Zebudo — Privacy Policy

Effective date: 2026-10-13

Zebudo is a puzzle game for iOS and Android. This policy explains what data the game processes, why, for how long, and what your rights are. We keep data processing to what is needed to run, protect and improve the game.

Who is responsible. The controller of your data is Oleksii Kiselov, an independent developer based in Spain. For anything about privacy, write to [email protected]. "We" in this policy means the developer.

In short

• You can play without an account. As a guest, a random install ID links your device to your progress on our server.
• If you sign in with an external account (such as Apple, Google or Facebook), we keep only the account ID that the provider issues for Zebudo — not your name, email address or photo.
• Our server is in the European Union. We do not sell your data for money; what our advertising partner receives for ads is described under "Advertising".
• The game may show ads; in the European Economic Area (EEA), the UK and Switzerland, personalised ads only with your consent.
• You can delete your account in the game; what remains afterwards is described under "Deleting your account".

What we process and why

Playing as a guest. On first launch the game creates a random install ID and registers it with our server, together with the platform (iOS or Android) and the app version. We need this to deliver puzzles, keep your progress and keep the game fair. Legal basis: performance of our contract with you — providing the game you asked for (Art. 6(1)(b) GDPR).

Sign in with Apple, Google or Facebook. Signing in is optional; it lets you keep your progress on all your devices. When you sign in, the provider gives the game a signed token. The game sends it to our server only to check it. The server keeps one value from it — the account identifier that the provider assigns to you for Zebudo — and discards the rest. The Google and Facebook sign-in screens say they share your name and profile picture (Google also your email address): these are inside the token that passes through our server, but we do not read or store them. From Apple we do not request your name or email. We use Facebook only for sign-in. Your picture in the game is an animal from the game's own set, not your photo. Legal basis: Art. 6(1)(b).

Your games. We keep your game progress and results (for example, which puzzles you played and how they went) and totals per puzzle. We use them to run the game, show your progress and improve the game. Legal basis: Art. 6(1)(b); analysing results to improve the game — our legitimate interest (Art. 6(1)(f)).

Reports you send. If you use "Report a problem", we receive your text, the state of the puzzle at that moment, the app version and the interface language. Please do not include personal details in the text. Legal basis: Art. 6(1)(b) — handling your request.

Purchases and subscriptions. Payments are handled by Apple or Google; we never see your card or billing details. To deliver what you bought (Premium or a skin), we receive from the store and keep the transaction and product identifiers, purchase dates, status and the purchase token. Purchases are linked to a random player ID, not to your identity. Legal basis: Art. 6(1)(b); checking that a purchase is genuine — our legitimate interest in preventing fraud (Art. 6(1)(f)).

Advertising. Advertising helps fund the game. Ads in the game are served by Google AdMob. When an ad is requested, Google's software in the game collects the IP address (used to estimate approximate location), device and advertising identifiers, interactions with ads and diagnostic data. Google processes them as an independent controller under its own policy (https://policies.google.com/privacy). In the EEA, the UK and Switzerland we ask for your consent with Google's consent form before any personalised ads; without consent Google shows only non-personalised or limited ads. You can change your choice at any time in the game: Profile → Ads → Consent settings. Outside these regions Google may personalise ads unless you limit this in your device settings (below). On iOS the game also asks for your permission to track (App Tracking Transparency). If you allow it, Google receives your device's advertising identifier (IDFA) for personalised ads and ad measurement; if you do not, it does not. You can change this at any time in iPhone Settings → Privacy & Security → Tracking; on Android, in Settings → Google → Ads. Legal basis: your consent for personalised ads and tracking (Art. 6(1)(a)); non-personalised and limited ads — our legitimate interest in funding the game (Art. 6(1)(f)).

Usage statistics. To understand how Zebudo is played and to improve it, the game sends game events to our server in the EU: opening the game and how long you play, starting and finishing a level, hints and continues, ads shown and watched, the Premium screen and purchase steps, your choice in the ad consent form, the app version and the platform. Our server also records the country of your connection, determined from your IP address; we do not store the IP address itself for statistics. It also sends a record of how you solved a puzzle — the marks you made and when, and how you rotated the sphere — tied to the puzzle only, without any link to you. The events are tied to a random statistics ID that is separate from your player ID. We use this data only for our own statistics and do not share it with anyone. Legal basis: our legitimate interest in measuring the game's audience (Art. 6(1)(f)). You can turn it off at any time: Profile → "Usage statistics"; the statistics ID is then deleted from your device.

