Privacy policy
This policy explains what the Tesswick games collect, why, who helps us process it, how long we keep it and what you can do about it. We collect as little as we can: you can play without signing in, and we never ask for your real name, email address, phone number, location, contacts or photos.
1. Who we are
Tesswick ("we", "us") develops and publishes the games listed below and is the controller of the personal data described in this policy.
- Controller
- Tesswick, [registered legal name and postal address: to be added before the first store release]
- Privacy contact
- privacy@planvi.co
- Player support
- support@planvi.co
2. What this policy covers
This policy applies to our mobile games Nockwick, Glazewick, Lotuswick and Sumwick on iOS and Android (the "games"), the backend service they talk to, and this website, tesswick.com. All four games share one backend. If you link the same Google or Apple account in more than one of our games, those games share one Tesswick account.
3. Data we collect and why
The table lists everything our games and servers keep about you, the purpose, the legal basis under the GDPR and UK GDPR, and how long we keep it. "Contract" means we need the data to provide the game you asked for. "Legitimate interests" means we need it to run the service fairly and safely, and we have weighed that against your privacy.
| Data | Why we use it | Legal basis | Kept for |
|---|---|---|---|
| Account ID (a random identifier we create; it contains nothing about you) | Identify your account and your progress | Contract | Until you delete your account, plus 30 days |
| Device ID (a random identifier the game creates on first launch and keeps in your device's secure storage) | Recover your account if you play without signing in, limit request rates, detect cheating | Legitimate interests | Until you delete your account |
| Display name and avatar you choose | Show you on leaderboards | Contract | Until you delete your account |
| Country, worked out once from your IP address when the account is created (country only, never city or coordinates) | Country leaderboards, aggregate statistics | Legitimate interests | Until you delete your account |
| Your Google Play Games player ID (Android) or Game Center player ID (iOS), when the game signs in to that service on launch or you sign in from Profile | Keep your progress and purchases on your account across your devices and across our games on the same platform | Contract | Until you delete your account |
| A one-way hash (SHA-256) of an email address, only for accounts that were linked with a Google or Apple account in an early version. We never store the email address itself, and Play Games and Game Center give us no email | Find your account when you write to support from that address | Contract | Until you unlink it or delete your account |
| Game progress, play sessions and the moves you made | Save and sync your progress, check that scores are genuine by replaying the moves on our server | Contract | Progress: until you delete your account. Sessions: 30 days in our main database (90 days for sessions that failed the score check), then in archive storage for 1 year |
| Gameplay events (for example level started or completed), tagged with your account ID, country, platform and app version | Understand which levels are too hard or too easy and improve the games | Legitimate interests, or consent where the law requires it | Raw events 90 days; aggregate statistics that no longer identify you 400 days |
| Device model, operating system version, app version | Support and compatibility | Legitimate interests | Until you delete your account |
| Device integrity result: a Google Play Integrity verdict on Android, or an Apple App Attest key and check result on iOS | Keep leaderboards fair by accepting ranked scores only from genuine copies of the game | Legitimate interests | Until you delete your account |
| Purchase status of the "Full game" unlock (and of the older "Remove ads" purchase). The store receipt is sent to our server to be verified and is not kept afterwards | Give you the purchase you paid for | Contract | Until you delete your account |
| Crash and error reports: error details, device model, OS and app version, a short hash of your account ID, the ID of the failing request, and recent steps in the app (screen changes, level events, sync status) | Find and fix crashes | Legitimate interests | Deleted automatically by Sentry after its retention period, at most 90 days |
| IP address | Deliver responses, work out your country at sign-up, limit abusive request rates | Legitimate interests | Not stored in our database; used only while handling the request |
| Advertising data: advertising ID (IDFA or Google advertising ID, only where you allow it), consent choices, device and network information, ad interactions | Show ads, limit how often you see them, measure them and prevent ad fraud | Consent where required (see section 6); otherwise only non-personalised ads | Collected by the ad SDKs directly, not by our servers; kept under each ad partner's policy |
| Messages you send us by email | Answer you and handle your request | Legitimate interests, or legal obligation for rights requests | As long as needed to handle the request and show that we did |
Game data is also stored on your device (progress, recent sessions, settings) so the games work offline. Uninstalling the game removes it.
