Privacy Policy
1. Summary
- No account is required. The whole game is playable as a guest, and guest play sends no gameplay data anywhere.
- Cloud save is optional. If you tap Continue with Google, we store a copy of your progress under your account so it can be restored on another device.
- Purchases go through Google Play. We never see your payment details; our own server verifies each coin-pack purchase with Google Play and records it.
- The current version contains no advertising SDK. Its "ads" are placeholders generated inside the app, and no data is collected or shared for advertising.
- No analytics or crash-reporting SDK is included.
- You can delete your account and its cloud data in the app (Settings → Account → Delete account) or by e-mail — see Account deletion.
2. Who is responsible
Yiğiter Labs is the developer of Sudoku: Classic & Beyond and the controller of the personal data described here. Contact: yigiterlabs@gmail.com.
3. Data that stays on your device
The app keeps the following in its private storage on your device only: puzzles in progress and history, notes, mistakes, statistics, streaks, daily-challenge progress, awards, coin and hint balances, unlocked themes, settings, language and accessibility preferences, and any purchase receipts awaiting verification. Unless you sign in, none of this is transmitted to us. Uninstalling the app (or clearing its data in Android settings) deletes all of it; we have no copy and cannot restore it.
4. Optional account and cloud save
When you tap Continue with Google in Settings, the app uses Google Sign-In (Google Play services) to obtain a sign-in token and signs you into Firebase Authentication, a Google LLC service. We then process:
- your Firebase user ID, your Google account e-mail address and display name (to identify your save and to show who is signed in);
- your game progress, stored in Cloud Firestore under your user ID: per-device coin and hint ledgers, statistics, daily-challenge history and streak, earned awards, unlocks earned with coins or ads, gameplay settings, synced presentation preferences, tutorial flags and bookmarks. Puzzles in progress are not synced.
Anonymous identity for coin purchases. If you buy a coin pack without signing in, the app creates a Firebase anonymous user — an opaque identifier with no name, e-mail or Google account behind it — because purchased coins are verified and credited by our server and must belong to an account. Signing in with Google later upgrades that identifier into your account. The identifier lives in the app's storage on your device; uninstalling the app loses it (the record on our side can be deleted as described in section 10).
Cloud-save data is used only to back up and synchronise your own progress. It is never used for advertising and never shared with other players. Firebase stores it on Google Cloud infrastructure; Google's terms are at firebase.google.com/support/privacy.
5. In-app purchases
The app offers optional one-time purchases (Remove Ads, Zen Mode, two coin packs, two cosmetic themes). Payment is handled entirely by Google Play Billing; we never receive your card or billing details. There is no third-party purchase-management provider.
To confirm that a coin-pack purchase is genuine and to deliver it, the app sends the purchase to our own Firebase Cloud Function, which checks it against the Google Play Developer API and then records it in our Firestore database. What we store:
- the Google Play purchase token for that purchase, in a server-only record no app or user can read, and its SHA-256 hash, which is the key everything else uses;
- the product bought, the quantity, the number of coins granted, Google's order ID when it provides one, and the times the purchase was credited and consumed;
- a billing alias — a one-way SHA-256 hash of the account identifier that started the purchase. It is not your name, e-mail or Google account ID; it exists so a purchase can be tied to the account that made it and cannot be claimed by another.
Permanent purchases (Remove Ads, Zen Mode, themes) are restored from Google Play itself, not from our database. Purchase records are not used for advertising and are not shared with anyone.
6. Advertising
The version of Sudoku: Classic & Beyond this policy covers contains no advertising SDK. The "advertisements" it shows (a placeholder interstitial between puzzles and optional placeholder rewarded ads) are drawn by the app itself, make no network requests, do not use the Android advertising ID, and collect or share nothing. You can remove them with the Remove Ads purchase.
If a future version introduces third-party advertising (for example Google AdMob), we will update this policy before that version is released, with the data such an SDK collects, the consent choices offered, and how to opt out.
