Privacy policy

When you play a game, signed in or not

Partner advertising. Games that use Google AdMob show occasional full-screen ads between rounds. To request them, the Google AdMob software in the game sends Google your IP address, device model, operating system, language, approximate location derived from that IP address, and your interactions with the ad. It can also send your device's advertising identifier when your device settings and the applicable consent allow it. Where the law requires consent, we ask first, and this is the data that choice controls. On iPhone and iPad, Apple's tracking prompt controls the advertising identifier separately.

When the game reaches its advertising-consent step, it contacts Google to find out which consent message applies, if any. That request happens before the form can be shown. Google AdMob advertising requests wait until the consent flow allows them.

Flownauts promotions. Games that support our house ads can show promotions for Flownauts games and FlowPass. We select them using the game, ad placement, app build, platform, language and supported media, rather than an interest profile or browsing history. For signed-in delivery, we use your account and device identifiers to check access, Remove Ads and FlowPass, protect playback and rewards, and limit repeat ads. These identifiers can be linked to your account. House-ad delivery uses short-lived playback and repeat-limit records; it does not create a separate linked history of clicks or viewing for campaign diagnostics. Purchase and reward accounting are kept separately. These promotions are separate from Google AdMob and its advertising-consent controls.

Recording game choices. We are introducing a service that records privacy choices with Flownauts. Games that use it relay the outcome of Google's User Messaging Platform advertising-consent flow, together with the relevant analytics choices, to our servers. Google's form remains the control for Google partner advertising. The record described below is an additional record of the choice, not a replacement for that form or your device's tracking permission.

Analytics. In games with analytics enabled, Google Analytics for Firebase records that a game was opened, that a puzzle was finished, and similar milestones, together with a per-install identifier, your device model, operating system and approximate location from your IP address. It never records the contents of your puzzles. Collection starts enabled in games that include analytics unless you have turned it off. You can turn collection off in Settings › Privacy choices. In our updated iOS games, Firebase Analytics is configured without advertising-identifier support; AdMob advertising has its own separate controls described above.

Local and cloud progress. Your game keeps a local copy of your progress and settings, together with the counters that keep ads infrequent and your consent choices. If you sign in and use eligible cloud saves, your game save and its display summary are sent to Flownauts so you can continue on another device.

Crash diagnostics. Sentry receives crash and error reports, app and build information, the platform, and technical context so we can fix problems. We disable default personal-information collection. For error reports prepared by game code, we remove account identity, request headers, cookies, bodies and URL parameters, and redact text that looks like an access token. These measures do not stop Sentry receiving the network information needed to deliver a report.

When you have a Flownauts account

You can create one on flownauts.com or from Account in games that support it. We store:

• your player id, the display name we generate for you or the one you choose, your avatar, theme and language;
• your country, which we fill in from your IP address when you sign in and which you can change in your account settings;
• the devices you have signed in from, including the name you give each one and its app version;
• cloud saves for the games you sync, and the games your account is connected to;
• leaderboard entries you submit, and the challenges behind them;
• if you join a team in a game that offers teams: the team you are in, your role, when you joined or left, the team invitations you send and receive, which puzzles and matches you counted toward the team's weekly goal, and the team postcards you earn;
• players you have blocked, and reports you have filed, including anything you typed in them;
• which version of this policy and our terms you accepted, and when;
• when you last used your account, so that we can tell when it has been inactive for 180 days;
• purchases and membership state, where you have bought something.

Flownauts manages your account and sign-in sessions. You can sign in using an emailed one-time code, a sign-in link on the website, or Apple or Google. We store your verified sign-in methods. For email sign-in we keep your address encrypted so we can deliver sign-in messages and show you a masked address in account settings. If you have a verified email sign-in method, our API can use that address when you view or change your signed-in newsletter preferences. Apple and Google receive the information needed for their sign-in service when you choose them. We do not use account passwords.

