This policy explains what Crate Jam: Slide Puzzle ("Crate Jam") collects, why, who it goes to, and how to make it stop. It covers the game on iPhone and Android and the services behind it. It is written to be read. If anything in it is unclear, write to privacy@unichat.dev and we will fix the wording.
The controller of your personal data is Ilhan Akbudak, trading as UniChat Games ("UniChat Games", "we", "us").
The short version
- We do not sell your data, and we do not share it for cross-context behavioural advertising.
- Crate Jam shows no ads, and there is no advertising code in the game at all.
- Nothing leaves your phone until you accept this policy and the Terms of Service in the game.
- You never have to give us your name, your email or anything else about you to play.
- You can delete your account and everything on it from inside the game, and it is actually deleted. Deleting does not lock you out: you can start again from scratch.
- You can ask the game for a copy of what we hold about you, from Settings, and get it as a file straight away.
1. What we collect
Things you choose to give us
| What | When |
|---|---|
| A display name, if you set one | When you pick one for your profile and the leaderboards |
| Your message and email address | When you write to support |
| Your Apple account identifier and, if you allow it, a name and relay email | Only if you use Sign in with Apple |
| Your Google account identifier and email address, and your name and profile picture if Google shares them | Only if you use Sign in with Google |
Things collected automatically as you play
Nothing is sent from your phone until you accept this policy. The few events from your first moments in the game (the app opening, the screens before the notice) wait on your phone and are sent only once you agree; if you never agree, they are never sent.
| What | Why it exists |
|---|---|
| An account identifier we generate, and a player ID we show you in your profile | To hold your progress. Neither is linked to your identity |
An install identifier: a random code the game makes the first time it runs (on iPhone, Apple's identifierForVendor) |
To tell your devices apart and to count sessions. It is not an advertising identifier, and we collect none |
| Device model, operating system and version, app version | To reproduce bugs and to know which devices to support |
| Your device's memory size, graphics chip, screen size and pixel density | To choose which devices to support and how detailed the game should look on each |
| Your device's language, region format, country setting, time zone and UTC offset, from its own settings | To decide which languages to translate into, to time reminders and the daily reward sensibly, for country flags on the leaderboard, and to understand which markets play |
| Which store installed the app (App Store, Google Play, or neither) | To tell official installs from others when something goes wrong |
| Whether you have allowed notifications | To know how many players a reminder can reach. We never see the reminders themselves |
| A welcome-gift marker for your device: on iPhone, a random code and its dates kept in your phone's Keychain; on Android, a one-way hash of your device's Android ID for our app, stored on our servers with the date the welcome gift began and how long you have played since | So the new-player unlimited hearts (3 days or 5 hours of play, whichever ends first) are given once per device, and not again after reinstalling the game or deleting an account |
| Session and gameplay events: launches and sessions, which screens you open, levels started, won, failed or left with the moves used, boosters used, coins earned and spent, purchases, daily reward claims, sign-ins, and when you accepted these documents | To see where the game is too hard, too easy, too slow or broken, and to tune move limits and prices |
| With each event: your account identifier, the session and how many sessions you have had, days since install, the app build, device model, operating system, platform, country, language, and whether you have ever made a purchase (not what you bought) | So events can be grouped into a funnel without needing anything about who you are |
| Performance samples (frame rate, loading times) and crash reports (the error, where it happened, how long the app had been running) | To keep the game smooth on older phones and to fix crashes |
| Your progress: levels delivered, best results, stars, coins, hearts, boosters, unlimited-hearts time, win streak | To keep your game where you left it, on every phone you sign in on |
| Your daily reward streak: how many days in a row you have claimed it, your best streak, and when you last kept a paused streak | To pay the right day's reward on every device |
| The moves of each level you finish | To re-play the level on our servers with the game's own rules and confirm the result before it counts on a leaderboard. It is a list of which crate moved where, not a recording of you or your screen |
| Leaderboard entries: your levels delivered, levels this week, display name, avatar and country | To rank you |
| Purchase records from Apple or Google: which product, when, the store's transaction or order identifier and purchase token, and (Apple only) the price and currency you paid | To give you what you bought, to handle refunds, and for tax and accounting |
| (no push token) | Reminders are scheduled on your phone and never leave it. See section 6 |
We do not look up your location from your IP address. The country we record is the one your phone's own settings say. We do not collect your contacts, your photos, your microphone, your camera, your precise or approximate location, your health data, or anything from other apps.
