Papelia Privacy Policy

1. Who is responsible

Papelia is operated by Racorway LLC. For privacy questions or requests, contact [email protected].

2. Data kept on your device

Your current puzzle, local progress, hints, settings and preferences are stored on your device. You can remove ordinary local data by clearing the app data or uninstalling Papelia. Sign-in credentials may be kept in the operating system’s protected Keychain or Keystore so account sessions can work securely.

3. Optional account and sync

You do not need an account to play. If you choose Apple or Google sign-in, Firebase Authentication processes the provider identifier and authentication information and may receive your email address, display name or profile picture, depending on what the provider supplies and the choices you make there. Papelia’s backend creates an internal player identifier and can store completed levels, daily puzzle results, active days, best streak, earned stamps, hint-balance operations and sync state.

Papelia’s own backend does not store your provider email address, display name or profile picture. Short session tokens normally last one hour and refresh tokens normally last 60 days. Signing out revokes the current refresh token.

Platform achievements are separate from your optional Papelia account. Only if you choose Achievements in the game settings can Papelia connect to Apple Game Center or Google Play Games. It then sends earned achievement milestones to that platform and keeps the platform’s game-scoped player identifier and your choice on this device to avoid mixing profiles. Papelia does not send that platform identifier to its own backend. Apple or Google controls the achievement records and related platform account data; deleting a Papelia account does not delete achievements already stored by them. You can manage your Game Center or Play Games profile in the respective platform settings.

4. Analytics and crash diagnostics

Firebase Analytics helps us understand broad game usage, such as app opens, puzzle starts and completions. Firebase Crashlytics receives crash reports and technical information needed to diagnose failures, which can include app version, device and operating-system details, timestamps and diagnostic traces. These services are provided by Google.

5. Advertising and rewards

Papelia may show interstitial ads and optional rewarded ads used to obtain hints. Google Mobile Ads and Google’s consent tools may process advertising identifiers where permitted, IP address, approximate location inferred from IP, device information, app interactions, diagnostics and ad interactions. On iOS, tracking permission is requested where required. Your consent and privacy options remain available in the game settings.

If you buy the optional one-time lifetime upgrade, Apple or Google processes the payment and RevenueCat processes a pseudonymous purchase identifier, transaction information and your entitlement status to deliver and restore the upgrade. The upgrade removes ads from your game. A Papelia account is not required for the purchase, and the purchase is not automatically linked to that optional account.

6. Operational security data

The service records limited pseudonymous app-open, puzzle-completion and advertising-impression events needed to understand reliability and operate the game. A separate reward-verification ledger prevents the same rewarded-ad transaction from being credited more than once. The server can also process IP address, user agent, requested URL and timestamps for security, rate limiting and troubleshooting. Installation identifiers sent to the backend are transformed with HMAC rather than stored in plain text.

7. Retention and deletion

Synced game data is kept while your optional account exists. Account deletion blocks access, revokes sessions, deletes the Firebase user and removes account-linked game data. A random deletion capability can remain for up to one year so an interrupted deletion can safely be retried, and a one-way fingerprint of the deleted Firebase identifier can remain for 24 hours to prevent immediate session reuse.

Papelia retains its pseudonymous app-open, puzzle-completion and advertising-impression events for 90 days. A scheduled deletion sweep removes expired records after that period; it normally runs every six hours and also when the service starts. The minimal reward-verification ledger is kept for the lifetime of the service to prevent duplicate rewards and abuse; it contains keyed installation hashes and transaction or operation identifiers, not the original installation identifier. Server security logs and records held by Firebase, Google, Cloudflare or hosting providers follow their own security settings, retention controls and legal obligations. Support messages are kept only as long as needed to resolve the request and meet legal obligations.

8. Legal bases and your choices

Depending on where you live, processing is based on providing the game you request, our legitimate interests in security and improvement, legal obligations, or your consent. You can play without signing in or connecting platform achievements, change ad privacy choices in settings, control tracking and Game Center or Play Games in the operating system, sign out, or delete your Papelia account. You may also request access, correction or deletion by contacting us.

9. Service providers and international transfers

We use service providers including Firebase, Google Mobile Ads, Google User Messaging Platform, RevenueCat, Apple or Google for in-app purchases and optional platform achievements, Cloudflare and our hosting infrastructure. They may process data in countries other than yours under their contractual and legal safeguards. We do not sell your personal information.

10. Children

Papelia is a general-audience puzzle game and is not directed to children under 13. If you believe a child has provided personal information contrary to applicable law, contact us so we can review and remove it.

11. This website

This static website does not set analytics or advertising cookies and does not contain third-party embeds. Cloudflare and the hosting provider may process IP address, user agent, requested URL, date and other technical request data to deliver and protect the site.

12. Changes and contact

We may update this policy when Papelia or its providers change. The current version and date will remain available here. Contact: [email protected].