This policy explains what Hexogram Arena ("the app", "we") collects, why, and what you can do about it. The app is operated by Ivan Stoyanov, trading as Clickoni ("we", "us"), who is the data controller for the purposes of the GDPR. You can reach us at ivan.stoyanov.stoyanov@gmail.com.
Guest play requires no account and no personal details. We create an anonymous identifier on your device so your progress and settings survive app restarts. Guest progress is stored on the device and is not linked to a name, email or any other identifier we can trace to you.
| Data | Why we need it |
|---|---|
| Email address | To create and secure your account, sign you in, and allow password reset. |
| Password | Handled and stored by Google Firebase Authentication. We never see or store your password ourselves. |
| Name and email from Google or Apple sign-in | Only if you choose those sign-in buttons. If you use Apple's "Hide My Email", we only ever receive the relay address. |
| Display name | Shown to other players on leaderboards, challenges and duels. Defaults to the part of your email before the "@"; you can change it. |
Your account is a single Clickoni account shared by all of our puzzle games. If you sign in to more than one of them, they use the same account, display name, friends and cosmetics.
If you allow notifications, we store a push token for your device so we can tell you when someone challenges you, when a duel or Arena challenge you take part in changes, and to remind you about your daily streak. You can revoke this at any time in your device settings; we delete the token when you delete your account.
If you use Settings → Send feedback, we store your message, the kind of feedback you chose, your account ID and display name, the app version, platform, operating system version and app language. Only we can read it, and we use it only to answer and act on your feedback.
In-app purchases (such as Premium or Remove Ads) are processed entirely by Apple or Google. We use RevenueCat to check which purchases your account owns, so they work on every device you sign in on. RevenueCat receives your account ID and the purchase records from the store (product, date, price, currency and transaction ID). Neither we nor RevenueCat ever see your card details.
Our infrastructure provider (Google Firebase) automatically processes technical data such as IP address, device model, operating system version and timestamps in order to deliver the service, prevent abuse and debug faults. We do not use this to build an advertising or marketing profile of you.
The app shows optional rewarded video ads — for example, to reveal a hint or to continue after running out of mistakes. Ads are served by Google AdMob. AdMob may collect and process an advertising identifier and technical data in order to serve and measure ads. See how Google uses data from apps that use its services.
In the European Economic Area, the UK and Switzerland we ask for your consent before any personalised advertising, using Google's consent management platform. You can choose non-personalised ads. Your choice is stored on your device; clearing the app's data or reinstalling it makes the app ask again.
On iOS, the app asks your permission under Apple's App Tracking Transparency before your device's advertising identifier is used. If you decline, you still see ads, but they are not personalised using that identifier. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account | Performance of a contract |
| Saving progress, streaks and leaderboards | Performance of a contract |
| Challenges, follows and live duels | Performance of a contract |
| Purchases and making them available on all your devices | Performance of a contract |
| Push notifications | Consent (device permission) |
| Personalised ads and the advertising identifier | Consent (consent form / App Tracking Transparency) |
| Crash reports, usage statistics and answering your feedback | Legitimate interests (keeping the app working and improving it) |
| Fraud, cheating and abuse prevention; service security | Legitimate interests |
We do not sell your personal data and we do not share it for cross-context behavioural advertising. We use these processors:
| Provider | What it does |
|---|---|
| Google Firebase (Authentication, Firestore, Realtime Database, Cloud Functions, Hosting, Analytics) | Accounts, game data storage, live matches, backend logic, usage statistics. Firebase privacy |
| Google AdMob | Serves and measures the optional rewarded ads. Google privacy |
| RevenueCat | Checks which in-app purchases your account owns. RevenueCat privacy |
| Sentry (Functional Software, Inc.) | Crash and error reports, stored in the EU. Sentry privacy |
| Expo push notification service | Delivers notifications to your device. Expo privacy |
| Google Play / Apple App Store | App distribution and purchases. |
We may also disclose data where legally required, or to establish, exercise or defend legal claims.
Your display name, rank tier, level and puzzle statistics are visible to other players on leaderboards, public profiles and in challenges or duels you take part in. Arena posts are public: every player can see your name and time on them. Your email address is never shown to other players.
Our providers may process data on servers outside your country, including in the United States. Where data leaves the European Economic Area or the UK, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
Depending on where you live, you have the right to access, correct, delete, export or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. To exercise any of these, email ivan.stoyanov.stoyanov@gmail.com. We respond within 30 days.
If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, you have the rights described in the CCPA/CPRA, including the right to know, delete and correct, and the right not to be discriminated against for exercising them; note that we do not sell or share personal information as those terms are defined by the CCPA.
You can delete your account and all associated data at any time inside the app, from Profile → Settings → Profile management → Delete account, or by following the instructions at clickoni.web.app/delete-account/hexogram.html. Because your account is shared by all of our games, deleting it removes it from every one of them. Your sign-in is removed immediately; your profile, game statistics, leaderboard entries, Arena posts, duels, challenges, follows, feedback and push tokens are removed from our live systems within 30 days.
Hexogram Arena is not directed to children under 13 (or under 16 in the EEA, where local law sets that age), and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
Data is transmitted over TLS and stored on Google Cloud infrastructure with access controlled by server-side security rules. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
If we change this policy we will update the date at the top of this page, and for significant changes we will notify you in the app before the change takes effect.
Ivan Stoyanov, trading as Clickoni
ivan.stoyanov.stoyanov@gmail.com