Privacy Policy for Pyralinks

1) Who we are

Controller / Developer: TMBoyz LLC

Contact email: support@tmboyz.com

2) Data we collect

We aim to collect the minimum necessary data to operate the app. Creating an account is optional; see User accounts for what it's required for.

• Account information (optional): If you choose to create an account, we collect and store:
  • Unique account identifier (AWS Cognito subject ID) to link your puzzle data to your account
  • Email address and password (for email/password accounts via AWS Cognito)
  • Basic profile information from social login providers (email and name, when available, if you sign in via Facebook, Apple, or Google)
  • Your completion status and in-progress state for each puzzle (stored in the cloud to sync across devices)
  • Account creation date and authentication tokens
• Subscription information: We use RevenueCat to manage our subscriptions and to check whether you have an active Pyralinks Plus subscription. Each check sends RevenueCat an identifier (your AWS Cognito subject ID once you're signed in, otherwise one the app generates), along with technical details that come with any internet request, such as your IP address and your device, browser and app version. RevenueCat keeps a record under that identifier with your subscription status (platform, renewal date) and purchase history, if any. See "Subscriptions & billing" below for details.
• Functional cookies: Short-lived cookies that authorize the app to securely download puzzle content from our servers. These cookies are not used for tracking and do not contain personal information.
• Server logs: When the app or website contacts our servers, we log the IP address, user agent, time and address of the request, for security and troubleshooting. Logs of signed-in requests may also include your account identifier. These logs are deleted after 14 days.
• Ads-related identifiers & device information: Our advertising partners (Google AdMob on mobile and Google AdSense on the web) may collect device or browser information such as advertising identifiers (e.g., Android Advertising ID), IP address, user agent, app version, and interaction data related to ad delivery and measurement.
• Website analytics (web only): On pyralinks.com we use Google Analytics to measure visits, pages viewed, time on site, approximate location (country/region), device and browser type, and how visitors arrived. Google Analytics uses cookies and similar technologies, and Google processes this data under its own privacy terms. In the EEA, UK, and Switzerland, analytics cookies are not set unless you consent. You can opt out with the Google Analytics opt-out browser add-on.
• App diagnostics: Apple and Google may share crash and performance reports with us from devices whose owners allow it. The mobile apps don't use an analytics service; the ad services in the apps may collect diagnostics to measure ad performance.
• Web cookies (web only): Google Analytics, AdSense, and related ad technologies may use cookies or similar technologies in your browser for ad delivery, measurement, or to remember preferences.
• Support communications: If you contact us directly (email or form), we'll receive the info you provide and any metadata needed to respond.

3) How we use data

• Provide and operate core gameplay features.
• Create and manage user accounts (if you choose to create one).
• Store and sync your puzzle progress across devices (for account holders).
• Authenticate you via email/password or social login providers (for account holders).
• Authorize secure access to puzzle content using functional cookies.
• Check whether you have an active subscription, using RevenueCat.
• Process and manage your optional paid subscription (for subscribers).
• Analyze subscription activity, such as numbers of subscribers and renewals, using RevenueCat's dashboard.
• Display advertisements and measure ad performance.
• Understand how visitors use the website, using Google Analytics.
• Maintain and improve stability, quality, and security.
• Respond to support requests and comply with legal obligations.

4) How we share information

• Advertising partners: Google's advertising services (AdMob in the apps, AdSense on the website) collect data directly from your device or browser to deliver and measure ads, as described in "Advertising" below. They process this data under their own privacy terms.
• Analytics: Google Analytics collects data directly from your browser on pyralinks.com to measure website usage. Google processes this data under its own privacy terms.
• Infrastructure providers: We use hosting and content delivery network (CDN) providers (Amazon Web Services/CloudFront) to deliver puzzle content. Functional cookies are used to authorize content delivery.
• Authentication services: We use AWS Cognito to manage user accounts. When you create an account, your authentication data is processed by AWS Cognito under their privacy terms. If you use social login (Facebook, Apple, or Google), those providers will process your authentication according to their respective privacy policies.
• Subscription/billing providers: RevenueCat, which manages our subscriptions, receives your app or account identifier. Payments are processed by Apple, Google or Link (operated by Stripe) under their own privacy policies. See "Subscriptions & billing" below for what each receives.
• Legal & compliance: We may disclose information if required by law or to protect rights, safety, and integrity.
• Aggregated or de-identified data: We may use or share non-identifiable insights (e.g., counts, trends).

