Paradise PuzzlesPrivacy Policy
Effective
This policy explains what the Paradise Puzzles game, its servers and this website collect, why, and the choices you have. Paradise Puzzles is made by Jamie Parnaby, trading as Obsidaby (“we”, “us”), who is the controller responsible for your data. You can reach us at admin@obsidaby.com (see Contact).
In short
- No ads and no tracking. You start as a guest, with no sign-up form.
- Your online progress is stored under a random game account. You can link Game Center (iPhone and iPad) or Google Play Games (Android) to recover it and to find friends who play. We don't ask for your real name, email address or phone number.
- Apple (App Store) or Google (Google Play) takes payment for purchases. We never see your card details or your Apple or Google account.
- The first time you play, the game checks your age. We keep whether you're 18 or over (and if not, when you will be), never your date of birth.
- Gameplay statistics are optional and stay off unless you switch them on.
- Crash reports help us fix problems. They never include your game account, and you can switch them off.
- You can delete your account at any time in the game, or by email.
What we collect and why
Your guest account and backup
The first time you play, the game creates an anonymous guest account: a random account ID and a secret token kept in your device's secure storage. Our server stores only a scrambled (hashed) copy of the token. The game stores your online progress, islands, buildings, in-game currency and items, the puzzle moves used to check results, and the in-game name and avatar you choose. Older offline saves may also have a separate cloud backup.
Why: to keep your progress safe and run the game. Legal basis: providing the game you asked for (contract).
Your age
The slots, the shop and raids are only for players aged 18 and over. The first time you play, the game establishes your age once, by asking for the month and year you were born. The game works out on your device whether you're 18 or over and keeps only what's described below, not the answer you typed.
We keep, on your device and with your game account: whether your answer makes you 18 or over and, if you told the game you're under 18, the month in which you'll count as 18, so those features unlock by themselves then. Because that's the month after the one you turn 18 in, your month and year of birth can be worked out from it; we use it only for this and delete it with your game account. Until your game account is established as 18 or over, our servers refuse spins, raids and purchases, and your island isn't offered to other players to raid. Puzzles and building your island work for everyone.
Why: to keep features meant for adults away from younger players, as the law and the App Store's rules for an 18+ game require. Legal basis: our legal obligations, and our legitimate interest in protecting younger players.
Account recovery and sign-in
You can choose to link Game Center on iPhone and iPad, or Google Play Games on Android, so you can recover your island on another device. Apple or Google handles the sign-in. Our server receives a signed proof (Game Center) or a one-time sign-in code (Google Play Games), uses it straight away to learn your player identifier with that service, and keeps only that identifier with your game account. We don't keep the access it grants, and we don't keep your name, picture or email address from these services, even when they send them. We never receive your password and don't use sign-in for advertising. Short-lived sign-in challenges stop anyone reusing a response. You can remove a linked sign-in in Account & recovery.
Friends who play
Through one of these services, the game can look for your friends there who also play, and make you friends in the game:
- Game Center: when you tap Game Center friends, Game Center asks you before sharing your friends list. The game sends their Game Center player identifiers to our server, which keeps only those that belong to players, and makes you friends once you appear in each other's lists.
- Google Play Games asks you before sharing your friends list with games, then tells our server which of your Play Games friends you shared.
We match these lists against players who have linked the same service, and never store friends who don't play. We remember which service brought each friendship. If you remove or block a friend, the game won't add them back.
Why: to let you recover your island on another device with a sign-in you already have, and to play with people you know. Legal basis: providing the game and the account recovery you asked for (contract).
Friends, rankings and island activity
Your chosen game name, avatar, stars, rank, island and building stages are visible to other players. Use a nickname, not your real name or other personal information. We store friend codes, friend requests, accepted friends (and which sign-in service, if any, brought them), blocked players, attacks and raids. Attacks and raids can change your island's coins or buildings while you are offline, within the game's protection rules, and their results appear in the affected players' activity lists. We don't access your device's contacts; friend lists from Game Center and Google Play Games are used only as described under Friends who play.
Names are checked automatically against a list of offensive and impersonating words before other players can see them. If you report a player in the game, we store your account ID, the player you reported, the reason you chose, the name they had and when you reported it. The player is never told who reported them. We look at the report and the accounts involved, and may change a name, hide an account from the rankings or suspend it under the Terms of Service; we keep a record of what we did and why. If several players report the same name, it is replaced by a default name until we review it.
