Privacy policy
1. Who is responsible
The controller within the meaning of the GDPR for the Tic Tac Know app and for this website is: Onur Sevik, Lausitzer Platz 17, 10997 Berlin, Germany. I am an individual developer, not a company.
Contact for everything about data protection: hello@tictacknow.com. This address is forwarded to a Google mailbox (Gmail), so Google receives the emails you send to it (see section 9).
2. In short
- We do not ask for your name, email address or phone number. The app creates a random player ID on first start. It is not anonymous: it is a pseudonym that links the data in sections 4 and 5 to your account.
- This website sets no cookies and loads nothing from other companies (section 3).
- The app has no ads, no purchases, no analytics and no third-party software that sends data. Reminders are local notifications; we have no push tokens (sections 7 and 6).
- The minimum age is 16 (section 12).
- You can delete your account and its data in the app at any time (section 14).
3. This website
This section is about this website only, not about the app. The website sets no cookies and uses no analytics. It loads nothing from other companies: fonts, images and scripts come from our own server.
The website is hosted by Cloudflare Pages (Cloudflare, Inc., USA). Like every web host, Cloudflare receives technical data with each request (IP address, date and time, requested address including its path, browser type, referring page) and may keep it in request logs. We use it to deliver and secure the site. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
Cloudflare adds network-error-reporting headers to its responses. If a page of this website fails to load, your browser may therefore send a network-error report to Cloudflare. The report says that a request failed and why; it does not contain the content of the page.
Invite page (…/j/ABCD)
A link of the form tictacknow.com/j/ABCD opens an invite page. The room code is part of the address, so your browser sends it to our host with the request and Cloudflare can see it in its logs like any other address (section above). The page then reads the code from the address in your browser and shows it, with a copy button and a QR code that is drawn on your device. It looks up nothing about the room or the person who invited you, and it sends the code nowhere else. The copy button writes to your clipboard only when you tap it. The page is kept out of search engines. Messaging apps that show a preview of the link fetch the page themselves; what they do with the address is governed by their own policies.
Email sent to hello@tictacknow.com is received by Cloudflare Email Routing and forwarded to a Gmail mailbox of the operator, so Cloudflare and Google handle your address and your message on the way and in the mailbox. We use your address and your message only to answer you (Art. 6(1)(b) or (f) GDPR) and keep them as long as needed for that.
4. The app: what is stored and sent
Tic Tac Know works with an account that the app creates on first start. We do not ask for your name, email address or phone number; the account is identified by a random player ID. The player ID, the install ID (see below) and IP addresses are pseudonymous personal data, not anonymous data: they let us link data to one account, though not to your name. The tables list what the app stores on our server (Supabase, see section 9) and what stays on your phone, as the app works today.
The player ID is needed to play online (profile, Daily history, Play a friend). You are not obliged to use these features; without a player ID they cannot work. Practice and Pass & play run on your phone.
All builds
| Data | What and why | Kept |
|---|---|---|
| Player ID | A random ID created on first start. It links your profile, Daily history and matches to your account. No email, phone number or password. The app shows a short form of it in Profile › About: the first 8 characters, for example 8F14-E45F, which you can copy to identify your account when you write to us. | Until you delete the account, or after 180 days without use (section 11). |
| Username and avatar | The name you chose (or a generated one) and one of the built-in avatar pictures; there is no photo upload. Please do not use your real name if you do not want opponents to see it. The name is checked automatically against the username rules on the server. It is shown to the other player in a Play a friend room and match. | Until you delete the account. |
| Featured title | An optional label for a category title you earned. Visible to your opponent in a room. | Until you delete the account. |
| App language | Your app language (English, Turkish or German) is sent to our server in a Play a friend room (so the game can pick grids that fit both players) and with each answer dispute. | Together with the room or the dispute it belongs to. |
| Daily history and “better than X%” | For each day you played the Daily: the date, your score and whether you finished it. It keeps your history and feeds the Daily line “better than X% of players”. To show that line, the app sends the day and your score to our server, which compares them with the Daily results of other accounts (score and finished flag per account) and answers with a percentage only, never with another player's data. Nothing is shown until enough players have finished that day. This is the only comparison line in store versions of the app (Practice and Play a friend lines exist in test builds only, section 5). Legal basis: contract (Art. 6(1)(b) GDPR). | While the account exists: until you delete it, or after 180 days without use. |
| Play a friend: rooms and results | A room holds its code, the host's and guest's player IDs, their names and avatars at the time of joining, the category, difficulty and language, the status and the current match. Finished matches keep the result, the squares and the answers played (as entries, not as the text you typed), for your Stats. While you play, the app stays connected to our server for live updates, and the text you type as an answer is sent to the server to be checked; the match record keeps which entry your answer matched and when, not the text. The server also notes when each player was last connected. | Rooms: deleted 30 days after the room ended; a room nobody joined: after 1 day. Results: kept while the account exists; when you delete it (or after 180 days without use) they stay as records without a link to you and without names (your opponent sees “Former player”). |
