Privacy Policy

1. Who is responsible for your data?

This policy explains how personal data is handled when you use the zoXom mobile app or website. The data controller is:

Lovas Máté EV (sole proprietor)
Bartl János utca 2/A
1149 Budapest
Hungary

For privacy questions, support or data protection requests, email support@zoxom.net.

2. Information processed by the app

• Account and sign-in information. When you first connect without an existing session, zoXom automatically creates a guest account with a unique player identifier. No email address is needed to play as a guest. New accounts also receive a randomly generated public guest username. We store your current public username, whether it was generated automatically, and whether the initial username prompt has been shown. If you use optional Apple or Google sign-in, we receive the provider account identifier, email address (including an Apple private relay address where applicable) and any profile information supplied by the provider, such as a name or profile picture. Supabase Auth processes this information and authentication tokens to maintain your account. An Apple revocation token is stored encrypted so that we can disconnect Apple sign-in when you delete your zoXom account. We do not receive your Apple or Google password.
• Game and virtual-item data. Your account is associated with puzzle and game-session identifiers, submitted board states, completion times and dates, difficulty, use of hints and undo, scores, daily progress, streaks, Coin balances, unlocked items and reward transactions. For new players, we also store introductory-puzzle and tutorial-step progress, the checkpoint board used by the introductory lesson, and records of any hint replenishment. This lets lessons resume safely, prevents duplicate hint consumption and controls access to the Daily Challenge. These records follow the same retention and account-deletion rules as other game data. Result synchronisation also sends a randomly generated app-installation identifier to distinguish result records. It is separate from your device's advertising identifier.
• Purchases. For purchases and eligible restorations, we process your player identifier, product and transaction or order identifiers, purchase tokens or signed transaction details, purchase dates, verification results, entitlement status and refund or revocation information. Apple or Google processes payment; zoXom does not receive your full payment card details.
• Optional daily reminders. If you enable reminders, we process a push token linked to your player identifier, device platform, language, time zone, notification preferences and delivery records, including timestamps, receipt identifiers, status and errors. These are used to schedule and deliver daily challenge reminders and avoid duplicate or failed deliveries. We do not send marketing or purchase offers through push notifications.
• Age and parental-approval signals. On supported devices, Apple or Google Play may supply a coarse age range and verification or parental-approval status. We do not ask for your exact date of birth. The minimal signal is held only in app memory to apply the protections described in section 9; it is not saved to your account or device storage or sent to our backend or advertising providers.
• Device storage and downloaded content. Your device stores the sign-in session, preferences, cached game data and content, unfinished boards and pending synchronisation records. Offline practice boards and the practice allowance remain local; practice completions are not uploaded as scored results. To download interface translations, the app sends the selected language and cached dictionary revision to Supabase without your player identifier or account access token. Content downloads and connection checks also expose ordinary network information, such as your IP address, to the delivery service.
• Technical and advertising data. Service providers process IP addresses and request information to deliver and secure their services. Advertising services may also process device and advertising identifiers, approximate location inferred from IP, ad views and interactions, crash information and performance diagnostics. Google sign-in may process identifiers and IP information for authentication and fraud prevention. See section 5.
• Support correspondence. If you email us, we receive your email address, message and any attachments or other information you choose to send.

Guest identifiers and installation identifiers are pseudonymous, not anonymous. Information linked to them can still be personal data. zoXom does not request microphone permission or record audio.

3. Why we process information

Where the GDPR applies, we rely on the following legal bases:

Account and game data are needed to provide the corresponding features. Provider sign-in, choosing a custom public username, personalised advertising and reminders are optional. New accounts receive an automatic public guest username and participate in leaderboards when their results qualify. Refusing advertising personalisation or reminders does not prevent you from playing. A mandatory platform verification or parental-approval requirement may restrict gameplay until resolved.

4. Leaderboards and public information

New accounts receive a public username in the form Guest_ followed by nine random digits. Qualifying results can appear automatically on daily and difficulty-based leaderboards under that name, before you open Statistics or choose a custom username. You can keep the guest username or replace it through the username settings. Other players can see your current public username, rank and relevant completion time or average time. Existing accounts without a public username remain omitted unless a username is set. Your sign-in email and provider profile information are not displayed.

Avoid using your real name or other personal details as your username if you do not want them to be public. To leave the leaderboards without deleting your account, email support@zoxom.net. After verifying account ownership, we can remove your public username, including an automatically generated guest username. It is not automatically recreated when you reopen the app. Choosing a custom username again enables participation again.

5. Service providers and advertising

We share information as needed to operate the features below, handle support and comply with legal requirements. Providers may use subprocessors. Apple and Google also process information for their own sign-in, store and advertising services under their privacy notices.

• Supabase: account authentication, database and file storage, content delivery and server-side game features. The production database is hosted in Ireland. Supabase privacy policy.
• Google AdMob and User Messaging Platform (UMP): advertisements, consent and privacy-choice management, ad measurement and fraud prevention. Google may process the advertising and technical data listed in section 2. For rewarded ads, we also send Google your pseudonymous player identifier and a reward-verification reference. Google returns signed ad-event details to our server so that the reward can be verified and credited to the correct account without duplicate grants. No additional AdMob Mediation network SDKs are integrated. Google privacy policy and advertising information.
• Apple and Google: optional sign-in, platform age signals, app distribution, payments and purchase verification. Apple privacy information and Google privacy policy.
• Expo, Firebase Cloud Messaging and Apple Push Notification service: delivery of requested reminders, including processing push tokens and notification content. Expo privacy policy, Firebase privacy information and Apple privacy information.
• Cloudflare Pages: website hosting, delivery and security, including IP addresses and technical request information. Cloudflare privacy policy.
• DotRoll: hosting the support mailbox and processing support correspondence. DotRoll privacy notice.

