Privacy Policy

Gridhaiku · Effective 24 October 2026

This policy explains what personal data the Gridhaiku app for iOS and Android (the "App") processes, why, and what rights you have. It also applies when you contact us about the App.

1. Who we are

The controller of your personal data is SIA NOTNA SOFTWARE, registration number 40203531194, Cialkovska iela 10–60, Daugavpils, LV-5410, Latvia ("we", "us"). You can reach us at [email protected].

2. What we collect and why

Your account

When you first open the App, Firebase Authentication creates an anonymous account with a random user ID. If you choose to sign in with Apple or Google, we also receive the email address and name that provider shares with us (with Apple you can hide your email behind a relay address). We use this to keep your progress safe and let you restore it on another device.

Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

Puzzle progress and settings

We store the daily puzzles you solve (date, puzzle type, solve time, hints used and whether you used Check), your streak, your Unlimited statistics (number of puzzles solved and times per puzzle, level and size), your settings, and when the account was created and last used. This syncs your progress and keeps your streak.

Unfinished puzzles, reminder times, some preferences, and what the App counts to space out ads and offers (such as when an ad last showed, how many free hints are left today and which days you unlocked) are kept only on your device and are not sent to us.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

Percentiles

The App can show how your daily solve compares with other players' ("faster than 72% of solvers"). When a solve counts (your first solve of that daily, on time), our server reads it from your stored progress and records that it was counted: your account ID, the daily, the puzzle type, your time, the hints you used and whether you used Check, and when. It then adds one to that daily's totals, which hold only counts and no IDs: how many solves without hints or checks took each 10 seconds, and how many solves had help. The App reads the totals to work out your percentage, or the share of solvers who had help, and keeps a copy on your device.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

Sharing and friends' links

When you share a result or puzzle, the App builds a link with the daily's number or the puzzle's code and your times for puzzles solved without hints or checks. The link holds nothing that identifies you, and anyone you send it to can see what's in it.

• When you open a friend's link, the App shows their times. If you start a puzzle from it, their time is kept on your device until you finish, to compare once on your result.
• On Android, after you install the App from a shared link, it reads Google Play's install referrer once, so it can open that daily. This stays on your device. Where you've allowed analytics, Google Analytics may also use the referrer to attribute the install.
• Shared links open a page on notnaapps.com if you don't have the App. The page uses no cookies or analytics; our hosting provider keeps standard server logs, including IP addresses, for security.

Legal basis: performance of our contract with you (Art. 6(1)(b)); for the server logs, our legitimate interest in running a secure website (Art. 6(1)(f)).

Weekly leagues

Where the App offers leagues and "Play in leagues" is on (it is by default), your first daily of the week puts you in a league of about 24 players for that week. The other players in it see a made-up name (an adjective and an animal), your time on each daily you solve that week, the hints you used and whether you used Check, and your points and place. They never see your name, email or account.

We store your league entry (that name, when you joined, and those times and hints), and on your account your name in leagues, your league tier, and the league, place and points of each week you played. You can draw another name, or turn leagues off in the App's settings, which removes you from this week's league.

Legal basis: performance of our contract with you (Art. 6(1)(b)).

Reminders

If you turn on reminders, or tap "Remind me when it opens" on a daily that isn't out yet where you are, the App schedules notifications on your device. Nothing is sent to us, and you can turn them off in the App's settings or your device settings.

News notifications and in-app messages

If your device lets the App send notifications, we may occasionally send news about the App, such as new puzzle types, through Firebase Cloud Messaging. To deliver them, Firebase gives your copy of the App a registration token linked to an installation ID; we don't store the token ourselves. On Android you can turn these off under "News" in the App's notification settings and keep reminders; on iOS, or to stop everything, turn off notifications for the App in your device settings.

The App may also show messages inside the App, such as news about features, through Firebase In-App Messaging. It fetches them from Firebase with an installation ID. Where you've allowed analytics, Firebase also uses analytics data to choose who sees a message and to count how often messages are shown and tapped.

