SOLYVO — Privacy Policy

Publisher

Hakan Timur — a natural person (sole proprietor) trading as Noriloop Studio

Postal address

Yenişehir Konakları, 979. Sokak 14G Daire 6, 26000 Tepebaşı, Eskişehir, Türkiye

Contact email

[email protected]

Application

SOLYVO: Block Puzzle (application id com.noriloop.solyvo)

Effective date

6 October 2026

This policy explains what information the mobile game SOLYVO: Block Puzzle ("SOLYVO", "the app", "we", "us") collects, why, and the choices you have. The app is published by Noriloop Studio (Hakan Timur). Contact: [email protected].

1. The short version

• You do not need an account. We never ask for your name, email address, phone number or contacts, and there is no SOLYVO sign-in. Signing in to Google Play Games is optional and only adds achievements and a backup you control (section 4a).
• The game itself runs on your device. Your boards, scores, settings and run history are stored only on your device.
• The app shows ads from Google AdMob. Ads use your device's advertising identifier and similar data. Where the law requires it, you are asked for consent first and can change your choice at any time in Settings → Privacy options.
• Purchases ("Remove Ads") are handled by Google Play. We never see your payment details.
• Verified leaderboards are optional. Only if you turn them on do we receive a random ID, the nickname you choose, and the moves of your submitted runs so our server can replay them. You can delete your leaderboard records at any time in Settings → Remove my scores.
• When enabled in your version, Firebase collects gameplay statistics and crash reports so we can keep the game stable and fair, and measures which of our own ads brought you to the game.
• We do not sell your personal information. The game is not directed at children under 13.

2. Information stored only on your device

The following stays in the app's private storage on your device. We cannot see it.

This data is deleted when you uninstall the app or clear its storage. If you use Android's device backup, Android may include the app's files in your Google account backup and restore them on a new device; this is controlled by your device settings, not by us.

Friend challenges. A shared result also carries a challenge link. The run itself (its seed, ruleset, mode, Daily date, the list of moves and, only if you typed one, your challenge name) is packed into the part of the link after #, which browsers never send to any website, so it does not reach us or any server. Whoever you send it to can replay your run. Challenges you receive are kept on your device (the last 10).

Message in a Bottle. A bottle you make is a short code that holds only rocks, pieces and a goal (no text, no name). Bottles you make or receive are kept on your device (the last 30 of each). If you choose Send to Bottle of the Week, only that code is sent to our Score Service, which checks that the puzzle can be solved and keeps the code and its fewest-moves count so one can be picked for everyone each week. Your IP address is used only in memory to limit how many bottles one connection can send and is not stored.

Sharing results. When you tap Share, the app creates an image and a short text (date, score, max combo, No-revive badge and a link to https://noriloop.net/solyvo) and opens your device's share sheet. Nothing is sent unless you choose an app to share with. The link contains no personal data.

3. Advertising (Google AdMob) and consent (Google UMP)

SOLYVO is free and is funded by ads: a small banner at the bottom of the screen (on Home and below the pieces during play; it never covers the board and never interrupts), full-screen break ads that appear only between games (never during a run), and an optional rewarded video you can choose to watch to continue a run.

Ads are provided by Google AdMob (Google LLC / Google Ireland Limited). When the app requests or shows an ad, the Google Mobile Ads SDK may collect and process:

• your device's advertising ID (Android Advertising ID) and app set ID;
• your IP address, from which an approximate location is derived;
• device and app information (device model, operating system, language, app version);
• interactions with ads (for example, that an ad was shown, tapped or closed) and diagnostic information about ad loading.

Google uses this to serve and measure ads, to prevent fraud, and, only if you allow it, to personalize ads. Google's own use of this data is described at https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy.

Consent. If you are in the European Economic Area, the United Kingdom, Switzerland, or another region where consent is required, the app shows Google's consent form (Google User Messaging Platform) after the game has started; you can play before answering. Where US state privacy laws apply, the same tool lets you opt out of the "sale" or "sharing" of personal information for targeted advertising. You can change your choices at any time in Settings → Privacy options (the entry appears where it is required). Depending on your choices, Google shows personalized ads, non-personalized or limited ads, or no ads.

You can also reset or delete your advertising ID in your Android settings (Settings → Privacy → Ads, wording varies by device).

Ad content. We set AdMob's maximum ad content rating to "Teen" and block sensitive ad categories. To report an inappropriate ad, write to [email protected] with a screenshot if possible.

Remove Ads turns off the banner and forced break ads. If you still choose to watch an optional rewarded video, AdMob processes data as described above for that ad.

4. Purchases (Google Play Billing)

The one-time "Remove Ads" purchase is processed by Google Play. Google handles your payment method and billing details under its own privacy policy; we never receive your card or bank details. The app receives a confirmation from Google Play (product ID, purchase status and a purchase token) and remembers on your device that you own the item. We do not currently send purchase information to our own server.

4a. Google Play Games (optional)

If your version of the app offers it, you can sign in to Google Play Games in Settings. Google runs Play Games under your Play Games profile and its own privacy policy; we never receive your Google account details.

• Achievements: when you earn a Medallion tier, the app tells Play Games to unlock the matching achievement.
• Backup (only when you tap Back up progress): the app stores one saved game in Play Games with your settings, stats, Daily results, streak, Sun Trail progress and score history. It does not contain your leaderboard ID, nickname or purchases. Restore progress reads it back after you confirm. You can delete Play Games data in the Play Games app or in your Google account.

The game never requires Play Games, and nothing is sent to Play Games if you do not sign in.

