Privacy policy

Who we are

Orange & Blue is a brain-games app published by Luci Studio. For anything about this policy or your data, write to orange-and-blue@luci-studio.com.

On your device

The app keeps your games, a preview of your progress, your settings, your privacy choices and the usage events waiting to be sent on your phone.

What our server keeps

Our server keeps what the app needs to work:

• the account: its id, when it was made and last used, its time zone, language and region (the country the network reports when the account is made);
• your progress, wallet (coins, lives, games bought) and purchases, Premium, the coins granted and the rewarded ads watched;
• the games you start, with their results and the moves you made, the starts the app blocked, your streaks and badges;
• your privacy choices;
• the sign-in sessions and devices of the account, with each device's platform, system version, model and app version;
• your sign-in methods, if you add one: for Apple or Google, the account id they give us and a verified email address; for Apple, the token Apple gives us, used only to revoke the link when you delete your account or remove Apple;
• the usage events still linked to you;
• if you use friends: your profile, friends, friend requests, blocks, name reports and league groups;
• if you get reminders: the phones registered for them and the reminders sent.

Your IP address, from the app, reaches our server with each request, through Cloudflare. Our server uses it only in memory, to limit how many requests one network can make in a minute; it keeps it in no database and leaves it out of its own logs. When our server cannot answer a request, for example while it restarts, the web server in front of it records that request, its IP address included, in the system log of the machine our server runs on.

Why we use it

• To run the service, without asking: your account, your games and their results, your streaks, your purchases and Premium.
• Crash reports, how the app performs on your phone, how fun you found a game, and your phone's model and system version: always, to keep the app working and fast. Other usage data: the app asks when you first open it, and your answer sets the Share usage data switch, which you can change at any time (Your choices).
• Ads: the app asks for consent just before the first ad, never when it opens.

Usage data

The app sends events such as a game started or finished, a workout completed, the Premium page opened or an ad shown. They are linked to a random analytics id kept with your account, never to your name, and help us fix problems and try out improvements: each event carries the variant of any experiment you are in. Turning Share usage data off stops keeping these events against your analytics id and gives your account a new one, so the events kept before can no longer be tied to you; deleting your account unlinks it too.

A few measurements are always kept with your analytics id, whatever that switch says: how fun you found a game, and how long the app took to start and how smoothly it ran. They are how we keep the games fun and the app fast on the phones people use.

Every event, the ones you turned off included, adds one to a count per event, day and country, which holds no user id and no IP address. The events kept carry your phone's platform, system version and model.

Crash reports

Crash reports go to Firebase Crashlytics, from Google. They are always sent, and carry no user identifiers.

Ads

The free app shows ads from Google AdMob. Before the first ad, the app asks for consent with Google's consent form in the EEA, the UK and Switzerland, and with Apple's tracking prompt on iPhone. Premium has no ads. When you watch an ad for a reward, your account id goes to AdMob, which confirms the view to our server.

Purchases

Premium and coins are bought through the App Store or Google Play, and RevenueCat tells our server about each purchase.

Signing in

You can sign in with Apple or Google. If you do, we keep the account id they give us and a verified email address.

Friends

If you use friends: your display name, your friend code, your friends, the requests you send and receive, the players you block, the names you report and the league groups you join.

Reminders

If you get reminders: the token your phone's notification service gives the app, and a record of the reminders sent.

Who processes it

• OVH hosts our server and its database, in Canada;
• Cloudflare carries all the traffic to our server and stores our encrypted backups;
• Google AdMob gets your account id as the user id of a rewarded ad, and the advertising identifier where you allow tracking;
• Google Firebase gets your phone's push token, to send reminders, and the crash reports;
• Google Sign-In, if you sign in with Google, confirms your Google account to our server;
• Apple confirms your Apple account to our server if you sign in with Apple, and revokes that link when you delete your account; it also delivers notifications on iPhone;
• RevenueCat gets your account id and your purchases.

These services process the data under their own data processing terms, which require them to protect it.

Where it is stored

Our server and its database are in Canada. Backups are kept, encrypted, in Cloudflare R2.

How long we keep it

• Your account and everything in it: as long as the account exists.
• Usage events linked to your analytics id: 13 months.
• The counts per event, day and country: kept, since they hold no personal data.
• Our server's logs: 30 days, with no IP address. A request our server could not answer is also recorded, IP address included, in the system log of the machine it runs on, which deletes its oldest entries when it is full.
• Backups: 30 days.
• Event batch ids: 7 days. The record of reminders sent: 7 days.
• The moves you made in each game: 30 days after it reaches our server; the game and its result stay with your account. A Daily Challenge keeps its moves with its result, as long as the account exists.
• Friend requests: 30 days after they are sent.
• The league groups you joined, past weeks included: as long as the account exists.
• Accounts, with or without a way to sign in: until you delete them; we never delete an account on our own. The one exception: when you sign in on a phone, if the phone was using an account without a way to sign in, its coins, bought games and Premium move to the account you signed in to, and the account left behind is deleted 48 hours later.

Your choices

• Usage data kept with your analytics id: in the app, Profile (your avatar at the top of each tab) → Settings → Privacy → Share usage data, at any time. Crash reports, how the app performs and how fun you found a game are not covered by it.
• Ad tracking on iPhone: withdraw your consent at any time in the iPhone's Settings → Privacy & Security → Tracking.
• Your account: you can delete it, as below.
• A copy of your data: write to orange-and-blue@luci-studio.com.

Deleting your account

In the app: Profile (your avatar at the top of each tab) → Settings → Delete account, at the end of the page. It deletes any account, whether or not you added a way to sign in, and permanently erases its progress. The account is closed at once: you are signed out everywhere; any Apple or Google account you added is free to use again; and this phone starts again with a new, empty account. Deleting does not cancel Premium: if you have Premium, cancel it in your store's settings too. Our server erases its data within 7 days, and our processors within 20 days; copies in our backups expire within 30 days.

Removing the app does not delete your account; on iPhone, installing it again can bring the same account back. We never delete an account on our own, except an account without a way to sign in that is left behind when you sign in on a phone (How long we keep it). To have an account deleted without the app, follow Delete your account.

Age

Orange & Blue is for people 16 and older.

Security

The app talks to our server over HTTPS. Your device's key is stored only as a hash. Backups are encrypted.

Changes and contact

Each version of this policy is dated at the top of the page. Questions and requests: orange-and-blue@luci-studio.com.