Privacy policy

Data we use and why

• Local game data. Settings, tutorial progress, guest play history, collections and unfinished Quest/Zen runs are stored on your device. Account-specific caches may also be stored there. Local saves are not a cloud backup and may be lost when you clear storage or uninstall.
• Account information. If you sign up, our authentication provider, Supabase, processes your email, authentication credentials and account identifier for sign-in, verification and recovery. If you choose Google sign-in on the web, Google and Supabase process the authorization and basic profile information you approve. We do not receive your Google password.
• Profiles and online play. We use your chosen display name, username, account ID, friend relationships, invitations, online presence, scores, game results and collection progress to provide social play, rankings and progression. Gameplay submissions can include the actions, timing and words needed to validate results and prevent cheating.
• Player safety. Where available, blocking stores the relationship between accounts. Reports contain the reporting and reported account identifiers, report category and optional details, and are reviewed privately by the operator to address inappropriate names, harassment and suspected cheating.
• iPhone purchase verification. For paid online access, Apple’s signed app-transaction proof is sent over HTTPS to our server for verification. We store hashed transaction/proof identifiers, account linkage and verification status/timestamps. We do not store the raw signed proof or your Apple Account password. Apple processes App Store payments; we do not receive your full payment-card details.
• Requests and support. Online requests expose technical information such as your IP address to the hosting providers. They may process request, diagnostic and security logs to operate and protect the services. If you email support, we receive your email address, message and any attachments you choose to send, and use them to handle your request.

LetterMatrix uses local storage for game settings, saves and sign-in sessions. The game has no advertising SDK or cross-app advertising tracking and does not request your location, camera, microphone or contacts.

Who can see the data

Other players can see your chosen public name, username and published game results. Friends and opponents may see presence and match information needed for online play. Your account email and private player reports are not shown in public profiles or leaderboards.

We use Supabase for authentication and game databases, Railway for the game server, and Vercel for the website. These providers process information needed to deliver and secure their services. Apple processes iPhone purchases, and Google processes Google sign-in when you choose it. Their services may process data in countries other than your own.

We may disclose information when required by law or when necessary to investigate abuse, protect accounts or defend legal rights.

Provider information: Supabase, Railway, Vercel, Apple and Google.

Retention and deletion

Local data stays on your device until you clear it or the operating system removes it. Account and associated cloud game data are retained while you use the account, unless removed earlier or deleted at your request. We retain support correspondence for as long as needed to resolve the request and handle related security or legal obligations.

Account deletion removes sign-in, profile, friendships, account-linked cloud scores and collection data. Where player safety controls are available, associated blocks and reports are removed when either account is deleted. Shared guest history and offline copies on other devices can remain until you clear storage on those devices.

A minimal detached hashed purchase transaction record remains after account deletion for ownership recovery and prevention of replayed purchase claims. This record is retained for as long as those verification purposes require it and is no longer linked to the deleted LetterMatrix account.

Provider logs and backups follow the providers’ retention settings and may outlast deletion from the active game database until they expire or rotate out. We do not promise immediate erasure from every backup. Information may also be retained when necessary to meet legal obligations or resolve a security incident.

Your choices and requests

You can play local Quest and Zen without creating an account. Sign out to stop using signed-in features, and clear app or website storage to remove local records. Deleting local storage does not itself delete an online account.

In versions offering it, use Profile → Delete account and the typed confirmation to request deletion in the app. You can also request deletion by emailing us from the account email, including if that control is unavailable or fails. Deleting your game account does not cancel an Apple purchase or request a refund.

Depending on your location, you may have rights to access, correct, delete, export or restrict the use of your personal information, object to certain processing, or withdraw consent where processing relies on consent. Email us to make a request. We may verify account ownership before disclosing or changing information. You may also contact your local data protection authority.

If you believe a child has provided personal information that should be removed, contact us. Do not include passwords, sign-in links or signed purchase proofs in any request.