Privacy Policy
Last updated: October 22, 2026
This policy explains what information the Tipsy Tiles mobile game (Android and iOS) and this website (tipsytiles.verxion.dev) collect, why, who it is shared with, and how you can delete it. Tipsy Tiles is made by Verxion (“we”, “us”).
1. Information we collect
Stored only on your device
Your progress (unlocked levels and stars), best scores, settings (volume, haptics, reduce motion), whether you bought Remove Ads, counters used to space out ads, and finished runs waiting to be uploaded while you are offline. This stays in the app’s storage on your phone. We cannot see it, and it is removed when you uninstall the app or use Delete my data.
Leaderboard guest account (our servers)
When the app first goes online it creates an anonymous guest account so your Endless scores can appear on the leaderboard. We store:
| Data | Purpose |
|---|---|
| A random player ID and a secret access token (we keep only a one-way hash of the token) | To recognise your app without a login |
| Your leaderboard name (randomly generated, or the one you choose) | Shown publicly on the leaderboard |
| Platform (Android/iOS) and app version | Compatibility and troubleshooting |
| When the account was created, last used and last renamed | The once-a-day rename limit and keeping the service healthy |
| For each finished Endless run: score, highest tile, number of drops, run length, app version, a run ID and the time | Rankings, and detecting impossible (cheated) scores |
Your name, scores and highest tile are public on the leaderboard (in the app and on this website), together with your player ID.
IP address
When the app or website contacts our servers, your IP address is used to limit abuse (for example, how many guest accounts or requests can come from one address). These counters are deleted automatically within about two hours. Our hosting and network provider may also keep standard, short-lived server logs for security.
Data request form
If you use the data deletion form, we store the player ID you enter (optional), your email address, your message and the time, only to handle your request and reply to you.
What we don’t collect
We don’t ask for or collect your real name, email (except through the form above), phone number, contacts, photos, precise location or any account login. The website sets no cookies of its own and uses no analytics (Cloudflare may set a strictly necessary security cookie).
2. Advertising (Google AdMob)
The free version shows ads from Google AdMob, provided by Google LLC / Google Ireland Limited. To show and measure ads and prevent fraud, Google may collect your device’s advertising ID (Android Advertising ID, or Apple’s IDFA if you allow tracking), IP address, device and app information, and how you interact with ads.
- Consent: in the EEA, the UK and Switzerland the app asks for your consent through Google’s consent form before any ad loads. If you decline, you get non-personalised ads. You can change your choice at any time in Settings → Ad privacy (shown where this applies).
- iOS: the app asks for permission to track (App Tracking Transparency). If you don’t allow it, your IDFA is not used.
- Android: you can reset or delete your advertising ID, or opt out of ads personalisation, in your device’s Google settings.
Learn more in How Google uses information from sites or apps that use its services and the Google Privacy Policy. Buying Remove Ads turns off the ads between runs; the optional ad to continue a run is still offered.
3. Purchases (RevenueCat, Google Play, App Store)
The Remove Ads purchase is paid through Google Play or the Apple App Store. We never see your payment details. We use RevenueCat, Inc. to check which purchases your app owns. RevenueCat receives an anonymous app user ID, your purchase history and receipts from the store, the product and price, and basic device, app and country information. See the RevenueCat Privacy Policy, and Google’s or Apple’s policies for the store itself.
4. Service providers
- Hosting: our servers and database, run by Verxion.
- Cloudflare, Inc.: our website and API traffic passes through Cloudflare’s network for speed and protection, which processes request data such as IP addresses (Cloudflare Privacy Policy).
- Google AdMob and RevenueCat, as described above.
We do not sell your personal information for money. Showing ads through AdMob may count as “sharing” for cross-context advertising under some US state laws; you can opt out with the consent and device settings described in section 2.
5. Why we use your data (legal bases)
- Providing the game and the leaderboard you choose to take part in (performance of a contract / legitimate interests).
- Preventing cheating and abuse (legitimate interests).
- Personalised ads (your consent, where required). Non-personalised ads and ad fraud prevention (legitimate interests).
- Handling your requests and meeting legal obligations.
6. How long we keep it
- Guest account and scores: until you delete them, or we close the leaderboard.
- Rate-limit counters with IP addresses: deleted automatically within about two hours.
- Data requests: until handled, then up to 30 days for our records.
- Data on your device: until you delete it or uninstall the app.
7. Deleting your data and your rights
In the app: open Settings → Delete my data. This immediately deletes your guest account and all its scores from our servers, then resets the game on your device (a Remove Ads purchase stays with your store account). If you can’t open the app, use the data deletion form.
Depending on where you live, you may also have the right to access, correct (you can rename yourself in the app), delete, restrict or object to the use of your data, to data portability, and to withdraw consent at any time. You can also complain to your local data protection authority. To exercise these rights, contact us at [email protected].
8. Children
Tipsy Tiles is a general-audience game and is not directed at children under 13 (or the minimum age in your country). We don’t knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
9. International transfers and security
Our providers (Google, RevenueCat, Cloudflare) may process data in other countries, including the United States, under safeguards such as the EU Standard Contractual Clauses. All connections use HTTPS, and access tokens are stored only as one-way hashes.
10. Changes
If we change this policy, we will update the date at the top of this page. Please check it from time to time.
11. Contact
Verxion · www.verxion.dev
Email: [email protected]