Polycross
Privacy policy
The short version
- There are no accounts. We never ask for your name, email address or password.
- Each installation gets a random, anonymous player ID. We use it to count how the game is played, to fix crashes, to restore purchases and to read the reports you send.
- Your progress, gems and streak stay on your device and in your own iCloud or Google backup. We cannot read them.
- The game is free with ads from Google AdMob. In the EEA, the UK and Switzerland you choose in a consent form whether ads may be personalized. On iPhone, ads can use your advertising identifier only if you allow tracking.
- This website sets no cookies. It counts visits with cookieless analytics (see “This website” below).
- We do not sell your personal data.
Who we are
Polycross: Vocabulary Puzzle (“Polycross”, “the app”) is published by IHSAN OKTAR KARA, an individual developer (“we”, “us”). We are the controller of the personal data described here. Contact: hello@polycross.app.
What the app collects, and why
Anonymous player ID
When you first open the app, it creates a random identifier (a UUID). It is not linked to your name, email address or Apple or Google account. It is stored on your device and in your own backup (iCloud key-value storage and the iOS Keychain on iPhone, Android Auto Backup on Android), so a reinstall continues as the same player. The analytics, crash reporting, purchase and report services below receive this ID.
How you play (analytics)
We record game events to understand which puzzles are too hard, where players stop, and whether the game works: the app opening, finishing the first-run setup, starting and finishing a level (language pair, CEFR level, level number, stars, hints, mistakes, time taken), words solved or missed, hints used, the daily puzzle and streak, ads watched, purchases (product, price and currency), settings changes, and reminder notifications opened or allowed.
- Google Firebase Analytics receives these events with the player ID and the device information the SDK collects (device model, operating system and app version, language, an app instance ID and an approximate country derived from the IP address). On iPhone it may use the advertising identifier only if you allow tracking.
- PostHog (EU cloud, servers in Frankfurt, Germany) receives a smaller set (app opened, setup finished, level and daily puzzle finished, ad watched, purchase, reminders) with the player ID, device and app information, and an approximate location derived from the IP address. Session recording is turned off: no screen recordings, taps or text you type are sent.
- On Android only, the Google Play install referrer tells us which campaign link (UTM tags) led to the installation. On iPhone, campaign results are only available to us as totals in App Store Connect.
Crash reports
Firebase Crashlytics sends a report when the app crashes: the technical state of the app (stack trace), device model, operating system and app version, and the player ID.
“Report a mistake” and “Send feedback”
If you report a wrong word or send feedback from the app, we store what you write (up to 500 characters) with the category you chose, the puzzle and word it is about (for reports), the player ID, the app version, the platform (iOS or Android), your language pair and the time. Messages are stored in Google Cloud Firestore. To protect this from abuse, the app signs in to Firebase Authentication anonymously; this creates a random Firebase user ID and asks you for nothing. Please do not write personal information in these messages.
Settings that can change without an update
Firebase Remote Config provides values such as reward sizes and how often ads and reminders appear. The SDK uses a Firebase installation ID and basic device and app information to fetch them.
Ads
Polycross shows rewarded videos (when you choose to watch one) and full-screen ads between puzzles, served by Google AdMob. AdMob processes device and app information, your IP address (from which it derives an approximate location), ad interactions and advertising identifiers, to show, measure and limit ads and to prevent fraud.
- Consent (EEA, UK and Switzerland). Before any ad is requested, Google’s consent form asks whether ads may be personalized. If you decline, only non-personalized ads are requested. You can change your choice any time in Settings → Privacy options.
- Tracking (iPhone). iOS asks whether Polycross may track you across apps and websites. Only if you allow it can AdMob and Firebase use your device’s advertising identifier (IDFA). You can change this in iOS Settings → Privacy & Security → Tracking.
- Android. You can reset or delete your advertising ID in your device settings (Google → Ads).
- “Remove ads” turns off the ads between puzzles. Reward videos still appear only when you choose to watch one.
Purchases
Gem packs and “Remove ads” are sold through the App Store (and Google Play). Payment is handled entirely by Apple or Google; we never see your card or payment details. RevenueCat manages purchases for us: it receives the store receipt, the products bought, prices, transaction IDs and your purchase history, and uses the player ID as its user ID, so “Restore purchases” works on a new device.
