Privacy Policy

Nonogram Odyssey is a logic puzzle game available on Android (Google Play) and at nonogramodyssey.com. This policy covers:

• The mobile application distributed on Google Play
• The website at nonogramodyssey.com
• Any related features, services, or communications

2.1 Information You Provide

2.2 Collected Automatically

We use collected data for the following purposes:

• Operate & deliver the service — run the game, sync progress, manage accounts
• Personalise your experience — remember preferences, suggest difficulty levels, restore purchases
• Process transactions — verify and restore in-app purchases via Google Play
• Send service communications — account confirmations, password resets, important policy updates
• Customer support — respond to inquiries and troubleshoot issues
• Analytics & improvement — understand feature adoption, fix bugs, prioritise new features
• Advertising — serve relevant ads through third-party ad networks (see Section 6)
• Security & fraud prevention — detect abuse, protect accounts, enforce our Terms
• Legal compliance — meet legal obligations and respond to lawful requests

We do not sell your personal information. We share data only in these limited circumstances:

• Service providers — cloud hosting, analytics, crash reporting — under binding data processing agreements
• Advertising partners — ad SDK providers that serve ads in the app (see Section 5)
• Legal requirements — when required by law, court order, or to protect user safety
• Business transfers — in a merger or acquisition, with advance notice before any policy change
• With your consent — for any other purpose, only with your explicit permission

We integrate the following SDKs and platforms. Each has its own privacy policy:

The free version of Nonogram Odyssey is ad-supported via Google AdMob:

• AdMob may show banner, interstitial, and rewarded video ads during gameplay.
• AdMob may use your Android Advertising ID (GAID) to serve personalised ads.
• Opt out: Android 12+ → Settings → Google → Ads → Delete advertising ID. Older Android → Opt out of Ads Personalization.
• You may still see contextual (non-personalised) ads after opting out.
• Purchasing the ad-free upgrade removes all ads and disables ad-SDK collection for your account.

After the retention period, data is permanently deleted or irreversibly anonymised.

• Encryption in transit — all app-to-server communication uses HTTPS / TLS 1.2+
• Encryption at rest — sensitive data is encrypted at rest on Firebase infrastructure (AES-256)
• Password security — passwords are never stored in plain text; Firebase Authentication manages secure hashing
• Least-privilege access — only authorised systems and personnel can access production data
• Regular audits — we periodically review Firestore security rules, dependencies, and configurations
• Incident response — in the event of a breach, affected users will be notified as required by law

Regardless of your location, you have the following rights over your personal data:

Email support@nonogramodyssey.com to exercise any right. We respond within 30 days. Identity verification may be required.

Account Deletion

You can request full deletion of your account and personal data at any time. See our dedicated Account Deletion page for step-by-step instructions, a full list of what gets deleted, what is retained and why, and the exact timeline. Once verified, deletion is completed within 30 days.

Additional rights and protections apply under the GDPR and UK GDPR if you are in the EU, EEA, or United Kingdom.

Legal Bases for Processing

• Contractual necessity (Art. 6(1)(b)) — account creation, game operation, purchase processing
• Legitimate interests (Art. 6(1)(f)) — analytics, security, fraud prevention, leaderboards
• Consent (Art. 6(1)(a)) — personalised advertising; non-essential tracking
• Legal obligation (Art. 6(1)(c)) — tax records; responding to lawful authority requests

Right to Lodge a Complaint

You may complain to your national supervisory authority. EU: edpb.europa.eu. UK: ico.org.uk.

California residents have specific rights under the CCPA as amended by the CPRA:

• Right to Know — request disclosure of categories and specific pieces of personal information collected, used, or disclosed
• Right to Delete — request deletion of personal information we collected (subject to exceptions)
• Right to Correct — request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing — we do not sell data; we do share identifiers with ad partners for behavioural advertising. Opt out via device ad settings or by contacting us
• Right to Limit Sensitive PI Use — we do not use sensitive personal information beyond what is necessary to provide the service
• Right to Non-Discrimination — we will not penalise you for exercising these rights

Submit requests to support@nonogramodyssey.com with subject "California Privacy Request". We respond within 45 days.

Nonogram Odyssey is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children below these ages.

• The app carries a general audience rating on Google Play and does not target children as its primary audience.
• We do not knowingly serve personalised advertisements to users under 13.
• If you are a parent or guardian and believe your child provided personal information without consent, email support@nonogramodyssey.com and we will delete it within 14 days.

Your data may be stored and processed in countries other than your own — including the United States, where Google / Firebase maintain data centres.

For transfers from the EEA or UK to countries without an adequacy decision, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreements (IDTAs) for UK transfers
• Transfers to providers certified under recognised adequacy frameworks

When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Display an in-app notification on next launch
• Send an email notification to registered users for significant changes

Continued use after the effective date constitutes acceptance. If you disagree, stop using the app and request account deletion.

For privacy questions, concerns, or data requests, please contact us. We respond within 30 days.