Legal basis: our legitimate interest in telling players about the App (Art. 6(1)(f)). You can object at any time by turning the notifications off.

App configuration and security

To deliver the day's puzzles and settings, the App connects to Firebase (Cloud Firestore, Remote Config and Cloud Functions). Like any internet service, these receive your device's IP address and basic technical data. We use Firebase App Check, which checks that requests come from a genuine copy of the App on a genuine device, to protect our servers from abuse. It relies on Google Play Integrity on Android and Apple App Attest or DeviceCheck on iOS, which receive information about the App and your device to do so.

Legal basis: our legitimate interest in running a reliable and secure service (Art. 6(1)(f)).

Usage analytics

We use Google Analytics for Firebase to understand how the App is used, for example which puzzles are played, which screens are opened, where players get stuck, and whether ads and offers were shown and purchases made. It collects app events, an app instance ID, device and operating system details, app version, and an approximate location (country or region) derived from your IP address. We look at this data in aggregate and use it to improve the App.

Legal basis: your consent where the law requires it, for example in the EEA, UK and Switzerland (Art. 6(1)(a)); otherwise our legitimate interest in improving the App (Art. 6(1)(f)).

Measuring our ad campaigns

When we advertise the App, for example with Google Ads or Apple Ads, we want to know which campaigns lead to installs, trials and purchases. Only where you've allowed it:

• Google Analytics for Firebase may read your device's advertising ID (Android Advertising ID, or on iOS the IDFA, only if you allow tracking in Apple's App Tracking Transparency prompt) and may share events such as installs, puzzles solved, trials and purchases with Google Ads, so Google can match them to the ads you saw.
• RevenueCat sends your purchase and subscription events (trial started, purchase, renewal, cancellation and expiry, with product, price and currency) to Google Analytics, linked to your app instance ID. If you turn analytics off, the App removes that link.
• On iOS, RevenueCat uses Apple's AdServices framework to learn which Apple Ads campaign, if any, led to your download. Apple provides this without your advertising identifier or anything that identifies you.

In the EEA, the UK and Switzerland we ask for this in Google's consent message ("measure advertising performance"). Elsewhere it follows the "Share usage statistics" switch in Settings › Privacy.

Legal basis: your consent where the law requires it, for example in the EEA, UK and Switzerland (Art. 6(1)(a)); otherwise our legitimate interest in knowing which of our ads work (Art. 6(1)(f)).

Crash reports

If the App crashes or hits a serious error, Firebase Crashlytics sends a report with the error, the state of the App, device model, operating system version and an installation ID, so we can fix the problem.

Where we ask for your consent, reports from before your answer wait on your device: they are sent if you agree and deleted if you don't.

Legal basis: your consent where the law requires it, for example in the EEA, UK and Switzerland (Art. 6(1)(a)); otherwise our legitimate interest in keeping the App stable (Art. 6(1)(f)).

Advertising

The free version of the App may show ads from Google AdMob. To show and measure ads, AdMob and the ad partners it works with may collect your device's advertising ID (IDFA on iOS or Android Advertising ID), IP address, device and app information and how you interact with ads.

• In the EEA, the UK and Switzerland, we ask for your consent through Google's consent message before ads are personalised. Without consent you see non-personalised ads, which are based on context, such as the App itself and your approximate location.
• On iOS, the App only uses your advertising identifier if you allow tracking in Apple's App Tracking Transparency prompt.
• Some features offer an optional rewarded ad: watching it gives you extra hints or checks, or unlocks a puzzle or feature. It collects the same data as other ads.
• If you buy Premium, the App shows you no ads. With Remove Ads, you see no ads unless you choose a rewarded ad for extra hints.
• You can reset or limit your advertising ID in your device settings at any time.

Google is responsible for its own use of this data as described in How Google uses information from sites or apps that use its services.

Legal basis: your consent for personalised ads and the cookies or identifiers that need it (Art. 6(1)(a)); our legitimate interest in funding the free App with non-personalised ads (Art. 6(1)(f)).