| Reports and blocks | If you report a username: your player ID, theirs, their name at that time and the room. Used to review names and to reset abusive usernames (Terms of use, section on names and moderation). If you block another player in Play a friend: we store the pair, that is who blocked whom (the two player IDs), so that the blocked player cannot join the blocker's rooms. There is no list of blocked players and no unblock yet in this version. Legal basis: legitimate interest in a safe game (Art. 6(1)(f) GDPR). | Blocks: until either of the two accounts is deleted. Reports: reports against you go with your account; reports you made stay without your player ID. |
| Answer disputes | Only when you tap “Dispute an answer”: the match, the square, your typed answer, what the game read it as, the app language and an optional note (up to 200 characters). Used to check and fix our content. Legal basis: legitimate interest in correct content (Art. 6(1)(f) GDPR). | 12 months after the dispute is closed (an open dispute until it is reviewed), or until you delete the account if that comes first. |
| Connection data and content downloads | Whenever the app connects to our server (sign-in, sync, Play a friend, downloading question packs and settings), the server and our processor see technical connection data such as your IP address and the time of the request, and keep it in server logs. We do not store IP addresses in our own tables. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR). | In the provider's server logs, only briefly (section 11). |
| Only on your phone | Your profile copy, the saved Daily game, your Practice match history, sound, haptics and reminder settings. The Daily reminder is a local notification scheduled on the phone using its time zone; nothing is sent to us and we have no push token. A random install ID is created on the phone in every build; it is sent only with the move log of test builds (section 5). When you share a result, the image or text is made on the phone and goes where you send it; we do not receive it. | Until you delete the account or the app. |
| Email you send us | “Contact us” and “Send feedback” open your own mail app. “Contact us” adds a short privacy note and your Player ID to the message, so that we can find your account for a request about your data. “Send feedback” adds a footer with the app version and build, the platform and the app language, with no name and no ID. You can delete or change all of this before sending. | As long as needed to answer you. |
5. Test builds and usage logs
Builds distributed for testing through TestFlight (iOS) additionally log how the game is played, so we can fix wrong or missing answers and judge how hard each square is. The Google Play closed-test build does not send these logs, and neither do the public store versions. If that ever changes, we will say so here first (section 6).
Purpose: improving the questions and judging difficulty. Legal basis: our legitimate interest in testing and improving the game (Art. 6(1)(f) GDPR). Testers are told about the logs in the test notes. You can object at any time (section 15) or simply use a store version instead.
| Log | What | Kept |
|---|---|---|
| Move log | For each move: time, category, grid and square, mode, difficulty, outcome (claimed, missed, timed out, already on the board), time taken, the entry a wrong answer matched (never the typed text), app build and the random install ID. We do not link the install ID to your account or name, but it is a pseudonym for one installation. | Raw rows 90 days, then rolled up per day, grid, square and outcome without the install ID. |
| Rejected answers | Each answer the game turned down: time, your player ID, category, grid, the row and column conditions, the text you typed and its normalised form, app language, build, and whether the name is unknown or does not fit. | 12 months, then deleted; earlier if you delete the account. |
| Comparison data | For the test-only lines “better than X% of players” and “faster than X% of players” in Practice and Play a friend: for each finished match the category, difficulty, how many answers were right and the median answer time, stored under your account. Other players only ever see a percentage. | Until you delete the account. |
6. Analytics
The app has no analytics today. If we add it later, it will be opt-in and off by default, with a separate optional consent for sending answers the game did not accept. We will update this policy before such a version is released.
7. Notifications, ads and third-party software
- Notifications are local only: the Daily reminder is scheduled on your phone. We have no push tokens and no push service.
- No ads, no purchases, no advertising ID.
- No third-party software (SDKs) that sends data: no analytics, no crash reporter, no ad or social-media SDK. The app talks only to our own Supabase project. Fonts and sounds are part of the app.
8. Why we use data and on what legal basis
- Providing the game features (player ID, profile, Daily and its “better than X%” line, Play a friend, Stats): performance of the contract, Art. 6(1)(b) GDPR.
- Security and logs (automatic username filter, reports, blocks, rate limits, server logs, website logs), answering disputes and test-build logs: our legitimate interests in a safe, working game with correct content, Art. 6(1)(f) GDPR. You can object (section 15).
- Optional features that need your consent, Art. 6(1)(a) GDPR: none are active today; the analytics described in section 6 would be. You can withdraw consent at any time.
- Email: Art. 6(1)(b) or (f) GDPR (section 3).
There is no automated decision-making with legal or similarly significant effect. The username filter and the checking of answers are automatic, but they have no legal effect on you; a name can be refused or reset, and you can choose another one or write to us (Terms of use).
