This Privacy Policy explains how ublitz.io LLC (“we”, “us”, “our”), the developer of the Spell Blitz mobile game (the “App”), handles personal information. It applies to the App on iOS and Android and to related services we provide. By using the App you agree to this Policy.
1. Who we are (data controller)
The data controller responsible for your personal information is:
- ublitz.io LLC
- 30 N Gould St, STE R, Sheridan, WY 82801-6317, United States
- Contact: data@ublitz.io
2. Information we collect
Information you provide
| Data | When | Why |
|---|---|---|
| Email address | If you sign in (Email/Password, Google, Apple, or Facebook) | Create and secure your account; sync scores across devices |
| Display name & profile photo | If provided by your sign-in provider, or set in-app | Show your name/avatar on leaderboards and in your profile |
The App does not collect your age, year of birth, or date of birth. Playing as a guest (without signing in) does not require any of the account information above. The words you type while playing are processed on your device to score the game and are not transmitted to us.
Information collected automatically
| Data | Collected by | Purpose |
|---|---|---|
| Gameplay & usage events (e.g. levels played, screens viewed, the target word of a round) | Firebase Analytics | Understand how the App is used and improve it |
| Crash reports & diagnostics (stack traces, device state) | Firebase Crashlytics | Detect and fix crashes and errors |
| Performance data (app start time, network request timings) | Firebase Performance Monitoring | Diagnose and improve performance |
| Coarse device data and IP address | Google AdMob | Serve and measure non-personalised ads and prevent fraud (see §5). We do not use an advertising ID (IDFA / Android Advertising ID) to build a profile of you or track you across apps. |
| Push notification token | Firebase Cloud Messaging | Send notifications (only if you enable them) |
| Device & app information (OS version, app version, device model, language/region, a pseudonymous app-instance ID) | Firebase / device APIs | App functionality, analytics, and diagnostics |
Information stored only on your device
Your downloaded word database is stored locally and encrypted with a per-device key (SQLCipher / AES). Your settings (e.g. language, text-to-speech rate, sound and haptic preferences) are stored locally. This data is not uploaded to us. Text-to-speech pronunciation is generated on-device.
3. How we use your information
- To provide and operate the App (gameplay, scores, leaderboards, daily challenges).
- To create, secure, and manage your account.
- To diagnose problems, prevent abuse, and improve the App.
- To display and measure advertising.
- To send notifications you have opted into.
- To comply with legal obligations.
4. Legal bases for processing (EEA / UK)
Where the GDPR or UK GDPR applies, we rely on: contract (to provide the App and, for users who are 13 or older, their account), legitimate interests (to secure, analyse, and improve the App and to serve non-personalised ads, balanced against your rights), consent (for push notifications, and — where required — for the storage of and access to information on your device used to serve non-personalised ads, which you can withdraw at any time), and legal obligation (to meet our compliance duties). We do not process personal data for personalised advertising.
5. Advertising and your choices
The App is free and supported by ads served through Google AdMob. All ads are non-personalised and limited to family-friendly (G-rated) content, regardless of your age or region. This means ads are not based on a profile of you.
- No ad tracking. We do not use the advertising identifier (IDFA / Android Advertising ID) to track you across apps or websites, and the App does not request App Tracking Transparency permission for that purpose.
- Consent (EEA / UK). Where required, we use Google’s certified consent flow before ads load. Ads remain non-personalised whether or not you consent; consent covers the storage of and access to information on your device that is needed to request and measure those ads.
- Contextual only. Because ads are non-personalised, they may use coarse, non-identifying signals (such as the App itself and general region) but not a profile built from your activity.
Google’s use of advertising data is described in Google’s Privacy & Terms.
6. Children’s privacy
Spell Blitz is a general-audience app. It is not directed at children, but it is designed to be safe for players of all ages, and anyone — including children under 13 — may play as a guest. The App does not ask for your age or date of birth.
- Guest play asks for no personal details. Playing without an account requires no name, no email, and no age; the words you type are processed on your device. The standard analytics, crash diagnostics, and non-personalised ad delivery described in §2 apply to all players and are never used to build a profile of any player.
- Accounts require 13+. Creating an account (email, profile, and leaderboards) is only for users who are 13 or older, and account creation asks you to confirm this. We do not knowingly collect personal information from children under 13. If we learn that an account belongs to a child under 13, we will delete the account and its data.
- Protective ad settings for everyone. Ads are non-personalised for all players and ad content is limited to a family-friendly (G) rating. We do not use an advertising identifier to profile or track any player, and we do not build advertising profiles or serve interest-based ads to anyone.
If you are a parent or guardian and believe your child under 13 has created an account or provided us personal information, contact us at data@ublitz.io and we will delete it. You can also delete an account and its data at any time from within the App (see §8).
7. How we share information
We do not sell your personal information. We share it only with service providers who process it on our behalf, and as required by law:
| Recipient | Purpose |
|---|---|
| Google (Firebase: Authentication, Firestore, Cloud Functions, Analytics, Crashlytics, Performance, Cloud Messaging) | Backend, accounts, analytics, diagnostics, notifications |
| Google AdMob | Advertising |
| Meta Platforms | Facebook Login only (if you choose to sign in with Facebook). The Meta SDK’s automatic app-event logging and advertising-ID collection are disabled. |
| Apple | Sign in with Apple (iOS) |
Sign-in providers (Google, Apple, Facebook) process your authentication under their own privacy policies. We may also disclose information to comply with legal process or to protect our rights, users, or the public.
8. Data retention and deletion
- Account data is retained while your account is active.
- You can delete your account from inside the App (Settings → Account → Delete account). Deletion is a soft-delete with a 30-day grace period during which you can restore it; after that, your account and associated data are permanently purged.
- Aggregated or de-identified analytics that can no longer be linked to you may be retained.
9. Your rights
EEA / UK (GDPR). You have the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent. You may also lodge a complaint with your local supervisory authority.
California (CCPA/CPRA). You have the right to know what personal information we collect, to request deletion, to correct it, and to opt out of “sharing” for cross-context behavioural advertising. We do not sell personal information. We will not discriminate against you for exercising these rights.
To exercise any right, use the in-app account deletion or contact data@ublitz.io.
10. Security
We use industry-standard safeguards: data in transit is encrypted with HTTPS/TLS, the on-device word database is encrypted with SQLCipher (AES) using a per-device key held in the platform secure store (iOS Keychain / Android Keystore), and access to backend data is restricted by security rules and server-side validation. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
11. International data transfers
Our service providers (including Google, Meta, and Apple) may process data in countries other than yours, including the United States. Where required, such transfers are protected by appropriate safeguards (e.g. Standard Contractual Clauses).
12. Changes to this Policy
We may update this Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you in the App. Continued use after an update constitutes acceptance of the revised Policy.
13. Contact us
Questions or requests about this Policy or your data:
- ublitz.io LLC
- Email: data@ublitz.io
- Address: 30 N Gould St, STE R, Sheridan, WY 82801-6317, United States