Purchases

If you buy an in-app purchase or subscription, payment is handled entirely by the Apple App Store or Google Play. We never see your card or bank details. We use RevenueCat to confirm purchases and unlock what you bought on all your devices. RevenueCat receives your account's user ID (the random ID described under Your account), the store receipt and purchase history (product, price, currency, dates and country), and basic device data.

Because purchases are linked to that ID, what you buy follows your account: if you've signed in with Apple or Google, it also unlocks on your other devices, including on the other platform. The App keeps a copy of your purchase status on your device, so what you bought works offline.

Where you've allowed analytics, RevenueCat also sends your purchase events to Google Analytics, as described under Measuring our ad campaigns.

Legal basis: performance of our contract with you (Art. 6(1)(b)) and our legal obligations under tax and accounting law (Art. 6(1)(c)).

Support

If you email us, we use your email address, your message and the details the App adds to it when you write from Contact support (app version, device model and system version, your plan, language and Support ID) to help you.

Legal basis: our legitimate interest in answering you (Art. 6(1)(f)).

3. Who processes your data

We share data only with the service providers that help us run the App, under contracts that limit their use of it:

We may also disclose data if the law requires it, or to protect our rights, your safety or the safety of others.

4. Where your data is stored

Your progress and settings are stored in Cloud Firestore in the European Union (Belgium and the Netherlands), and our server functions run in Belgium. Some services, including Firebase Authentication, Analytics, Crashlytics, AdMob, RevenueCat and our website host DigitalOcean, may process data in the United States or other countries. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

5. How long we keep it

• Account, progress and settings: until you delete them in the App or ask us to delete them.
• Records of counted solves: deleted automatically 30 days after the daily, or sooner if you delete your account. The totals hold no identity and are kept.
• Leagues: each week's league, with the names, times and hints in it, is deleted automatically 8 weeks after the week ends. Your name in leagues, tier and past weeks' results stay on your account until you delete it.
• Analytics: up to 14 months, then deleted by Google.
• Crash reports: about 90 days.
• Purchase records: RevenueCat keeps its record until you delete your account. Records of sales from the App Store and Google Play are kept as long as tax and accounting law requires.
• Support emails: as long as needed to resolve your request, and no longer than 2 years.

6. Your rights and choices

Under the GDPR and similar laws you have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to its processing, and to withdraw consent at any time without affecting earlier processing.

• Delete your data: in the App, go to Settings › Privacy › Delete my data. If you've signed in, use Settings › Account › Delete account. This deletes your progress, settings, records of counted solves, league profile and account from our servers, removes you from this week's league, and deletes RevenueCat's record of your purchases and what the App kept about them on your device. Past weeks' leagues keep your made-up name and times, no longer linked to your account, until they're deleted 8 weeks after their week. It doesn't cancel a subscription: cancel it in your App Store or Google Play account. Apple and Google keep their own purchase records under their policies. Without the App, see Delete your account.
• Ads, analytics, ad measurement and crash report consent: change your choice in the App's privacy settings, and manage tracking in your device settings.
• Anything else: email [email protected]. Including the Support ID from Settings › About helps us find your data. We reply within one month.

You also have the right to complain to a data protection authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija). You can also complain to the authority where you live or work.

7. Children

The App is a general-audience puzzle game and is not directed at children under 13. We do not knowingly collect personal data from children under 13, or under the age of digital consent in their country. If you believe a child has given us personal data, contact us and we will delete it.

8. Security

Data is encrypted in transit and at rest by our providers. Access to your progress on our servers is limited to your own account, and only we can access our server systems. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach where the law requires.

9. Changes to this policy

We may update this policy as the App or the law changes. We will publish the new version on this page with a new effective date, and tell you in the App if the changes are significant.

10. Contact

SIA NOTNA SOFTWARE, Cialkovska iela 10–60, Daugavpils, LV-5410, Latvia · [email protected]