In short: you can play without an account, and the app has no ads or trackers. We only learn your email if you sign in or write to us yourself. Any data can be deleted — in the app, on the website or by emailing lialex2016@gmail.com.
Who processes your data
The data controller is A. V. Litvinenko, a self-employed individual (Russian professional income tax regime), the author and rights holder of the Xiaolong Sudoku app and the xiaolong.app website.
Contact for data questions: lialex2016@gmail.com.
This policy covers the Xiaolong Sudoku mobile app (iOS, Android) and the xiaolong.app website. It follows Russian Federal Law No. 152-FZ “On Personal Data”.
What the app collects
Without an account. Games, settings and progress stay on your device. Our server receives technical installation data: a random installation ID, platform, language, time zone, app version and — if you allowed notifications — a push token. None of it identifies you.
With an account (optional sign-in with an email code) we also store:
- your email address;
- progress and settings for syncing between devices: games, results, learned characters;
- sign-in sessions: device, IP address and browser or app version, sign-in time — to protect your account;
- one-time sign-in codes — only as a hash and for no more than 10 minutes.
Crash reports. If the app crashes, an error report is sent (Sentry) without your name, email or IP address.
The app shows no ads, does not use the device advertising ID and shares no data with ad networks.
What the website collects
- Support form: name (optional), email, message, device and app version, IP address — to reply and to fight spam.
- Account deletion request: email, comment, IP address.
- Playing on the site: your unfinished game, chosen level and theme are kept only in your browser (localStorage) and are never sent to the server.
- Cookies and analytics — see below.
Why, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Signing in and syncing progress | email, progress, sessions | performance of the terms of use |
| Notifications (if enabled) | push token, language, time zone | consent (system permission) |
| Replying to requests and deleting accounts | email, name, message, IP | consent given in the form |
| Fixing bugs | anonymous crash reports | legitimate interest in a working app |
| Website traffic statistics | cookies, browser data | consent (cookie banner) |
| Abuse prevention | IP address, security event log | legitimate interest |
Cookies and Yandex Metrica
Necessary — the site can’t work without them: your language (lang cookie) and cookie choice (consent), plus theme and game in localStorage.
Analytics — Yandex Metrica (Yandex LLC): anonymous visit statistics, _ym* cookies. If you decline analytics cookies, Session Replay and click maps are turned off.
Marketing cookies are not used at the moment.
You can change your choice any time via “Cookie settings” at the bottom of every page.
Who we share data with
We never sell data or share it for advertising. We use services that process data on our behalf and only for the purposes above:
- a hosting provider — the server running the website and API;
- an email service — sending sign-in codes and replies;
- Google Firebase Cloud Messaging, Apple Push Notification service, RuStore Push — delivering notifications if you allowed them;
- Sentry (Functional Software, Inc.) — crash reports without personal data;
- Yandex LLC — Yandex Metrica on the website.
Google’s and Apple’s notification services and Sentry are located outside Russia, so using them may involve cross-border transfer of technical data (a push token, an anonymous crash report).
Data may be disclosed to authorities only where the law expressly requires it.
How long we keep it
- account, email and progress — until you delete the account;
- sign-in sessions — until you sign out, and no longer than 30 days without use;
- sign-in codes — 10 minutes;
- support messages and requests — until answered, plus no more than one year;
- crash reports — up to 90 days;
- after account deletion only a record that an account was deleted remains — without your email or anything that identifies you.
Your rights
You can find out what data we hold about you, correct it, withdraw consent and ask for deletion:
- delete your account in the app: Settings → Account → Delete;
- or on the account deletion page — by request;
- or write to lialex2016@gmail.com — we reply within 10 business days.
If you believe your rights are being violated, you can contact Roskomnadzor, the Russian data protection authority.
How data is protected
Connections to the server are encrypted (HTTPS). Sign-in codes and refresh tokens are stored only as hashes, and database access is limited by separate roles. Suspicious sign-ins and code guessing are blocked.
Children
Anyone can play — the app doesn’t ask you to tell it anything about yourself. An account is optional; if a child under 14 needs one, a parent should create it.
Changes to this policy
If the policy changes, the new version will appear on this page with a new date. We’ll mention significant changes in the app.