Privacy Policy

Last updated: 18 September 2026 Data controller: uğurcan güden (natural person / individual developer) Contact: [email protected]

This policy explains which data the Curiobox mobile application processes, why it processes them, and which rights you have over those data. By using the application you accept this policy.

Curiobox is a word puzzle (crossword) game. It collects the minimum data required for the game to work and does not sell your data. The application shows ads and offers an optional subscription that removes them; what each of these means for your privacy is set out one by one in sections 4 and 5 below.

1. You do not need to create an account

Curiobox does not ask you for an e-mail address, phone number, full name, date of birth or any identity information in order to create an account. You do not create a password and you do not sign in to an account.

The only exception is your e-mail address, and it is entirely up to you: in the "Write to us" form in Settings you may optionally enter an e-mail address, only if you want us to be able to reply to you. Leaving it empty does not prevent you from submitting the form and you are never pressed for it. The details are in section 7.

The first time you open the application, an anonymous player record is created for you on our server. This record consists of nothing but a randomly generated identifier and does not identify you in real life; it only serves to distinguish which device your game progress belongs to.

This anonymous identity is created on Supabase Auth, the application's authentication infrastructure, and the signInAnonymously method is used.

2. Your display name (username)

The application automatically generates a readable display name for you (example format: MorKirpi482). You can change this name from within the application if you wish; changing it is not mandatory.

• The display name is stored on the server.
• Because the display name has to be unique, the system needs to compare the name you choose with the names of other players.
• Information about when you changed your name is stored in order to limit consecutive changes.

What you should know about this name: The display name is your own choice and does not have to contain your real name. We do not recommend that you enter your real name, your e-mail address or any personal information of yours as a display name.

In this version your display name is not shown to any other player. The application does not contain a ranking (leaderboard) table. If a ranking feature is added in the future, this policy will be updated and the change will be announced within the application.

3. Game data

The fundamental rule of the game is this: score, time and correctness decisions are made on the server. This is mandatory for the game to work fairly and requires the collection of the following data:

All of these data are kept separately in the context of the language pair you selected; your progress in one language pair does not mix into the other.

None of these data identify you in real life; they are all tied to the anonymous player identity described in section 1.

4. Advertising

Ads are shown in the application through Google AdMob.

Where and how often:

• A full-screen interstitial ad may appear only on the transition after the Result screen of a stage. There is no banner ad on the game screen.
• The rewarded video ad placement is disabled in this version. If it is enabled in the future, this policy will be updated.
• Ad display depends on switches managed from our server: the first few stages are ad-free and there is a minimum interval between two ads.
• Premium subscribers see no ads (see section 5).

Consent and personalisation:

• On iOS the application shows you the App Tracking Transparency (ATT) permission prompt. If you do not give permission, ads still appear, but they are not personalised.
• In Europe, Google's UMP consent screen is shown. If you do not give consent, either no ad request is made at all or ads are shown without personalisation.
• You can change these preferences later as well, from your device's privacy settings and from the consent screen inside the application.

Which data are processed for advertising: in order to show and measure an ad, the AdMob software development kit (SDK) may process the following kinds of data from your device:

• The advertising identifier (on iOS the IDFA — only if you gave ATT permission; on Android the device's advertising identifier),
• Approximate location inferred from the IP address (at country/region level),
• Device and application information (such as model, operating system version, application version).

Curiobox does not collect these data and they do not reach our server. They are processed directly by Google and Google's own privacy policy applies: https://policies.google.com/technologies/ads

On iOS, Apple's privacy-preserving ad measurement framework SKAdNetwork is also used. SKAdNetwork measures the success of ad campaigns in aggregated form, without identifying the individual user.

5. Premium subscription and payment data

Curiobox offers an optional monthly subscription that only removes the ads. The subscription does not change the content of the game, your score, your time, the unlocking of stages or their difficulty.

Your payment information does not reach us. Payment is made entirely through the App Store or Google Play. Your card details, your billing address, your full name and your e-mail address never reach Curiobox and are not stored by us.

Only the following records, which serve to determine whether the subscription is valid, are kept on our server, and they are tied to your anonymous player identity:

Verification: our server decides whether your subscription is valid; the application's own assertion is not accepted. For this purpose the subscription identifiers obtained from the store are sent to Apple's and Google's verification services. This is a transfer that is mandatory for the operation of the payment service.

