Privacy policy

Last updated: 28 October 2026

1. Who we are

Buddy: Puzzle Adventure ("the game") is made by Nineteen Squares L.L.C-FZ, a limited liability company in the Meydan Free Zone, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, licence no. 2655176 ("we", "us"). We decide how your data is used, so we are the "controller" under the EU and UK General Data Protection Regulation (GDPR) and the other laws named below.

Contact for all privacy questions: [email protected].

Our representatives. We have no office in the EU or the UK. You can also contact our representatives there about your data:

In the EU: [EU REPRESENTATIVE: name, postal address, email]
In the UK: [UK REPRESENTATIVE: name, postal address, email]

2. The short version

You can play without giving us your name, email or phone number. The game creates a random player ID for you.
We store your progress on our server in the EU, so it is safe.
We count how the game is played (for example which level you started) to make levels fairer and fix problems. We do this on our own server. Only to measure our own ads, the phone apps also send a few milestones to Google (section 3).
The Android and iPhone apps use Google AdMob for ads, Google Firebase Crashlytics for crash reports and Google Analytics for Firebase to measure which of our ads bring players who enjoy the game. Where the law requires it, we ask before ads use your data, and you can change your choice any time.
We don't sell your data for money. There is no chat with other players.
You can download or delete your data at any time in the game: Settings > Privacy > Export my data / Delete my account.

3. What we collect, why, and on what legal basis

"Contract" means we need the data to give you the game you asked for (GDPR Art. 6(1)(b)). "Legitimate interest" means we have a good reason and have checked that it does not outweigh your interests (Art. 6(1)(f)); you can object (section 8). "Consent" means we only do it if you agree (Art. 6(1)(a)); you can withdraw your consent any time.

What	Why	Legal basis
A random player ID and a sign-in token for your guest account	To run your account and keep your progress	Contract
Your language, time zone, device type (Android, iPhone or web) and app version	So daily puzzles reset at your midnight and the game works on your device	Contract
Your game progress: levels, moves, medals, coins, items, map repairs, souvenirs, daily puzzles, quests, expeditions and races	To save your game, give rewards and check that results are fair	Contract
Buddy's name, if you give one (letters and numbers, max. 16 characters, checked by a word filter)	To show it to you, your friends and your crew mates	Contract
Game events (for example "level started", "hint used") with your player ID, and a daily summary per player made from them (for example sessions, play time, levels won, ads watched, money spent)	To see which levels are too hard, find bugs and understand which features work	Legitimate interest: improving the game. The data stays on our server, is linked only to the random player ID and is kept for a short time (section 7)
Tests of game variants (A/B tests): which variant of a feature you got, for example a different reward	To find out which version players like more	Legitimate interest: improving the game
Where the install came from ("install source"): on Android the campaign tags of the Google Play link you used (for example `utm_source`, `utm_campaign`); on iPhone an Apple attribution token that only says whether an Apple Ads campaign led to the install; in the web version the campaign tags of the web address. Stored once with your player ID	To see which of our own campaigns bring players and what they cost	Legitimate interest: measuring our own marketing. We don't read your advertising ID for this and don't follow you across other apps
Crews and friends: your friend code, your friends and crew, the crew name (from a fixed list), the emotes you send (5 fixed emotes), races you join, blocks and reports (a fixed reason and an optional note of up to 200 characters)	So you can play with friends, and to keep the community safe	Contract; legitimate interest (safety)
Swap shelf: the souvenirs you offer and want, completed swaps, the thank-you emote, reports and blocks	So you can swap spare souvenirs, and to keep swapping fair and safe	Contract; legitimate interest (safety, fraud prevention)
Purchases: the product, the store's order or transaction number, whether it was verified, refunds. Google Play or Apple handle the payment; we never see your card details	To deliver what you bought, restore it and handle refunds	Contract. After you delete your account: legitimate interest in keeping records that tax and accounting law requires
Ad rewards: which reward you chose a video for, and the ad network's confirmation	To give you the reward and prevent fraud	Contract
Reminders, if you turn them on: your choices (which kinds, quiet hours) and your time zone. Reminders are planned on your phone; we receive no device token	To remind you only about the things you chose, never at night	Contract (you switched the feature on). You can turn it off in Settings or in your phone settings
"Report a problem" (only when you send one): the reason, your optional text (max. 500 characters) and the technical details the app shows you under "What we send" (app version, device type and system version, screen size, language, the level you were in, the last screens and the last app error messages)	To help you and fix bugs	Contract; legitimate interest (fixing bugs)
Crash reports (Android and iPhone app only): when the app crashes or hits an unexpected error, Google Firebase Crashlytics receives the error report: the technical stack trace, your device model, system version and device state (for example free memory), the app version, the world and screen you were on, your random player ID and an installation ID that Firebase creates. Tokens and email addresses in error texts are removed first. No name, advertising ID or location	To find and fix crashes quickly	Legitimate interest: keeping the game stable
Ad measurement (Android and iPhone app only): Google Analytics for Firebase receives that the app was opened, app sessions, purchases made through Google Play or the App Store, ads shown and their value, and a few game milestones (tutorial finished, 5/10/20/40 levels cleared, came back after 1 and 7 days), together with an app instance ID that Firebase creates and, where allowed, the advertising ID. No name, no player ID, no text you type	To learn which of our ad campaigns bring players who keep playing, so we only pay for ads that work, and to let Google show our ads to people likely to enjoy the game	Legitimate interest: measuring our own campaigns. Use of the advertising ID and ad signals for Google Ads only with your consent where the law requires it (the same choice as for ads, section 4)
Your IP address	To protect the service against abuse (rate limits)	Legitimate interest: security. It is kept only in memory for at most one hour and never stored with your account
Server logs: web server logs with a shortened IP address (the last part removed), the page requested and the browser or app type; error logs with scrambled (hashed) IDs	To run the server securely and fix errors	Legitimate interest: security and operation
Ads in the Android and iPhone apps (see section 4)	To fund the free game	Consent where the law requires it; otherwise legitimate interest
If you ask for deletion on our website without the app: your email, an optional player ID and an optional message	To answer your request	Legal obligation (GDPR Art. 6(1)(c) with Art. 12 and 17)

