Read how tsumo collects, uses, protects, and shares personal data, including account information, gameplay activity, analytics, cookies, and privacy rights.
This policy explains what data we collect, how we use and disclose it, and rights that may apply by jurisdiction.
This Privacy Policy applies to personal information processed through the Service. The Service is operated under the tsumo name. For privacy questions, rights requests, accessibility-related privacy questions, or legal privacy notices, contact support@tsumo.io.
We collect information directly from you, automatically from your device or browser, from authentication providers you choose, and from service providers that support security, hosting, analytics, advertising, and infrastructure operations.
Where GDPR or UK GDPR applies, legal bases may include contract performance, legitimate interests in operating and securing the Service, consent for optional analytics or storage where required, and legal obligations.
| Category | Examples and Sources | Purposes |
|---|---|---|
| Account identifiers | Email address, user ID, authentication provider ID, and Google OAuth profile data if you choose Google sign-in. | Create accounts, authenticate sessions, prevent abuse, provide support, and maintain account security. |
| Profile and user content | Username, optional avatar URL, support messages, and account settings you provide. | Display profile features, personalize gameplay, moderate content, and respond to requests. |
| Gameplay and learning records | Match history, rankings, puzzle progress, tutorial progress, rule set, game logs, and review metadata. | Operate gameplay, preserve history, calculate rankings, debug rules behavior, and improve learning surfaces. |
| Device, network, and security data | IP-derived diagnostics, browser data, error logs, session activity, and Cloudflare Turnstile anti-abuse checks. | Secure the Service, detect abuse, troubleshoot failures, enforce terms, and maintain infrastructure. |
| Storage and analytics preferences | Cookie consent choice, timestamp, policy version, language, theme, session landing path, and optional Google Tag Manager analytics events after consent. | Remember choices, measure product usage when allowed, improve performance, and honor consent controls. |
| Advertising delivery data | Google AdSense ad requests, device and browser signals, approximate location, ad interaction signals, and ad consent or privacy signals where applicable. | Serve, measure, frequency-cap, personalize where permitted, and protect advertising against fraud and abuse. |
| Legal acceptance metadata | Terms version, privacy version, acceptance time, and legal-completion method. | Operate signup, prove account status, enforce terms, and handle disputes or compliance obligations. |
We use essential storage technologies for core functionality, optional analytics when consented, and Google AdSense advertising technologies. See our Cookie Policy for details on consent choices and controls.
We do not sell personal information for money. Google AdSense and related advertising providers may process device, browser, ad request, consent, and interaction data to serve, measure, frequency-cap, personalize where permitted, and protect ads against fraud and abuse. Where required, advertising consent and revocation are handled through Google Privacy & messaging or another Google-certified consent management platform configured for the site.
We respond to and honor Global Privacy Control (GPC) signals and Browser Do Not Track (DNT) signals. If our systems detect a GPC or DNT signal indicating your preference to opt out of tracking, we automatically disable optional analytics and third-party advertising cookies, treating the signal as a valid request to opt out.
We may disclose information to service providers that support authentication, database and storage, hosting, anti-bot protection, email delivery, logging, customer support, analytics, advertising, and security operations. These providers may include Supabase for account and data infrastructure, Google when you choose Google OAuth, analytics consent permits Google Tag Manager to load, or Google AdSense advertising is served, and Cloudflare Turnstile for anti-abuse checks.
We may also disclose information to legal authorities when required, to enforce our rights or protect users, or in connection with a merger, acquisition, financing, or asset transfer.
We retain information for as long as reasonably necessary for the purposes described in this policy. Account data is generally retained while the account is active. Gameplay, ranking, and puzzle records may be retained to provide history, prevent abuse, and maintain service integrity. Security logs, legal acceptance records, and support communications may be retained longer when needed for fraud prevention, legal obligations, dispute resolution, or contract enforcement. Local and session storage may remain on your device until you clear it or update your choices.
The Service is not intended for children under 13. If we learn we collected personal information from a child under 13 without required consent, we will delete it in accordance with applicable law.
Depending on your state of residence and legal thresholds, you may have rights to know/access, correct, delete, and obtain portability of your personal information, to opt out of sale/share or targeted advertising where applicable, and to appeal denials of certain requests. California residents may have additional rights under CCPA/CPRA, including the right to know categories of information collected and disclosed, the right to non-discrimination for exercising privacy rights, and the right to use an authorized agent where permitted.
We do not knowingly use or disclose sensitive personal information for purposes that require a separate limit-use control under California law. If that changes, we will provide the required notice and controls.
If GDPR or UK GDPR applies, our legal bases may include contract performance, legitimate interests, consent, and legal obligations. You may have rights to access, rectification, erasure, restriction, portability, objection, and to withdraw consent where processing is consent-based. You may lodge a complaint with your local supervisory authority.
We apply reasonable administrative, technical, and organizational safeguards. Data may be processed in countries where our providers operate, with contractual and legal safeguards where required.
We do not use solely automated decisions that produce legal or similarly significant effects. Automated anti-abuse, ranking, and moderation signals may help protect the Service or prioritize review, and you may contact us if you believe an automated or assisted enforcement outcome is wrong.
We may update this policy from time to time. For request workflows, timing, and appeals, see Data Privacy and Rights. You can also contact support@tsumo.io.
tsumo