Privacy Policy

1. Who is responsible

SoftYorch (Jorge Agulló), Spain · softyorch@gmail.com

2. Data we process

2.1 Account data (registration with email)

• Email address
• Password (stored in hashed form by Firebase Authentication; we never see it or have access to it)
• The nickname you choose
• Whether your email address has been verified, and when you last signed in

2.2 Guest accounts

• An anonymous identifier created by Firebase Authentication, with no email address or name attached.
• A guest’s progress is kept on the device, not on our servers.
• If you create an account from a guest session, the account keeps that same identifier and the games you played as a guest (the last 100 at most) are sent to our server to be scored.

2.3 Profile and game progress (registered accounts)

• Nickname, public handle and avatar
• Level, experience (XP), ranking points, best score, daily streak and the date of your last game
• Games played, won, lost and abandoned, and statistics for each game mode (games, wins, best score, best streak, longest run)
• Trophies unlocked and when, and your online-play statistics
• Colour palettes unlocked and premium / ad-free status

2.4 Online matches

• While a match lasts, its room holds your nickname, your account identifier, your answers, your score and whether you are connected. Rooms are deleted automatically six hours after they are created.

2.5 Usage statistics (only with your consent)

Through Google Analytics for Firebase we record what is done in the game, not who does it:

• Screens opened
• Games started, finished and abandoned: mode, score, rounds, accuracy, duration and level reached
• Trophies unlocked, online rooms and matches, how you signed in, and whether you shared a result
• Ads shown and ads tapped
• Three properties: account type (guest or registered), ad-free status and player level

We never put your nickname, email address, account identifier or room codes in these statistics. Google Analytics adds technical data of its own: an app-instance identifier, device model, operating system version, app version, language and approximate country.

2.6 Crash reports

When the app crashes, Firebase Crashlytics sends a report with the error trace, device model, operating system version, app version and an installation identifier. Crash reports are sent whether or not you accept usage statistics (see section 4). Without that consent they carry no account identifier, no nickname and no record of what you did in the game.

2.7 Advertising

Google AdMob and Google’s User Messaging Platform (UMP) may collect the device’s advertising identifier, its IP address and data on how you interact with ads, in order to show advertising, personalised or not according to your answer in the consent form.

2.8 Protection against abuse

Firebase App Check, through Google Play Integrity, checks that requests reach our servers from a genuine copy of the app on a genuine device; for that, Google processes integrity signals from the device and the app. Our servers also count certain requests per account for a short time, to limit abuse.

2.9 Data that stays on your device

Your settings (sound, music, visual effects, your choice about usage statistics), your progress and trophies, and finished games waiting to be sent. Uninstalling the app removes all of it.

We do not collect: precise location, contacts, photos, camera or microphone, or payment data. The app has no purchases today; if it ever does, they will be handled by Google Play and we will not have access to card details.

3. What we use the data for

• To create and manage your account and sign you in (Firebase Authentication).
• To save your progress, work out your score, level and trophies on our servers, and show the leaderboard (Cloud Firestore, Cloud Functions).
• To run online matches (Cloud Firestore, Firebase Realtime Database).
• To understand how the game is played and improve it (usage statistics).
• To find and fix errors (crash reports).
• To show advertising and, where you agreed, personalise it (Google AdMob).
• To protect the game against cheating and abuse.
• To send the emails the service cannot work without: address verification and password reset. We send no marketing emails.

4. Legal basis

• Performance of the contract for using the app (Art. 6.1.b GDPR): account, progress, leaderboard and online play.
• Your consent (Art. 6.1.a GDPR): usage statistics and personalised advertising. You give it, or not, in the consent form shown the first time you open the app.
• Legitimate interest (Art. 6.1.f GDPR): crash reports, which we need to keep the app working for everybody, and the security of accounts and scores (abuse prevention, validation of results).

You can change your answer at any time: Profile → Privacy options reopens the consent form, and Profile → Usage statistics switches the statistics off on its own. Withdrawing consent does not affect what was processed before.

5. What other players can see

Your nickname, public handle, avatar, level, ranking points and best score are shown to other players in the leaderboard and in online matches. To build the leaderboard, the app of any signed-in player can read the profile and progress of registered accounts. Your email address is never part of that.

When you share a result, the text is written on your device and handed to the app you pick. We only note that something was shared, and only if you accepted usage statistics.

6. Providers and third parties

We use these providers, which act as processors or under their own privacy policies:

• Google Firebase (Authentication, Cloud Firestore, Realtime Database, Cloud Functions, App Check, Google Analytics, Crashlytics): accounts, game data, statistics and crash reports.
• Google AdMob and Google User Messaging Platform: advertising and consent management.
• Google Play (distribution of the app and Play Integrity).

These providers may process data outside the European Economic Area, under the safeguards the GDPR recognises (the EU–US Data Privacy Framework or standard contractual clauses). We do not sell your data.

7. How long we keep the data

• Registered accounts: for as long as the account exists. Deleting it from the app removes the account, profile, progress, trophies and online rooms at once.
• Guest accounts: deleted automatically after 30 days without use. A guest’s progress lives on the device and is lost on signing out or uninstalling.
• Online rooms: six hours.
• Crash reports: 90 days.
• Usage statistics: for the period set in Google Analytics, 14 months at most.

8. Your rights

Under the GDPR you may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you gave:

• From the app: edit your profile, delete your account, Privacy options and the Usage statistics switch, all in Profile.
• By email: softyorch@gmail.com
• See how to delete your account and data.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country.

9. Children

The app is not directed at children under 13 and does not knowingly collect their data. If we learn that a child under 13 has given us data without parental authorisation, we will delete it.

10. Security

We apply reasonable technical and organisational measures to protect personal data, including the encryption in transit and at rest provided by Firebase, server-side rules that stop one player from changing another’s data, and scores computed on the server. No system is infallible: use a strong password and do not share it.

11. Changes to this policy

We may update this policy to reflect changes in the law or in the service. Substantial changes will be announced in the app or on this website. The “Last updated” date shows the version in force.

12. Contact

SoftYorch · softyorch@gmail.com