Teams. Teams are for adults. You can start a team, or join one only by accepting an invitation from a friend. A team's name is whatever its creator types. Among players, only the team's members and those invited to it see the name, and members see each other's public profiles. When a puzzle or match counts toward the team's goal, we record which one it was and when, not your time, moves or score. Each team postcard keeps the team's name, emblem and color as they were that week.

When you visit flownauts.com

Google Analytics records the pages you view, your approximate location from your IP address, and your browser and device. We strip sign-in links out of the addresses before they reach Analytics. Where the law requires consent, we ask before anything is set.

When you shop for merchandise

Our merchandise is sold by Fourthwall, Inc., the seller of record: Fourthwall runs checkout, takes payment, collects sales tax, prints and ships your order, and handles returns.

The shop. On shop.flownauts.com you can browse and fill a cart without an account. The shop keeps one strictly necessary cookie holding your cart's id, so your cart is still there when you come back. The shop pages themselves do not use analytics or advertising cookies.

Checkout. Checkout runs on pages Fourthwall operates for us. There Fourthwall collects your name, email address, shipping address and phone number, what you order and what you pay, and your payment details, which go to its payment processors; we never see your card details. Fourthwall and its payment processors may also use information about your device and payment to prevent fraud. Fourthwall handles this information as an independent business under its own privacy policy, and it sends your order and shipping emails.

What we see. Fourthwall shows us the orders placed in our shop, including the name, email address and shipping address on each, so that we can answer questions about them and keep business records. Placing an order never subscribes you to our newsletter.

Analytics at checkout. We have added Google Analytics to our checkout pages to measure visits and purchases. It records the pages you view, the products you add to your cart and buy, and the order value, together with a cookie identifier, your IP address and your browser and device. Visitors in the European Economic Area, the United Kingdom, Switzerland and some other countries see a cookie banner first, and Google Analytics waits until they agree. We have not added any advertising pixels to the checkout pages.

When you use our updated privacy controls

We are introducing a record of the choices you make through the website, the account preference center, and games and companion apps that use the new service. Where these updated controls are available, we record which purposes you allow or decline, the versions of those purpose descriptions and this policy shown to you, when we recorded the choice, and whether it came from the website, a game, the companion app or your account settings. We also record how the choice was made, such as a banner, a preference change, Google's consent form or a browser privacy signal. Changing a choice creates a new record; we keep the earlier record as history.

If you are not signed in, the record uses a randomly generated consent identifier. On the website, this identifier and a private code that proves ownership of the record are kept beside your choice in your browser's local storage, rather than in a cookie. If you make a choice while signed in, we associate it with your player id. When the updated website or app links your existing choices after sign-in, those records also become part of your account history.

The record includes the country code supplied by our network edge and the regional consent default applied. It does not contain your IP address. The country code helps us apply the appropriate default; it is separate from the country you can edit in your account settings. Section 4 explains how long these records remain, and section 5 explains how to change your choices.

Optional commerce reporting

Where our updated privacy controls are available, you can choose whether Flownauts records how its purchase offers are used. This optional first-party reporting starts off. It is separate from Google Analytics, advertising consent and the information needed to process a purchase or give you access to something you bought.

If you allow commerce reporting, we record which offer screen was displayed, whether you opened checkout or dismissed the offer screen, the offer and its version, the product, game or app, store channel and relevant times. We use a random reporting identifier linked to your account or recorded browser or installation choice. We also project verified purchases, renewals and refunds from our own billing ledger, including the product, store, transaction time and any recorded charge and currency. A checkout click does not prove a purchase, and we do not use a client's claim of success as revenue.

With this choice enabled, supported games also record meaningful gameplay starts and completions, the game, platform, channel and relevant times. We group this activity by the first observed consented play to measure later returns.

We use Google Cloud BigQuery to store and analyse these reporting records, with Dataform preparing reports for Flownauts. The reporting records do not include your email address, payment-card details, provider credentials or private sign-in codes. They help us understand offer performance, observed purchases and gameplay returns.