The billing, trial period, renewal, cancellation and refund rules of the subscription are explained in the Terms of Service.

6. Usage measurement (in-app statistics)

In order to understand which parts of the application work and where it gets stuck, we keep event records tied to your anonymous player identity on our own server. No third-party analytics service is used for this.

The types of event recorded are the following:

• Opening of the application,
• Starting and completing a stage,
• Taking a hint,
• Display of an ad,
• Setting a reminder and opening the application from a reminder,
• Completing or skipping the introductory tour,
• A change in subscription status.

What you should know about these records:

• Event rows are deleted automatically by the server after 90 days.
• In the administration panel these rows are not viewed one by one, but only as aggregated counts.
• These records are not shared with advertising networks and are not used for ad targeting.

7. Feedback ("Write to us")

From the "Write to us" section on the Settings screen you can send us written feedback. This is entirely optional; no game flow asks you for feedback and the form appears only when you open it yourself.

When you send a piece of feedback, the following are stored on our server:

What you should know about this record:

• The record is tied to the anonymous player identity described in section 1. The reason is to limit the number of messages that can be sent in a single day and to prevent abuse. For this reason the application offers no fully anonymous feedback option.
• Do not write personal information in your message. We strongly ask you not to write passwords, card numbers, identity numbers or other people's personal data; the purpose of this field is not to collect them.
• Your feedback is read only by the data controller (uğurcan güden) in the administration panel. It is not shown to other players, not published and not shared with advertising networks.
• In the panel each record may have a status (new / read / closed) and an internal note visible only to us. That note is not shown to you.
• You cannot see the message you sent again in the application; there is no "my submissions" section and no reply is given inside the application. If a reply is needed and you left an e-mail address, we write the reply manually by e-mail.
• Feedback records are kept indefinitely (see section 14); if you want them deleted, you can use the process in section 15.

8. Reminder notifications

If you wish, the application can set a notification that reminds you of the game. This is entirely optional.

• Notification permission is requested separately; if you do not give it, the application continues to work normally.
• The reminder is set locally on your device; the content or the time of the notification is not sent to our server.
• Only the information that a reminder was set and that the application was opened from a reminder is kept, within the scope of the event records in section 6.
• You can withdraw the permission at any time from your device's settings.

9. Data we do not collect

None of the following are collected, stored or processed by Curiobox:

• Precise location information — the application does not request location permission and does not access GPS data. (That Google, which serves the ads, may infer approximate location at country/region level from the IP address is explained in section 4.)
• Contacts / address book — the application does not request contacts permission.
• Photos, camera, microphone — the application requests none of these permissions.
• Health and fitness data
• Card details, billing information and other payment data — payment is made entirely through the store and these data do not reach us (see section 5).
• Phone number, full name, address
• E-mail address — it is not collected for creating an account, signing in or marketing. It is stored only in the feedback form in section 7, if you write it, and only in order to reply to you.
• Search history, browsing history, other applications on your device
• Chat and player-to-player messaging content — there is no such feature in the application. (The feedback in section 7 is one-way: it only gives you a way to write to us, it does not enable correspondence with other players, and the text you write is not shown to any player.)

We do not collect the advertising identifier (IDFA / Android advertising identifier); this identifier is processed only by AdMob and only if you gave permission.

10. Third-party components and service providers

The third-party components used in the application are limited to the following:

• Supabase — the infrastructure where the data are hosted (database, authentication and server-side game rules). It is the service provider that processes data on our behalf.
• Google AdMob — the advertising software development kit (SDK) used to show the ads. It acts as an independent data controller; see section 4.
• Apple App Store and Google Play — distribution of the application, collection of payment and verification of the subscription. The party to the payment relationship is the store.

The application contains no analytics or crash reporting software development kit. None of the tools such as Firebase Analytics, Google Analytics, Facebook SDK, Sentry, Crashlytics and the like have been included in the application; usage measurement is carried out on our own server as described in section 6.

Apple and Google may provide us with the application's crash reports and download statistics in aggregate (anonymous) form under their own policies; the party collecting these data is the store and the store's own privacy policy applies.