5. Verified leaderboards (optional)

Leaderboards are off until you opt in. You are asked once, after your first ranked Daily Sun Challenge ("Show your score on today's board?"), and you can change this at any time in Settings. Declining changes nothing else in the game.

What we receive when you opt in. When you finish a ranked Daily, or set a new personal (or No-revive) best in Endless, the app sends to our Verified Score Service:

• a random leaderboard ID created on your device when you opt in (a UUID; it is not derived from your device, advertising ID or Google account);
• your nickname (a generated one such as "Golden Falcon 35", or one you choose; please do not use your real name);
• the run log: run seed, ruleset version, mode, Daily date, and the list of moves you made (which piece slot and board cell for each placement, plus a marker if you used a revive);
• the score and No-revive flag the app claims, and the app version;
• a Google Play Integrity token for that submission. Google's Play Integrity service tells our server whether the request comes from a genuine copy of the app on a genuine device; it does not tell us who you are.

What our server does. It replays your moves with the same open game rules to check that the score is legally reachable, then stores a leaderboard record and returns your rank. It does not store your move list: it keeps a one-way fingerprint (SHA-256 hash) of the log to detect copied runs, plus:

Your nickname, score and run code are visible to anyone who opens the leaderboards. A run code lets other players replay the same pieces; it does not identify you.

Network data. Like any internet service, our server receives your IP address with each request. We use it, only in memory, to limit abusive request rates. Our hosting provider (Google Cloud) also records standard request logs that include the IP address; these logs are kept for up to 30 days.

Where. The service runs on Google Cloud Run with Google Cloud Firestore in the europe-west1 region (Belgium). Google acts as our processor.

Integrity checks. If an integrity check fails or the same run log was already submitted by someone else, the record is hidden pending manual review. We never show this to other players as an accusation.

Deletion. Settings → Remove my scores deletes every leaderboard record linked to your leaderboard ID from our server and then forgets the ID on your device. Your local best scores stay. If you no longer have the app, email [email protected] with your nickname and the dates of your Daily results and we will delete the matching records.

Retention. Leaderboard records are kept for as long as the leaderboard they belong to is offered, or until you delete them. Records hidden for review are either published or deleted after review.

6. Analytics, crash reports and remote configuration (Firebase)

When enabled in your version of the app, we use these Google Firebase services (Google acts as our processor):

• Firebase Analytics — anonymous usage statistics so we can tell whether the game is fair, stable and fun: for example that a run started or ended, its score, length and end reason, Daily participation, settings changes (theme, drag offset, effects), and whether an ad or purchase screen was shown. These events never contain your name, contact details, your move list, or your leaderboard nickname. Firebase also processes an app-instance identifier, device model, operating system, language and an approximate country derived from your IP address. Where EU/UK consent rules apply, Analytics collects only if you allow both storing information on your device and measuring content performance in the consent tool; you can change this at any time under Privacy options. Elsewhere it is on and described here. On Android, Analytics also reads your device's advertising ID so we can measure which of our own ad campaigns (Google Ads) brought new players and whether they kept playing; it is not used to show you personalized ads (ad personalization signals are off), and you can reset or delete the advertising ID in Android settings. Google Signals is turned off. Analytics data is kept for 14 months.
• Firebase Crashlytics — crash reports (stack trace, device model, operating system, app version, free memory and a random Crashlytics installation ID) so we can fix crashes. Crash reporting runs for all users because a stable app is necessary to provide the game (legitimate interest). Crash reports are kept for 90 days.
• Firebase Remote Config — downloads game settings such as ad limits (which can only become stricter), feature switches and the leaderboard address. It uses a Firebase installation ID. Remote Config never changes your personal settings or a run in progress.

7. Why we use data (legal bases)

Where the EU/UK GDPR or similar laws apply (for example Brazil's LGPD or Turkey's KVKK), we rely on:

8. Sharing and selling

We do not sell personal information and we do not share it with data brokers. Data is disclosed only to:

• Google as described above (AdMob, Play Billing, Play Integrity, Google Cloud hosting, and Firebase when enabled);
• authorities, if we are legally required to.

Your leaderboard nickname, scores and run codes are public by your choice when you opt in.

9. Children

SOLYVO is a general-audience puzzle game for players aged 13 and over. It is not directed at children under 13, and we do not knowingly collect personal information from them. Ads are limited to content rated "Teen" or lower. If you believe a child under 13 (or under the age of digital consent in your country) has submitted leaderboard scores, contact [email protected] and we will delete them.

10. International transfers

Our leaderboard server stores data in Belgium (EU). Google may process ad, billing and analytics data in other countries, including the United States, under its own safeguards (such as the EU Standard Contractual Clauses and the EU–U.S. Data Privacy Framework).

11. Security

All connections from the app to our server and to Google services are encrypted (HTTPS/TLS). Our database cannot be read or written directly by apps; only our server can access it, using Google Cloud access controls. No method of storage or transmission is completely secure, but we keep the data we hold to the minimum described above.

12. Your rights and choices

• Leaderboards: turn them off, rename yourself, or delete your records in Settings.
• Ads: change consent in Settings → Privacy options (where shown); reset or delete your advertising ID in Android settings; or buy Remove Ads to stop the banner and forced break ads.
• Device data: clear the app's storage or uninstall the app.
• Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, to withdraw consent, and to complain to your local data protection authority. Because we do not use accounts, we may ask for your nickname and Daily dates to find your leaderboard records. Write to [email protected]; we answer within 30 days.

13. Changes to this policy

If we change how the app uses data, we will update this page and the effective date above, and, for material changes, tell you in the app or in the store release notes before the change applies.

14. Contact

Noriloop Studio (Hakan Timur) Email: [email protected]