Privacy Policy

Information we process

• Your chosen display name, illustrated avatar, race color and optional manually selected region code. No photo upload or location permission is used.
• A random player identifier and secret session credential that reconnect your Nobody profile or saved account to its rooms, archive and statistics. Account sessions are bound to a device installation. Do not share session credentials or installation secrets.
• Multiplayer room membership, moves, private board values, progress, mistakes, finishing times, match results, archived matches, statistics and server-verified achievements.
• Friend requests, accepted friendships, in-app room invitations and block relationships. Joining a room does not automatically create a friendship.
• Technical connection information, such as IP address and network metadata, that Cloudflare may process to deliver and protect the service. The game database and application logs do not store raw IP addresses.
• The message and reply address you voluntarily send to support. Email is not required to play.
• When monetization is enabled: credit balances, verified rewards, purchase entitlements, receipt identity digests and refund adjustments. Stores handle payment-card details. Pending store tokens are encrypted and removed within 48 hours.

Private notes and their history, app settings, local achievements, Solo/Practice progress and native Daily progress stay on your device. Browser Daily is different: its puzzle, entered values, latest move acknowledgement, daily conditions, mistake count and start/completion times are saved with your server profile. Browser Daily notes and pending-move recovery state are also stored locally.

Optional identity and notifications

Nobody mode needs no account, email address or password. The currently offered optional sign-in methods are Google, Apple and email sign-in links, which let you save and recover a profile across devices. Facebook and password signup/reset are not offered in the current app interface. Firebase Authentication processes your provider identity, email address when supplied, linked methods and authentication credentials/session state. Cloudflare stores the verified provider-to-player mapping and app session fingerprints, rather than the provider email address or raw Firebase token. Each selected sign-in provider applies its privacy policy.

Active Firebase Authentication, Messaging and Google Sign-In SDK processing includes device and user identifiers, operational diagnostic information, and other technical and usage information for app functionality and SDK operational analytics. Some records are associated with user or device identifiers; the technical inventory also includes unlinked diagnostic data. This processing is separate from multiplayer statistics and may occur while advertising delivery is disabled. Not explicitly initializing the Firebase Analytics product does not exclude operational analytics inside these other SDKs.

The first save preserves your player ID, name, avatar, archive, friends and statistics. If an account already exists, you choose whether to use it or explicitly merge your current Nobody profile. Confirmed merges keep original purchase ownership and accounting evidence while linking access to the saved account. Cloudflare remains authoritative for gameplay, profiles, social relationships, statistics and commerce.

Social notifications are off initially and use the enabled Firebase Cloud Messaging (FCM) service after you opt in. You choose game invitations and friend requests separately on Android, iOS and supported web browsers. Registration stores an installation ID, installation-credential fingerprint, permission, platform, categories and FCM token. Google processes Firebase installation identifiers and delivery information; iOS delivery uses Apple APNs and web uses browser push services. Messages contain generic copy and event/owner IDs, never private room codes, board values or credentials. The app fetches a room code only after authenticated validation.

Social event records and pending send jobs expire at their event deadline. Logout, token/owner changes and deletion remove obsolete routes and jobs. Native Daily reminders are scheduled only on your device through Expo Notifications; their time and timezone-sensitive schedule are not uploaded to FCM. Web has no Daily reminder scheduler.

Saved account profiles are retained until deletion and do not use the Nobody inactivity expiry. App account device sessions expire 30 days after issue unless renewed. Signing out creates a separate Nobody profile without deleting the saved account. Account deletion requires recent sign-in; an Apple-linked account additionally requires fresh Apple confirmation and revocation before server deletion. The server removes linked private data and notification routes atomically and queues Firebase Auth user deletion for retries. Local confirmation does not establish provider completion. Firebase and other providers apply their own backup/security retention; removing a push route does not guarantee removal of every provider installation or diagnostic record. See Firebase's privacy information.

Crash diagnostics in native apps

Native builds that include Firebase Crashlytics automatically send crash reports and selected non-fatal errors to Google to diagnose reliability problems. Reports include stack traces and exception text, app version, operating system and device details, installation and session identifiers, and relevant technical app state.