4. Data we do not collect
We do not collect or store your email address in readable form, your real name, phone number, precise location, contacts, photos, or your IP address in our database. The games have no chat and no content made by players other than display names.
5. What other players see
If you post a score to a leaderboard, other players can see your display name, avatar, country and score. Names are checked by an automatic filter and can be changed or removed by our moderators. You can change your name in the game's Profile screen.
6. Ads, consent and tracking
Since 27 September 2026 the games show no ads and do not track you: the advertising software in the app is never started, no consent message or App Tracking Transparency prompt is shown, and no advertising ID is read. The first 100 levels are free and one purchase unlocks the rest. The rest of this section describes what would apply only if we turned ads on in a game, which we would announce in that game first.
If ads were on, the games would be funded by ads. Ads are delivered through AppLovin MAX, which works with a number of ad networks, including Google AdMob. The ad software in the app collects the advertising data listed above directly; our own servers never receive your advertising ID.
- EEA, UK and Switzerland: before any ads load, we show a consent message from Google's User Messaging Platform. Your choice is passed to AppLovin MAX and its ad networks. If you do not consent, you only get non-personalised ads. Where your region requires it, the game's Settings screen lets you review or change your choice at any time.
- iPhone and iPad: we ask for permission through Apple's App Tracking Transparency prompt before any tracking. If you choose "Ask App Not to Track", your advertising ID is not shared. You can change this in iOS Settings > Privacy & Security > Tracking.
- Android: you can reset or delete your advertising ID in your device's Settings (Google > Ads, or Privacy > Ads, depending on the device).
- United States: see section 11 for how to opt out of the "sale" or "sharing" of personal information for targeted ads.
A one-time purchase, "Full game", unlocks every level after level 100 in the game where you bought it and always includes playing without ads.
7. Service providers and SDKs
We use the following companies to run the games. Each acts under a data processing agreement or its own terms and privacy policy, and receives only what it needs for the task described.
| Provider | What it does for us | Data involved | Its privacy policy |
|---|---|---|---|
| Cloudflare | Hosts our backend, database, file storage and analytics, and this website; protects them against attacks | All account and game data in section 3; IP addresses while requests are handled | cloudflare.com/privacypolicy |
| AppLovin (MAX SDK) | Ad mediation: chooses which ad network shows an ad | Advertising data in section 3, consent signals | applovin.com/privacy |
| Google: AdMob and the User Messaging Platform | Ads through MAX; the consent message in the EEA, UK and Switzerland, and consent signals for US states | Advertising data, consent choices | policies.google.com/privacy and how Google uses data from partner apps |
| Google: Play Integrity API (Android) | Tells our server whether a ranked score comes from a genuine copy of the game on a genuine device | Integrity verdict, app package name, a request hash | policies.google.com/privacy |
| Google Play Games (Android) | Signs you in when a game opens so your progress and purchases follow your account; we exchange a one-time code for your Play Games player ID | Play Games player ID and display name; no email | policies.google.com/privacy |
| Google Play (Android) | App distribution and the "Full game" purchase | Purchase receipt | policies.google.com/privacy |
| Apple: App Attest (iOS) | Tells our server whether a ranked score comes from a genuine copy of the game | A device-specific key and signed checks; no personal information | apple.com/legal/privacy |
| Apple Game Center (iOS) | Signs you in when a game opens so your progress and purchases follow your account; our server verifies a signature Apple issues for your player ID | Game Center player ID (the team-scoped ID Apple gives our games), no email | apple.com/legal/privacy |
| Apple App Store (iOS) | App distribution, the "Full game" purchase, App Tracking Transparency (not shown while ads are off) | Purchase receipt, tracking permission | apple.com/legal/privacy |
| Sentry | Crash and error reporting | Crash and error reports in section 3 | sentry.io/privacy |
The ad networks that can bid for ads through MAX are named in the consent message shown in the EEA, UK and Switzerland. Write to privacy@planvi.co for the current list. We do not sell personal data for money, and we do not share it with anyone else except where the law requires it (for example a valid court order).
