Number Series — Privacy Policy

1. Who is responsible for your data

The data controller is FUNCODE SRL, a limited liability company registered in Romania, trading as FunCode / KazyDroid.

• Registered office: Str. Eugen Ionesco 67, Cluj-Napoca, Cluj County 400357, Romania
• Trade register: Trade Register No. 2013002104120
• Fiscal code (CUI): 31945144
• VAT: RO31945144
• Email: contact@funcode.ro

We have not appointed a Data Protection Officer, and are not required to. Privacy questions and requests go to the email address above and are handled by the company.

2. What Number Series collects

Playing without an account

You can install the app and play every single-player mode — Classic, Daily Challenge, Marathon, SpeedBlitz, Zen Practice, Tournament, Mastery, Brain Training, the IQ Test, Kakuro, Number Cascade, MathMaze, Equatle, Target, Sequence Set, Symbol Sums and Daily Estimate — without signing in and without a network connection. Your progress, streaks, statistics, settings and puzzle history are written to storage on your own device and stay there. We do not receive them.

Your account, if you create one

Signing in is optional. It is needed only for friends, cloud backup, and to attach a subscription to something more durable than one device. Sign-in is with your Google account, handled by Google's Firebase Authentication — there is no password for us to see or store. From it we receive and store:

• A user ID — an opaque identifier Firebase generates for your account.
• Your email address — held by Firebase Authentication so you can sign back in. It is never copied into your public profile and is never shown to another player.
• Your display name — as provided by your Google account, and editable in the app.
• When your account was created, and when you last opened the app while signed in.

Your public profile

If you use the Friends feature, the app publishes a small profile that other signed-in players can read: your username, display name, chosen avatar, whether you subscribe, and summary game statistics such as your streak. Your email address is never part of it.

Whether you can be found by searching for your username is a setting you control, and it is off unless you turn it on. Note the distinction: turning search off stops you appearing in other people's searches, but a profile link you have handed to somebody yourself keeps working — that is the point of a share link.

A username is checked for uniqueness against a reservation list, so claiming one records that it is taken and by which account. When you change your username, the one you gave up is kept for about 90 days and then deleted automatically, so it cannot be immediately re-registered by somebody impersonating you.

Friends, requests and duels

When you add a friend we store the link between the two accounts, and alongside it a copy of each other's username and avatar so the list can be shown without reading the other person's profile every time. A pending friend request stores who sent it, to whom, and when. A duel stores the puzzle seed, the game mode and the two scores.

Friend challenges. You can challenge a friend to the same puzzle you just played. The challenge carries your result, the game mode and the puzzle seed. When your friend plays it, their reply is delivered to them and a copy is kept on your side so you can see how they did: their user ID and username, the mode and seed, both of your results (such as score, time and mistakes) and when they replied. Only you can read that copy. It is not made at all if one of you has blocked the other, if you are no longer friends, or if the challenge has expired; blocking someone also deletes the challenges and copies between you. The copy is deleted 30 days after the reply, or sooner if either of you deletes your account.

Comparing your daily results with friends

If you turn on the friends leaderboard, your result for each day's puzzle is shared with the people you have added as friends, so you can see how you all did on the same puzzle. That covers the dailies — the Daily Challenge, Kakuro, Number Cascade, Equatle, Target, Sequence Set and Symbol Sums — and for each day and mode we store the time you took, your score, how many mistakes you made, how many hints you used, and whether you met that day's goal. Number Cascade is scored rather than timed, so it has no time. In some games the time or score shown to friends already includes that game's hint and mistake penalties (for example, Symbol Sums adds time for each wrong check and each reveal), so it is the same result, not extra information. Equatle, Target, Sequence Set and Symbol Sums share a day only when you solved it; practice rounds and friend-challenge rounds are never shared.

Daily Estimate shares your accuracy for the day and, if you switched the leaderboard on after we added this to the wording, the number you guessed — the switch says so. If you switched it on earlier, your friends see your accuracy but not your guess until you switch it on again. Subscribers can also open a list of their friends' estimates for the day; it is built only from what those friends shared here, so it shows nothing that the leaderboard does not.

This is off unless you switch it on — the app offers it after you finish a daily, and the switch is in your profile. It is separate from the setting that controls whether people can find you by username. Only your current friends can see these results: they are never part of your public profile, and no other player or member of the public can read them. Our server assembles a friend's leaderboard from their friends list at the moment they open it, so when a friendship ends, that person stops seeing your results.

If you switch it off, we delete what you had already shared, rather than just stopping new results. Results are also deleted when you delete your account, are included when you export your data, and are otherwise kept for 90 days and then deleted automatically. A result you replay from the Daily Archive is never shared — only the day you played it live.

