently online and when you were last seen, so friends can see your status and invite you.

3.4 Virtual coins and rewards

We keep your coin balance and a ledger of every change (for example daily rewards, mission and achievement rewards, arena entries, refunds and prizes, and rewarded-video coins), together with daily reward claims and unlocked avatars. The ledger lets us resolve disputes and prevent abuse. Coins have no monetary value; see the Terms of Service.

3.5 Rewarded ad verification records

When you choose to watch a reward video for coins while signed in, we create a single-use reward record containing a random code, the placement, the reward amount, its status, and details reported back by the ad network in its signed server-to-server confirmation (such as the event identifier, ad unit, platform and network name). Coins are added only after that confirmation is verified. These records are linked to your account.

3.6 Technical information

When the game connects to our servers, we process your IP address and basic request information (such as app and platform details) to deliver the service, keep connections alive, limit abusive traffic and protect accounts. [Publisher to confirm whether server access logs are kept, what they contain, and for how long]

3.7 Information stored only on your device

Offline progress (campaign levels and stars, mode records, settings, saved in-progress puzzles and local statistics) is stored on your device. It is not sent to us unless you use online features that need it. Uninstalling the game or clearing its data removes it.

3.8 Information collected by third-party SDKs in the app

Google AdMob (Google Mobile Ads SDK and User Messaging Platform) collects information such as your device's advertising ID, IP address, device and app information, and ad interactions in order to serve, measure and limit ads and to record your consent choices. See section 6.
Meta (Facebook) SDK is included for Facebook Login. In the current build, the SDK is configured with automatic app event logging and advertiser ID collection enabled, which means Meta may receive app events (such as installs and app launches) together with device information and your advertising ID, including if you do not sign in with Facebook. Meta processes this under its own policies. [Publisher to confirm whether this configuration will be kept, disabled, or made subject to consent]
Google Sign-In and Sign in with Apple process the information needed to authenticate you when you choose them.

Analytics. The current build does not include a separate analytics SDK (such as Firebase Analytics or Unity Analytics), and Unity's analytics and crash-reporting services are switched off. If we add one, we will update this policy first.

3.9 Support messages

If you contact us, we receive what you send: typically your name or nickname, email address, Player ID and message, plus anything you attach.

4. How we use information

To create and run your account, sign you in, and keep your progress and coins in sync.
To run multiplayer: matchmaking by skill, private rooms, invitations, live turns, scoring and results.
To provide friends, presence, leaderboards, leagues, missions, achievements and rewards.
To verify rewarded videos and credit coins only for completed views.
To show ads, including personalised ads where you have agreed or where the law allows it.
To keep the game fair and secure: server-side move checks, rate limiting, preventing coin abuse and investigating cheating.
To answer support requests and send service messages (such as verification and password reset emails).
To comply with the law and enforce our Terms of Service.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. Legal bases (EEA and UK)

Performance of a contract: providing the account, online play, friends, coins, rewards and support you ask for.
Legitimate interests: security, fair play, fraud and abuse prevention, verifying ad rewards, and improving the game, balanced against your rights.
Consent: personalised advertising and any device storage or access that requires consent, collected through Google's consent message; and the Facebook friends feature. You can withdraw consent at any time.
Legal obligation: where we must keep or disclose information by law.

6. Advertising and consent

The game is free and supported by ads served by Google AdMob. It shows rewarded videos, which you choose to watch in exchange for coins, a hint or a second chance, and occasional full-screen ads between levels. Rewarded videos are always optional.

Consent. In the European Economic Area, the UK and Switzerland, and wherever else Google requires it, the game shows Google's consent message (User Messaging Platform) before ads are requested. You can choose whether to allow personalised ads. If you decline, you may still see non-personalised or limited ads. [Publisher to confirm how players can reopen the consent choices inside the game]

Your device controls. On Android you can reset or delete your advertising ID, or opt out of personalised ads, in your device's Google settings (Settings > Google > Ads, or Settings > Privacy > Ads, depending on your device).

Google uses information under its own policies. Learn more at How Google uses information from sites or apps that use its services and the Google Privacy Policy.

Other players

Your display name, avatar, Player ID, rank, trophies, ratings, public statistics, medals and leaderboard positions can be seen by other players. Friends can also see when you are online. Opponents see your moves and results in matches you play together.

