Privacy Policy

Sudoku - Mind Puzzle

Effective 24 September 2026. This replaces the version dated 20 September 2026.

1. Who we are

Sudoku - Mind Puzzle ("the app") is published by ChillWithNaFu Games LLC ("we", "us"). We are the company responsible for the information described here — in European terms, the data controller.

You can reach us at any time at chillwithnafu@gmail.com, or by post at ChillWithNaFu Games LLC, 2222 W Grand River Ave, Ste A, Okemos, MI 48864, United States.

2. What the app collects automatically

Gameplay analytics

The app uses Google Analytics for Firebase to understand how the game is played — which difficulty levels people choose, where they get stuck, which features go unused. These are counts and events, not a diary. Typical examples:

• a puzzle was started, completed, abandoned or lost, with its difficulty and how long it took
• a hint, AutoFill, Smart Eliminate, skip or continue was used
• a screen was opened, a setting was changed, a theme was selected
• a daily challenge was played and a streak continued or broken
• an ad was requested, shown or failed to load
• a purchase or subscription was completed

There is no free-text field anywhere in the app, so there is nothing you can type that could end up in an analytics event.

Alongside those events, the app records a small set of properties describing your installation: the app version; how many days since you installed and how many sessions you have played; whether you currently subscribe; puzzles completed and current streak; the first difficulty you picked; your iOS tracking-permission answer; which experiment group you are in; and two fields that describe the build rather than you — app_environment and install_source. Those last two record whether the app is a production release, a TestFlight beta, a simulator, a developer build, or a copy installed outside an app store, and which store it came from. They exist so we can keep our own testing out of the real numbers. A related field, app_env, is attached to every analytics event for the same reason. None of these identify you.

Firebase itself also collects standard technical information: device model, operating system version, language and region, a random app-instance identifier that Google generates, an approximate location worked out from your IP address (country or region level — see section 4), and, on Android, your advertising ID unless you have limited it.

We never assign you a user ID. The app has no account system and does not set a customer identifier of its own.

Crash reports

Firebase Crashlytics records a report when the app crashes or hits an error we are tracking. A report contains the technical stack trace, your device model, operating system version, app version, and whether the app's local storage loaded correctly. It does not contain a user identifier and it does not contain anything you typed, because there is nothing to type.

Settings we send to your app

Firebase Remote Config lets us turn features on and off, and adjust things like ad frequency, without shipping an update. When the app asks for its settings, the request carries a Firebase installation identifier so Google can answer it. No gameplay information is sent.

Reminders and notifications

The app only asks for notification permission when you tap something that needs it — never on first launch. If you allow notifications, Firebase Cloud Messaging registers a notification token with Google for your device and adds the device to a general group so we can send occasional reminders. That token is not sent to any server of ours, because we do not have one. If you turn notifications off in the app's settings, the token is deleted and the device leaves the group.

Some reminders — a daily challenge nudge, a streak warning — are scheduled entirely on your phone. To get the timing right the app reads your device's time zone. That stays on the device.

3. What you give us

Nothing, unless you choose to write to us. If you email chillwithnafu@gmail.com from inside the app or otherwise, we will have your email address and whatever you put in the message, and we will use it only to answer you.

4. What we do not collect

Stated plainly, because the previous version of this policy got it wrong:

• No location. The app requests no location permission on either platform and contains no location software. Firebase and the ad networks can estimate your country or region from your IP address, which every internet service can do, but the app never asks your device where it is.
• No contacts, no calendar, no camera, no microphone, no photos. No permission is requested for any of these and no code in the app uses them.
• No accounts, no login, no social sign-in. There is nothing to create and nothing to sign into.
• No name, email address, phone number or postal address is ever requested by the app.
• No payment details. Card and billing information goes to Apple or Google. We never see it.

The only permissions the app declares are: billing (to sell in-app purchases), notifications, and restarting reminders after your phone reboots. On iPhone, the only permission prompt the app can show besides notifications is the Apple tracking prompt described below.

5. Advertising, and your choices about it

The free version of the game is paid for by advertising. We use Appodeal, which is a mediation service: it runs an auction among many ad networks for each advertising slot and shows the winner. The list of those networks is in section 8.

