1. Data Controller & Contact Information
For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the California Consumer Privacy Act (CCPA/CPRA), Apple App Store Review Guidelines, and Google Play Developer Program Policies, the data controller is:
2. Information We Never Collect
Tallyslate is designed around privacy minimization and offline-first play. You are never required to create a personal account or provide your real identity to play. Specifically, we never collect, request, or access:
- Your real name, email address, phone number, or physical mailing address (unless you voluntarily email our support team).
- Precise or coarse GPS/device location data (no location permissions are requested on iOS or Android).
- Contacts, address book entries, call logs, SMS messages, camera, microphone, or photo library files.
- Biometric, health, financial account numbers, or payment card numbers (all in-app purchases are processed directly by Apple StoreKit 2 on iOS and Google Play Billing on Android).
3. Categories of Data Processed & Purpose
Depending on which features you use and the consent choices you make in the User Messaging Platform (UMP), Apple App Tracking Transparency (ATT), or in-app Privacy Settings dialog, Tallyslate processes the following limited categories of technical and gameplay data:
3.1 On-Device Local Storage (iOS UserDefaults & Android Jetpack DataStore)
Your active 8×8 board state, local high score, daily streak counter, coin balance, booster inventory, and audio/haptic preferences are stored locally on your device inside iOS UserDefaults or Android Jetpack DataStore (block_blitz_prefs). This data remains on your device and can be cleared at any time via Settings → Delete My Account & Data or by uninstalling the app.
3.2 Competitive Leaderboards & Anti-Cheat Verification (Firebase)
When you participate in global leaderboards or Championship Tourneys, the app uses Firebase Anonymous Authentication to generate a random, pseudonymous installation identifier (uid) with no personal profile information attached. When you submit a score, our Cloud Functions receive:
- Pseudonymous UID & Display Alias: Your anonymous UID and an optional 3–16 character player handle (defaulting to
Player-XXXX). - Deterministic Replay Payload: The 64-bit random seed, your claimed score, and the compact move log of block placements and booster activations so our server-side
ReplayVerifiercan deterministically verify that the game was played fairly.
3.3 In-App Purchases (Apple StoreKit 2 & Google Play Billing)
When you purchase coin packs or starter bundles, the transaction is handled entirely by Apple App Store (StoreKit 2) on iOS or Google Play Billing on Android. We never see or store your credit card or banking details. Our backend receives only the cryptographic JWS transaction / purchaseToken, productId, and orderId to verify entitlement and credit your in-game balance idempotently.
3.4 Optional Rewarded Ads & Consent Management (Apple ATT, Google UMP & AdMob)
Tallyslate has zero forced mid-game ads. If you choose to watch an optional rewarded video ad to earn free coins, the ad SDK may process your device's advertising identifier (IDFA on iOS only when authorized via Apple's App Tracking Transparency framework; AAID on Android), coarse IP-based country/region, and ad reward completion events for ad delivery and fraud prevention. In the EEA, UK, and applicable US states, explicit consent is requested before any personalized ad request is made.
3.5 Crash Reporting & Performance Diagnostics (Firebase Crashlytics & Analytics)
Subject to your analytics consent toggle in Settings, we use Firebase Crashlytics and Firebase Analytics to collect anonymized crash stack traces, device model/OS version, and aggregate gameplay telemetry (such as session start and game-over counts) to fix bugs and maintain 60 FPS stability.
| Data Category | Data Type | Processor / SDK | Purpose & Legal Basis | Encrypted in Transit |
|---|---|---|---|---|
| App Activity | Score, 64-bit RNG seed, move log, player alias | Google Cloud Firestore & Cloud Functions | Leaderboard ranking & anti-cheat verification (Contract / Legitimate Interest) | Yes (TLS 1.3) |
| Device or Other IDs | Anonymous Firebase UID | Firebase Authentication | Pseudonymous session security & cloud save (Legitimate Interest) | Yes (TLS 1.3) |
| Financial Info | Google Play purchaseToken & orderId |
Google Play Billing API | Fulfilling virtual coin/bundle purchases (Performance of Contract) | Yes (TLS 1.3) |
| Device or Other IDs | Advertising ID (AAID) & ad reward events | Google AdMob / UMP SDK | Optional user-initiated rewarded video ads (Consent via UMP / Settings) | Yes (TLS 1.3) |
| Crash Logs & Diagnostics | Stack traces, ANR reports, device model/OS | Firebase Crashlytics & Analytics | App stability & bug resolution (Consent / Legitimate Interest) | Yes (TLS 1.3) |
4. Data Retention & How to Delete Your Data
We provide both instant in-app self-service deletion and a web/email deletion request channel in full compliance with Google Play's User Data Deletion requirements, GDPR Article 17 (Right to Erasure), and CCPA.
Option A — Instant In-App Deletion (Recommended)
- Open Tallyslate on your Android device.
- Tap the Settings (Gear Icon) in the top navigation bar.
- Scroll to the Privacy & Data Controls section and tap "Delete My Account & Data".
- Confirm deletion. The app immediately deletes your cloud leaderboard entries, tournament records, and anonymous Firebase UID, and wipes all local Jetpack DataStore preferences on your device.
Option B — Web / Email Deletion Request (Without the App Installed)
If you have already uninstalled the app and wish to delete any remaining pseudonymous leaderboard or tournament records associated with your Player Alias or Anonymous UID:
Tallyslate Data Deletion Request and include your in-game Player Alias (e.g., Player-4821) or Anonymous UID. We process all verifiable erasure requests within 7 calendar days (and always within the statutory 30-day maximum).
5. Your Privacy Rights (EEA, UK, and California)
Depending on your jurisdiction, you have the right to:
- Withdraw Consent at Any Time: You can toggle Analytics, Crash Reporting, and Personalized Ads on or off at any time in Settings → Privacy & Consent inside the app, without affecting your ability to play.
- Access, Portability & Erasure: Request a copy of the pseudonymous data linked to your UID or erase it immediately using the in-app deletion button.
- Do Not Sell or Share My Personal Information (CCPA/CPRA): We do not sell personal information for monetary consideration. You can opt out of personalized advertising sharing at any time via the in-app privacy toggle or Android OS settings (Settings → Google → Ads → Delete advertising ID).
- Supervisory Authority Complaint: UK residents may contact the Information Commissioner's Office (ICO at ico.org.uk), and EEA residents may contact their local Data Protection Authority.
6. Children's Privacy & International Transfers
Tallyslate is a general-audience spatial strategy puzzle game and is not directed to children under the age of 13 (or under 16 in applicable EEA jurisdictions). We do not knowingly collect personal data from children. If you believe a child has submitted information to us, please contact brand@tallyslate.com and we will promptly delete it.
Cloud services provided by Google LLC (Firebase and Google Cloud Platform) may process pseudonymous technical data on servers located in the United States or the European Union under the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the DPF, and Standard Contractual Clauses (SCCs).