Why: to provide online play, friends and rankings, apply the game rules consistently and keep names respectful. Legal basis: providing the game you asked for (contract), and our legitimate interest in keeping the game safe and fair.
In-app purchases
Purchases are made through the App Store (Apple) or Google Play (Google), under their terms. We never receive your card details, billing address, or Apple or Google account. With each purchase the game gives the store a random reference to your game account (not your name or email address), so the purchase is credited to the right island.
App Store: the game sends our server Apple's signed record of the transaction. We check Apple's signature and add the items to your game account. We store the transaction and original transaction IDs, the product, the purchase and signing times, whether it was a live or test purchase, a fingerprint (hash) of the signed record and the items we gave you. Apple tells our server when a purchase is refunded or revoked, and we record that against the purchase.
Google Play: the game sends our server the purchase token Google issues. We check it with Google and add the items to your game account. We store a fingerprint (hash) of the purchase token, the order ID, the product, the purchase time and state, whether it was a live or test purchase, and the items we gave you. Google tells our server about purchases that are refunded or cancelled, and we record that against the purchase.
Why: to deliver what you bought exactly once, to restore an interrupted purchase, and to answer support questions about it. Legal basis: providing the game you asked for (contract).
Optional gameplay statistics
If you switch on Share anonymous stats in Settings, the game sends us events about how the game is played: screens viewed, levels started, won or lost (with score, moves and time), boosters used, building upgrades, spins, raids, daily gifts, purchases (product and price) and session length. Each event carries a random installation ID, your device platform, the app version and your country. Our hosting provider works out the country from your IP address; the IP address itself isn't stored with the events.
The installation ID is never sent along with your game account, so we can't connect statistics to your account or to you. Statistics are off for new players, and you can switch them off at any time. When you do, events that haven't been sent yet are deleted from your device.
Why: to find levels that are too hard, fix problems and improve the game. Legal basis: your consent.
Crash reports
When the game hits an error or crashes, it sends us a crash report: what went wrong (the error and where in the game's code it happened), how often, the app version, your device model, operating system version, graphics chip, memory and screen size, and the last few screens and menus you opened before it happened. If the game closed unexpectedly while you were playing, the report is sent the next time you open it. Before a report leaves your device, the game removes anything that looks like an email address, an account or purchase identifier, a sign-in token or an IP address.
Reports are sent with a random ID used only to limit how often one device can send them; we don't store it. They never include your game account, Player ID or the installation ID used for statistics, so we can't connect a report to you or your account. Crash reports are on by default, and you can switch them off at any time with Send crash reports in Settings. When you do, reports that haven't been sent yet are deleted from your device.
Why: to find and fix crashes and errors and keep the game working. Legal basis: our legitimate interest in providing a game that works, which you can object to by switching crash reports off.
Apple and Google may also collect crash information about the app under your own device settings and their privacy policies, and show it to us without identifying you.
Emails to support
If you email us, we receive your email address, your message and anything you include, such as your Player ID, device model or screenshots. Our mailbox is hosted by Microsoft (Microsoft 365). When we delete an account at your request, we keep a short record that we did: a scrambled (hashed) reference to the account, the ticket reference and how ownership was confirmed, with no other personal data.
Why: to answer you, fix problems and show that we handled your request. Legal basis: our legitimate interest in supporting players; for deletion records, our legal obligation to handle data protection requests.
Technical data
Like any internet service, our servers receive your IP address and basic request details, such as the time and the address requested, whenever the game connects. We use them to answer the request and to protect the service, for example by limiting how many requests one address can make. Our hosting provider's request logs can contain them and are deleted after at most 7 days.
This website uses no cookies, analytics or third-party content. Our hosting provider receives your IP address to deliver the pages and protect the site, and we keep no website logs.
Legal basis: our legitimate interest in keeping the game and the website working and secure.
Kept on your device only
Your settings and notification reminders stay on your device. The month and year of birth you type into the age check never leave it, and aren't kept on it either. The game schedules its notifications (for example “your lives are full”) on the device itself, so nothing about them is sent to us.
