Privacy policy

Your game account

You can begin with a guest game account. The game creates a random device credential and a game account identifier so the service can recognize your account and keep your progress. A guest account is still an account; it is not anonymous to the game service.

If you choose the sign-in option available on your device, Google or Apple provides an identity credential. We verify it and associate the provider's account identifier with your game account. Our account database does not use your Google or Apple email address or display name to identify you. The provider handles its own sign-in process under its privacy policy.

The service also keeps account creation and activity times, your game's time zone, session information and app version. We use these to operate your account, coordinate rewards and keep incompatible app versions from causing problems.

Progress, purchases and technical information

The service processes the information needed to run the game and confirm its results:

• Gameplay: the board and pieces you submit, attempts and results, cleared levels, stars, lives, Pigment balance, boosters, owned avatars, reward claims and challenge participation. The server checks submitted runs and maintains the account's progress and balances.
• Purchases: the store, product, transaction reference, purchase status and delivery or refund records. We send purchase credentials and an account-related alias to the relevant store verification service. Google Play or Apple handles payment details; the game service does not receive your full payment card number.
• Service diagnostics: IP address, request identifiers, requested service route, response status, request timing and error information. Some service logs include your game account identifier. These records help diagnose failures and protect accounts and purchases.
• Support: your email address, messages and any details or screenshots you choose to send. The game's Copy support details feature prepares a limited report for you to review and send; it does not submit that report automatically.

Information kept on your device

Your local save contains progress and balance copies, owned items, preferences, unfinished boards, pending requests, and credentials used to sign in to the game service. Do not share a save file: it can contain access credentials.

Accessibility, sound and haptic preferences remain on your device after account deletion. The game clears local account credentials, progress and pending account requests after deletion is confirmed. If device cleanup is interrupted, the game asks you to retry it.

Why we use information

We use account and gameplay information to provide the game you request, save progress, deliver purchases and rewards, and respond to support requests. We use verification and diagnostic information to prevent duplicate purchase claims, investigate errors, protect the service and apply the game's rules.

Where a legal basis is required, providing requested game services and purchases relies on performing our agreement with you; security, fraud prevention and service maintenance rely on our legitimate interests, subject to your rights. Information needed for an applicable legal obligation is processed on that basis. Where consent is legally required for an optional feature, that feature requires your consent.

Other services that process information

Google and Apple process information when you use their sign-in or store services. Optional Google Play Games features can share verified achievement milestones with your Play Games profile when you choose to sync them. Your platform profile and its visibility are controlled through the platform's settings.

Cloudflare Pages provides this website's hosting. Google Workspace hosts our working support inbox and processes support email addresses, messages and attachments on our behalf. Google's data-processing terms are at https://cloud.google.com/terms/data-processing-addendum/. Spaceship provides the game backend's virtual private server in the United States, where account, gameplay, purchase-verification and operational records are processed. Spaceship's data-processing terms are at https://www.spaceship.com/legal/data-processing-addendum/.

Google Cloud Storage holds encrypted database backups and deletion-recovery records in the us-central1 region in the United States. Google Cloud Secret Manager separately holds recovery-key material in the same region. These services support backup expiry and honoring completed deletions after a restore.

Our providers may process information outside your country. Spaceship's data-processing addendum includes standard contractual clauses for applicable international transfers. Other providers' processing and transfer arrangements follow their applicable terms and the services we use. The hosting locations described above do not mean that every provider support, network or residual copy is processed only in those locations.

We may disclose information when required by applicable law or when necessary to protect people, investigate misuse or establish legal claims. These purposes do not permit unrelated marketing uses.

Ads and game measurement

The current game implementation measures sessions, active puzzle time, level starts and results, and purchase starts and completions through our own game service. These observations are linked to your game account. They help us understand progression, reliability and whether optional rewards improve the game. This measurement remains active when rewarded ads are disabled; choosing not to watch an ad does not turn it off.