Things Apple and Google give us
- Game Center (iPhone): a player identifier for your Apple Account, so your progress survives reinstalling. We do not receive your Apple ID, your email or your real name.
- Google Play Games (Android): a player identifier for your Play Games profile, for the same reason. We do not receive your Google password.
- Sign in with Apple: the identifier Apple issues for our app, and, only if you allow it, your name and a private relay email address.
- Sign in with Google: see section 2.
- The App Store and Google Play: confirmation that a purchase happened. We never receive your card, your billing address or your store password.
2. Google user data
If you choose Sign in with Google, Google shares with us only the basic profile scopes
openid, email and profile: an identifier Google issues for our app, your email address, and,
if Google shares them, your name and profile picture. We ask for nothing else, and we cannot read
your Gmail, Drive, contacts or anything else in your Google account.
We use this data only to sign you in, to recognise your account on another phone, and to find your account if you ask us for help or for deletion by email. We do not use it for advertising, we do not sell it, we do not transfer it to anybody except our hosting provider (section 4) to run the sign-in, and no person reads it unless you ask us to, the law requires it, or we need to investigate abuse or a security problem. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time by deleting your account (section 8), or by removing Crate Jam from your Google account's third-party connections. Deleting your account deletes the Google identifier and email we hold.
3. Why we use it, and our legal basis
| Purpose | Basis (GDPR Article 6) |
|---|---|
| Running the game, keeping your progress, delivering and restoring purchases | Performance of a contract |
| Verifying level results and stopping cheating on the leaderboards | Legitimate interests: a leaderboard nobody trusts is worth nothing |
| Deciding which devices, languages and markets to support, from device facts | Legitimate interests |
| Tuning difficulty, move limits and prices from gameplay events | Legitimate interests |
| Giving the welcome gift once per device (the marker) | Legitimate interests: preventing abuse of a free offer |
| Fixing crashes and making the game better | Legitimate interests |
| Answering support messages | Performance of a contract, and legitimate interests |
| Sending you reminders about the game | Consent: you ask for these, and you can withdraw at any time |
| Meeting tax, accounting and legal obligations | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights, and we use the least data that answers the question, which is why our analytics are keyed to an identifier we generated rather than to anything about you.
4. Who we share it with
We share personal data only with:
- Supabase, our hosting, database and authentication provider, acting as our processor under a data processing agreement. Your account, progress, leaderboard entries and analytics events are stored on their infrastructure.
- Apple, for Game Center, Sign in with Apple and purchases on iPhone. Apple processes that data under its own privacy policy.
- Google, for Google Play Games, Sign in with Google and purchases on Android. Google processes that data under its own privacy policy.
- Professional advisers, and authorities, where we are legally required to, or to establish or defend legal claims.
- A buyer, if the game or the company is sold. You will be told before your data moves.
We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not use it to build advertising profiles.
5. Advertising
Crate Jam shows no advertising, and the game contains no advertising SDK. If that ever changes, we will publish a new version of this policy naming the partner and what it receives, and ask you to accept it in the game, before the first ad appears.
6. Notifications
Every notification Crate Jam sends is scheduled on your phone. There is no push server, we hold no notification token, and nothing about when or why you are reminded leaves your phone.
What it sends, and nothing else:
- Your hearts are full, when they have refilled after running out.
- Your daily reward is waiting, in the early evening, if you have not claimed today's.
- Unlimited hearts end soon, half an hour before a timed window you bought runs out.
- You were close, the next afternoon, after a level you nearly finished.
- Pip's tip jar is full, once, when it fills.
- Come back, at one day, three days, a week, two weeks and a month since you last played. Then it stops.
The rules those obey: at most one a day, at most five waiting at once, never between 22:00 and 09:00 your local time, and every pending reminder is cancelled the moment you open the game.
We never ask for permission on your first launch. The game asks once, after you return for a second visit or win level 10, whichever comes first. You can turn reminders off in Settings, or in your phone's settings, and neither costs you anything in the game.