Optional purchase personalisation

When this feature is available, signed-in players can choose purchase personalisation separately from gameplay, purchase and offer analytics. This optional choice starts off. If you allow both choices, we use gameplay linked to your account and eligible, verified initial purchase outcomes to estimate how likely you are to buy FlowPass or downloadable content during the following week and personalise recommendations. FlowPass and downloadable content have separate estimates. An estimate may be unavailable when eligibility, purchase coverage or model quality is insufficient and is not a guarantee.

We use Google Cloud BigQuery and its machine-learning tools for these predictions. This choice does not change your access, purchase price or whether a purchase succeeded, or sign you up for marketing. We do not upload the predictions to third-party advertising audiences. Until the feature and its privacy controls are available, personal purchase predictions remain disabled.

When you ask us for help

When you send a support request, from flownauts.com or by email, we keep your email address, the name you give us, your message, the game and topic it is about, and any screenshots you attach. If you choose to include them, we also keep your device, operating system, app version and language. If you are signed in, we link the request to your account. Screenshots are stored privately and never at a public address.

AI-assisted support. If you confirm that you are 18 or over, we may use Anthropic's Claude to help understand your support request and prepare or send a reply. This can include relevant messages and screenshots you provide. Requests that do not qualify for AI handling go to our support team. AI can make mistakes; you can ask for a person to help.

TestFlight feedback. When you send beta-testing feedback through Apple TestFlight, we receive your comment, any screenshots or crash information supplied by Apple, and app, build and device details. We store this as a private support request. We may use Google Cloud's Vertex AI Gemini to classify the feedback and create separate internal bug tasks for distinct reported problems. For this processing, we send the feedback text, request and comment references, and limited channel, platform, device and app-version details. We do not send screenshot files or crash-log files to Gemini in this workflow. Anything you include in the comment may be sent as part of that text. AI can make mistakes, and our team reviews the reported problems.

When you email us or subscribe

If you write to us about anything else, we keep your message and address for as long as it takes to help you. If you subscribe to our newsletter, we keep your address, confirm it by email before sending anything else, and record where you signed up and, if you signed up for a game's news, which game. Owning a game never subscribes you to anything, and every newsletter has an unsubscribe link that works.

To send you the right version of each issue, we use your language and your country. If you subscribe while signed in, your country is the one in your account settings; otherwise we work it out from your IP address. If your subscription is linked to your Flownauts account, we also check whether you have FlowPass. Your language sets the language of the issue, your country decides which sponsor messages it carries, and FlowPass members get none. We keep your subscription, its confirmation and any unsubscribe in our own records; Mailgun, the service that delivers our email, receives each message only to send it. A newsletter may contain a small image that lets Mailgun tell us whether you opened it, and its links may go through Mailgun's tracking address so we can see which links are clicked; we use this to see which issues and links people find useful. Some mail apps and link scanners open messages or follow links on their own, so these figures are estimates. Sponsor messages are always labeled "Sponsored", and sponsors receive no personal data from us (section 3).

What we never collect

We do not collect your precise location, your contacts, your photos, your microphone or your camera. We do not ask for sensitive information and do not want it. We do not know your real name unless you tell us.

Notifications. When you enable remote notifications in a supported game, we store a private delivery token or browser subscription, the application and installation, language, notification choices and quiet hours. We also keep records of attempts to send notifications. System permission is separate from marketing consent; enabling these notifications does not enable advertising, analytics or marketing.

FlowPass through Fourthwall

Fourthwall handles membership checkout, payment, renewal and your billing account under its privacy policy. To give you game access, we verify the paid membership with Fourthwall and match its email to a verified email on an existing FlowAccount. This does not create an account or sign you in. We keep the membership identifiers, paid period and access state needed to provide and reconcile your benefits. Mailgun delivers service emails welcoming you to FlowPass and notifying you when access ends; open and click tracking are disabled for these messages. Buying FlowPass never subscribes you to our newsletter. Fourthwall billing and FlowAccount game access have separate logins.

To run the games and your account; to show and measure advertising, which is what keeps the games free; to understand which games people enjoy so that we make better ones; to keep leaderboards honest and to deal with abuse; to answer you when you write to us; and to meet our legal obligations.