Releases with expanded game analytics ask a separate optional choice before recording detailed level-solving time, guide use, control presses and navigation. You can play without this measurement and change the choice in Settings, then Privacy & data, then Game analytics choices. These observations are linked to your game account. When the reporting integration is enabled, approved records are sent by our game service to our dedicated PostHog project in the United States. They exclude your email, sign-in credentials, purchase receipts, free-form messages, raw puzzle boards and touch recordings. PostHog's privacy information is at https://posthog.com/privacy/.

Earlier direct Google AdMob releases: From level 10, automatic ads may appear after three wins or two consecutive failures, including in your first session. Reward videos are optional. Lessons and boss victories remain protected. Automatic ads have no per-session cap and are limited to 24 per UTC day.

When that integration is included and used, Google can process IP address, device or account identifiers, ad interactions and diagnostic information for ad delivery, measurement and fraud prevention. The exact information depends on the platform, SDK configuration and privacy choices. Google's information is at https://policies.google.com/privacy/. Required privacy prompts must be configured and verified before ads are enabled; the game's Privacy choices control opens the provider's options when available.

Our own service also records offered and requested ads, loading and viewing outcomes, reward verification, and any reported impression value and currency. A game-account identifier and reward ticket are used to match Google's signed reward callback to the promised reward. Client reports alone cannot award a reward. Analytics contains a fixed set of fields, not your messages, passwords, sign-in tokens or unrestricted diagnostic text.

Optional LevelPlay flow: only releases that include and enable this integration may mediate ironSource, Unity Ads, Google AdMob, Meta Audience Network, Mintegral and Liftoff Monetize. Android also includes Ad Quality. These services may process account and device identifiers, IP addresses, ad interactions, value observations and diagnostic data for delivery, measurement, ad quality and fraud prevention, subject to privacy choices. This description does not mean that the new flow or every listed network is active in your release.

LevelPlay is gated by an explicit '18 or older' choice and Google's User Messaging Platform (UMP) privacy flow. An unknown age or a younger choice does not enable LevelPlay; direct AdMob may remain available under its separate policy. Age eligibility, ad privacy choices and gameplay personalization are separate. iOS tracking respects Apple's permission state.

In the new campaign flow, automatic ads may appear only after you tap Retry following 2 failed attempts or Next level following 3 completions, counted since the last shown automatic ad. Failures need not be consecutive. Early levels, lessons and boss results are included. Remove Ads, consent, availability and daily limits still apply. This differs from the earlier direct-AdMob flow described above.

Reward videos remain opt-in. For LevelPlay, a signed server-to-server completion identifies the initialized game account and a unique event. Our service verifies and deduplicates it, records 1 generic credit, then atomically redeems that credit against an eligible server-issued intent for a life, Pigment, extra time or an Endless checkpoint retry. The signature does not bind the completion to a particular ticket, auction or ad price. SDK playback, earned and paid callbacks alone cannot grant rewards.

If gameplay personalization and loaded-value selection are enabled in Endless Mix, the service may use play history and a fresh value for the currently cached rewarded ad to choose a future hand. Initially, only a positive USD value reported as an exact Unity Ads BID qualifies. Google, Meta, Mintegral, Liftoff and other unsupported, estimated, missing or stale prices leave price-based difficulty at its baseline. A change is limited to one difficulty tier and requires a legal-placement check. Already displayed pieces stay fixed. Turning personalization off uses standard deals. Loaded quote and paid-value observations remain distinct from authenticated reward credits.

Website hosting

We have not enabled optional Cloudflare Web Analytics or added other analytics scripts, advertising trackers or a newsletter signup. Hosting still involves processing website traffic.

The website reads your browser's preferred language and stores your chosen language on your device using local storage so that links can open in that language. This preference is not sent to an analytics service. You can change it with the language menu or remove it by clearing this site's browser data. Translated text and fonts are served with the website; no translation service receives your visit.

When you visit, Cloudflare processes request information that can include your IP address, traffic routing and system configuration details to deliver and protect the site. It also produces operational statistics such as request volumes and error rates. Cloudflare explains its handling of this information at https://www.cloudflare.com/privacypolicy/.

Cloudflare's hosting request data follows its applicable service terms and retention criteria; we have not established a fixed expiry for this website's hosting records. The game-server log period below does not apply to Cloudflare's records. Opening an external store or support link is subject to that service's own practices.