We do not collect your name, contacts, photos, precise location or health data. You cannot type messages to other players.

Our legitimate interests, weighed. Improving levels, fixing crashes, measuring our own campaigns and keeping the game safe are things players expect from a free game. We limit them to a random player ID, keep the data on our own server or with a processor bound by contract, don't combine it with data from other companies, and delete raw data quickly. Many players are teenagers, so we use no data for these purposes that could harm them, and we never use it for advertising profiles.

Other players see only this: your friends and crew mates see Buddy's name, your friend code, how many levels you cleared, your race points and your hat. In an optional public race group, others see only your place, points and hat, never a name. On the swap shelf, others see only an anonymous "Explorer" picture, never your name, friend code or player ID.

The web version (in your browser) shows no ads and sends no crash reports. It saves your game in your browser's storage. If you type a character that our built-in fonts do not have, your browser may load it from Google Fonts (Google receives your IP address). Our website's mini-game stores its medals only in your browser.

Not switched on yet: Buddy's workshop (special souvenir pictures made with AI), sign-in with Google or Apple, and reminders sent from our server. We will update this policy before we switch any of them on.

4. Ads and your choices

The Android and iPhone apps show ads from Google AdMob: short videos you choose to watch for a reward (for example an extra heart or double coins), and from level 10 now and then a full-screen ad between levels (never during a level). The one-time purchase "Remove ads" turns off the ads between levels. The web version shows no ads.

The Google Mobile Ads SDK in the app collects data on your device and sends it to Google: your device's advertising ID (Android; on iPhone only if you allow tracking, see below) or a vendor ID (iPhone), device data, your IP address, coarse location derived from it, and how you interact with ads. Google uses this to show ads, measure them, limit how often you see them and prevent fraud.
When we ask: once, right before the first ad you would see (when you first tap a video, or before the first ad between levels), not when you start the game. After that we don't ask again; you can change your choices yourself.
Your choice: in the EEA, the UK and Switzerland, we ask for your consent with Google's consent form before ads use your data for personalised ads or store information on your device. If you agree, the ads can be personalised. If you say no, you still get ads, but they are not personalised. In some US states you can opt out of the use of your data for targeted advertising. You can change your choice any time in Settings > Privacy > Privacy choices.
If you are under 16: in some countries you need a parent's permission to consent alone. Please choose "Do not consent" unless a parent agrees.
iPhone: right after that, we ask for permission to track you (Apple's App Tracking Transparency). Only if you allow it, Google may use your iPhone's advertising identifier (IDFA) for personalised ads. If you don't allow it, the IDFA is not used. You can change this any time in your iPhone's settings (Privacy & Security > Tracking).
For personalised ads, Google is a separate controller responsible for its own use of the data. More about how Google uses data from apps: policies.google.com/technologies/partner-sites. Google's privacy policy: policies.google.com/privacy
Our server only stores which reward you watched a video for and whether an ad between levels was shown, not your advertising ID.

5. Who else receives data

Hosting: Hetzner Online GmbH, Germany, runs our servers. Our servers are in Finland (EU). Hetzner processes the data only on our instructions (processor, GDPR Art. 28).
Google Firebase Crashlytics (Android and iPhone app only) receives the crash reports as our processor (Google LLC, USA, and Google Ireland Ltd.). It does not get game progress and does not use the reports for advertising. firebase.google.com/support/privacy
Google Analytics for Firebase (Android and iPhone app only) receives the ad measurement data in section 3 (Google LLC, USA, and Google Ireland Ltd.) and shares conversion data with Google Ads to measure our own campaigns. firebase.google.com/support/privacy
Google AdMob shows the ads (section 4).
Google Play and Apple handle downloads and payments under their own privacy policies. They also tell the app, once, which campaign link an install came from (Google Play Install Referrer; Apple's attribution token, which our server may check with Apple).
Other players see what section 3 says.
Authorities or courts, only if the law requires it.
If our company or the game is sold, the buyer takes over the data under this policy. We will tell you before.