Where the law asks for a basis: we process what is necessary to give you what you asked for, we rely on your consent for advertising, analytics and marketing where consent is required, and we rely on our legitimate interest in running a sustainable studio for the rest.

Google acts on its own behalf for advertising, which means it decides how the advertising data it collects is used. The other providers process the information listed above to provide the services described.

AI services. We use Anthropic's Claude for eligible adult support requests and Google Cloud's Vertex AI Gemini for internal TestFlight feedback triage, as described in section 1. Our separate studio-authoring tools use Claude and Vertex AI with studio-authored material. Jev does not receive player-support data in these workflows. These AI tools do not receive your cloud saves or unrelated account information.

Newsletter sponsors. Our newsletter may carry messages from sponsors, who pay to appear there and are always labeled "Sponsored". Sponsors receive no personal data from us: not your address, not your language or country, and nothing about who opened or clicked what. Each sponsor receives one figure, the number of clicks on its link, broken down by country. When you follow a sponsor's link you go to the sponsor's own site, and its privacy policy applies there.

We do not sell your personal data for money. Some United States state laws treat sharing data with an advertising partner for personalized advertising as a "sale" or as "sharing", and on that definition our advertising counts. Section 5 tells you how to opt out, and we never treat anyone differently for doing so.

We also share when the law requires it, to protect people from harm, and with a buyer if the studio is ever sold, in which case this policy travels with your data.

Game progress on your device stays until you delete the game. Everything else:

