Privacy Policy
This policy explains what personal data Tuggle processes, why, for how long, and what you can do about it. It covers the Tuggle app for iPhone and iPad and the website playtuggle.com.
The short version: you can play without an account, without giving us your name and without an email address. We keep the minimum we need to sync your progress, run duels and daily puzzles, keep the game fair and deliver what you buy. We do not sell your data. Personalised ads are shown only if you agree to them.
1. Who is responsible
The data controller is:
Little Lion Labs Sole proprietorship (eenmanszaak) registered in the Netherlands Owner: Emine Çabuk Chamber of Commerce (KvK): 42012326 VAT (BTW): NL005432658B68 Prinses Julianastraat 12, 2802 JR Gouda, the Netherlands
Privacy questions and requests: privacy@playtuggle.com General support: support@playtuggle.com
2. What we process and why
2.1 Guest account
The first time you open Tuggle, the app creates a guest account on our server. It consists of:
- a random account id and a random session token (we only store a hashed form of the token);
- a random display name such as "Coral Otter 42", which you can change (2 to 20 characters);
- the date the account was created;
- the country your request came from, at country level only, derived from the network connection at the moment the account is created. We use it to place you in leagues and to show regional leaderboards. We do not store your IP address in our database.
Purpose: to save your progress across devices and reinstalls, and to let you take part in duels, daily puzzles and leagues. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
2.2 Sign in with Apple (optional)
If you choose to link your account with Sign in with Apple, we receive from Apple a stable, app-specific user identifier and verify Apple's signed token. We do not ask Apple for your name or email address and we do not store one. Purpose: to restore your progress on a new device. Legal basis: contract (Article 6(1)(b) GDPR).
2.3 Gameplay data
- Progress: the highest level reached, stars per level, your spool balance, your city and the cosmetics you own, and when they were last updated.
- Daily puzzle and duel results: the moves you made (which rope, at what time), your time, the number of slips and the outcome. Duels also store which two accounts played, the duel code and its expiry date.
- Leagues: your weekly league group, tier and points.
We replay your moves on our server to check that a result is possible for a human player. This protects the leaderboards and other players. Other players can see your display name, your chosen cosmetic, your duel and daily results and your league points. They cannot see anything else about you.
Legal basis: contract (Article 6(1)(b) GDPR) for running the game; our legitimate interest in fair play and preventing cheating (Article 6(1)(f) GDPR) for the replay checks.
2.4 Purchases
Purchases in the app are processed by Apple. Apple handles payment; we never see your card or bank details. To deliver what you bought, the app sends us Apple's signed transaction. We store the transaction id, the product id, the store, the time we verified it and, if Apple tells us so, the time it was refunded or revoked. Legal basis: contract (Article 6(1)(b) GDPR).
2.5 Ads
Tuggle shows ads through Google AdMob, provided by Google Ireland Limited. You can remove interstitial ads with the "No Ads" purchase. Rewarded ads are always optional: you choose to watch one in exchange for spools.
- Consent first. In the EEA, the UK and Switzerland the app shows Google's consent form (User Messaging Platform) before any ad is requested. You can change your choice at any time in Settings → Privacy → Ad choices.
- App Tracking Transparency. On iOS the app asks for permission before it can access your device's advertising identifier (IDFA). If you decline, the IDFA is not available to us or to Google.
- Without consent Google shows non-personalised or limited ads. Google may still use cookies or similar local storage and process your IP address and device information for frequency capping, aggregated reporting and fraud prevention, as described in Google's own policies.
- Rewarded ads: when you finish a rewarded ad, Google sends our server a signed confirmation containing your Tuggle account id and a transaction id, so we can credit your spools exactly once. We store the transaction id, your account id, the reward and the time.
Legal basis: your consent (Article 6(1)(a) GDPR) for personalised ads and access to the advertising identifier; contract (Article 6(1)(b) GDPR) for crediting rewards. Google acts as an independent controller for its ad services. More: https://policies.google.com/technologies/partner-sites.
2.6 Push notifications (optional)
If you allow notifications, we store your Apple Push Notification service token so we can tell you when a friend has played your duel or when your league week ends. We send at most one notification per day. Legal basis: your consent (Article 6(1)(a) GDPR), given through the iOS permission prompt; you can withdraw it in iOS Settings at any time.
