Privacy Policy for Crossplay Solver by TWF

1. Who we are

Crossplay Solver by TWF is published by MPL Ventures LLC, 330 N Wabash Ave, Floor 23, Chicago, IL 60611-7619, United States.

For anything relating to this policy or to your personal information, contact us at [email protected].

Under the UK and EU General Data Protection Regulation, MPL Ventures LLC is the data controller for the processing described below.

2. The short version

There is no account in Crossplay Solver, no sign-in and no profile. We do not ask for your name or your location, and we do not build a record of who you are. The only time we would have your email address is if you choose to give it to us when sending feedback, and that is always optional.

The app is free and it is paid for by advertising. That is where most of the data goes, so it comes first.

• Advertising is served by Google. To choose which adverts to show, Google receives information about your device and how you use the app. In Europe, the UK and Switzerland we ask your permission before any of that is used to personalise adverts, and you can say no and change your mind later.
• The letters you look up go to our own server so it can work out your moves. Nothing else goes with them, and we cannot connect a lookup to you.
• Board photos never leave your phone. The text recognition runs on the device itself.
• Google's text recognition library sends Google technical diagnostics about how it performed. That includes your device model, our app's name and version, and an identifier for your installation of the app. It does not include your photos, your letters, or anything you typed.

The detail is below, and the detail governs.

3. What we do not collect

Crossplay Solver does not collect:

• Your name, phone number or postal address
• Your email address, unless you choose to give it to us when you send us feedback. See Section 7
• Your precise location. Advertising uses an approximate location worked out from your internet connection, which is described in Section 8
• Your contacts, calendar, or anything else from elsewhere on your device
• Your photos, or anything recognised inside them

We do not sell your personal information in the ordinary sense of the word. United States state privacy laws use wider statutory definitions of "sell" and "share" that can cover advertising of the kind described in Section 8, and Section 12 explains what to do if you would rather we did not.

4. Requests to our word server

Crossplay Solver is not an entirely offline app. When you ask it to find words, it sends the letters on your rack and the current state of your board to a server we operate, over an encrypted HTTPS connection. The server works out the possible moves and sends them back.

We run that server ourselves, on a machine rented from DigitalOcean in New York, United States. No advertising network, analytics provider or other third party sees or handles these requests.

Like almost every web server, ours keeps a routine access log. Each entry records the time of the request, the address requested (which includes the letters you asked about), the type of device and browser that made it, and the size of the response. IP addresses are truncated as the log is written, so an entry cannot be traced back to a particular device or person. Logs are kept for 14 days and then automatically deleted.

There is no account, no session identifier and no device identifier attached to these requests. We cannot connect a lookup to you, and we do not attempt to.

We keep these logs so we can see that the service is working, diagnose faults and identify abusive traffic. We do not use them to build a profile of anyone, and we do not share them.

5. Photos and board scanning

Crossplay Solver lets you import a screenshot of your board rather than entering it by hand.

When you use this feature, your phone shows you its own photo picker. You choose one image, and only that image is shared with the app. Crossplay Solver never receives access to your photo library as a whole through this route.

The image is read on your device to work out the board layout. It is never uploaded to us or to anyone else. Images do not leave your phone. Once the board has been created, the app does not keep it.

If you turn on the option to delete a screenshot after importing it, the app will ask for permission to your photo library, because deleting a photo requires that access. You can decline, and everything else in the app will continue to work.

The app keeps count of your board imports, because the free allowance depends on it. Section 8 explains how the advertising works and why the count exists. The count is a number and a date, and nothing else. It is not attached to your identity, because we do not have one for you, and it is used for nothing except working out whether your next import shows a full-screen advert.

6. Diagnostics sent to Google by the text recognition library

Reading the letters off an imported board photo is done by Google ML Kit, a text recognition library built into the app. The recognition itself happens entirely on your device. Google does not receive your photo, the board it contained, or the words you looked up.

Google does receive technical information about how the library performed. Google's own documentation sets out what this covers, and we are required to tell you about it. Each time the feature runs, Google collects:

• Device information, such as manufacturer, model, operating system version and build, and which machine learning hardware your device has
• Application information, meaning our app's package name and version
• An identifier for your installation of the app. Google describes this as a per-installation identifier that is not intended to identify you or your device
• Performance metrics, such as how long recognition took
• API configuration, such as the image format and resolution passed in
• The size of the input and output, not their content
• The version of the feature, the type of event, and any error codes

Google uses this to measure performance, fix bugs, maintain and improve the library, and detect misuse. Google states that this data is encrypted in transit and is not passed to third parties. Google's handling of it is governed by Google's Privacy Policy, and the specifics are published in Google's ML Kit terms and its ML Kit data disclosures.