Downloading puzzles and audio
Puzzles and pronunciation audio are downloaded from our content server
(cdn.byteandrise.com, run on Cloudflare). These requests carry
no player ID. Like any web server, Cloudflare processes your IP address and basic request
information to deliver the files and protect the service.
Reminders
Daily puzzle and streak reminders are local notifications, scheduled on your device by the app itself. There is no push server, and no notification token is sent anywhere. You can turn reminders off in Settings or in your device settings.
What stays on your device
Your progress, stars, gems, streak, languages and settings, and the puzzles you have downloaded, are stored on your device. To survive a reinstall or a new phone, the app also writes your progress to your own platform backup: iCloud key-value storage on iPhone (it syncs between devices signed in to the same Apple ID) and Android Auto Backup to your Google account on Android. These backups belong to your Apple or Google account; we cannot access them.
What we do not collect
- No account, name, email address, phone number or password.
- No contacts, photos, microphone, camera or precise location.
- No session recordings or screen captures.
- No payment card details.
This website
polycross.app sets no cookies and stores nothing in your browser, so there is no cookie
banner. To see how many people visit and which links bring them, the pages send cookieless
analytics to PostHog (EU cloud): each page view and each tap on an app
store button, with the page address, the referring site, any campaign tags in the link (such
as utm_source), the browser and device type, and the approximate country, which
PostHog derives from your IP address. Nothing is kept between visits, so a visit cannot be
linked to another visit or to your use of the app. There are no session recordings. The site
is hosted on Cloudflare, which processes your IP address to deliver the
pages.
Legal bases (EEA and UK)
- Consent: personalized ads and, on iPhone, tracking. You can withdraw it at any time as described above.
- Contract: processing purchases and restoring them.
- Legitimate interests: analytics to improve the game and this website, crash reports, non-personalized ads that keep the game free, abuse protection, and handling the reports and feedback you send us.
Who receives data
We use these service providers. They process data on our behalf or, for ads, as described in their own policies:
| Provider | Used for |
|---|---|
| Google (privacy policy, Firebase) | AdMob ads and consent, Firebase Analytics, Crashlytics, Remote Config, Firestore, Authentication |
| PostHog Inc. (privacy policy) | Product analytics for the app and this website, EU cloud |
| RevenueCat Inc. (privacy policy) | Purchases and restoring them |
| Cloudflare Inc. (privacy policy) | Delivering puzzles and audio, this website |
| Apple and Google | App stores, payments, iCloud and Android backups |
Some of these providers process data outside your country, including in the United States. Where the law requires it, transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We do not sell personal data. In some US states, personalized advertising can count as “sharing”; you can opt out by declining tracking on iPhone, by choosing non-personalized ads in Privacy options, or by limiting ad personalization in your device settings.
How long we keep data
- Analytics events (Firebase, PostHog): up to 14 months, then deleted.
- Crash reports (Crashlytics): 90 days.
- Reports and feedback messages: until we have handled them, at most 24 months.
- Purchase records (RevenueCat): as long as needed to provide and restore your purchases, and as required for tax and accounting.
- Data on your device and in your backup: until you delete the app and its backup (see “Your choices” below).
Children
Polycross is a general-audience game. It is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has sent us personal information, contact us and we will delete it.
Your rights and choices
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict its processing, and withdraw consent. You can also complain to your data protection authority.
Because there is no account, we cannot tell which data is yours from your name or email. The easiest way to make a request is to send it from inside the app: Settings → Send feedback. Your message then carries your player ID, and we can find and delete the analytics, crash, purchase and message data linked to it. You can also write to hello@polycross.app.
- Ads: Settings → Privacy options (EEA, UK, Switzerland); iOS Settings → Privacy & Security → Tracking; on Android, your device’s ad settings.
- Reminders: Settings → Notifications.
- Your progress: deleting the app removes the data on your device. To also remove the backup, delete Polycross’s data from iCloud (iOS Settings → your name → iCloud → Manage Storage) or from your Google account backups.
Security
Data is sent over encrypted connections (HTTPS). The app can only add reports and feedback messages; it cannot read them back. Access to the provider consoles is limited to us.
Changes
If we change this policy, we will update the date at the top. If the change is significant, we will also tell you in the app.