Privacy Policy for Whirldrop

Whirldrop is a casual board game (a drop-and-connect game with rotating gravity). We keep data to the minimum needed to run online play and rankings.

1. What We Store

On your device: your settings (sound, haptics, theme, language and board rules), local play statistics, points, coins, challenge progress and unlocked cosmetics. These remain on your device unless you later use a leaderboard, online or account feature, at which point eligible progress is synchronised as described below.

Accounts and cloud features: we use Google Firebase (Anonymous Authentication + Cloud Firestore). The app automatically creates an anonymous guest account with a random identifier when it connects to Firebase. When you use leaderboard, online or account features, we may store the following information linked to that identifier:

• a username you choose (a display name shown to opponents and on rankings — please don't use your real name or any personal information);
• your country or region choice, ranking points, coin earning/spending counters, unlocked cosmetics and equipped cosmetic;
• account creation and last-active timestamps used for account maintenance and online availability;
• while an online match is live: the match's rules and the moves played (column numbers), plus a periodic "still connected" timestamp used to detect when a player leaves or loses connection. Match records also contain the participating anonymous account identifiers and display names;
• optional email sign-in: if you choose to sign in (purely to save and restore your progress across devices), we store your email address linked to the account. There is no password: we email you a six-digit one-time code and you type it back into the app. That code is stored only until it is used or expires — it is valid for five minutes, and the record is deleted automatically within 24 hours. The sign-in emails are sent through Gmail (Google), so Google processes your address in order to deliver them. This is entirely optional — the game works fully without it.

Reliability and abuse prevention: Firebase Crashlytics may receive crash diagnostics such as device/app version, stack traces and technical identifiers. Firebase App Check uses device attestation signals to help reject automated abuse. Firebase Authentication processes IP addresses for security and abuse prevention. If you enable online match notifications, Firebase Cloud Messaging processes an app-installation identifier and notification token to deliver them. We do not use these services to build advertising profiles.

This data is processed on Google's servers under Google's terms. We do not sell it. Advertising data is handled separately by AdMob as described in section 6.

2. What We Do Not Collect

We do not request your phone number, real name, contacts, photos or precise GPS location. We do not require an email — one is stored only if you opt into email sign-in (section 1). You may choose a country or region for your profile. Our advertising provider may infer approximate location from your IP address; this does not require GPS permission (section 6). We run no behavioural analytics of our own. Crash diagnostics are described in section 1.

3. Permissions

The app uses Internet access for the optional cloud features and ads described above. Two players on one device and play-vs-computer remain available when cloud services are unavailable. If you opt into the daily-reward reminder or online match alerts, the app also requests notification permission.

4. Children's Privacy

Whirldrop does not knowingly collect personal information from children. Optional profile and account information is described in section 1; please do not put personal information in a public username. If you believe a child has provided personal information, contact us to request its deletion (section 8). There are no in-app purchases. The app shows ads via Google AdMob (section 6).

5. Data Deletion

You can delete your account and its cloud data at any time, directly in the app: Profile → Delete account. This removes your profile, username, ranking data, coin counters, cosmetics and leaderboard entry, and deletes the underlying authentication account (including a linked email, if any). Short-lived match records are normally deleted when a match finishes or by automated retention; they and service backups/logs may take additional time to disappear. Account deletion cannot be undone. Limited pseudonymous settlement records are kept for up to 90 days and then deleted automatically; service logs may be retained where needed for fraud prevention, security, or legal compliance. Alternatively, you may request deletion by contacting us (section 8) with your linked email address (if any), in-app username, and approximate creation date.

6. Advertising

Whirldrop shows ads through Google AdMob: a full-screen (interstitial) ad after some online games, and an optional rewarded ad you can choose to watch to earn cosmetic coins. The Google Mobile Ads SDK may collect and share IP addresses (which can estimate approximate location), app and ad interactions, diagnostic information, and device or other identifiers such as an advertising identifier. Google uses this information to deliver and measure advertising, perform analytics, and prevent fraud and abuse, under Google's policies. In regions that require it (e.g. the EEA/UK) we show a consent prompt before any personalised ads. You can reset or limit the advertising identifier in your device settings.

7. Changes to This Policy

If this policy changes, the updated version will be posted on this page with a new "Last updated" date.

8. Contact Us