• Cloud saves stay while your account is active. If a paid membership lapses we hold the saves for twelve months, so that nothing is lost if you come back, and then delete them.
• Reports about other players are kept for 180 days after we close them, so that patterns of abuse remain visible.
• Teams. A puzzle or match counted toward a team's weekly goal is kept for 90 days after that week ends; the team then keeps only its weekly total. A membership that has ended is kept for 90 days, and an invitation for 30 days after it is accepted, declined, withdrawn or expires. Team postcards stay in your collection until you delete your account. When you delete your account, your memberships, invitations and postcards are deleted, a team you owned passes to another member or closes, and what you counted is kept without your name or profile for up to 90 days, then deleted, so your teammates' progress does not change. A team's name belongs to the team: it stays on the team and on postcards already earned after its creator leaves or deletes their account. A team's name is removed 90 days after the team is disbanded. Weekly team records drop the team's name 90 days after the week ends; postcards keep the team's name as it was that week until their holder deletes their account.
• Support requests are marked solved seven days after our last reply if you have not answered, and closed fourteen days after that. We start deleting a closed request, with its messages and screenshots, 180 days after closing it, or straight away if you ask us to delete it. Mail you send us passes through Mailgun to us without Mailgun keeping a copy; copies in Google Workspace are stored separately and may remain under its retention settings. Our support team handles that cleanup manually and tracks outstanding copies; we do not treat deletion as complete while those obligations remain unresolved.
• AI-provider copies. Anthropic normally deletes API inputs and outputs within 30 days. It may retain data longer for safety-policy enforcement or legal requirements. Deleting your request from Flownauts does not immediately remove a copy already sent to Anthropic. Our normal support-request retention and deletion process still applies to the conversation we hold. For TestFlight triage, Google Cloud does not use the feedback to train its AI models without our permission. We do not enable request-response logging or create explicit content caches for this processing. Google Cloud's project-level implicit caching remains enabled and may retain feedback text and generated content in durable storage to improve service performance. We have not verified a fixed retention limit for this durable caching mode. Google may separately retain flagged prompts for abuse monitoring for up to 90 days in the selected region or multi-region, and authorised Google employees may review them. Deleting the support request from Flownauts does not immediately delete copies retained by Google.
• Account deletion takes effect immediately and finishes in the background. Deleting your account also deletes your newsletter subscription and preferences. We give you a receipt that lets you change your mind for 30 days; after that it cannot be undone. We keep a one-way fingerprint of your sign-in identity for 400 days, so that the same account cannot be recreated to evade a ban, and the financial records tax law requires us to keep, which do not identify you by name.
• Inactive accounts. If you haven't signed in to your account for 180 days and don't have an active membership, we may delete it, and this has the same effect as deleting it yourself.
• Website analytics follow the retention setting on our Google Analytics property.
• Orders are kept by Fourthwall under its privacy policy and the tax and consumer laws that apply to sales. Order details that reach us in a support request follow the support-request schedule above.
• Checkout analytics follow the retention setting on our Google Analytics property.
• Newsletter until you unsubscribe. If you sign up but never confirm, we delete your address after 30 days; if you unsubscribe from everything and have no account, we delete your subscription record after a year. If an address bounces permanently or someone marks our email as spam, we keep only a one-way fingerprint of the address so we do not email it again.
• Email delivery records, showing whether each email we sent was delivered, bounced or reported as spam and, for newsletters, whether it was opened and which links were clicked, are kept for 180 days. Mailgun keeps its own delivery logs for a short time (currently one day) before deleting them.
• Optional commerce reporting. Analytical event and transaction projections remain in active reporting for at most 30 days from the event or transaction. Small derived gameplay cohorts and linked outcomes expire at most 35 days from the original cohort day; later activity does not restart that period. Temporary delivery, staging and export-input copies expire after 30 minutes and cannot be admitted as new reporting data after that window. Physical removal runs asynchronously and can take longer during outages or while outstanding writes are resolved. These copies do not create another reporting history. If you withdraw this choice, we stop new collection for that choice and remove its retained reporting history. Account deletion also removes the account's reporting history. Cleanup waits for outstanding writes to be resolved so a delayed write cannot restore erased history. Google Cloud's recovery storage may retain deleted warehouse data for up to a further 14 days (seven days of time travel followed by seven days of fail-safe storage); this recovery data is not used for reporting. We retain opaque deletion markers to reject delayed messages. These choices do not remove the separate billing records needed to honor purchases and meet legal obligations.
• Optional purchase personalisation, when available. Raw gameplay activity is kept for up to 30 days. Personal features, derived purchase outcomes, predictions and model-contribution records expire at most 35 days from the original gameplay cohort day; later activity or retraining does not restart that period. Models expire no later than their earliest contributing training or evaluation data. Withdrawing either required choice stops prediction use, removes retained personal prediction records and removes models that used them. Temporary staging and export-input copies are also covered by cleanup; outstanding writes must be resolved so a delayed job cannot restore erased data. Physical removal runs asynchronously and can take longer during outages or while outstanding writes are resolved. The warehouse recovery-storage limits described above also apply; recovery copies are not used for prediction.
• Flownauts house-ad delivery. Playback and delivery records are scheduled for short expiry and cleanup. Repeat-limit records expire no later than the end of the current serving day. Purchase and reward accounting follow their separate retention requirements.
• Privacy-choice records. Records that are not connected to an account are deleted 13 calendar months after the newest record for that consent identifier. Records connected to your account, including choices linked after sign-in, remain as account history and are removed when your account is deleted. Removing the browser's local choice does not by itself delete a record already sent to us.
• Notifications. We delete notification records 30 days after settlement or expiry, and revoked registration metadata after 30 days. Registrations not refreshed for 270 days are revoked. Account deletion removes registrations, notification preferences and notifications to or about you.

Google partner advertising in the games. In Europe, the United Kingdom and Switzerland, advertising requests wait until the consent flow allows them; the initial consent-information request is described in section 1. You can change your consent choice from Settings › Privacy choices. In United States states with a right to opt out, the same control turns off personalized advertising. Declining never stops you playing and never costs you content. If the game uses Google partner advertising and Google's consent flow permits it, you may see advertising that is not personalized instead.

On iPhone and iPad, Settings › Privacy & Security › Tracking controls the advertising identifier for every app. On Android, Settings › Google › Ads does the same, and can reset or delete it.

