Privacy Policy — Tessera

What We Collect

Account information

• Username — chosen by you, required for the leaderboard and multiplayer
• Email address — only if you sign up with email and password (optional if using Google)
• Google Play Games ID — if you sign in with Google Play Games on Android
• Display name — same as username
• Player ID — randomly generated, used for private game invitations

Game data

• All game moves and results — stored to enable async multiplayer and the leaderboard
• ELO scores and rank history
• Match history — matches played, wins, losses
• Bot game statistics — difficulty levels, win rates per level, player counts used
• Per-round tile draft choices and wall placement data
• Factory and centre tile selections, floor line penalties received
• End-game bonus statistics — rows completed, columns completed, colour sets completed

Usage data (analytics events — stored on our servers, not sent to third parties)

• Session starts and durations
• Matches started and completed (by player count: 2, 3, or 4 players)
• Tutorial and solo challenge progress
• Avatar and theme purchases
• Ad interactions (rewarded ads watched, interstitials dismissed)
• Achievements unlocked

Device information (for crash reporting only)

• App version
• Android OS version
• Device model (e.g., "Samsung Galaxy A52")

What We Don't Collect

• Passwords — handled entirely by Google or our authentication provider; we never see them
• Precise or approximate location
• Contacts or address book
• Microphone or camera
• Payment card or billing details — handled entirely by Google Play Billing; we never see payment information
• Personal messages between players — the only player-to-player text is usernames in challenge notifications
• Device identifiers such as IMEI, MAC address, or phone number

We never sell your personal data.

How We Use Your Data

Game functionality: Your tile draft choices and wall placements are stored to enable async multiplayer — your opponent reads your moves when they take their turn. Without this, online multiplayer is not possible.

Leaderboard and ranking: Your username, ELO score, and match results appear on the public leaderboard. Other players can see your username and rank.

Personalisation: Your chosen avatar, active theme, and settings preferences are stored so they sync across your devices.

Analytics: Usage events are stored to help us understand how players use the game and where to improve it. These are associated with your internal user ID — never with your name or email in analytics queries.

Notifications: If you grant notification permission, your device's push token is stored to send multiplayer turn alerts. The daily reward reminder is scheduled locally on your device and does not require sharing data with our servers.

Third Parties

Tessera relies on a small number of trusted services. Each has its own privacy policy:

Service	Purpose	Their Policy
Supabase	Database, authentication, realtime sync	supabase.com/privacy
Google AdMob	Advertisements (non-personalised by default)	policies.google.com/privacy
Google Play Games Services	Sign-in, achievements sync	policies.google.com/privacy
Google Play Billing	In-app purchases	play.google.com/about/play-terms
RevenueCat	Purchase management and entitlement tracking	revenuecat.com/privacy
Expo / React Native	App framework and push notification delivery	expo.dev/privacy

We do not share your data with these services beyond what each needs to perform its function. Tessera has no Facebook integration.

Advertising — AdMob non-personalised ads

Tessera requests non-personalised ads from Google AdMob. This means AdMob does not build a behavioural profile based on your identity or cross-app activity. AdMob may still use contextual signals (e.g., general location derived from IP, language) to select relevant ads. You are not asked for consent to personalised advertising. If Google's regional requirements change this default, an in-app consent dialog will be displayed before any ad is shown.

RevenueCat — purchase data

RevenueCat receives your Google Play purchase receipts and the entitlements they unlock. RevenueCat does not receive your name, email, or gameplay data. It uses an anonymous user ID to associate purchases with your account.

Your Rights

Access: Request a copy of the data we hold about you by emailing [email protected].

Deletion: Delete your account from within the app: Settings → Account → Delete Account. This begins a 30-day grace period. After 30 days, all personal data — username, email, match history, ELO, tile statistics — is permanently deleted from our servers. Analytics events are anonymised rather than deleted, as they are already aggregated into statistical reports.

Correction: Change your username at any time from Settings → Profile (up to 3 times per 30 days).

Portability: Request your complete match history as a JSON file by emailing [email protected]. We will respond within 30 days.

Opt out of analytics: Contact us and we will flag your account to exclude it from all analytics aggregation. Operational data (game moves for multiplayer) cannot be excluded while your account is active.

Data Storage

All gameplay data, account data, and analytics events are stored on our own servers in India. By creating an account, you acknowledge that your data will be stored there, which may have different data protection laws than your country of residence.

Data Retention

• Active accounts: All data retained while the account exists.
• Deleted accounts: Personal data removed within 30 days of deletion request. Analytics events anonymised permanently.
• Inactive accounts: Accounts with no activity for 24 months may be flagged for deletion with 30-day email notice if an email is on file.
• Raw analytics events: Retained for 12 months in raw form; aggregated into statistics and raw events deleted after 12 months.

GDPR (European Economic Area)

If you are in the EEA, you have the following additional rights under the General Data Protection Regulation:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your account and all associated personal data (completed within 30 days).
• Right to restriction: Request that we stop processing your data while a dispute is pending.
• Right to data portability: Request your match history in a machine-readable format (JSON).
• Right to object: Object to processing based on legitimate interest. Note that operational data (game moves) is necessary for the service to function and cannot be excluded while your account is active.

Our lawful basis for processing your data is contract performance (game data is necessary to provide the service) and legitimate interest (anonymised analytics to improve the game). To exercise any of these rights, email [email protected]. We will respond within 30 days.

Children's Privacy

Tessera is rated Everyone (E) on Google Play. The target audience is 13 and older. We do not knowingly collect personal data from children under 13. If we learn that we have done so without parental consent, we will delete that data promptly. If you believe a child under 13 has provided us with personal data, contact [email protected] and we will investigate and delete the data within 30 days.

Changes to This Policy

We will notify players of significant changes via the What's New screen in the app. Minor corrections may be made without notification. The "Last updated" date at the top always reflects the current version.

Contact

2DGameClub Studio
[email protected]