Testing and improving the game. We analyse how Zebudo is played — games and their outcomes, hints and continues, ads watched, purchases — to develop and improve the game: to test new features, content and settings on groups of players, to balance difficulty and the hint economy, and to tailor settings to how you play. Groups may be chosen by country, platform or your playing habits. For this we use your game activity linked to your player ID; we use it only for our own analysis and do not share it with anyone. Legal basis: our legitimate interest in developing and improving the game (Art. 6(1)(f)). You can object at any time: Profile → "Usage statistics"; when it is off, your activity is not used for this analysis and you get the standard settings.

Connection and security data. When the game connects, our server and our network provider Cloudflare receive your IP address and technical connection data. We use them to deliver the service, to limit the number of requests and to protect the server from attacks; Cloudflare processes connection data on our behalf. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f)).

Data on your device. Settings, your hints, the current game, cached puzzles, your local game log, a copy of your purchases and your session are stored on the device. They are needed for the game to work and are removed when you delete the app. Some data of the sign-in components may remain on the device until you delete the app. A renewal reminder, if you turn it on, is scheduled on your device only.

Anonymous statistics. We may create statistics that do not identify you (for example, how often a puzzle is solved) and use them freely, including publicly.

Our website zebudo.com uses no analytics and no tracking cookies; only strictly necessary cookies are set (security cookies of our hosting provider and the session cookie while you sign in on the account deletion page).

Who receives data

We do not sell personal data for money. We use these providers:

• Hetzner Online GmbH (Germany) — hosts our server and database in the EU, on our behalf;
• Cloudflare, Inc. — network, protection and hosting of zebudo.com, on our behalf;
• our email provider — for messages you send to [email protected], on our behalf;
• Apple and Google — sign-in, app stores and payments, as independent controllers under their own policies;
• Meta Platforms Ireland — sign-in with Facebook, as an independent controller under its own policy;
• Google — advertising (AdMob), as an independent controller.

We may also use and disclose data to comply with the law, to prevent abuse of the game, and to establish, exercise or defend legal claims. If the game or the business behind it is transferred to another company or person (for example, a company set up by the developer), your data may be transferred with it under the same rules; we will tell you about such a change.

Transfers outside the EEA. Our server is in the EU. Cloudflare, Apple, Google and Meta may process data in the United States; such transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

How long we keep data

We keep data longer only where the law requires it (for example, accounting records) or while a dispute is open; such records are kept without a link to your account where possible.

Deleting your account

In the game: Profile → Delete account. This immediately deletes from our server your account and the data linked to it: your player record, sign-in links, sessions, game history, statistics and the text of your reports. Copies in backups are overwritten within 30 days. What remains: the puzzle states from your reports without any link to you, purchase records for up to 2 years without a link to you, and anonymous statistics. You can also withdraw Zebudo's access to your Apple, Google or Facebook account in that account's settings. If you cannot use the app, go to https://zebudo.com/delete-account and sign in there with the same Apple, Google or Facebook account. If you play as a guest, your data is deleted automatically after 12 months without activity; to delete it sooner, write to [email protected] with the player ID shown in your profile.

Deleting the account does not cancel a subscription: cancel it in your App Store or Google Play subscription settings. Your purchases stay with your Apple or Google account and can be restored with "Restore purchases".

Your rights

You can ask us for access to your data, its correction or deletion, restriction of processing, and a copy in a portable format. You can object to processing based on our legitimate interest, including usage statistics and game testing, and withdraw any consent at any time; this does not affect processing done before. Write to [email protected]; we reply normally within one month, as the GDPR requires. We do not store your name or email, so to find your data we may ask for the player ID shown in your profile. You may also complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or to the authority in your country.

Children. Zebudo is not intended for children under 13, or under the higher age your country sets for consenting to online services on your own (14 in Spain). We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Security. We protect your data with encryption in transit, access controls and pseudonymous identifiers. No system is completely secure; we cannot guarantee absolute security of your data.

Automated decisions. We do not make automated decisions with legal or similarly significant effects about you.

Changes. If this policy changes, we will publish the new version at this address with a new effective date and may tell you in the game about important changes. Earlier versions stay available at https://zebudo.com/privacy.

Contact: Oleksii Kiselov, [email protected]

Effective date: 2026-10-13