Privacy Policy

Who this policy covers

This policy applies to the Firework Cube Puzzle Android apps, the website at fireworkcubepuzzle.com, and the account, cloud-save, support, and purchase-verification services operated for the game.

Data we process

• Optional account data. A Firework account ID, a display name supplied by Google, and a one-way hash of the verified Google or email identity. For email Magic Links, the email address is sent to our delivery provider; our account database stores the identity as a hash rather than a readable email address.
• Game progress and settings. Completed levels, stars, rewards, selected skins, accessibility settings, daily-challenge state, and synchronization revisions when cloud save is enabled.
• Purchase and entitlement records. Product, sales channel, transaction status, provider reference, entitlement state, refund or revocation state, and timestamps. Google Play and Stripe process payment details; Firework Cube Puzzle does not receive or store complete card numbers.
• Authentication and security data. Hashed session and Magic Link tokens, short-lived login challenges, install identifiers stored as hashes, rate-limit counters, webhook event identifiers, and security logs. Hosting logs may include IP address, browser or device user agent, request path, status, and time.
• Support communications. Information you choose to include when contacting support.

How we use data

• Authenticate accounts and provide cloud save across supported devices and distribution channels.
• Verify purchases, restore entitlements, process refunds or revocations, and prevent duplicate grants.
• Deliver requested Magic Links, respond to support requests, secure the service, prevent abuse, and diagnose failures.
• Meet accounting, tax, platform, fraud-prevention, and legal obligations.

Service providers and disclosures

We disclose only the data needed for service delivery to:

• Google Cloud for hosting, database, security, and operational logging.
• Google for optional sign-in, Google Play distribution, billing, purchase verification, and platform integrity.
• Stripe for website checkout, payment processing, refunds, and fraud controls.
• Resend and its email infrastructure for requested Magic Link and support email delivery.

We may also disclose information when required by law, to protect users or the service, or as part of a business transfer subject to this policy.

Children and families

Offline guest play does not require a name, email address, or account. Account linking, external links, account deletion, and purchasing are placed in an adult-facing account or parent area. We do not use behavioral advertising or build advertising profiles for children.

A parent or guardian may request access to or deletion of a child's linked account by following the account deletion process or contacting us.

Retention and deletion

• Account and cloud-progress data remain while the account is active and are deleted when account deletion completes.
• Access sessions are short-lived; refresh sessions expire after 30 days unless rotated or revoked sooner. Magic Links expire after 15 minutes.
• Expired sessions, Magic Link records, login challenges, and rate-limit buckets are removed from the application database after a seven-day security and troubleshooting buffer.
• Security, delivery, and hosting records are retained only as reasonably needed for abuse prevention, troubleshooting, and service integrity under configured provider retention periods.
• After account deletion, purchase entitlements are removed. Narrow transaction records may be de-identified and retained for refunds, chargebacks, fraud prevention, accounting, tax, and legal requirements.

Delete a linked account in the app or follow the steps at fireworkcubepuzzle.com/delete-account. Guest data stored only on a device can be removed by clearing app storage or uninstalling the app.

Security and your choices

We use encrypted HTTPS transport, hashed identity and token references, rotating sessions, signed provider webhooks, server-side purchase verification, restricted database access, and account deletion controls. No system can guarantee absolute security.

You may play without linking an account, sign out, unlink an identity after adding another recovery method, or delete the account. You may also contact us to request access, correction, or deletion where applicable.

Contact

Questions about privacy or data requests: immanuel.baby777@gmail.com.

We may update this policy when the game, providers, or legal requirements change. Material changes will be posted on this page with a new effective date.