We do not see this data. It does not reach us, we hold no copy of it, and it tells us nothing about you. Google's library does not offer a way to switch it off, so the honest position is that using the photo import feature means Google receives these diagnostics. If you would rather it did not, enter your board by hand instead. Everything else in the app works without the photo import.

This is separate from the advertising in Section 8, even though Google is involved in both.

7. Sending us feedback

There is a feedback link in the app. Tapping it opens your browser and takes you to a Google Form, which sits outside the app.

The form asks which of our apps you are writing about, whether you are on Apple or Android, and what you would like to tell us. There is also a field for your email address. That field is optional. You only need it if you want a reply, and the form says so.

If you give us your email address, we use it to reply to you and for nothing else. We do not sell it, we do not share it, we do not add you to any mailing list, and we do not use it for marketing. Our legal basis is your consent, given when you choose to fill the field in.

Responses go to a spreadsheet in our Google Workspace account, where Google acts as our processor. Five people at MPL Ventures LLC can see it. Nobody else has access.

We delete email addresses from that spreadsheet after 12 months. We keep the feedback itself, along with the device type and which app it was about, for longer, because it helps us improve the apps. Once the email address is gone, what remains cannot be connected to you.

If you would like your feedback removed sooner, email [email protected] and we will delete it.

8. Advertising

Crossplay Solver is free, and advertising is what pays for it.

Who serves it. Our advertising is served by Google AdMob, which is Google's advertising service for mobile apps. We are the publisher and Google is the network. AdMob is the only advertising service in the app, and we do not use it to bring in other advertising networks. If that ever changes, we will name them here before it does.

Where you will see it. A banner advert appears at the bottom of most screens. A full-screen advert appears when you import a board photo, after your free allowance for the day is used up.

How the free allowance works. Your first three board imports carry no full-screen adverts at all. After that you get one board import a day without one, and full-screen adverts appear on further imports until the next day. Roughly once a month the first-three allowance starts again. This is why the app counts your imports, as Section 5 describes.

What Google receives. For advertising to work, information about your device and your use of the app is shared with Google and with the advertisers and advertising technology companies in its network. This includes:

• An advertising identifier. On iPhone and iPad this is Apple's identifier for advertisers, and it is only available if you allow tracking when asked. On Android it is Google's advertising ID
• Your approximate location, worked out from your internet connection. Not GPS, and not your address
• Your IP address
• Information about your device, such as its model, operating system version, language and country, and the type of network connection
• Information about our app, meaning its name and version
• Information about the adverts themselves, such as which were shown to you, whether you looked at or tapped one, and when

It does not include your name, because we do not have it. It does not include your photos, the letters you looked up, or anything the word server sees.

What it is used for. Choosing which advert to show you, measuring whether adverts were seen and worked, capping how often you see the same one, and detecting fraudulent traffic. Where you have agreed, it is also used to make adverts more relevant to you based on information about you and your device. Where you have not, adverts are chosen without that.

Our legal basis. Consent, for personalised advertising and for the advertising identifier where the law requires consent for it. For non-personalised advertising and for measuring and fraud prevention, our legitimate interest in funding a free app. We do not rely on consent you have not given.

Google's own role. For some of this processing Google acts as our processor, and for some of it Google is a controller in its own right and decides how the data is used. Google sets out that split, and how it handles advertising data, in Google's Privacy Policy and in its advertising business terms. Google sets its own retention periods for it and we cannot shorten them.

9. Your choices about advertising

You have three separate controls, and they do different things.

In Europe, the UK and Switzerland: the consent prompt. Before any personalised advertising is shown, the app asks whether you agree, using Google's consent tool. You can refuse. The app keeps working, and you will still see advertising, chosen without using information about you. You can change your answer at any time from the app's settings, and changing it to no takes effect from that point onwards.

On iPhone and iPad: the tracking prompt. Apple requires a separate permission before an app may use the identifier for advertisers or otherwise track you across other companies' apps and websites. The app asks for this through Apple's own prompt. If you decline, we and Google will not use that identifier, and you will see less relevant adverts rather than fewer of them. Declining is a complete answer. No part of Crossplay Solver is withheld from you for declining, and nothing is asked of you in exchange. You can change it later in your device settings, under Privacy and Security, then Tracking.

On Android: your advertising ID. You can reset it or delete it entirely in your device settings, under Privacy, then Ads. Deleting it stops apps receiving it.

If you are in the United States and you would rather we did not share information for advertising, tell us at [email protected] and we will apply that. Section 12 covers the rest of your rights.

10. Who else is involved

Google, through AdMob. The advertising described in Section 8. This is the largest data flow in the app.

