Legal

Privacy Policy

Read how tsumo collects, uses, protects, and shares personal data, including account information, gameplay activity, analytics, cookies, and privacy rights.

Browse beginner guides Practice with puzzles Play against bots

1. Scope and Controller Information

This Privacy Policy applies to personal information processed through the Service. The Service is operated under the tsumo name. For privacy questions, rights requests, accessibility-related privacy questions, or legal privacy notices, contact support@tsumo.io.

2. Categories, Sources, Purposes, and Legal Bases

We collect information directly from you, automatically from your device or browser, from authentication providers you choose, and from service providers that support security, hosting, analytics, advertising, and infrastructure operations.

Where GDPR or UK GDPR applies, legal bases may include contract performance, legitimate interests in operating and securing the Service, consent for optional analytics or storage where required, and legal obligations.

Category	Examples and Sources	Purposes
Account identifiers	Email address, user ID, authentication provider ID, and Google OAuth profile data if you choose Google sign-in.	Create accounts, authenticate sessions, prevent abuse, provide support, and maintain account security.
Profile and user content	Username, optional avatar, support messages, account settings, and club-listing details such as venue name, public address, schedule, and map coordinates that you provide.	Display profile features and public club listings, personalize gameplay, moderate content, and respond to requests.
Gameplay and learning records	Match history, rankings, puzzle progress, tutorial progress, rule set, game logs, and review metadata.	Operate gameplay, preserve history, calculate rankings, debug rules behavior, and improve learning surfaces.
Device, network, and security data	IP-derived diagnostics, browser data, error logs, session activity, and Cloudflare Turnstile anti-abuse checks.	Secure the Service, detect abuse, troubleshoot failures, enforce terms, and maintain infrastructure.
Storage and analytics preferences	Cookie consent choice, timestamp, policy version, language, theme, session landing path, and optional Google Tag Manager analytics events after consent.	Remember choices, measure product usage when allowed, improve performance, and honor consent controls.
Advertising delivery data	Google AdSense ad requests, device and browser signals, approximate location, ad interaction signals, and ad consent or privacy signals where applicable.	Serve, measure, frequency-cap, personalize where permitted, and protect advertising against fraud and abuse.
Legal acceptance metadata	Terms version, privacy version, acceptance time, and legal-completion method.	Operate signup, prove account status, enforce terms, and handle disputes or compliance obligations.

Categories, examples, sources, and purposes

3. Cookies, Analytics, and Tracking Choices

We use essential storage technologies for core functionality, optional analytics when consented, and Google AdSense advertising technologies. See our Cookie Policy for details on consent choices and controls.

We do not sell personal information for money. Third-party vendors, including Google, use cookies to serve ads based on prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on visits to our site and/or other sites on the Internet. You may opt out of personalized advertising by visiting Google Ads Settings or www.aboutads.info. Where required, advertising consent and revocation are handled through Google Privacy & messaging or another Google-certified consent management platform configured for the site.

We treat Global Privacy Control (GPC) and Browser Do Not Track (DNT) signals as opt-out signals for tsumo optional analytics, which remains disabled. For site-owned AdSense units, we request restricted data processing when either signal is detected. Google states that it also receives GPC signals directly for users in applicable US states and triggers restricted data processing for those ad requests. Restricted or non-personalized ads are not based on prior behavior, but Google may still use limited storage for delivery, measurement, frequency capping, and fraud prevention; advertising choices remain available through Google Privacy & messaging and Google ad settings.

Cookie Policy

4. Disclosure to Service Providers and Others

We may disclose information to service providers that support authentication, database and storage, hosting, anti-bot protection, email delivery, logging, customer support, maps and address geocoding, analytics, advertising, and security operations. These providers may include Supabase for account and data infrastructure, OpenStreetMap and Nominatim for club maps and organizer-requested venue geocoding, Google when you choose Google OAuth, analytics consent permits Google Tag Manager to load, or Google AdSense advertising is served, and Cloudflare Turnstile for anti-abuse checks.

We may also disclose information to legal authorities when required, to enforce our rights or protect users, or in connection with a merger, acquisition, financing, or asset transfer.

5. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this policy. Account data is generally retained while the account is active. Gameplay, ranking, and puzzle records may be retained to provide history, prevent abuse, and maintain service integrity. Security logs, legal acceptance records, and support communications may be retained longer when needed for fraud prevention, legal obligations, dispute resolution, or contract enforcement. Local and session storage may remain on your device until you clear it or update your choices.

6. Children's Data

The Service is not intended for children under 13. If we learn we collected personal information from a child under 13 without required consent, we will delete it in accordance with applicable law.

7. US State Privacy Rights

Depending on your state of residence and legal thresholds, you may have rights to know/access, correct, delete, and obtain portability of your personal information, to opt out of sale/share or targeted advertising where applicable, and to appeal denials of certain requests. California residents may have additional rights under CCPA/CPRA, including the right to know categories of information collected and disclosed, the right to non-discrimination for exercising privacy rights, and the right to use an authorized agent where permitted.

We do not knowingly use or disclose sensitive personal information for purposes that require a separate limit-use control under California law. If that changes, we will provide the required notice and controls.

8. EU/UK Addendum

If GDPR or UK GDPR applies, our legal bases may include contract performance, legitimate interests, consent, and legal obligations. You may have rights to access, rectification, erasure, restriction, portability, objection, and to withdraw consent where processing is consent-based. You may lodge a complaint with your local supervisory authority.

9. International Transfers and Security

We apply reasonable administrative, technical, and organizational safeguards. Data may be processed in countries where our providers operate, with contractual and legal safeguards where required.

10. Automated Decisions

We do not use solely automated decisions that produce legal or similarly significant effects. Automated anti-abuse, ranking, and moderation signals may help protect the Service or prioritize review, and you may contact us if you believe an automated or assisted enforcement outcome is wrong.

11. Changes and Requests

We may update this policy from time to time. For request workflows, timing, and appeals, see Data Privacy and Rights. You can also contact support@tsumo.io.

Data Privacy and Rights