Our custom diagnostic context contains the app version, environment and a fixed startup stage. We do not deliberately attach your display name, email, account ID, game session credential, room codes, board values or social graph. Automatic exception text and stack traces are generated by the SDK. This feature does not enable Firebase Analytics or its user-action breadcrumbs.

Google states that Crashlytics retains crash traces and associated identifiers for 90 days before starting removal from live and backup systems. Deleting a Sudoku profile does not automatically erase these separate diagnostic records. Contact support for diagnostic-data questions. See Firebase's privacy information.

How we use information

• Run synchronized multiplayer games, validate moves and determine results on the server.
• Restore your Nobody profile or optional saved account and show your rooms, archive, statistics and leaderboard position.
• Deliver consent-based social features, including friend requests and presence for accepted friends.
• Enforce room and message limits, prevent abuse and keep the service reliable.
• Respond to support, privacy, access or deletion requests you choose to send.

What other players can see

Room participants can see your display name, avatar, race color, connection state, progress, mistake status, preset reactions and match result. Leaderboards show public profile labels, aggregate performance and your manually selected region where used. Accepted friends can also receive social presence.

After completing their own browser Daily puzzle, players can see other completed Daily results, including display names, finishing times, mistake counts and ranking. Daily results are hidden from a player until that player completes the attempt.

Your digits and notes remain private from other players. A player may ask to reveal the positions of cells you have filled; sharing happens only if you accept and lasts a few seconds. Spectators see colored progress positions, not private cell values.

There is no free-text chat or contact-book access. Optional sign-in does not upload your address book. Use a non-identifying display name if you do not want your real name to be public.

Storage and retention

Your local name, app session credentials and installation proof are stored in browser storage on the web and secure device storage on iOS and Android. Firebase SDKs separately persist their authentication state and, when enabled, messaging registration state.

Each game website keeps its own browser storage, Nobody credentials, local progress, consent choices and notification permissions. Opening another game website does not transfer these records. Signing in to the same saved account can recover its server records, but does not transfer local Practice progress or browser permissions.

• Waiting rooms expire after up to 2 hours without an update.
• Active and finished rooms expire after up to 24 hours without an update.
• A Nobody profile that is disconnected and has no room memberships is removed after 30 days of inactivity unless it has a purchase record, nonzero credit balance, pending reward confirmation or active manual VIP grant.
• Saved account profiles are retained until deletion, independently of the 30-day expiry of account device sessions.
• Each profile keeps at most 50 archived matches. Confirmed merges also retain provenance for historical statistics that cannot be fully reconstructed from that archive.
• The server profile keeps up to seven browser Daily attempts. Starting another Daily attempt replaces the oldest retained attempt once that limit is reached. Profile/account deletion also removes its server Daily attempts.

Clearing browser storage or Android app data removes the local token. On iOS, Keychain-backed secure storage may survive uninstall and reinstall with the same bundle identifier, although this is not guaranteed. Uninstalling is not a reliable way to delete your server profile. Server data follows the retention rules above unless you delete it earlier.

Commerce records maintain balances and entitlements. Confirmed account merges link access without rewriting original purchase ownership. Server deletion removes the relevant wallets, credit history and account-owner links, and removes the player association from receipt digests. Unlinked digests and refund state remain to prevent duplicate grants. Unconfirmed ad intents are removed after their callback window.

An unsaved Nobody profile depends on its device credential; losing it may prevent recovery. When sign-in is configured and enabled, an already saved account can be recovered through a linked sign-in method. Only an explicitly confirmed merge from your current Nobody profile into your verified account combines those profiles. Signing out or reinstalling does not itself delete a saved account.

Service providers and links

Cloudflare hosts the game server, website, WebSocket transport and security layer, and may process network metadata for those services. Apple, Google and Expo may process information when they build, distribute or operate their respective app services; those activities are subject to their own policies.

Optional EQR room-invitation delivery is disabled until configured. If enabled, it receives the room-invitation link and a stable allocation identifier, not your session token, display name, email address, board values or social graph.

The installer QR uses only the public installation URL. It does not contain your session token, display name or game board. Opening or scanning provider-delivered links may expose network metadata to that provider and to the destination service.

