LITTLE PUZZLES / PRIVACY
Privacy policy
This policy explains sign-in, rankings, optional analytics and support for Little Puzzles. Byeonggyun Oh operates the service as Yuno Studio and is responsible for privacy inquiries.
Effective: 2026-09-16
1. Age and choices
The service is for people aged 14 or older. We do not collect dates of birth or identity documents. Children under 14 should not use it. A parent who becomes aware of a child’s data may contact us to request deletion. Practice is available without sign-in. Account features and analytics are separate choices.
2. Sign-in and account information
Choosing Google or Apple uses that provider and Firebase Authentication to process account identifiers, authentication tokens and profile information supplied by the provider, including names and email addresses (including Apple private relay addresses). The Google sign-in SDK declares account information including phone numbers, device information and usage data in its privacy manifest. Our app does not directly request phone numbers, passwords or contacts, and does not use SMS authentication. Provider passwords are not sent to our game server. Our game database links a Firebase UID to a game profile; records are not automatically merged using names or email addresses.
3. Rankings and public information
Ranked play stores a profile ID, nickname, creation/visit times, country code and display preference, free-ticket history, game/rules/start/end/validation/score data, leagues and trophies. We use these for account recovery, score validation, rankings, tickets and service statistics. Nicknames, scores, positions, leagues and enabled country flags are visible to other participants. The release version displays automatically generated public names and does not offer custom-name entry or editing. Names entered in earlier tests may remain in account records but are not displayed publicly in the release version. We estimate country from the connection IP and do not store the raw IP in the game database. Providers’ connection processing is separate.
4. Fair play and connection security
Ranked input is processed for server validation; new raw move histories are not saved in the database. Older test histories are cleared when the relevant profile connects. We keep invalid-submission counts, reasons, restriction expiry, deduplication hashes and operator restriction/reversal records for security and fair play, without publishing them. Cloudflare and authentication providers may process IP addresses, request times, device/browser information and technical diagnostics for delivery, security and reliability.
5. Optional app analytics
When enabled in the mobile app, Google Analytics for Firebase processes an app-instance identifier, app/device/OS/language information, approximate IP-derived location, first opens, sessions and game selections, starts, completions, early exits, duration and save outcomes. We use this to improve games and understand usage. Data can be associated with an installation and is not completely anonymous. We do not add account UIDs, nicknames, emails, scores or move histories to analytics events. Advertising identifier collection, ad personalization and Google signals are disabled; no advertising services are linked. Choose analytics in the initial notice or change it in the app’s privacy settings. All games remain available when disabled. Earlier test builds may enable analytics by default; the same settings can disable it.
6. Device storage and website
Practice records, language, controls, audio, analytics choices and confirmation of the age notice remain on your device. Practice records are not sent to the game database. The authentication SDK maintains sign-in on the device; web game-session cookies last up to 30 days after issue. Removing the app or device data does not delete a server account. Our support, deletion and privacy pages contain no analytics scripts or forms that store request content. Website requests pass through Cloudflare.
7. Retention and deletion
Linked game records remain while an account exists; there is no automatic inactivity deletion. Account deletion removes linked operational database records. A retry UID remains until deletion completes, and a completion receipt for about 24 hours. Current D1 Free recovery backups may retain data for up to 7 days; deletions are reapplied after restoration. Firebase retains authentication IP logs for a few weeks; other authentication data may take up to 180 days to leave live and backup systems after deletion is initiated. Analytics user/event retention is set to 2 months; aggregate reports may remain separately. Support/deletion emails and verification correspondence are deleted within 30 days after resolution. Electronic records are removed from operating systems; any legal retention exception will be explained with the data, basis and period. Provider security/operational logs follow provider policies and are not all erased immediately by game-account deletion.
8. Providers and international processing
Google LLC operates Firebase Authentication in the United States. Google Analytics processes installation/device/usage data when enabled. Gmail processes your address, message, attachments and replies when you contact us. These Google services may use global facilities including the US. Cloudflare, Inc. handles API/website connections and ranked requests and stores game records in D1. Our D1 database currently runs in Asia-Pacific without a fixed-country restriction; Cloudflare network processing may occur worldwide. Data is transmitted through encrypted connections when you use the relevant feature, for the purposes and periods above. You can use Practice without account/ranked processing, disable analytics, or choose not to email us (without receiving email support). Contact us about overseas processing or stopping it. We update the notice when transfer conditions change and obtain separate consent where required.
9. Sharing, tracking and safeguards
Beyond public rankings and the provider processing described above, we do not sell personal information or share it with data brokers. We do not combine it with other companies’ app/site data for advertising tracking. Legally required disclosures are limited to what is necessary. We use encrypted connections, verified authentication, limited access and account-specific deletion. Do not send passwords, verification codes, identity documents or payment details in support emails.
10. Access, correction, deletion and contact
The app profile lets you download records, change flag visibility and delete your account. Generated public names cannot be edited in the app; contact us by email to request correction of retained information such as earlier nicknames. Deletion requires fresh authentication and removes game records and the Firebase sign-in account, not your Google or Apple account itself. Without installing the app, use the deletion page or email below for access, correction, deletion, restriction or consent withdrawal. We verify you or an authorized representative with the minimum necessary information and explain the result or any limitation. Local practice records must be deleted separately. Disabling analytics stops future collection but does not erase all previously sent data. Since analytics does not receive the account UID, deleting an account does not guarantee deletion of all analytics for an installation. Contact us about analytics requests too.
11. Policy changes
We publish the effective date and changes here. Material changes affecting rights or processing purposes are also announced in the app or by a similar notice, with renewed consent where required. History: first published September 16, 2026.