What we don't do
- No advertising and no advertising SDKs.
- No tracking you across other companies' apps or websites.
- We don't sell or share personal data, and we don't use data brokers.
- No access to your precise location, contacts, photos, camera or microphone. The only location we learn is the country in optional statistics, worked out from your IP address.
Who else handles data
- Cloudflare, Inc. hosts our servers, database, statistics, crash reports and this website on our behalf, under a data processing agreement.
- Microsoft hosts our support mailbox (Microsoft 365) on our behalf, under a data processing agreement.
- Apple runs the App Store, processes App Store payments and refunds and, if you link it, Game Center, under Apple's privacy policy.
- Google runs Google Play, processes Google Play payments and refunds and, if you link it, Google Play Games, under Google's privacy policy.
Apple and Google decide for themselves how they use what you give them as a store or sign-in provider. We don't share your data with anyone else unless the law requires it.
Where data is processed
Cloudflare and Microsoft run global networks, so your data may be processed outside your country, including in the United States. Where data leaves the UK or the European Economic Area, it is protected by safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum) and the providers' certification under the EU–US Data Privacy Framework and its UK Extension.
How long we keep it
| Data | Kept for |
|---|---|
| Game account, linked provider identifiers, progress, backup and friends | Until you delete your account, or until we stop running the game. |
| Game Center friends that belong to players | Replaced each time the game sends your Game Center friends. Deleted when you remove Game Center or delete your account. |
| Your age check (18 or over or not, and for under-18s the month from which you'll count as 18) | Until you delete your account. Resetting an offline island keeps it on your device. |
| Purchase records and your island activity | Until you delete your account. Other players may keep anonymised records of transfers that affected their islands. |
| Scrambled (hashed) App Store transaction and Google Play purchase references | Kept after account deletion, with no link to you, so the same purchase can never be claimed twice. |
| Player reports | Until we review them, then 180 days. Deleting either account deletes the report. |
| Moderation actions on your account (a name change, a suspension and why) | Until you delete your account |
| Gameplay statistics | Up to 3 months |
| Crash reports | 30 days |
| Server request logs | Up to 7 days |
| Support emails | Up to 2 years after the conversation ends |
| Records of deletion requests | As long as we need to show the request was handled, and at most 6 years |
Your choices and rights
- Delete your game account: Settings → Delete account removes your game account, online progress, sign-in links, friends and backup from our server and erases your progress on the device. It does not delete your Apple or Google account, or your Game Center or Google Play Games profile. Without the app, see Delete your account.
- Statistics: switch Share anonymous stats on or off in Settings.
- Crash reports: switch Send crash reports on or off in Settings.
- Notifications: turn them off in your device's Settings app.
Depending on where you live, you may also have the right to access, correct, export or restrict the use of your data, to object to how we use it, and to withdraw consent. To use these rights, email us with the Player ID shown in the game's Profile screen and at the bottom of Settings. Use the Player ID to identify the game account you are asking about; never send a sign-in password or game access token. Because anyone can see a Player ID, we may ask for details only the account's owner would know before we act. We reply within one month.
If you're unhappy with how we handle your data, please tell us first. You can also complain to your data protection authority; in the UK that's the Information Commissioner's Office.
California residents: we don't sell or share personal information, as those terms are defined in the CCPA.
Age
Paradise Puzzles includes simulated gambling and is rated 18+. It isn't directed at children. The game checks your age the first time you play (see Your age): the slots, the shop and raids stay locked for anyone under 18, and our servers refuse them too. If you entered your age wrongly, or you think a child has been playing, contact us with the Player ID from the game's Profile screen and we'll correct or delete the account.
Security
All traffic between the game and our servers, and to this website, is encrypted (HTTPS). Our server stores only hashes of game access tokens. Online rewards and transfers are checked on the server. Local backup checksums detect accidental corruption; they are not proof of a competitive result. No system is perfectly secure, but we work to protect your data and keep as little of it as we can. To report a security problem, email admin@obsidaby.com.
Changes to this policy
If we change this policy, we'll update the date at the top. If the change is significant, we'll also tell you in the game. Earlier versions are available on request.
Contact
Jamie Parnaby, trading as Obsidaby
Postal address available on request by email
admin@obsidaby.com