Privacy Policy

1. Who is responsible

The controller for the processing described here, in the sense of the General Data Protection Regulation (GDPR), is the developer of the game:

The developer is an individual, not a company. The full postal address is published by Google in the “About the developer” section of the app's page in the Google Play Store, and by Apple on the App Store product page.

2. What the game stores on your device

The game keeps everything it knows about you in its own private storage on your phone: one SQLite database file and the system's preferences store. None of it leaves the device. There is no sync, no backup to us, no backend and no way for the developer to read it.

It consists of exactly this:

• Your boards. Per puzzle: the letters you have typed, which cells a hint revealed, how many seconds you have played, and how many hints you used.
• Your records. Per puzzle: how many times you solved it, your best time solved without hints, and when you last solved it.
• The daily log. Which daily boards you have played, and today's date for the daily board.
• Your coins. The balance, the day of the last daily gift, and one row per transaction (its id, its kind, and how many coins it added or removed).
• Your settings. Language, light or dark theme, text size, sounds, haptics, error checking, whether the timer is shown, whether the daily reminder is on, whether crash reports and usage statistics are allowed, whether onboarding is finished, and how many puzzles you have started.
• Ad bookkeeping. When a rewarded video last paid out, and any reward that was earned but not yet credited.

There is no player id anywhere in that database. The coin account is written as a single row with a fixed key, because there is only ever one player: no account, no login, no generated identifier of ours.

Legal basis: this storage is strictly necessary for the feature you asked for — playing the game and keeping your progress (§ 25(2) no. 2 TDDDG); so far as personal data is processed at all, Art. 6(1)(b) GDPR.

Deleting it: uninstalling the app removes all of it, including any coins you have not spent. There is no cloud copy, so there is nothing to restore afterwards.

3. Usage events (Google Analytics for Firebase)

To see which puzzles players get stuck on and where they give up, the published version of the game sends a short, fixed list of events to Google Analytics for Firebase, unless you turn it off (see the box below).

What is never sent: an answer, a letter you typed, a clue, the contents of a board, or anything else you wrote. The list of events is closed — it is written out in one file in the source code, and an automated test fails the build if an event is ever sent carrying the solution letters of the board being played. Nothing here is free text.

This is the complete list, all thirteen of them:

In addition, a screen_view event records which screen you are on. Those names are a closed set of nine — home, chapters, chapter, stage, daily, daily_stage, shop, settings, onboarding — and never a board id.

The Firebase SDK itself then collects technical information the game does not control: a randomly generated app-instance identifier, its standard automatic events (first open, session start, app update), device model, operating system version, language, app version, and an approximate location, such as country and region, derived from the IP address. Google uses the IP address for that derivation and does not keep it in the Analytics reports. No precise location is collected: the game has no location permission. No advertising identifier is read for Analytics.

Coin purchases. coins_purchased and coins_purchase_failed name the coin pack by its store product id (see section 6). Separately, Google Analytics records in-app purchases made through the App Store or Google Play on its own, as Google documents: the product, its name and its price. The payment itself — card, name, address — stays with Apple or Google.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in improving a game that is given away free. You can object at any time (Art. 21 GDPR); see section 11 for how.

Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

4. Crash reports (Firebase Crashlytics)

When the game crashes or hits an error it did not expect, a report goes to Firebase Crashlytics. It contains the error type, the stack trace, a short label saying which part of the code was running, the device model, the operating system version, the app version, the time, and an installation identifier generated by Crashlytics itself. The error's message is included only for a crash, and even then not for the kinds of error (input and database errors) whose message could repeat what you typed; an error the game caught and handled is sent as its type alone. A report can also include a few short notes that the game's own code wrote earlier in the same session.

It also carries two labels of ours: build_channel, which says whether this is a test build or the published one, and screen, which of the nine screen names listed in section 3 you were on. Those are the only custom values attached, both come from fixed lists, and neither is ever anything you wrote.

Your puzzles, your letters and your coins are not part of a crash report.

The installation identifier is not the advertising identifier, is not shared for advertising, and is regenerated if you delete and reinstall the app.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in finding and fixing crashes. A puzzle game that loses your board when it crashes is worth nothing, and without these reports we would not know it had happened. The switch described in section 3, Settings → About → “Crash reports and usage statistics”, turns crash reports off as well.

Processor: Google Ireland Limited (address as above).

5. Ads (Google AdMob) and your consent

The game can show rewarded video ads, and nothing else. There is no banner, no full-screen ad between puzzles, and no ad when you open the app. The rules are part of the product, not a preference:

• a rewarded video plays only when you choose to start one, to earn coins;
• no ad is ever shown before your fourth puzzle;
• nothing interrupts a board you are solving;
• an ad never stands between you and a puzzle: every board is free, and coins can also be earned by playing.

To serve and measure an ad, Google processes among other things the device's advertising identifier (Android's advertising ID, or on iOS the IDFA where you allow it), the IP address, device type and operating system, an approximate location, and your interaction with the ad. Google publishes the details and the list of advertising partners itself: business.safety.google/privacy and Google's GDPR notes for AdMob.