The website. In Europe, the United Kingdom and Switzerland we ask before anything but strictly necessary storage is set, and Google Analytics runs without cookies until you say yes. Everywhere else it is on when you arrive and you can turn it off. Either way the control is the same one, on the Your privacy choices page, and you can change your answer whenever you like.

As our updated website controls are introduced, the banner and Your privacy choices page show the available purposes and let you allow or decline each optional purpose. Necessary functions stay enabled. We record the choice as described in section 1. Your choice takes effect locally even if sending that record to our servers fails.

Checkout. In the European Economic Area, the United Kingdom, Switzerland and some other countries, the checkout's cookie banner, run by Fourthwall, lets you decline analytics cookies. Elsewhere the checkout does not read your choices on flownauts.com, so to opt out of analytics there, block these cookies in your browser. Declining never stops you from buying.

Global Privacy Control. Where the updated website controls are available, we honor a Global Privacy Control (GPC) signal from your browser by turning off optional advertising purposes, wherever you are. An earlier advertising grant does not override an active signal. GPC does not itself change your separate analytics or newsletter choice; you can manage those through their controls.

Your account. From your account settings you can change your display name and country, disconnect a game, sign devices out, download everything we hold about you, and delete your account.

As the new Privacy preferences page becomes available in your account, you can view the latest recorded choice for each surface and change the choices offered there. Your data download includes your recorded consent history, including browser choices linked to your account. To change the advertising choice controlled by Google's form, use Privacy choices in the relevant game.

Commerce reporting. Where the updated controls offer this choice, you can turn optional gameplay, purchase and offer analytics on or off for the relevant website, game, companion or account surface. Turning it off does not stop you buying or using purchased content. Your account data download includes retained reporting records linked to your account; withdrawing the choice or deleting your account removes that reporting history. Advertising, Google Analytics and newsletter choices remain separate.

Purchase personalisation. When this feature and its privacy controls are available, it has a separate optional choice for signed-in gameplay. Allowing commerce reporting does not allow personal purchase predictions. You can turn the prediction choice off in the relevant game privacy controls. Withdrawal stops prediction use and removes personal prediction records and models that used them; playing, purchases, membership and access still work. Your account export includes retained features, derived purchase outcomes, predictions and model-contribution records linked to your account, and account erasure also covers them.

Email. Every newsletter has an unsubscribe link. Unsubscribing does not affect email about your account, such as a sign-in code or link, a receipt or a reply to a support request.

The updated account preference center also shows your newsletter preferences. A website, game or account privacy-choice record does not subscribe you to marketing email. Newsletter sign-up still requires email confirmation, and you can use the newsletter controls or unsubscribe link to leave.

Your rights. Depending on where you live, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it elsewhere. Your account settings do most of this immediately. For anything else, write to privacy@flownauts.com and we will answer within 30 days. If you are in Europe or the United Kingdom you may also complain to your data protection authority. Fourthwall holds the details of your orders; you can ask it directly, and we pass on requests about orders that you send us. Notifications. You can turn off notifications or change quiet hours in the game, or revoke permission in your device or browser settings. A notification already handed to a provider may still arrive. These controls are separate from newsletter subscriptions.

Our games are for a general audience and are not directed to children under 13, or the higher age that applies where you live. We do not knowingly collect personal information from children, and we do not knowingly show them personalized advertising. If you believe a child has given us information, write to privacy@flownauts.com and we will delete it.

Our account and database servers are in the United States. Cloudflare handles live gameplay on its global network, so that information may be processed in other countries. When your data leaves Europe, the United Kingdom or Switzerland, it travels under the safeguards the law provides, which are the European Commission's standard contractual clauses or, for companies certified under it, the EU–US Data Privacy Framework.

Everything travels over encrypted connections. Sign-in tokens are held in your device's secure storage. Access to our systems is limited to the people who need it. No service can promise perfect security, and we will tell you and the regulators if something goes wrong, as the law requires.

When this policy changes we publish a new version with a new effective date and keep the previous one available. If a change is significant we will ask you to review it in the app or on the site before it takes effect.