We do not sell personal information. Optional monetization uses Google AdMob in native apps, Google AdSense on sudoku.vircit.com, and Apple App Store or Google Play billing. Features remain disabled until configured and tested. When ads are enabled, Google may process device, network, storage and ad-interaction information. Consent is requested where required before ad requests; native ad requests are non-personalized. Available advertising privacy controls appear in Shop. The app does not request the iOS tracking permission. Optional saved profiles currently use Firebase Authentication with Google, Apple or email sign-in links; Facebook and password signup/reset are not offered. Social notifications use direct FCM with APNs or browser push delivery; Daily reminders stay on the device. Auth, Messaging and Google Sign-In providers process operational diagnostics and analytics as described above. The source does not initialize the Firebase Analytics product, and automatic Meta app events and advertiser-ID collection are disabled. These settings do not exclude other active SDK operational processing. There is no free-text chat or address-book upload.

Android test builds may use Qonversion for purchase analytics. It processes its own anonymous identifier, store transaction and purchase-token information, and technical information such as device, app and network metadata. Its Android privacy mode disables advertising-identifier collection. We do not send your display name, game session token or social graph to Qonversion. Our server determines your in-game balance and purchases.

Server-profile deletion does not automatically delete Qonversion's separate analytics record. Contact support for help with provider data access or deletion. See Qonversion's privacy policy.

International processing

Service providers may process information in countries other than the country where you live. For information about international processing and applicable transfer safeguards, contact support@kono.dev.

Your choices and deletion

• Edit your display name, avatar, color or manual region in Profile.
• Decline cell-sharing requests, or disable cell sharing when creating a room.
• Block or unblock players from the in-game player list. Blocking hides that player's public label and progress and removes friendship or pending requests.
• Use Settings → Profile → Export server data to obtain the current profile's gameplay/social data, wallet, banner entitlement and recent commerce audit records, including linked accounting for a saved account. The export also includes identity methods, account-device expiry, notification-registration metadata and merge provenance where applicable. Each commerce section includes up to 1,000 recent records and states the total and whether older records are omitted. Provider receipt hashes, purchase tokens, push tokens and credentials are excluded.
• For Nobody, use Settings → Profile → Delete Nobody profile while connected. For a saved account, use Delete account after recent sign-in and finish any active race, purchase or reward first. Deletion removes the profile's server friends, archive, statistics, balances, banner entitlements and notification routes; account deletion also removes linked private accounting and all account sessions. Deletion does not request a store refund. Other players keep their own match records, with your identifying labels replaced by “Deleted player” where retained.

Server deletion removes its browser Daily attempts but does not remove local Solo/Practice or native Daily progress, pencil notes, pending-move recovery state, achievements or settings. Local data must be cleared separately. See the deletion instructions for the in-app route and email alternative.

For access, correction, deletion or other privacy questions, email support@kono.dev. Do not send session tokens, passwords, sign-in links, installation secrets or store credentials. We may request limited non-secret details to identify the correct profile.

Your data protection rights

Under applicable data protection law, and subject to the relevant conditions, you may have the right to request:

• Access to your personal information.
• Correction of inaccurate or incomplete personal information.
• Erasure of your personal information.
• Restriction of processing.
• A portable copy of your personal information where the right to data portability applies.
• An objection to processing where it is based on legitimate interests.

To make a request, email support@kono.dev. We may need limited non-secret details to verify that the request relates to the correct profile. Do not send session tokens, passwords, sign-in links, installation secrets or store credentials. If you have lost an unsaved Nobody credential, we may be unable to identify its server record without reliable evidence linking your request to that profile. A saved account may be recovered through a linked sign-in method when that provider is available.

You may also complain to your local data protection authority. You do not have to contact us before making a complaint.

Children and changes

Sudoku Mates is a general-audience puzzle game and is not designed specifically for children. No contact details are required to play. Avoid putting personal or contact information in your public display name.

We may update this policy when the product or service providers change. The updated date appears at the top of this page.

Contact

Operator: VIRCIT OU
Support and privacy: support@kono.dev