11. What is stored on your device?

The following are stored on your device:

• Your anonymous session token — this ensures that you do not start as a new player every time you open the application.
• The setting of the reminder you set (if you set one).
• One-off preference flags such as ad consent and the introductory tour.

No copy of game data, personal information or cookies is kept on your device.

12. Why we process your data (legal basis)

We process game data, your username and subscription records for the performance of the service relationship between you and us: without a record of score, time and progress the game cannot fulfil its function, and without a subscription record we cannot recognise your ad-free entitlement.

We process the usage measurement records (section 6) within the scope of our legitimate interest in keeping the application operational and improving it.

Personalised advertising is based solely on your explicit consent: if you do not give consent on the ATT and UMP screens, ads are not personalised.

Your data are not used for sale, for data brokerage or for any profiling that tracks you across applications.

13. With whom are your data shared?

Your data are not sold and are not rented.

The only parties with access are the following:

• The data controller (uğurcan güden) — for technical maintenance and troubleshooting.
• Supabase — the infrastructure provider where the data are hosted.
• Google (AdMob) — only within the scope of ad display and limited to the data listed in section 4.
• Apple / Google Play — only within the scope of subscription verification and payment.
• Competent public authorities where legally required.

The servers of these services may be located abroad; subscription verification and ad display therefore involve a transfer of data abroad.

14. How long do we store your data?

• Game data and username: for as long as your anonymous player record exists.
• Usage measurement event records: 90 days; when the period expires they are deleted by the server.
• Subscription records: for as long as the subscription relationship continues and to the extent required by financial/legal retention obligations.
• Feedback records (section 7): indefinitely — there is no automatic deletion period for these records and they are kept regardless of how long ago the report was made. The reason is that a bug report may still be valid months later. The records are deleted manually only: upon your deletion request (section 15) or when we consider it necessary.

When you submit a deletion request, the process in section 15 is carried out.

15. Your rights and data deletion

Under the applicable data protection legislation you have the rights to access your data, to request their rectification and their erasure.

In this version there is no "delete my account" button inside the application. You can submit your deletion request in the following way:

Deletion request: Send an e-mail to [email protected] with "Data deletion request" written in the subject line. So that your record can be found, write the username shown in the application inside the e-mail (you can see it on the Profile screen). Your request is concluded within 30 days at the latest and you are replied to from the same e-mail address.

Upon request, your anonymous player record and all game data tied to it (display name, sessions, scores, progress, hint and attempt records, event records and the feedback you sent) are permanently deleted. This operation cannot be undone.

If you have a subscription: deletion of your player record does not cancel your subscription. The subscription continues on the App Store or Google Play; to cancel it you have to use the subscriptions section in your device's account settings.

Automatic deletion: When you remove the application from your device, the anonymous session token on your device is deleted as well. From that moment on your record on the server becomes inaccessible and when you reinstall the application you start as a new player — your old progress cannot be recovered. This is the known and accepted behaviour of the application; account recovery is not available in this version. (Your subscription can be restored with the same store account; your progress cannot be restored.)

16. Children's privacy

Curiobox is rated 4 years and over. The application does not knowingly collect personal data from children; it does not collect personal data from any user in any case.

The application contains no chat, no messaging between players and no display of user-generated content to other players. The feedback form in Settings (section 7) is one-way: the text you write reaches only us, is not shown to any player and is not published. It does, however, contain ads and an optional subscription. In order to prevent unwanted purchases being made on a child's device, we recommend that you use the device's parental controls / purchase approval settings.

17. Security

Access to the data on the server is restricted by row level security policies (RLS): a player can only read their own records and cannot directly modify score/progress/subscription records; only the server-side game and verification logic can write these records. Feedback records (section 7) are completely closed to the application: the application cannot read, modify or delete these records; only the server-side feedback endpoint can write them and only the administration panel can read them. All communication takes place over an encrypted connection (HTTPS).

18. Changes to this policy

If the policy changes, the "Last updated" date on this page is updated. If there is a significant change (e.g. a new type of data starting to be collected, a new ad placement being enabled or a leaderboard being added), the change is additionally announced within the application.

19. Contact

For all your questions about this policy or your data:

uğurcan güden [email protected]

Last updated: 18 September 2026