To do that, the advertising system receives:

• your device's advertising identifier — on iPhone and iPad only if you allowed tracking (see below), and on Android unless you have turned off or reset it in system settings
• your IP address, and the approximate location derived from it
• your device model, operating system and app identifier
• how you interacted with the ad, and your privacy choices

We also record how much an ad impression earned, along with which network and placement it came from, in Firebase Analytics. That is revenue measurement, not a record of you.

The iPhone tracking prompt

The first time you open the app on an iPhone or iPad, and before any advertising software starts, iOS shows Apple's App Tracking Transparency prompt asking whether the app may track you across other companies' apps and websites. If you say no, your advertising identifier is not made available and ads become less relevant — they do not go away. Android has no equivalent prompt.

The consent form in Europe and the UK

Where the law requires it, a consent form appears before any advertising loads, and your answer is passed to the ad networks. It is run by Appodeal's consent manager, which supports the IAB Transparency and Consent Framework and Google's User Messaging Platform.

Rewarded video

Some ads are rewarded videos you choose to watch in exchange for a hint or a power-up. Choosing to watch one does not give us or our partners any information about you beyond what is described in this policy.

If you subscribe or buy the ad-removal upgrade

Banner ads and the full-screen ads between puzzles stop. Optional rewarded video remains available if you choose to watch one. We do not describe this as "no ads", because that would not be true.

6. Purchases and subscriptions

All purchases go through the App Store or Google Play. They handle payment; we never receive your card details, billing address, or Apple ID / Google account.

What happens on our side:

• Your device stores which products you own, how many power-ups you have left, your subscription tier and expiry date, and the store's transaction identifiers. This is what stops you being charged twice for the same thing.
• Receipts are checked on your device. We have no server, so no receipt is ever transmitted to us.
• When a purchase completes, an analytics event is sent to Firebase containing the product identifier, the price, the currency, the store's transaction identifier, and whether the purchase came from a real store or a test environment. This is how revenue is measured. It contains no payment details and no name.

7. What stays on your device

The following is stored only on your phone or tablet, in the app's private storage:

• your current puzzle, including notes and elapsed time
• your statistics — games played and won, times, streaks, scores, best times
• your settings and preferences, including your chosen theme
• tutorial progress and daily challenge progress
• your purchase records and power-up balances, plus a backup copy of those purchase records saved as a plain file inside the app's own documents folder, so your purchases survive if the main storage is damaged

None of this is sent anywhere. Depending on your settings, your phone's own backup system (iCloud Backup or Android Auto Backup) may include it in a device backup; that backup belongs to Apple or Google and your account, and we have no access to it. Uninstalling the app removes all of this from the device.

8. The companies we rely on

We do not sell your information to data brokers. The companies below receive information because they provide a part of the app, and each handles it under its own privacy policy.

Platform and infrastructure

Advertising

We have a direct relationship with one advertising company, Appodeal, which provides the mediation, the bidding software and the consent manager. We do not have accounts or contracts with the networks below.

They are listed anyway because of how mediation works: when an ad slot comes up, Appodeal runs an auction and passes your ad request to these networks, each of which receives your information and decides for itself how to use it. They are not simply Appodeal's subcontractors. We think you are entitled to know who actually receives your data, not just who we happen to pay.

The networks built into this version of the app:

This list reflects the networks compiled into the current version of the app, and we update it when that changes. Appodeal also publishes its own current partner list in its privacy policy, and the consent form shown in Europe and the UK lets you see and set your choices for each participating vendor individually.

9. Where your information goes

The companies above operate globally and may process information on servers outside your country, including in the United States.

Where information about people in the UK, EU, EEA or Switzerland is transferred to the United States, our providers rely on one of the following: an adequacy decision; certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions — Google, which runs Firebase, is certified under it; or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum where a provider is not certified. Each provider's own policy, linked above, describes the safeguards it applies.

10. How long information is kept

11. Your choices and controls

• Ad tracking on iPhone or iPad. Settings → Privacy & Security → Tracking. You can withdraw permission at any time.
• Ad tracking on Android. Settings → Google → Ads, where you can reset or delete your advertising ID. Deleting it cuts the link between your device and the advertising profile built on it.
• Consent in Europe and the UK. See the note in section 5. Email us to withdraw until the in-app screen ships.
• Notifications. Turn them off in the app's settings, or in your device settings. Turning them off in the app deletes the notification token.
• Everything at once. Uninstalling the app stops all collection immediately and erases everything the app stored on your device.
• Do Not Track and browser opt-out signals. The app is not a web browser. It cannot receive "Do Not Track" or Global Privacy Control signals, because those are sent by browsers and there is no equivalent for a mobile app. The device settings above are the working opt-out, and they apply immediately.