5) User accounts (optional)

You can optionally create a free account. An account is required to subscribe to Pyralinks Plus on our website, play past puzzles in the archive, and save your puzzle progress in the cloud so it syncs across devices and can be recovered if local data is lost.

Account Creation Methods

• Email/Password: Create an account directly using your email address and a password. Your credentials are securely managed by AWS Cognito.
• Social Login: Sign in using Facebook, Apple, or Google. We use AWS Cognito's Hosted UI to handle authentication with these providers. We receive basic profile information (name, email) from the social provider you choose.

What We Store for Accounts

• Unique account identifier (AWS Cognito subject ID) for linking your puzzle data
• Your email address and name, when available (shown on the Account page)
• Your completion status and in-progress state for each puzzle
• Account creation date and authentication tokens

Note: We store your email and name from the social provider and your user ID at that provider, which links that sign-in to your Pyralinks account. We don't store profile pictures.

Account Deletion

You can delete your account directly from the app:

• Open the Account page
• Tap the "Delete account" button
• Confirm deletion

If you have a Pyralinks Plus subscription that is still set to renew, the app requires you to cancel it first, because deleting your account does not cancel a store subscription. See "Subscriptions & billing" below.

When you delete your account:

• Your account data and cloud-stored puzzle progress are permanently deleted from our servers
• Deletion is immediate and cannot be undone
• Your account's puzzle progress and settings are removed from the device you delete it on. On your other devices, the account and its local data are removed the next time the app checks the account online and finds it deleted
• Subscription records held by our service providers are kept until you ask us to delete them (see "Subscriptions & billing")

What Works Without an Account

You can play today's puzzles without creating an account, and your progress will be saved locally on your device.

6) Subscriptions & billing

We offer an optional paid subscription, "Pyralinks Plus," which provides ad-free play. Your subscription is linked to your account identifier or, if you subscribe in our iOS or Android app without an account, to an identifier the app generates. It moves to your account if you later sign in on that device.

What we collect

• Your account identifier (AWS Cognito subject ID), or an app-generated identifier if you have no account, used to link your subscription status to you.
• Subscription status (whether you're subscribed, which platform you subscribed through, and your renewal date), managed on our behalf by RevenueCat.
• For web purchases: your account's email address, used as your billing email; the name and billing address you enter at checkout; and basic details of your payment method, such as its type and last four digits.

We never see or store your full card or bank account number. Payment is handled entirely by:

• Apple's App Store (iOS purchases)
• Google Play (Android purchases)
• Link, operated by Stripe (web purchases), which sells web subscriptions on our behalf as the merchant of record (Link Privacy Policy).

Each of these processes your payment information under its own privacy policy.

Web purchases are available in select countries. Our content delivery network determines your country from your IP address; we don't store it.

How this data is shared

Your account identifier, or the app-generated identifier if you have no account, is shared with RevenueCat, which verifies your purchases with Apple, Google, or Stripe and tells the app whether you have an active subscription. For web purchases, your account identifier is stored with your subscription at Stripe to match it to your account. Your account's email address is passed through RevenueCat to the checkout as your billing email, for your receipts and for managing your subscription.

When you delete your account

You can't delete your account while a subscription is still set to renew; cancel it first where you bought it. Deleting your account keeps your RevenueCat record (subscription status and purchase history, if any), so that a store subscription you pay for later can still be moved to a new account; you can ask us to delete it at support@tmboyz.com. For web purchases, we can also delete your saved payment details at Stripe on request; records of past payments are kept for accounting. Apple, Google and Link each keep their own records of your purchases under their own privacy policies.

If you subscribed without an account, you can ask us to delete its record at support@tmboyz.com with the order ID from your App Store or Google Play receipt.

7) Advertising (AdMob & AdSense)

We use third-party advertising companies to serve ads when you visit our website and applications. These companies may use information about your visits to this and other websites in order to provide advertisements about goods and services of interest to you.

• Mobile (Android/iOS): We use the Google AdMob SDK. Google, as a third-party vendor, may collect advertising identifiers (such as Android Advertising ID or iOS IDFA), IP address, approximate location, and app interaction signals to serve and measure ads.
• Web: We use Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to pyralinks.com and/or other sites on the Internet.