Service providers and partners

Google: advertising and consent (AdMob, User Messaging Platform) and Google Sign-In.
Meta Platforms: Facebook Login, friend discovery and the SDK behaviour described in section 3.8.
Apple: Sign in with Apple, where available.
Cloud hosting for our game servers and database: [Publisher to name the hosting provider and server region]
Email delivery for verification and password reset messages: [Publisher to name the email (SMTP) provider]
Website hosting: this website is hosted by Vercel.

We may also disclose information when required by law, to protect the rights and safety of players or the public, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

We do not sell personal information for money.

8. International transfers

Our service providers may process data in countries other than yours, including the United States. Where data from the EEA, UK or Switzerland is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions, as offered by those providers. [Publisher to confirm the country where the game servers are located]

9. Data retention

Account and game data is kept while your account exists and is deleted when you delete your account (see section 10).
Email and password codes expire after 15 minutes.
Online status entries expire automatically within about a minute and a half of your game disconnecting.
Player ID numbers are kept in a register of issued numbers, without any other account data, so a number is never given to a different player.
Inactive accounts: [Publisher to state whether inactive accounts are deleted and after how long]
Backups and logs: [Publisher to state how long database backups and server logs are kept]
Support messages: [Publisher to state how long support emails are kept]

10. Account deletion

You can permanently delete your online account inside the game: open Settings, choose Account & security, then Delete account, and type DELETE to confirm (email accounts also confirm with their password). Deletion removes your account, sign-in methods, coins, trophies, friends, invitations, achievements and match results from our live database straight away.

Matches you played remain in your opponents' histories, but linked only to an anonymous identifier rather than to your account. Full details, including how to request deletion if you can no longer open the game, are on the Account Deletion page.

11. Security

We protect data with measures including encrypted connections, hashed passwords, hashed session tokens and verification codes, encrypted storage of Facebook access tokens, rate limiting, and server-side checks of every match move and coin change. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach that affects you, we will notify you and the authorities where the law requires it.

12. Children

The game is not directed at children under 13 (or the higher minimum age that applies in your country, such as 16 in some EEA countries) and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us at [Privacy contact email, to be supplied] and we will delete it. [Publisher to confirm the target age group declared in Google Play Console matches this section]

13. Your rights (EEA and UK)

Subject to the conditions and exceptions in the law, you have the right to:

access the personal data we hold about you and receive a copy;
correct inaccurate data (you can change your display name and avatar in the game);
delete your data (see section 10);
restrict or object to processing based on legitimate interests;
receive your data in a portable format;
withdraw consent at any time, without affecting processing before the withdrawal; and
lodge a complaint with your local data protection authority.

To exercise a right, email [Privacy contact email, to be supplied] with your Player ID. We may need to verify that the account is yours before acting on the request, and we will respond within the time the law requires.

14. US state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws), you may have the right to know what personal information we collect and how we use it, to access, correct and delete it, to obtain a copy, and to opt out of targeted advertising, "sales" or "sharing" of personal information. We will not discriminate against you for using these rights.

In the last 12 months, the categories of personal information we collected are those described in section 3: identifiers (such as Player ID, email address, advertising ID and IP address), account login information, internet or network activity (gameplay and match activity), and inferences limited to skill ratings used for matchmaking. We do not sell personal information for money. Personalised advertising through Google AdMob, and the Meta SDK behaviour in section 3.8, may count as "sharing" or "targeted advertising" under some state laws. You can opt out by declining personalised ads in the consent message, by opting out of personalised ads in your device settings, or by contacting us at [Privacy contact email, to be supplied]. You can use an authorised agent where the law permits.

15. This website and cookies

This website does not use advertising or analytics cookies and does not track you across sites. Our hosting provider (Vercel) processes technical data such as IP addresses to deliver pages and protect the site. Because we do not use non-essential cookies, no cookie banner is shown.

If you use the contact form, we receive the details you enter and send them to our support inbox through an email delivery provider. The form briefly processes your IP address to prevent spam. We use your message only to reply.

16. Changes to this policy

We will update this policy when the game or our practices change, and change the effective date at the top. If a change is significant, we will give notice in the game or on this website before it takes effect.

17. Contact

[Publisher legal name, to be supplied]
[Publisher postal address, to be supplied]
Privacy: [Privacy contact email, to be supplied]
Support: [Support email address, to be supplied]

If you are in the EEA or UK and we are required to appoint a representative there: [Publisher to confirm whether an EU/UK representative is required and add their details]

Privacy Policy