We do not currently offer an in-app switch to turn analytics or crash reporting off. We would rather say so than imply a control that does not exist.

12. Deleting your information

This needs an honest explanation, because our situation is unusual.

The app has no account, no login and no server-side profile. We hold nothing filed under your name, because we never learn it. The only identifiers that exist are pseudonymous and tied to a device: a random installation identifier generated by Google, and — unless you have limited it — your device's advertising ID.

What that means in practice:

• Uninstalling the app immediately and permanently removes everything stored on your device, and stops any further collection.
• Resetting or deleting your advertising ID in your device settings breaks the link between your device and the advertising profile built around it.
• To have analytics or crash records removed from our systems, email us. We will need something that identifies the records — realistically your advertising ID or the Firebase installation ID — and we will delete matching records or confirm they have already aged out under the retention periods above.

Data-protection law recognises this position: where a controller genuinely cannot identify a person from the information it holds, and cannot verify a request against a specific individual, it is not required to acquire more information about you purely in order to comply. We will not start collecting identifying information just to be able to process deletion requests. If you can give us an identifier, we will act on it.

13. If you are in the UK, EU, EEA or Switzerland

You have the right to ask for access to your information, to have it corrected or deleted, to restrict or object to how it is used, to receive a copy in a portable form, and to withdraw consent at any time. You also have the right to complain to your national data protection authority.

Please read section 12 first: it explains what we can realistically do when we hold no identifying information about you.

The legal bases we rely on:

Profiling and automated decisions. Choosing which ad to show you is automated and is a form of profiling. It has no legal or similarly significant effect on you — it changes which advert appears, nothing else. We do not make any decision about you by automated means that affects your rights, your access to the app, or what you pay.

14. If you are in the United States

Depending on where you live, state privacy laws may give you rights over your information. These include California, Colorado, Connecticut, Virginia, Texas, Utah, Oregon and a growing number of other states. Broadly, you may have the right to know what is collected, to get a copy, to have it deleted or corrected, and to opt out of targeted advertising. Again, section 12 explains what we can do without an account.

Advertising and the word "sale"

Categories of information involved

Under California law, the categories are: identifiers (advertising ID, installation ID); commercial information (which products you have bought); internet or app activity (the gameplay events in section 2); coarse geolocation inferred from your IP address; and device diagnostics. These are used for the purposes described throughout this policy, and are disclosed to the companies listed in section 8. We do not collect sensitive personal information, and we do not knowingly collect or share the information of anyone under 16.

Nevada

Nevada residents may ask us to confirm that we do not sell personal information for monetary consideration. We do not. Email chillwithnafu@gmail.com if you would like that confirmed in writing.

We will not treat you differently for exercising any of these rights — the app works the same either way.

15. Children

Sudoku - Mind Puzzle is a general-audience puzzle game. It is not directed at, and not intended for, children under 13 — or under the minimum age of digital consent where you live, if that age is higher. We do not knowingly collect information from children under that age.

If you believe a child has used the app and you would like their information removed, contact us at chillwithnafu@gmail.com and we will delete what we can identify. Please read section 12 so you know what to expect.

16. Security

Information stored on your device is protected by your device's own security — your passcode, and the operating system's app sandboxing. Information in transit to Firebase, the stores and the ad networks travels over encrypted connections.

Because we run no server and hold no account database, there is no central store of player information to be breached. That is a deliberate design choice, not an accident. It is also the reason the protections above depend partly on you keeping your device secure and up to date.

17. Changes to this policy

We will update this page when the app changes. The effective date at the top always tells you which version you are reading. If a change is significant, we will say so in the app. Continuing to use the app after a change means you accept the updated policy.

18. Contact us

Questions, requests or complaints about privacy:

ChillWithNaFu Games LLC
2222 W Grand River Ave, Ste A
Okemos, MI 48864
United States
chillwithnafu@gmail.com

We aim to reply within 30 days.