Privacy Policy
Last updated 4 October 2026 · CVPK Digital Studio LLC
Time Tussle is a history card game. You can play as a guest without entering an email address or password. Guest play creates an anonymous account through Supabase, our authentication provider, and stores a profile and game data on our servers. Registering with an email address lets you sign in again and use your profile on another device. Some versions may show advertising to guests and registered players while they wait for a match or after a game. A monthly subscription removes all ads and is available after confirming an email address.
What we collect
If you play as a guest: an anonymous account identifier, a generated display name, and profile and gameplay data. Guest play does not ask for an email address or real name.
If you register with an email address: your email address, a password stored and hashed by Supabase, and a display name you choose.
If you add a profile photo: the app processes the image you choose on your device and uploads only a square JPEG copy. The selected original is not uploaded to our servers. Adding a photo is optional. The app asks you to choose an image through the iOS or Android photo picker. It does not request access to your full photo library.
The server checks the uploaded photo's format and size. After a successful upload, your photo can appear to people in the same waiting room or game without waiting for a human review. The file is kept in private storage and displayed through a link that expires. Anyone who has a valid photo link may also view it. We can remove a photo after a report. Replacing or deleting a photo queues the old file for deletion if it cannot be removed immediately.
If you report or block another player: a report stores the reporter and reported account identifiers, room identifier, a reason selected from a fixed list, creation time, status and any recorded resolution. Reports do not include free-text messages. A block stores the two account identifiers and creation time. These records are kept in the game database, are not shown to other players and are used to review reports and prevent blocked accounts from entering new rooms together.
Gameplay data: statistics such as games played, won, and lost, streaks, doubts made and called correctly, cards placed, and badges earned. In multiplayer, the room, its participants, the display names they use in that room, and game actions such as moves are visible to the other people in that room.
If you use Game Center on iOS: Game Center is optional. Apple processes your Game Center account and the achievement identifiers and progress reported by the app. On iOS 26 or later, a room host can publish the room's six-character party code through a Game Center activity so invited players can join. We do not send your Game Center player identifier to our servers. Declining or signing out of Game Center does not block the game.
Diagnostics: crash reports and error traces through Sentry. A diagnostic report can include a Sentry technical identifier, device model, operating system, app version, language, time zone, release, environment, and technical context such as a stack trace. These reports help us find and fix bugs.
If ads are enabled for your account: Google AdMob may process your IP address, device identifiers, ad interactions, and technical data to deliver ads, measure them, and prevent fraud. An IP address can indicate an approximate location. Because we do not verify each player's age, the updated app requests age-restricted ad treatment and non-personalized ads. We do not send your Time Tussle email address or account ID to AdMob for ad targeting. Ad requests require the available privacy choices to permit them. You can reopen ad preferences in Settings when that option is available.
If you confirm your email and sign in to a version with subscriptions: RevenueCat receives your Time Tussle account identifier and checks your ad-free access, even if you have not subscribed. If you buy or restore the subscription, Apple or Google handles the payment, and RevenueCat receives the store purchase records and subscription status. We do not receive your full payment card number.
Stored on your device: your language choice, music and sound settings, a cached copy of the card deck, login session tokens, pending practice results, ad frequency information, cached subscription status, privacy choices managed by the ad SDK, optional analytics and attribution choices, and account-deletion request information needed to retry an interrupted operation. The app keeps a minimum local marker for the first verified account linked to that installation, even when analytics and attribution are off. It also records whether an attribution attempt has started. After account deletion, the account link becomes a marker without an account identifier so the installation cannot be linked to another account for campaign attribution. You can still sign in or play with another account on the same device. These markers are not sent off the device.
Optional product analytics
Starting with version 1.3.1, product analytics starts on when you have no saved choice. Earlier versions ask you to turn it on. A saved off choice stays off. You can turn analytics off in Settings and keep playing. This setting is separate from your ad preferences.
When product analytics is on, PostHog receives your account and installation identifiers, session identifiers, app version, operating system version, language, event times and a limited set of events about tutorials, joining rooms, playing and completing games, connection problems, ads and subscriptions. We use these events to see whether players finish games, return to play and encounter problems, and to compare advertising results. We do not send email addresses, display names, profile photos, room entry codes, cards or hidden dates to PostHog. Session recordings and automatic screen capture are disabled.
You can turn analytics off in Settings. This stops new analytics events and clears unsent events on your device. It does not remove events that were already received. Account deletion includes a request to remove your PostHog record and associated events; the server retries if the provider is unavailable. The project uses PostHog's EU service and discards client IP addresses from stored events. We have not set a separate ordinary retention period for these events.
Optional campaign attribution
Starting with version 1.3.1, campaign attribution starts on when you have no saved choice and product analytics is on. Earlier versions ask you to turn it on. A saved off choice stays off. You can turn attribution off separately in Settings. This does not stop you from playing or change your ad preferences. Our server stores the setting, the disclosure version, and the time it was saved with your account.
