Privacy policy

Effective 20 October 2026

What Fjalëkryq collects, why, who sees it and how to delete it.

Who we are

Fjalëkryq is published by Arbri Sotiri, Tirana, Albania ("we"). We decide how your data is used, which makes us its controller under the General Data Protection Regulation (GDPR) and other data protection laws. For any question: [email protected].

What stays on your phone

Your settings (theme, timer, notifications), puzzles you started but haven't finished, and daily reminders are stored only on your phone. The phone schedules the reminders itself: no server sends you notifications, and we keep no notification tokens. The image you make to share a result is created on the phone and goes only where you send it.

Your account

As a guest, your account has only a random identifier, with no name or email. If you sign in with Apple or Google, the account is linked to it and your progress comes back on any phone where you sign in.

• With Apple: Apple gives us an identifier and your email address, or a relay address if you choose Hide My Email.
• With Google: Google gives us your email address, an identifier, and the name and photo on your Google profile. Our sign-in provider stores them with the account; the app doesn't show your Google name or photo.

We use your email address only for signing in and for replying when you write to us. We don't send marketing email.

What other players see

The name you choose (or the one we give you) and your avatar (letters, colour and frame) appear on the leaderboards and on your player card. Next to them are your times, your number of hints and your rank, plus your totals: puzzles solved, current streak, time played, and how many players gave you a Bravo. Who gave you a Bravo isn't shown.

Results and coins

For every puzzle you solve we store the game, the puzzle, the date, your time, hints and moves. We also store your statistics, streaks and coin history: what you earned, what you spent and the ads you watched for coins. We use them for the leaderboards, to restore your progress on another phone, and so that no reward is paid twice.

Moderation

Names are checked against a list of banned words, on the phone and on the server. When you report a player, we store who reported whom, the reason, and the name at that moment. The list of players you blocked is private. When enough different players report the same name, it is replaced automatically with a name the app generates. Every moderator action (a name change, removal from the boards) is logged with the old and the new name.

Ads

The app shows ads from Google AdMob: videos you choose to watch for coins, and a full-screen ad after you finish a puzzle. For this, Google collects the device's advertising identifier, your IP address and the approximate location it reveals, device and app information, ad interactions and diagnostic data.

• In the EU, the UK and Switzerland we ask for your consent with Google's form before any ad is shown. Change your choice any time in Cilësimet → Privatësia e reklamave.
• On iPhone, Apple asks whether you allow tracking. Without your permission, the advertising identifier isn't given to Google. Change it in Settings → Privacy & Security → Tracking.
• On Android, delete or reset the advertising identifier in your phone's settings, under ads.

Without your consent, Google shows non-personalised ads, which use less data, for example to limit how often an ad appears and to stop fraud. How Google uses this data: policies.google.com/technologies/partner-sites.

Who else processes it

• Supabase stores accounts and results, on servers in Ireland.
• Google: Google sign-in and ads (AdMob).
• Apple: Sign in with Apple.
• The App Store and Google Play: downloading the app and ratings, under their own policies.

These providers may process data outside your country, including in the United States, with safeguards such as the European Commission's standard contractual clauses. We don't sell data, and we don't share it with anyone else unless the law requires it.

Legal bases

• Contract: your account, saving your progress and the leaderboards.
• Legitimate interest: moderation, fair play, security and preventing abuse.
• Consent: personalised ads, tracking on iPhone, and notifications. You can withdraw it any time.

How long we keep it

• Your account and everything linked to it, until you delete it.
• Guest accounts unused for 60 days are deleted automatically, with all their data.
• Reports and the moderation log, as long as needed to deal with abuse. When you delete your account, reports you sent stay without your name, and moderation actions on your name stay without a link to the account.
• Server logs (such as the IP addresses of requests) disappear on their own within a few days.
• Backups, if any, are overwritten within 30 days.

Your rights

You have the right to see the data we hold about you, correct it, delete it, receive it in a readable format, object to or restrict its processing, and withdraw consent. You can change your name and avatar yourself under Profili. Delete your account in Cilësimet → Fshi profilin, or with these steps. For anything else, write to [email protected]; we reply within 30 days. You can also complain to the data protection authority where you live.

Children

Fjalëkryq is for ages 13 and over. If you believe a younger child has created an account, write to us and we will delete it.

Security

Connections to the server are encrypted. Database rules let each player change only their own data. Only the moderator has the moderation tools, and every moderator action is logged.

This website

This website uses no cookies, analytics or resources from other services. If you pick light or dark mode, your browser remembers that choice; it isn't sent anywhere. The service that hosts it may keep IP addresses in its server logs for a short time.

Changes

When we change this policy, we change the date above. For important changes, we let you know in the app.