Daily Estimate and the crowd

In Daily Estimate you make one guess a day and see how it compares with everyone else's. When you are signed in, locking in a guess sends the date, your guess and how accurate it was to our server. We keep that under your account for 30 days and then delete it automatically; it is also deleted when you delete your account and included when you export your data. It lets the app show you the crowd's result again and stops the same day being counted twice.

We also add your guess to an anonymous count for that day: how many people played, and how their guesses and accuracy were spread across ranges. The count holds no user ID, name or exact guess, so it cannot be traced back to you — which is also why it stays after you delete your account. Any signed-in player can see that day's count. Practice rounds and friend-challenge rounds are never sent. If you lock in a guess while signed out, the app keeps it on your device and sends it when you next sign in, as long as that is within two days; after that it is dropped without being sent.

Blocking and reporting

If you block someone, we record that you blocked them. If you report someone, we record who reported whom, the reason given, and when. A person reads those reports — there is no automated moderation system behind it, and we would rather say so than imply one exists.

Both of these survive the other person deleting their account, and are explained in what deletion does and does not remove. A block is your safety decision, and a report is a record of something that happened to somebody; letting either be erased by the reported party would defeat the point.

Cloud backup of your progress

Signed in, the app can back your progress up so a new phone can restore it. The backup is a snapshot of the same gameplay data that already lives on your device: levels, streaks, statistics, tournament results, mastery stars, and the log of puzzles you got wrong. It holds no messages and no free text beyond your own display name. A bounded history of recent games is kept alongside it — the most recent 200 rows, with older ones discarded automatically.

Subscriptions and credits

If you subscribe, Google Play takes the payment — we never see your card, address or any payment detail. What we receive and store is the record needed to know that you are entitled: the product you bought, a Google-issued purchase token, the current state of the subscription and when it expires or renews. Credits are a free in-game currency; we store your balance and an append-only ledger of the changes to it, so a balance can always be explained.

Notifications

Daily Challenge and Brain Training reminders are scheduled on your device and involve no server. Friend requests, however, arrive as a push notification, and for that we store a messaging token for your installation, issued by Google's Firebase Cloud Messaging. It identifies the app installation, not you personally, and changes if you reinstall. Tokens that stop working are pruned automatically.

Analytics, crash and performance reporting

We ask before any of this is switched on, and "no" is a real answer. On first launch the app shows a privacy choice; nothing is collected until you make it, and you can change your mind at any time in Settings → Privacy, where the two switches are independent.

If you say yes, we collect:

• Analytics (Google Analytics for Firebase) — which screens you open and which game events happen, such as completing a level or opening the paywall, together with the device model, OS version, language, country and an app-instance identifier generated by the SDK. We attach a handful of gameplay properties: your highest level, preferred game mode, daily streak and games completed. We never set your account ID or email as an analytics identifier, so analytics is not joined to your account.
• Crash reporting (Firebase Crashlytics) — the stack trace and recent log lines when the app crashes, plus device model and OS version.
• Performance (Firebase Performance Monitoring) — how long screens and network calls take. This follows the crash reporting switch rather than having one of its own: it is diagnostics about how the app behaves, which is the same bargain, and a third switch would be a distinction without a difference.

Checking the app is genuine

The app uses Firebase App Check with Google Play Integrity to confirm that a request to our server came from a real, unmodified copy of the app on a genuine device. Google evaluates your device and app installation to produce that verdict, and we receive only the verdict, not the underlying device data. This is what stops somebody with a repackaged copy of the app reading other players' data, and it cannot be turned off without turning off the online features.

How you found us

On first launch the app asks Google Play for the install referrer, so that a link somebody shared with you opens the right puzzle rather than the home screen. It is read once and used on the device; we do not send it anywhere or store it.

Kept only on your device

Settings, themes, tutorial progress, your local puzzle history, your mistake log, and the offline copy of the avatar catalogue all live in the app's own storage and are never sent to us unless you turn on cloud backup. Uninstalling the app removes all of it.

3. What Number Series does not collect

• No advertising. The app contains no ad network, requests no advertising identifier, and does no profiling. Nothing you do here feeds an ad.
• No location. Never requested, never accessed. The country in analytics is Google's coarse estimate from your IP, not a location permission.
• No contacts, photos, microphone or camera. None of these permissions are requested. The app requests only notification permission, and vibration.
• No uploads. There is nothing in the app that uploads a file. Avatars are a fixed set of images we ship; you choose one, you do not provide one.
• No free-text messaging. You cannot send another player a written message. The only text another player sees from you is your display name and username.
• No data brokers, no third-party trackers.
• We never sell or share your personal information, in any sense, including the specific meanings those words carry under California law. What other players see is only what you choose to show them — your public profile if you use Friends, and your daily results if you turn on the friends leaderboard (section 2).