7. App updates and diagnostics
At launch the app may check for updates to its JavaScript bundle through Expo Application Services (EAS Update), operated by 650 Industries, Inc. That request carries the platform, the app's runtime version, the update channel and a random installation identifier; it carries no personal data and no gameplay data. Expo's privacy policy is at expo.dev/privacy.
The app includes no analytics and no crash-reporting SDK. Google Play may show us aggregated crash and performance statistics for the app through the Play Console, as described in Google Play's own terms.
8. Purposes and legal bases
| Processing | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Account sign-in and cloud save | Back up and synchronise your progress at your request | Performance of a contract (Art. 6(1)(b)); consent, by choosing to sign in |
| Purchase verification and records | Deliver what you bought, prevent fraud and duplicate credits, handle refunds and bookkeeping | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests in fraud prevention (Art. 6(1)(f)) |
| Update check | Keep the app working and current | Legitimate interests (Art. 6(1)(f)) |
9. Service providers
| Provider | Service | Role | Their policy |
|---|---|---|---|
| Google LLC | Firebase Authentication, Cloud Firestore, Cloud Functions (hosted on Google Cloud) | Processor for our backend | firebase.google.com/support/privacy |
| Google LLC | Google Sign-In (Google Play services), Google Play Billing, Google Play Developer API | Independent controller for your Google account and payments | policies.google.com/privacy |
| 650 Industries, Inc. (Expo) | EAS Update | Processor for update delivery | expo.dev/privacy |
| Cloudflare, Inc. | Hosts this website (Cloudflare Pages) | Processor for this website's delivery and standard server logs | cloudflare.com/privacypolicy |
We do not sell personal data and we do not share it for cross-context behavioural advertising.
10. Retention and deletion
- On your device: until you uninstall the app or clear its data.
- Account and cloud save: until you delete your account. You can do that in the app (Settings → Account → Delete account, or Delete cloud data for an anonymous purchase identity) or by e-mailing yigiterlabs@gmail.com — see Account deletion. Deletion removes the Firebase user and the whole cloud-save document, including the purchased-coin balance.
- Purchase records after deletion: the raw purchase token is removed immediately. A pseudonymous record — product, quantity, coins granted, Google order ID, timestamps, the hashed token and the hashed billing alias — is retained for as long as needed to honour refunds, keep a spent purchase from being credited twice, and meet bookkeeping obligations. It contains no name, e-mail or Google account ID.
11. Security
All traffic between the app and Google's services uses TLS. Cloud-save documents are protected by Firestore security rules that allow access only to the signed-in owner; purchase-token records are readable by no client at all, only by our server code. No method of storage or transmission is completely secure, so we limit what we process to what the features above require.
12. Children
Sudoku: Classic & Beyond is a general-audience puzzle game. It is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from them. The "Beginner" difficulty for the 6×6 board is a difficulty label, not a children's mode. If you believe a child has provided personal data through the optional sign-in, contact us at yigiterlabs@gmail.com and we will delete it.
13. Your rights
Depending on where you live — including under the GDPR, the UK GDPR, the CCPA/CPRA and Türkiye's KVKK — you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, to withdraw consent, not to be discriminated against for exercising these rights, and to complain to your data-protection authority. To exercise them, e-mail yigiterlabs@gmail.com. To identify your data, quote the Google account e-mail you signed in with, or — for an anonymous purchase identity — the Google Play order number of a purchase. We respond within the time allowed by the applicable law.
14. International transfers
Google, Expo and Cloudflare may process data on servers outside your country, including in the United States. Where required, such transfers rely on safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as described in each provider's policy.
15. Changes to this policy
We will update this page when the app or the law changes, and change the effective date at the top. Material changes — such as adding an advertising SDK — will also be announced in the app before the version that makes them is released.
16. Contact
Yiğiter Labs
E-mail: yigiterlabs@gmail.com