Google, through ML Kit. The text recognition library described in Section 6. Google receives diagnostics, never your images or your words.

Google, through Workspace. If you send us feedback, the form and the spreadsheet holding the responses run on our Google Workspace account. Google acts as our processor there under its data processing terms.

Those three are separate arrangements that happen to involve the same company, and information does not move between them because of us.

DigitalOcean. Our word server runs on a machine we rent from DigitalOcean, who act as our processor. They provide the infrastructure and do not handle the content of your requests.

Advertisers and advertising technology companies in Google's network. They receive the advertising information described in Section 8 in order to bid for and deliver adverts. We do not choose them individually and we have no relationship with them.

Apple and Google as app stores. They distribute the app and operate the App Store and Google Play. They collect their own information about downloads and, if you have opted in at the operating system level, app usage and crash diagnostics. Apple shows us aggregate reports built from that in App Store Connect. We do not receive anything that identifies you and we cannot see what any individual did. That processing is theirs rather than ours, and is governed by Apple's privacy policy and Google's privacy policy. You can turn it off in your device settings under Privacy and Security.

We do not work with analytics providers or data brokers, and there is no analytics or crash reporting software in the app.

11. Age, and who the app is for

Crossplay Solver is made for adults. Our declared target audience is 18 and over, and the terms of use require you to be at least 18.

We are not directed at children and we do not knowingly collect personal information from anyone under 18. We do not verify anyone's age, so if you believe a child has provided us with personal information, contact [email protected] and we will look into it and delete it.

This matters more than it used to, because the advertising described in Section 8 is personalised. Setting the audience at adults is what keeps that straightforward.

12. Your rights

There is no account and no identifier we control, which limits what most of these rights can practically reach. Two things about you do exist: an advertising identifier held by your device and by Google, and any feedback you sent us with an email address attached.

If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on it. Withdrawing advertising consent is done in the app, as Section 9 describes, and you do not need to write to us for that. You also have the right to complain to your national supervisory authority. In the UK that is the Information Commissioner's Office.

Data held by Google rather than by us. The advertising data in Section 8 and the diagnostics in Section 6 are held by Google. Use Google's privacy tools to exercise rights over those, and see Google's ad settings for advertising specifically.

If you are in California, you have the right to know what personal information is collected, to delete it, to correct it, and to opt out of the sale or sharing of it. Advertising of the kind in Section 8 is capable of falling within the statutory meanings of "sell" and "share", so there is something to opt out of. To do that, email [email protected] with "Do not sell or share my personal information" in the subject line, or refuse the consent prompt and decline the tracking prompt described in Section 9, which achieves the same result on your device. We will not discriminate against you for exercising any of these rights.

Residents of other US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Rhode Island and Indiana, have broadly similar rights, including a right to opt out of targeted advertising. The exact list varies by state. Ask us and we will tell you what your state provides.

To make a request, email [email protected]. We aim to respond within one month. Where a request is complex, or where you have made several, the law allows us two further months and we will tell you within the first month if we need them. Because there is no account, we often cannot verify that particular data relates to you, and where that is the case we will explain why rather than simply refusing. If you sent us feedback and included your email address, we can find that record and delete it on request.

13. Where information is processed

MPL Ventures LLC is based in the United States, and our word server runs in DigitalOcean's New York datacentre. When you use the app, your device sends its request there directly, wherever in the world you happen to be.

The advertising described in Section 8, the diagnostics in Section 6 and the feedback in Section 7 all go to Google, which processes them on its own global infrastructure under its own arrangements.

Where we send personal data from the European Economic Area or the United Kingdom to the United States, we rely on the safeguards our providers have in place. The European Commission has decided that the United States offers adequate protection, but only for organisations certified under the EU-US Data Privacy Framework. Where our provider is certified, we rely on that. Where it is not, we rely on the European Commission's standard contractual clauses. Write to us and we will tell you which applies to a particular transfer and give you a copy of the relevant safeguards.

14. How long we keep things

We keep nothing else from your ordinary use of the app.

15. Security

Traffic between the app and our server is encrypted in transit using HTTPS, as is the diagnostic traffic Google's library sends and the advertising traffic the Google Mobile Ads software sends.

Because the app holds no account and stores no personal information about you, there is no stored personal data of yours for us to protect. Board states and settings you create are saved on your own device and are protected by your device's own security. Deleting the app removes them.

16. Changes to this policy

We will update this policy when the app changes. The date at the top always reflects the current version.

Where a change is material, particularly one that introduces new data collection or advertising, we will publish the updated policy and update our App Store and Google Play declarations before the new version of the app is released. Where the law requires consent, we will ask for it rather than relying on you having read this page.

17. Contact

[email protected]