4. Why we process it, and our legal basis

What	Why	Legal basis (GDPR Art. 6)
Account identifier, email, display name	To give you an account and sign you back in	Performance of a contract — Art. 6(1)(b)
Public profile, username reservation	So friends can find and recognise you, and so two people cannot hold one username	Performance of a contract — Art. 6(1)(b)
Friends, requests, duels, friend challenges	To operate the social features you chose to use	Performance of a contract — Art. 6(1)(b)
Daily results shared with friends	So your friends can compare their result on the same puzzle with yours	Your consent — Art. 6(1)(a). Off unless you turn it on; withdraw it any time in your profile, and what you shared is deleted.
Daily Estimate guesses and the anonymous daily count	To show how your guess compares with everyone else's that day	Performance of a contract — Art. 6(1)(b)
Blocks and reports	To keep players safe from each other and act on abuse	Our legitimate interest in the safety of users — Art. 6(1)(f)
Cloud backup of progress	To restore your game on a new or reinstalled device	Performance of a contract — Art. 6(1)(b)
Subscription state, purchase token, credit ledger	To give you what you paid for, and to keep an accounting record	Performance of a contract, and legal obligation for the accounting record — Art. 6(1)(b) and (c)
Messaging token	To tell you a friend request arrived	Your consent to notifications — Art. 6(1)(a)
Analytics, crash and performance data	To see what is used and what breaks, and fix it	Your consent — Art. 6(1)(a). Refusing changes nothing about the game.
App integrity verdict	To confirm requests come from a genuine, unmodified copy of the app	Our legitimate interest in security and preventing abuse — Art. 6(1)(f)

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. Leaderboards and streaks rank gameplay, nothing else.

5. Who else processes it

We use Google as our sole infrastructure provider. Google acts as our processor under a data processing agreement and processes data on our instructions:

• Firebase Authentication — accounts and sign-in.
• Cloud Firestore — the database holding profiles, friends, entitlements and cloud backups.
• Cloud Functions — the server code that claims usernames, verifies purchases, and deletes accounts.
• Firebase Cloud Messaging — delivering friend-request notifications.
• Cloud Storage for Firebase — serving the avatar images. It holds nothing of yours.
• Firebase Remote Config — fetching configuration values. It sends us no personal data.
• Firebase App Check with Google Play Integrity — confirming the app is genuine.
• Google Analytics for Firebase, Crashlytics, Performance Monitoring — only with your consent, as set out in section 2.

Two Google services act on their own account rather than as our processor, under Google's own privacy policy:

• Google Play — your download, your subscription and its payment. We receive confirmation and a purchase token, never payment details.
• Google Play Games Services — leaderboards and achievements, if you use them. Your Play Games profile is governed by Google, and is separate from the profile described in section 2.

There are no other recipients. We do not share your data with advertisers, analytics companies other than the Firebase products above, or data brokers. We may disclose data if legally required to, and would tell you unless prohibited from doing so.

6. Where your data is stored, and transfers outside your country

Our database is hosted in the United States (nam5 (United States, multi-region)), and our server code runs there too (us-central1 (United States)). If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States.

That transfer relies on the European Commission's Standard Contractual Clauses, which form part of the Google Cloud data processing terms we are bound by, together with Google LLC's certification under the EU–US Data Privacy Framework and its UK and Swiss extensions. You can request a copy of the relevant safeguards by emailing us.

If you never sign in, nothing of yours leaves your device, so none of this applies to you.

7. How long we keep it

Data	Kept for
Account, profile, username	Until you delete your account
Public profile	Until you delete your account, or stop using Friends and ask us to remove it
Friends, friend requests	Until either person removes the other, or deletes their account
Daily results shared with friends	90 days, then deleted automatically — sooner if you turn the friends leaderboard off or delete your account
Your Daily Estimate guesses	30 days, then deleted automatically — sooner if you delete your account
The anonymous Daily Estimate count	Kept, because it holds nothing that identifies you
Duel challenges	Expire automatically a short time after they are sent
A friend's reply to your challenge (the copy on your side)	30 days after the reply, then deleted automatically — sooner if either of you deletes your account or one of you blocks the other
A username you gave up	About 90 days, then deleted automatically
Cloud backup of progress	Until overwritten by a newer backup, or you delete your account
Game history rows	The most recent 200, and no longer than 12 months; older rows discarded automatically
Messaging token	Until you sign out, delete your account, uninstall, or the token goes stale
Subscription and credit records	Until you delete your account, except where accounting law requires us to keep a transaction record for longer
Abuse reports, and blocks others placed on you	Kept after your account is deleted — see section 9
Analytics and crash data	Retained by Google on our behalf — 2 months for analytics, 90 days for crash reports
Anything on your own device	Until you clear the app's data or uninstall it

"Deleted automatically" is a scheduled cleanup, not a stopwatch. An expired item stops being used immediately, and Google's infrastructure removes the stored copy shortly afterwards — usually within 24 hours. We would rather describe the mechanism than imply something vanishes the instant it expires.

