Privacy

Private playtest · Updated September 27, 2026

This invitation-only test is for adults aged 18 or older, including friends outside the United States. Please do not use it if you are under 18.

Pocket Cube is operated by Hootan Shadmehr in San Francisco, California, United States. For privacy questions or requests, contact support@pocketcube.app.

What we keep and why

• Guest accounts: a random account identifier, a protected device credential, platform and account/device timestamps let you play and recover saved progress. The server stores a hash of the credential, not the credential itself.
• Optional bug reports: The report form prepares a draft for you to review and send by email. App version, browser and screen details are included only if you choose them. Nothing is sent automatically.
• Optional Google sign-in: Google supplies a verified account identifier and email address so you can use the same progress across devices and see which account is signed in. We keep the latest verified email. Your Google password is never given to us, and provider access or refresh tokens are not saved in the game database.
• Play: completed levels, submitted move sequences and attempt results, together with unlocked hints for your unfinished level. Your unfinished cube and Undo/Redo history stay on this device. We keep your fewest-hints personal best for each current puzzle, hint counts for ongoing play, and the hint count shown with a completed attempt’s result.
• Mock economy: when enabled, we keep your test coin ledger, Hint purchase receipts, pretend purchases and unlocks, selected background, simulated/native test-ad sessions and reward claims. These records keep balances accurate and prevent duplicate charges or rewards when you retry or combine accounts. They are linked to your game account and included in account export/deletion. No real money changes hands.
• Reliability and security: account-operation receipts, limited technical logs and backups help prevent account mix-ups and recover from failures. Connections expose an IP address and browser information to the server; infrastructure error/security logs may include them. We do not add IP addresses to game-account records.
• Messages you send us: if you contact us, we use the message and contact details to respond and handle your request.

The browser stores your game credential, saved game/account and pending transaction journals, and preferences such as sound, handedness and menu sections. Necessary cookies remember the private-test invitation and protect Google sign-in. Clearing browser storage can remove access to an unlinked guest account.

Web play uses simulated ads. Native test builds can use Google Mobile Ads and its User Messaging Platform to display Google test creatives and collect privacy choices. These are test ads, not paid advertising, and purchases remain pretend. Linking Google is optional; you can play as a guest.

When native ads are requested, Google's SDK may process your IP address and approximate location, device identifiers, ad interactions and diagnostics for ad delivery, measurement and fraud prevention. Test ads still contact Google. We do not give the ad SDK your Pocket Cube email, device credential or saved moves. See Google's SDK data disclosure and privacy policy. Native ad privacy choices are available in Settings; where consent is required, ad requests wait for that choice. iOS asks separately before tracking. Declining tracking does not prevent play.

Native builds keep account credentials and pending transactions in encrypted, device-bound storage instead of browser local storage. Device settings control Google or Apple advertising identifiers and permissions. Account deletion removes our account records; it does not change separate Google privacy choices or data held by Google.

Who processes it

The operator can access data for running the test, support and security. Amazon Web Services hosts the game and its restricted backups in the United States. Google handles sign-in when you choose it, under Google’s privacy policy. Support email is forwarded by Porkbun to the operator’s Google-hosted inbox. We may also disclose information when legally required or necessary to protect the service and people using it.

For EU/UK personal data covered by AWS’s processing terms, AWS provides contractual transfer safeguards, including standard contractual clauses where applicable. AWS describes those safeguards here. Contact us for information about processing or international transfers.

Where data-protection law requires a legal basis, we rely on our legitimate interests in operating this voluntary private test, saving the progress you request, responding to you and securing accounts. We do not use these interests to justify advertising or unrelated uses. Where native ad processing requires consent, we request it through the privacy prompt. You can revisit those choices in Settings.

Download or delete your account

In Settings, choose Download account data for a copy, or Delete account and confirm. Deletion makes that account unavailable on every device and normally finishes within a few minutes. If the connection fails, return to Settings to check its status; a failed connection does not cancel the request.

We remove the account’s active identity/email, play and mock-economy records. A different account keeps completed levels it already received through an explicit progress combination, without retaining the deleted account’s move history. This browser removes the deleted account’s saved journals while keeping other saved accounts. Other devices remove their local copies when they reconnect and learn of the deletion.

We retain a small security record: the random deleted account identifier, deletion timestamps and hashes that prevent old device credentials or reserved sign-in secrets from being reused. These records persist while the service or its recoverable copies exist. They contain no email, Google identifier or move history, but they are still security-related personal data.

Restricted backups can contain older data until rotation. Backup snapshots use a seven-day retention setting; temporary recovery copies are kept out of ordinary use. Before a copy is restored for play, deletion records are reapplied so an erased account cannot return. Downloaded exports that you save are under your control.

There is no automatic inactivity expiry for active accounts during this private test. Unfinished sign-in proofs expire after ten minutes and their email claims are cleared by maintenance. Mock coin and purchase records can be deleted with the account. This test does not create real financial records; real payments would need a separate retention policy before being enabled. Contact us if a download is too large, deletion stays pending, or you cannot access the account.

Your choices and rights

You may contact us to request access, correction, deletion or a portable copy, to object to processing, or to ask that it be restricted. Available rights and exceptions depend on applicable law. We may need to verify ownership proportionately; never send us your password or device credential. We aim to respond promptly and within the applicable deadline, normally one month for EU/UK requests. You may also complain to your local data-protection authority.

If you believe a child has provided information, contact us so we can address it. We will review this notice before introducing children’s support, live advertising, real payments or a broader launch. Material changes will be brought to testers’ attention.