Your choices and opt-outs:

• Device Settings: On iOS, you can allow or deny tracking for Pyralinks in Settings > Privacy & Security > Tracking. On Android, you can reset or delete your advertising ID in Settings > Privacy > Ads (or Settings > Google > Ads on some devices).
• Google My Ad Center: You may manage, view, and delete your Google advertising data and opt out of personalized advertising by visiting My Ad Center.
• Third-Party Opt-Out: Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting the Digital Advertising Alliance at www.aboutads.info.
• Regional Consent: In the EEA, the UK and Switzerland, a Google consent message asks for your consent before ads use your data. If you don't consent, Google shows non-personalized or limited ads instead. Non-personalized ads can still use cookies or your advertising identifier for frequency capping, aggregated reporting and fraud prevention. In those regions, you can change this choice in the apps at any time from Ad Privacy Options in the puzzle settings.

8) App permissions & sharing

• Sharing features: You can share your puzzle results using your device's built-in sharing interface. The content you choose to share is sent to the destination app or service you select. We do not receive or store any of the content you share.
• Other permissions: We do not request access to contacts, microphone, camera, precise location, or photos. If that changes in the future, we will request permission in-app and update this policy.
• Tracking (iOS): The app asks for permission to track you for personalized ads (App Tracking Transparency). You can change this later in Settings, as described in Advertising.

9) Local data storage

Our applications store game progress and preferences locally on your device:

• Your puzzle progress, including completion status and in-progress puzzle states
• App settings and preferences

Without an account: Your puzzle progress and settings stay on your device and are not sent to our servers. You are responsible for backing up your device data if desired. Uninstalling the app will delete this local data.

With an account: Your puzzle progress is synced to the cloud and stored on our servers. A local copy also remains on your device. You can delete cloud data by deleting your account as described in section 5. Remove from device on the Account page deletes that account's local copy from the device, and keeps its cloud data with the account.

10) Data retention & deletion

We retain only what's needed to operate the app or respond to support, and otherwise for as short a period as practical.

Account Data

If you create an account, we retain your account information and cloud-stored puzzle progress until you delete your account. You can delete your account from the Account page in the app, which will immediately and permanently delete:

• Your account credentials (email/password or social login connection)
• Basic profile information (email, name)
• All cloud-stored puzzle progress (completion status and in-progress state) linked to your account
• Account creation date and authentication tokens

We keep your former account identifier (Cognito subject ID) and a one-way fingerprint of your account's email address so that we can find your subscription records if you later ask us to delete them. We delete both when we handle that request.

Puzzle progress can remain in our database backups for up to 35 days after deletion.

If you have Pyralinks Plus, see "Subscriptions & billing" above for what happens to your subscription records when you delete your account.

Other Data

If you've contacted us for support and want your messages deleted, email us and we'll erase them unless we must keep them for legal reasons.

For detailed instructions on how to delete your local app data, account data, and request other data deletion, please see our Data Deletion Policy.

11) Security

We use reasonable technical and organizational measures appropriate to the nature of the data we handle, including:

• HTTPS encryption for all data in transit
• Secure cloud storage (Amazon Web Services)
• Industry-standard authentication via AWS Cognito
• Access controls and authentication

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

12) Children's privacy

The app is intended for users aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

13) Your rights & choices

Depending on your region, you may have the following rights:

• Access: Request a copy of the information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your information
• Advertising Controls: Control ad personalization on your device or browser as described above

To exercise these rights, please contact us at support@tmboyz.com.

Account deletion: You can delete your account from the Account page in the app. If you cannot access the app, contact us at support@tmboyz.com and we will assist you with account deletion after verifying your identity. You may also uninstall the app (mobile) or stop using the site (web) to cease further collection.

14) International data transfers

Our services are hosted on Amazon Web Services (AWS) infrastructure, which may involve data processing in the United States and other countries. Account authentication is managed by AWS Cognito, which processes data in accordance with AWS's data protection standards.

15) Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will change the "Last updated" date above and, where appropriate, provide additional notice in the app or on our website.

We encourage you to review this privacy policy periodically for the latest information on our privacy practices.

16) Contact us

If you have questions or concerns about this privacy policy or our data practices, please contact us at:

Email: support@tmboyz.com
Website: www.pyralinks.com