8. Your rights

If you are in the EEA, the UK or Switzerland, the GDPR (and its UK and Swiss equivalents) gives you the right to:

• Access the personal data we hold about you (Art. 15).
• Correct anything inaccurate (Art. 16) — your display name, username and avatar you can edit directly in the app.
• Delete your data (Art. 17) — see deleting your account.
• Restrict how we process it (Art. 18).
• Receive a copy in a portable, machine-readable format (Art. 20) — the app can export your data to a JSON file from Settings → Account, and you can also ask us by email.
• Object to processing based on our legitimate interests (Art. 21).
• Withdraw consent at any time. Analytics and crash reporting are in Settings → Privacy and take effect immediately; notifications are in your device's Android settings. Withdrawing does not affect processing that already happened.

Email contact@funcode.ro to exercise any of these. We will respond within one month. There is no charge.

You also have the right to complain to a data protection authority. Our lead authority is the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Romania , and you may also complain to the authority where you live or work.

If you are in the United Kingdom or Switzerland

The same rights apply under the UK GDPR and the Swiss Federal Act on Data Protection. UK residents may complain to the Information Commissioner's Office; Swiss residents to the Federal Data Protection and Information Commissioner.

If you are in California

Under the CCPA as amended by the CPRA, you may request to know what personal information we collect and why, request its deletion or correction, and are protected against discrimination for exercising those rights. The categories we collect are set out in section 2: identifiers, commercial information about your subscription, and internet activity in the form of the analytics you consented to. We do not sell or share personal information, and we have not done so in the preceding twelve months. We do not collect sensitive personal information.

If you are elsewhere

Comparable rights of access, correction and deletion apply under Brazil's LGPD, Canada's PIPEDA and Quebec Law 25, Australia's Privacy Act, Japan's APPI, South Korea's PIPA, South Africa's POPIA, India's DPDP Act, and a growing number of US state privacy laws including those of Virginia, Colorado, Connecticut, Utah and Texas. Whatever your jurisdiction, emailing us at contact@funcode.ro is the way to exercise them, and we apply the same process to everyone.

9. Deleting your account

You can delete your account and everything attached to it, from inside the app or by email. The account deletion page explains exactly what is removed, what is kept and why, and how to ask.

Two things deliberately survive deletion: abuse reports filed about you, and blocks other players have placed on you. Otherwise deleting an account would be a way to erase a record of harming somebody, or to undo another person's safety decision. Both are retained under our legitimate interest in user safety.

10. Children

Number Series is not intended for anyone under 13, and we do not knowingly collect personal data from them.

We do not ask for your date of birth, and we do not operate an age gate — we are telling you that plainly rather than implying a check that does not happen.

The limit is set by the social features rather than the puzzles, and it is 13 rather than higher because of what those features are not: there is no messaging in Number Series. No private messages, no comments, no photos, no voice. The most another player can do is find you by username, send a friend request, and — if you accept — see your statistics. There is no channel through which somebody can say something to you privately.

The part that is worth a parent's attention is that usernames and display names are free text, and are the only free text in the app. Somebody can choose a handle in order to say something with it. You can block them, which is immediate and needs nobody's agreement, and report them, which a person reads. You can also leave discoverability off — it is off unless you turn it on — so that you cannot be found by searching at all.

If you believe a child under 13 has given us personal data, email contact@funcode.ro and we will delete the account and its contents.

11. Security

All traffic between the app and our servers is encrypted with TLS, and data is encrypted at rest by Google Cloud. What each account can read is restricted by server-side security rules enforced by the database itself rather than by the app, so a modified copy of the app cannot reach another player's data. Anything that matters — your subscription state, your credit balance, your public profile — can only be written by our server, never by a device, which is why a tampered client cannot grant itself a subscription. Firebase App Check additionally verifies that requests come from a genuine installation.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell you directly where the law requires it.

12. Changes to this policy

We may update this policy as the app changes. The "Last updated" date at the top always reflects the current version. If a change materially affects your rights or how we use your data, we will tell you in the app before it takes effect.

13. Contact

Questions, requests, or anything that reads wrong to you: contact@funcode.ro. The terms and conditions cover the rest of the agreement between us.