2.7 Game Center
If you are signed in to Game Center, your scores and achievements are reported to Apple's Game Center under Apple's terms. We do not store your Game Center identity on our servers.
2.8 Statistics and crash reports
Tuggle contains no third-party analytics SDK. If you have chosen to share analytics with app developers in your iOS settings, Apple gives us aggregated App Analytics and crash reports that do not identify you.
2.9 Security and abuse prevention
To keep the service available, our hosting provider processes your IP address while a request is being handled, and we keep short-lived request counters per IP address and per account to limit abuse. Legal basis: legitimate interest in a secure, available service (Article 6(1)(f) GDPR).
2.10 Email to us
If you email us, we use your email address and message only to answer you. Legal basis: legitimate interest in answering your question, or contract if it concerns your purchase.
3. Who we share data with
We use these service providers (processors) under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting of our API and website, database (D1), key-value storage, live duel rooms | Global network; data stored by Cloudflare |
| Apple Inc. / Apple Distribution International Ltd. | App distribution, in-app purchases, Sign in with Apple, push notifications, Game Center, App Analytics | Ireland / USA |
Google Ireland Limited (AdMob) and Apple act as independent controllers for their own services and process data under their own privacy policies.
We do not sell personal data, and we do not share it with data brokers. We may disclose data if Dutch or EU law requires it.
4. International transfers
Some providers process data outside the European Economic Area, including in the United States. We rely on the EU–U.S. Data Privacy Framework where the provider is certified (Cloudflare, Google and Apple are), and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the relevant safeguards.
5. How long we keep data
| Data | Kept until |
|---|---|
| Guest account, progress, purchases, league history | You delete your account. Guest accounts with no activity for 24 months are deleted automatically |
| Session tokens | You sign out, delete the account, or the account is deleted for inactivity |
| Duel results | 90 days after the duel ends or expires |
| Daily puzzle results | 12 months |
| Rewarded-ad records | 12 months |
| Push token | You turn off notifications, the token changes, or you delete your account |
| Abuse-prevention counters | A few minutes |
| Hosting logs | Up to 30 days |
| Support emails | 2 years after the last message |
6. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing.
- Delete your account: in the app, Settings → Account → Delete account. This deletes your account and all associated data from our server immediately. See our account deletion page for details.
- Change ad consent: Settings → Privacy → Ad choices.
- Any other request: email privacy@playtuggle.com. Because you play without an email address, we may ask you for your account id (shown in Settings → Account) so we can find your data. We answer within one month.
You also have the right to complain to a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (https://www.autoriteitpersoonsgegevens.nl). You can also complain to the authority in the EU country where you live.
Players in Turkey (KVKK)
If you live in Turkey, Law No. 6698 on the Protection of Personal Data (KVKK) also applies. Little Lion Labs is the data controller. We process the data described above for the same purposes, on the grounds in Article 5(2)(c) (performance of a contract), 5(2)(f) (legitimate interest) and, for personalised ads and push notifications, your explicit consent (Article 5(1)). Because our providers are abroad, data is transferred abroad under Article 9 KVKK on the basis of appropriate safeguards or your explicit consent. You have the rights listed in Article 11 KVKK and may contact privacy@playtuggle.com or complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
7. Children
Tuggle is rated 9+ on the App Store and is made for a general audience. We do not ask for anyone's age, real name or email address, and there is no free-text chat between players. Personalised ads are shown only after consent through Google's consent form. In the Netherlands, children under 16 need a parent or guardian to consent on their behalf; we ask parents to make that choice together with their child, or to leave personalised ads off. A parent who believes their child has given us personal data can ask us to delete it at privacy@playtuggle.com. More in our notice on children and ads.
8. Security
All connections use TLS. Session tokens are stored only as a hash. Access to production systems is limited to the owner and protected with strong authentication.
9. The website
playtuggle.com does not use cookies or analytics. Our hosting provider processes your IP address to deliver the page and protect it from abuse (legitimate interest).
10. Changes
When we change this policy we update the date at the top. For important changes we will also tell you in the app.