If both attribution and product analytics are on, the iOS app may request a short-lived Apple AdServices token and send it directly to Apple's attribution service. On Android, the app may read the Google Play Install Referrer. The app uses the response only to assign a validated attribution status, acquisition network, and acquisition cohort. PostHog receives those three normalized fields in a separate product analytics event. It does not receive the Apple token, raw Play referrer, gclid, a full provider response, IDFA, IDFV, or GAID. If a campaign cannot be matched against a verified list, the result is recorded as unknown, not organic.
The Apple token and Play referrer stay in memory for one attempt per installation and are not saved. Before a read, the app saves only that the attempt started. A consumed attempt is not repeated after the app resumes, restarts, reloads your profile, or after you turn attribution off and on again, even if the first attempt was interrupted. The flag does not contain the token, referrer, or provider response. You can turn attribution off in Settings. This stops new reads and discards an unsent attribution event, without changing your ad or product analytics choices. Other unsent product analytics stay queued under your analytics choice. An Apple system request that already started cannot be recalled, but the app discards a late result and does not send the follow-up request to Apple's attribution service. Android closes the Install Referrer connection and discards a late callback. Attribution events already received by PostHog remain until an account-deletion request is processed and the provider verifies the asynchronous deletion.
Location and diagnostics
The app does not request GPS or location permissions. One earlier Sentry event contained approximate geography derived from an IP address. Sentry is now configured for the Time Tussle mobile and backend projects to discard IP addresses and remove user geography from new stored events. New synthetic events checked after the change contained neither IP addresses nor geography.
We do not promise that a diagnostic report can never contain personal data. We use Sentry data-scrubbing settings and review reports when investigating a problem. An ordinary retention period for account data, provider backups, and diagnostic logs has not been defined here.
How we use data
- To run the game and match players into multiplayer rooms.
- To save and show stats and badges.
- To check profile photos, respond to reports, and enforce the player safety rules.
- To investigate crashes, errors, and service problems.
- To show ads to eligible players while they wait for a match, browse available public games, or view results after a game, when ads are enabled and permitted by their privacy choices.
- To verify and restore ad-free subscription access.
- To measure which verified campaigns bring players to the game, when both optional attribution and product analytics are allowed.
Who processes data for us
| Provider | Purpose |
|---|---|
| Supabase | Account authentication, database, and private profile photo storage |
| Railway | Backend server and game database hosting |
| Sentry | Crash and error reporting |
| PostHog EU | Optional product analytics and normalized campaign attribution fields, when the required choices are allowed |
| Resend | Supabase Auth sends account confirmation, email change, and password recovery messages through Resend SMTP from no-reply@auth.timetussle.com. |
| Apple App Store, Google Play | App distribution and subscription billing when you purchase |
| Apple AdServices, Google Play Install Referrer | Optional campaign attribution, when you allow it |
| RevenueCat | Purchase verification and subscription access across devices |
| Google AdMob | Ads, consent choices, ad measurement, and fraud prevention when ads are enabled |
| Apple Game Center | Optional sign-in, achievement progress, and multiplayer room invitations on supported iOS versions |
Data deletion
Both guest and email accounts can be deleted from Settings > Delete Account. You can also request deletion by email without installing the app. We need to verify that the account belongs to you before acting on an email request.
Once the server accepts a deletion request, access to that account is revoked. Removing the authentication account and its profile data may still be in progress. A return to the sign-in screen does not mean every deletion step has finished.
Deletion removes the authentication account, profile, profile photo, personal statistics, and badges. If photo storage is temporarily unavailable, deletion is queued and retried. Shared game records and other players' results remain; your account link is removed and your name in those records is replaced with Deleted player.
Deletion also removes your block relationships. Existing safety reports remain as moderation records. The identifier for an account is removed from a report when that account is deleted. The room reference, player identifier used in that game, fixed report reason, rules version, dates, status and recorded resolution remain.
If RevenueCat has a customer record for the deleted account, the server queues a request to delete it and retries when the service is unavailable. Deleting your Time Tussle account does not cancel a subscription billed by Apple or Google. Cancel renewal in your store account before deleting your game account if you no longer want to be charged.
A temporary deletion record and status receipt remain to block old sign-ins and check the request. They become eligible for removal only once deletion is complete and at least 24 hours and 1 minute have passed since removal of the authentication account was confirmed. Pending requests are kept until resolved. We have not defined an ordinary retention period for account data, provider backups, or diagnostic logs.
Your rights
You can ask us to access, correct, or delete your personal data. If you are in the EU, UK, or a US state with privacy laws, you may have additional rights, including deletion and objection. Contact us to exercise them.
Children
The game is for players aged 13 and older. The app does not collect a date of birth and does not verify age or identity.
International transfers
CVPK Digital Studio LLC is based in the United States. We have not yet verified the locations where each provider processes data or the transfer terms that would apply to a public release.
Changes
If we change this policy, we will update the date above and notify players in the app when appropriate.
Contact
CVPK Digital Studio LLC, hello@cvpkdigitalstudio.com.