8. Anti-cheat and automated decisions
To keep leaderboards fair, our server replays the moves of every ranked session with the same game rules as the app and checks timing and device integrity. Scores that fail these checks are not ranked. If an account repeatedly submits scores that fail the replay check, it is automatically blocked from leaderboards for 7 days, then 30 days, then permanently. This affects leaderboards only: you can always keep playing. If you think a block is wrong, write to support@planvi.co and a person will review it.
9. How long we keep data
Retention for each kind of data is in the table in section 3. In addition:
- Deleting your account immediately replaces your name with "Deleted" and removes your avatar, linked Play Games, Game Center, Google or Apple identifiers, email hash, device records, sign-in tokens and leaderboard entries. The remaining account record, your progress and your sessions are deleted from our main database 30 days later. Details are on the delete account page.
- Backups: our database is backed up daily. Backups are kept for 90 days and used only to recover from failures, so deleted data can remain in a backup until it expires.
- Security records: actions our staff take on an account (for example a ban or a forced name change) are kept in an internal audit log for security and legal reasons.
10. Your rights and choices
Depending on where you live (including under the GDPR and UK GDPR), you have the right to:
- Access and portability: use Export data in the game's Settings to get a copy of your account data and progress as a JSON file, or ask us.
- Correction: change your display name and avatar in the game's Profile screen, or ask us.
- Deletion: use Delete account in the game's Settings, or see the delete account page for other ways.
- Objection and restriction: object to processing based on legitimate interests, or ask us to restrict it.
- Withdraw consent at any time, as described in section 6. This does not affect processing before you withdrew it.
- Complain to your local data protection authority. We would appreciate the chance to fix the problem first.
Write to privacy@planvi.co to use any of these rights. Because we do not know who you are, we may ask you to send the request from inside the game (for example by attaching your exported data) or from the email address of the Google or Apple account you linked, so we can find the right account. We reply within one month.
11. US state privacy rights (CCPA and others)
If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect and why (this policy), to access it, to correct it, to delete it, and not to be treated differently for using these rights.
We do not sell personal information for money. Letting ad networks use your advertising ID and device information for targeted ads may count as "selling" or "sharing" under these laws. To opt out:
- use the privacy choices in the game where they are shown, which pass an opt-out signal to AppLovin MAX and its ad networks;
- on iPhone, choose "Ask App Not to Track" or turn off "Allow Apps to Request to Track"; on Android, delete your advertising ID; or
- write to privacy@planvi.co with the subject "Do not sell or share".
The categories of personal information we collect are identifiers (random account and device IDs, and your advertising ID where you allow it) and internet or other electronic network activity (gameplay events, crash reports). We do not collect sensitive personal information. We reply to verified requests within 45 days.
12. Children
Our games are not directed to children under 13 and have no content for adults only. They have no chat, no player-made content other than moderated display names, and no social links other than to the app stores. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, write to privacy@planvi.co and we will delete it.
13. Security
All traffic between the games and our servers uses HTTPS. Sign-in tokens and the device ID are kept in the device's secure storage (Keychain on iOS, Keystore-backed storage on Android). Email addresses are never stored in readable form. Access to our admin tools requires multi-factor authentication, and every staff action is logged. No system is perfectly secure; if you find a vulnerability, please report it to security@planvi.co.
14. International transfers
Our providers operate worldwide, and your data may be processed outside your country, including in the United States. Where data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the safeguards in our providers' data processing agreements, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.
15. This website
tesswick.com uses no cookies, no analytics and no scripts, and loads nothing from other websites. Cloudflare, which hosts it, processes your IP address and request details to deliver the pages and protect the site against attacks.
16. Changes to this policy
When this policy changes we update the effective date at the top. If a change materially affects how we use your data, we will also tell you in the games before it takes effect.
17. Contact
Privacy questions and requests: privacy@planvi.co. Help with a game: support@planvi.co.