Consent. In the EU/EEA, the United Kingdom and Switzerland, Google's User Messaging Platform checks your consent status and shows its form where one is required. No ad is requested before that status is resolved, and if consent is refused the game never asks for an ad at all.

Changing your mind. Where consent applies, Settings → “Ad settings” reopens the same form. The row appears only where it leads somewhere: Google decides that, and it says no for players outside those regions, for whom the row would be a dead end.

Apple ATT (iOS). The first time you open the game, iOS asks you once whether the app may track you across other companies' apps and websites. The game shows a short screen of its own first, in your own language, explaining what is about to be asked; the decision itself belongs in Apple's dialog, not in ours. Your answer decides whether AdMob may use your device's advertising identifier (the IDFA). Declining takes nothing away from the game. You can change it later under Settings → Privacy & Security → Tracking.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, for storing and reading information on your device for advertising. Withdrawal takes effect for the future.

Recipient: Google Ireland Limited (address as above), as the provider of the advertising service in its own right.

A build of the game that carries no ad unit does not start the advertising SDK at all, requests nothing and shows nothing. Where that is the case for the version you installed, the entire section above describes a capability that is switched off.

6. Coin purchases

Everything in the game is free. Every chapter, every board and the daily puzzle cost nothing and are not behind a payment. The only thing sold is coins, which buy hints:

• jadval_coins_200 — 200 coins
• jadval_coins_600 — 600 coins
• jadval_coins_1500 — 1500 coins

None of them is on sale at the moment: coins come only from playing. The rest of this section describes what happens once they are.

The purchase itself is handled entirely by Apple's App Store or Google Play. The developer receives no payment data — no card number, no name, no address. On your device the game only writes a row saying that coins arrived; unless you have turned usage statistics off, Analytics also learns which pack was bought and, as Google documents, the product's name and price (section 3). From the stores the developer receives aggregated sales and payout reports that do not identify you.

Coins are consumable: they are spent, they live only on your device, and there is no purchase history to replay to rebuild a balance. See the terms of use for what that means for you.

Legal basis: Art. 6(1)(b) GDPR — performing the purchase contract. The stores' own privacy policies govern their part: Google · Apple.

7. The daily reminder

If you turn the daily reminder on, your phone's own notification system schedules it and your phone shows it. It is a local notification: there is no push service, no device token, no message from us, and nothing is sent anywhere. Turning it off in settings, or denying the notification permission, ends it.

8. What the game does not do

• No account, no registration, no email address, no password.
• No access to location, contacts, camera, microphone, photos or files: the game asks for none of those permissions. (The approximate location in sections 3 and 5 is Google's estimate from the IP address.)
• No push notifications and no messages from us.
• No server of our own: every puzzle is inside the app and nothing is downloaded. The game works fully offline.
• No advertising identifier is read for analytics or crash reports.
• No selling of data, and no sharing beyond the services named on this page.

9. Recipients and transfers outside the EU

Data is disclosed only to:

• Google Ireland Limited — Firebase Analytics, Firebase Crashlytics, and AdMob where ads are served;
• Google Ireland Limited / Google Payments or Apple Distribution International — handling a coin purchase;
• GitHub, Inc. — only for delivering this website (see section 13).

Data may be transferred to and processed in the USA by Google LLC or Apple Inc. Those transfers rely on the recipients' certification under the EU-US Data Privacy Framework and/or on the European Commission's Standard Contractual Clauses, which form part of their respective terms. The developer is himself resident in the United States.

10. Retention

11. Your rights, and how to use them

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Consent you have given can be withdrawn at any time with effect for the future (Art. 7(3)).

In practice the developer holds nothing that could identify you and normally cannot find you again in the Firebase reports (Art. 11 GDPR). What you can do:

• Delete everything the game knows: uninstall it. All local data goes, including unspent coins.
• Stop analytics and crash reports: turn off Settings → About → “Crash reports and usage statistics” (see section 3). To object, or to have what was already sent deleted, write to support@topjow.org.
• Change or withdraw ad consent: Settings → “Ad settings”, where consent applies.
• Reset your advertising identifier or turn off personalised ads for the whole device: in the Android or iOS system settings.

For any request write to support@topjow.org. Please say what you need; we answer within the one-month period of Art. 12(3) GDPR.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR) — either where you live or the one responsible for the controller.

12. Children

The game is a word puzzle for a general audience and is not directed at children. It does not knowingly collect data from children, and it asks for no personal information from anyone. If you believe a child has provided personal data through this app, write to support@topjow.org and we will delete what we can identify.

13. This website

This page is served by GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you open it, GitHub processes the connection data that is technically required, including your IP address, the time, the file requested and your browser. The legal basis is Art. 6(1)(f) GDPR — providing a working, secure website. See GitHub's privacy statement. This page sets no cookies and loads no third-party fonts, scripts or analytics. There is no tracking on it.

14. Changes to this policy

When the game changes, this page is updated, and the version published here with the date at the top is the one that applies. A material change to what is collected will be announced in the app.

This policy describes the game as of the date given above. It is not legal advice.