We do not sell or rent your data.

6. Data outside the EU

We are a company in the United Arab Emirates (UAE). The EU, the UK and Switzerland have not decided that the UAE protects data to their standard. Your data is stored in the EU, and our small team in the UAE accesses it from there over encrypted connections. The GDPR applies to us directly because we offer the game to players in the EU, so your rights are the same as with an EU company, and we follow it for all players. The EU has not yet published standard contract clauses for companies that are already bound by the GDPR in this way; when it does, we will use them.

Google may process data in the USA and other countries. Google LLC is certified under the EU-US Data Privacy Framework (with its UK and Swiss extensions); Google also uses the Standard Contractual Clauses. Apple uses the Standard Contractual Clauses. You can ask us for a copy of the safeguards.

7. How long we keep data

Your account and game data: as long as you have an account. When you delete it, we delete it right away, including friends and crew membership, swap offers and reports, problem reports, test variants, the install source and the daily summaries. Souvenirs you already swapped stay with the other player.
Game events: the individual events are deleted after 30 days. Daily summaries per player and figures without any player ID (for example how many players reached level 10 on a day) are deleted after 13 months.
Coin and reward records: when you delete your account, they are moved to a new random ID with no link to you, for bookkeeping and fraud checks.
Purchase records: the same, but they keep the store's order number, for as long as tax and accounting law requires (up to 7 years).
Crash reports at Google Firebase Crashlytics: 90 days.
Ad measurement data at Google Analytics for Firebase: 14 months.
IP addresses for rate limits: at most one hour, in memory only.
Server logs: at most 14 days.
Encrypted backups: 14 days, then they are overwritten.
Deletion requests via our website: 12 months after we receive them, to show that we handled them.

8. Your rights

You have the right to:

access your data and get a copy (in the game: Settings > Privacy > Export my data, a file of everything we store about you),
correct wrong data,
delete your data (in the game: Settings > Privacy > Delete my account),
restrict our use of your data,
take your data with you (the export is a machine-readable JSON file),
object to uses based on legitimate interest, for example game events or crash reports. Email us; we stop unless we have compelling reasons,
withdraw your consent any time, for example for ads in Settings > Privacy > Privacy choices. This does not affect what happened before.

Without the app, use the form at /delete-account.html or email [email protected]. We answer within one month. To protect your account, we may ask you to show that it is yours, for example with your player ID (Settings > Account in the app).

Complaints. You can complain to a data protection authority. In the EU and EEA, you can go to the authority in the country where you live or work, or where you think the problem happened (list: www.edpb.europa.eu/about-edpb/about-edpb/members_en). In the UK: the Information Commission (ICO), ico.org.uk. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. We would be glad if you contacted us first.

9. Children and teens

The game is for players aged 13 and older. We do not knowingly collect data from children under 13. If you think a child under 13 is playing or has given us data, email [email protected] and we will delete the account.

10. Automatic decisions

We do not make decisions about you that are based only on automatic processing and have legal or similarly significant effects. Our server checks level results automatically so that manipulated results don't count, and a word filter checks Buddy names. Reports from players are always looked at by a person.

11. Security

All connections use HTTPS. Sign-in tokens are stored only as hashes. Logs contain only shortened IP addresses and scrambled IDs. Backups are encrypted. Only our team can access the admin area, behind an extra access check and a password login.

12. Players in the United States

This section applies if you live in a US state with a consumer privacy law (for example California).

What we collect is listed in section 3: identifiers (player ID, device and advertising IDs), internet activity in the game, coarse location (by Google for ads), purchase records and the content you send us. We collect it from you, your device, the app stores and Google, for the purposes in sections 3 and 4.
"Selling" and "sharing": we don't sell your data for money. The ads SDK sends data to Google for targeted advertising, which some state laws call "sharing" or "selling". You can opt out in Settings > Privacy > Privacy choices (where offered) or by emailing us with your player ID. We don't knowingly sell or share data of players under 16.
Your rights: to know, access, correct and delete your data, and to opt out of targeted advertising. You can use them as in section 8 or by email, also through an authorised agent. If we say no, you can appeal by replying to our answer. We will not treat you differently because you used your rights.
We keep data as described in section 7.

13. Players in the United Arab Emirates and elsewhere

We also follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). The purposes, recipients, transfers and rights described above apply to you. You can complain to the UAE data protection authority. Wherever you live, you can use the rights in section 8.

14. Changes

If we change this policy, we update the date at the top. If a change matters for you, we tell you in the game before it applies, and ask for your consent again where the law requires it.

15. Contact

Nineteen Squares L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Licence no. 2655176 (Meydan Free Zone, Dubai). Manager: Sina Rosemann. Email: [email protected]. Representatives: section 1. Legal notice: /support.html#legal