9. Who receives data
We do not sell data and do not share it for advertising. These companies receive data on our behalf or as independent providers:
| Recipient | Role and data | Company and country |
|---|---|---|
| Supabase | Processor for the app's database, sign-in, file storage, live connection and server functions: everything in section 4 and, in test builds, section 5, plus connection data (IP address). The project runs in the EU region Frankfurt (Germany). Supabase uses sub-processors such as Amazon Web Services (AWS). | Supabase, Inc., USA |
| Cloudflare | Processor for hosting this website (Cloudflare Pages) with its request logs, and for routing email sent to hello@tictacknow.com (Cloudflare Email Routing). Receives IP addresses, requested addresses (including invite codes in …/j/ links) and the emails themselves on their way. | Cloudflare, Inc., USA |
| Google (Gmail) | Receives the emails you send to hello@tictacknow.com in the operator's mailbox (mail forwarding target) and stores them there. | Google Ireland Limited, Ireland, and Google LLC, USA |
| Apple App Store | Distributes the iOS app (and TestFlight). Apple handles your download and Apple account under its own privacy policy as an independent controller; we do not receive your Apple account data. App Store Connect shows us statistics and, if you share them with developers, crash reports. | Apple Distribution International Limited, Ireland, and Apple Inc., USA |
| Google Play | Distributes the Android app. Google handles your download and Google account under its own privacy policy as an independent controller; we do not receive your Google account data. The Play Console shows us statistics and, if you share them with developers, crash reports. | Google Ireland Limited, Ireland, and Google LLC, USA |
Other players see your username, avatar and featured title in a Play a friend room and match. Authorities receive data only where the law requires it.
10. International transfers
The app's data is stored in the EU (Frankfurt). Some recipients are US companies or use sub-processors outside the EU, so personal data can be accessed from, or transferred to, the USA or other countries. Such transfers rest on the EU–US Data Privacy Framework where the recipient is certified under it (adequacy decision of the European Commission), and otherwise on the EU standard contractual clauses (Art. 46 GDPR) together with additional safeguards where needed. You can ask us for a copy of the safeguards (section 15).
11. How long we keep data
- Account data: until you delete the account. Accounts with no activity for 180 days are deleted automatically by a daily job. If your phone comes back later it creates a new account and uploads its data again.
- Rooms (Play a friend): deleted 30 days after the room ended; a room that nobody joined: after 1 day. When a player deletes the account, their name and avatar in other players' rooms become “Former player”.
- Rejected answers (test builds): 12 months.
- Answer disputes: 12 months after they are closed; open ones until they are reviewed.
- Move log (test builds): 90 days, then only daily totals without an install ID.
- Server logs of our providers (IP addresses and requests): kept only briefly by them; at present about one day for the app's database provider.
- Backups, if any are made, are deleted within a short period.
- Email: as long as needed to answer you. Everything else: see the tables in sections 4 and 5.
12. Children
Tic Tac Know is for people aged 16 and over. The app has no age check, so it cannot stop a younger person from installing it. If you are under 16, please do not use the app. If you are a parent and think your child uses it, write to hello@tictacknow.com and we will delete the account.
13. Security
The app and the website talk to our servers over encrypted connections (TLS). Access to the database is restricted by access rules so that a player can read only their own records, and the keys that give full access are not in the app. We collect only the data the features need. No system is perfectly secure, but we take care to keep your data safe.
14. Delete your data
In the app: open Profile, choose Delete account and confirm. This deletes your account on the server with your profile, Daily history, disputes and the other data linked to it, and then clears the data stored on your phone. The app then starts again as a new player. In rooms of other players your name and avatar become “Former player”, and finished matches stay without a link to you. In test builds the move log is not linked to your account and stays until its 90 days are over (section 5). Deleting needs an internet connection; without one, nothing is deleted.
What exactly is deleted and what is kept is listed on the page Delete your data. If you can no longer open the app, write to us there or at hello@tictacknow.com.
15. Your rights
Under the GDPR you have the right to access, rectification, erasure (in the app, or on the page Delete your data) and restriction of processing; the right to receive your data in a portable format; the right to object to processing based on legitimate interests (Art. 21 GDPR); and the right to withdraw a consent at any time, without affecting the processing done before.
To use these rights, write to hello@tictacknow.com. Because accounts have no name or email address, we can only find your data if you tell us which account is yours: send the Player ID shown in Profile › About in the app (8 characters, for example 8F14-E45F; the “Contact us” email already contains it). If a short ID happens to fit more than one account, we may ask for more details. If you cannot open the app, tell us your username, your avatar and roughly when you started playing; then we can only act when this clearly points to one account. We answer within one month.
You also have the right to complain to a data protection authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de. You may also complain to the authority of your own country.
16. Changes and language versions
We will update this page when the app or the way we handle data changes. The date at the top shows the latest version.
This policy is available in English, Turkish and German. If the versions differ, the English text prevails.
17. Contact
Questions about privacy: hello@tictacknow.com. Help with the app: Support. Who we are: Imprint.