Your advertising choices. We use Google's UMP to obtain consent where required. Where an applicable form is available, the app's Settings provide Privacy choices to review, change or withdraw your choices, including applicable regional opt-outs. iOS tracking permission is handled separately by the platform and can be changed in device settings.

Personalised ads may use interests and activity processed through Google's advertising services. Refusing personalisation prevents personalised ads; other ads may still appear only in a mode permitted by your choices and applicable requirements. Non-personalised ads can still use identifiers or device storage for frequency limits, measurement or fraud prevention, so they are not necessarily anonymous or exempt from consent. When no advertising mode is permitted, the app requests no ad. You can continue playing without consenting to personalisation.

Buying Remove Ads stops automatic interstitial ads. Rewarded videos remain optional and subject to the same privacy protections. zoXom has no separate active gameplay-analytics service; this does not exclude measurement or diagnostics performed by the providers described above.

6. International transfers

The production database is hosted in Ireland, within the European Economic Area (EEA). This does not mean that every provider processes information only within the EEA. Providers and their subprocessors may process data elsewhere, including the United States and Singapore.

Where required, transfers rely on an applicable adequacy decision or safeguards such as the European Commission's Standard Contractual Clauses. Supabase and Cloudflare describe these safeguards in their Supabase Data Processing Addendum and Cloudflare Data Processing Addendum. Contact us for information about the safeguards applicable to your data.

7. How long information is kept

• Accounts, game, purchase and reward records: until you delete your account or the service ends, subject to legal obligations or specific legal claims. Accounts are not automatically deleted because of inactivity.
• Notification records: preferences, registered devices and delivery records are retained until account deletion or service closure. Disabling reminders stops future scheduled reminders but does not by itself erase these records.
• Age signals: only in app memory, with fresh checks on later launches or relevant refreshes; no account or device-storage record is kept.
• Local app data: cached content is replaced when refreshed. Successful account deletion clears that player's local data. Device-wide preferences, downloaded dictionaries and the installation identifier can remain until you clear the app's local data; they are separate from the deleted account.
• Support emails and attachments: while handling the request and for 12 months after closure, unless a legal obligation or specific dispute requires longer retention.
• Technical logs: Supabase's current Free-plan API and database logs have a one-day retention window. This is separate from the account, purchase and notification records in the database. Other providers' operational logs and recovery copies follow their service retention arrangements. Supabase retention information.

We do not keep separate player-database backups or exports. Providers may maintain operational or recovery copies. Any information retained for a legal obligation or claim is kept only as long as needed for that purpose.

8. Your choices, account deletion and rights

Delete your account in the app: open Settings and the account section, then confirm account deletion. Linked Apple or Google accounts require fresh authentication with a connected provider. Guests can delete their account from the active app session. Deletion removes the account and associated player, game, purchase, reward and notification records from the active zoXom database. Apple sign-in is revoked where linked. It does not delete your Apple or Google account, erase store records held independently by those providers or automatically refund purchases.

Request deletion without the app: email support@zoxom.net and say that you want your zoXom account deleted. The controller handles requests personally. You may include your username to help locate the account, but a public username alone is not proof of ownership. Before disclosing data or deleting an account manually, we ask for proportionate verification, such as an authenticated app action or confirmation through the linked provider email where applicable. If you have lost a guest session, we may be unable to verify the account from the available information. Do not send passwords or payment card details.

Uninstalling the app or signing out does not delete server-side account data. Deletion from active systems does not guarantee immediate erasure of provider logs or recovery copies, and the limited legal-retention exceptions in section 7 may apply.

Other choices: manage advertising choices in the app's privacy settings and applicable device tracking settings; disable reminders in the app or device notification settings; contact us to leave public leaderboards.

Depending on applicable law, you may request access, correction, erasure, restriction or a portable copy of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Send requests to support@zoxom.net. GDPR requests are normally answered within one month; permitted extensions will be explained.

You may complain to the supervisory authority where you live, work or believe an infringement occurred. In Hungary, this is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

9. Children's privacy

zoXom is intended for teenagers and adults and is not specifically directed at young children. We use available Apple and Google Play age-range and parental-approval signals for privacy protections, not advertising targeting or analytics. The platform may present its own sharing or verification interface; availability and requirements vary by device and region.

The app requests no advertisements when a shared age range does not establish that the player is at least 18, when an age-signal check fails, or while a required verification or parental approval is unresolved. If sharing is optional and declined, or the API is unsupported, absence of a signal is not proof of adulthood; the app follows the existing UMP and advertising-eligibility requirements.

A mandatory platform verification or pending or declined parental approval can restrict gameplay until resolved. Account settings, deletion, privacy controls and support remain accessible. A minor age range alone does not block gameplay. Daily reminders have no blanket 18+ requirement. Parents or guardians with concerns can contact support@zoxom.net.

10. Website privacy and security

The website uses no analytics scripts, advertising SDKs, contact forms, cookies or browser storage. Its appearance choice is kept in memory and passed between pages in the page URL. Images and fonts do not require external content providers. Cloudflare may process technical requests for delivery and security. Third-party links lead to services covered by their own privacy notices.

Protection measures include encrypted network connections, authenticated account access, database access controls, server-side purchase verification and encrypted storage of the Apple revocation token. No online service can guarantee absolute security.

11. Changes to this policy

We update this policy when the app or its data practices change. The date at the top identifies the latest revision. Where additional notice or consent is required, we provide it before the relevant change takes effect.