7. How long we keep it
| Data | Kept for |
|---|---|
| Your account, progress, profile and daily streak | Until you delete your account |
| Device records (the facts in section 1 about each device you play on) | Until you delete your account |
| The welcome-gift marker and its dates | 24 months after the device was last seen, including after you delete your account (section 8) |
| An automatic account nobody ever signed in to (no Game Center, Play Games, Apple or Google) | Deleted once unused for 12 months, or 30 days if nothing was ever played on it. Never an account with a purchase on it |
| Leaderboard entries | Until you delete your account, or until the board is retired |
| The moves of a level you finished | 90 days after it was verified, then deleted. The verified result stays with your progress |
| Analytics events and performance samples | 24 months, then deleted |
| Crash reports | 12 months, then deleted |
| Purchase records | As long as tax and accounting law requires, usually 7 to 10 years |
| Support messages | 24 months after the conversation ends |
8. Your rights
Wherever you live, you can ask us to:
- give you a copy of what we hold about you;
- correct anything wrong;
- delete your account and its data;
- restrict or object to processing based on our legitimate interests;
- take your data elsewhere in a portable format;
- withdraw consent for notifications, at any time, without affecting anything else.
Signing in to an account you already have (for example after reinstalling the game) moves what the automatic account on that phone held into it (progress, items, purchases and leaderboard results, never creating coins that were not earned) and then deletes the automatic account.
Deletion is built into the game. Open Settings, then Delete my account, and confirm. What happens then:
- You can never sign in to that account again. It is permanently closed on our side, not hidden on yours.
- You can still play. Deleting releases your Game Center, Play Games, Apple and Google identifiers, so next time you get a new, empty account rather than being locked out.
- Deleted outright: your cloud-saved progress, your device records, your coin balance and its history, your boosters, hearts and unlimited-hearts time, your daily streak, your level results and their moves, and your sign-in identifiers.
- Anonymised: your profile. Your display name is removed and becomes free for someone else, your avatar is reset, your player ID is released, and your country, language and time zone are cleared.
- Kept, without anything identifying you: the welcome-gift marker of each device you used and its dates. It holds no account identifier and no name. It is kept so that deleting an account is not a way to claim the welcome gift again, and it is deleted 24 months after the device was last seen.
- Kept, without anything identifying you: your past leaderboard results, because they are part of other players' rankings. They no longer carry your name. Ask us and we will remove them too.
- Kept for as long as tax law requires: purchase records, with your account identifier removed.
- Analytics events: kept as anonymous statistics, with the identifier that linked them to you replaced by a random one that points at nothing, then deleted on the schedule above.
- Everything on your phone is erased too: your progress, your settings, every reminder the game had scheduled, and any statistics not yet sent (they are discarded, not sent). The next time you open Crate Jam it starts as a new download does and asks you to accept these documents again. The only thing kept on the phone is the welcome-gift marker described above. This happens even if you were never signed in.
We keep a record that a deletion happened (the date and how many rows were affected, nothing about who you were), because we are required to be able to show that we honoured your request.
No longer have the game? See cratejam.unichat.dev/delete-account to ask by email.
Getting a copy is built into the game too. Open Settings, then Export my data, and
the game saves a file called cratejam-my-data.json that you can open or share from your
phone. It contains your account, profile, devices, progress, wallet and its history, purchases,
level results, daily streak and leaderboard entries. For analytics it gives you a summary (how many
events of each kind, and over what period) rather than the raw rows. If you want the raw rows, ask
us and we will send them.
For anything else, write to privacy@unichat.dev. We answer within 30 days and we do not charge for it.
If you are in the EEA or the UK, you may also complain to your local data protection authority. We would rather you told us first.
If you are in the United States, see the US state privacy notice for the rights your state gives you and how to use them.
9. Children
Crate Jam is for players aged 13 and over. It is not directed to children, we do not knowingly collect data from anybody under 13, and if we learn that we have, we delete it.
If you are a parent or guardian and believe your child has been playing, write to privacy@unichat.dev and we will delete the account.
10. Security
Data in transit is encrypted with TLS. Access to production data is limited to the people who need it and is protected by multi-factor authentication. Our database enforces per-player access rules at the row level, so one player's session cannot read another player's data even if the app asked it to; the game can add analytics events but never read them back. Purchases are verified with Apple or Google on our servers, and level results are re-played on our servers, rather than trusted from the device.
No system is perfect. If we suffer a breach that puts you at risk, we will tell you and the relevant authority within the time the law requires.
11. Where your data is
We use infrastructure that may store or process data in the European Union and the United States. Where data leaves the EEA or the UK, we rely on the European Commission's standard contractual clauses, or on an adequacy decision, and we keep a copy on file you may request.
12. Changes
If we change this policy in a way that matters (new data, a new recipient, a new purpose), we will publish the new version, raise its version number, and ask you to accept it in the game before you carry on playing. Earlier versions stay online. The date and version at the top of this page always say which one you are reading.
13. Contact
Ilhan Akbudak, trading as UniChat Games privacy@unichat.dev