Retention and account deletion

Account and gameplay records are kept to provide your game account until you delete it; there is no automatic deletion for inactivity. Deleting the app or signing out does not delete the server account. See https://pigmentrun.com/delete-account/ for the game's deletion instructions and the support email route, which can receive requests without requiring you to reinstall the game.

A completed account deletion removes the active account, its sign-in links and sessions, gameplay records, progress, balances, owned items and account-linked purchase records. Limited records remain for the specific purposes below.

• Deletion confirmation: a hashed credential reference, request identifier and deletion timestamps allow an interrupted in-app request to be confirmed for 30 days. For an operator-verified support request, a separate case confirmation keeps the case identifier, a keyed account marker, verification-method code, database role and timestamps for 30 days. These confirmation records contain no raw sign-in credential, provider identity or copied ownership evidence and are removed by scheduled cleanup after expiry.
• Sessions: server session records expire after 90 days without the activity that renews them, and expired records are removed by scheduled cleanup. Temporary Apple sign-in challenges expire after five minutes.
• Game measurement: analytics sessions and their events are removed by scheduled, bounded cleanup once the session has had no activity for 90 days, or with account deletion. This is measured from the session's last activity, not a maximum of 90 days from each event. Account-level cohort assignments and verified ad reward records remain with the account until it is deleted, because they also maintain reward history and prevent repeated grants. The deployed housekeeping service runs the bounded cleanup; outages can delay physical removal.
• Optional expanded analytics in our service: unsent observations expire from the device after seven days. Linked observations expire from our reporting database 90 days after receipt; linked verified reporting facts expire 90 days after verification. Turning optional analytics off stops new detailed collection and clears its device queue and first-party observations. Account deletion also removes these linked records. Verified progress, attempts and purchase evidence retain their separate service purpose and schedule.
• PostHog reporting copy, when enabled: PostHog Cloud's current events query window is one year on Free and seven years on paid plans. These windows limit what reports can query; they do not guarantee physical deletion at that time. The reporting copy follows PostHog's applicable storage and deletion terms, described at https://posthog.com/docs/data/events-retention and https://posthog.com/docs/privacy/data-storage#data-deletion. Turning optional analytics off or deleting your game account requests deletion of the linked reporting identity and events. Remote deletion is asynchronous and retried until verified; an outage can delay completion. Re-enabling uses a new reporting identity. Export remains off until the matching disclosures and remote-erasure process have been verified.
• Purchase security: hashed purchase references, store, product, original purchase time and refund status remain without the game account link or usable purchase credential to prevent the same purchase being claimed again. They have no fixed expiry while the store can present the historical transaction again. Their necessity is reviewed at least annually and when store verification rules change; records are removed when replay protection is no longer needed.
• Apple authorization: if you used Sign in with Apple, an encrypted credential may remain solely to complete revocation with Apple. Confirmation from Apple removes the active revocation job; a provider outage can delay this step. An encrypted recovery copy can remain in the deletion journal described below.
• Deletion recovery: an encrypted journal records a keyed account marker, deletion time, minimal purchase security records and any encrypted Apple revocation obligation. This lets us honor deletions when restoring an older backup. We use a verified rotation procedure to retire account-marker evidence and completed-revocation residuals within 30 days. A fresh recovery baseline must preserve completed deletions and purchase protections before old evidence is removed; older snapshots are refused for return to service. Rotation and erasure require an operator and are not a blind automatic age-deletion rule. Unresolved provider obligations are investigated and retained until completed, and purchase security records follow their separate retention rule.
• Managed game-service logs and backups: operational logs are limited to 30 days and encrypted database backups to 14 days from the snapshot through scheduled cleanup. Optional Spaceship VPS backups and snapshots are disabled. Account deletion does not instantly rewrite archives; restoration must preserve completed deletions before service resumes. Cleanup failures require investigation, and an outage can delay physical erasure.
• Support: active support records and copies we control are retained for 12 months after a support conversation closes. Additional evidence gathered to verify an account request is removed from those records within 30 days after that request is resolved. A minimal request/outcome record may remain for 12 months to document the response. We manage these deadlines through a manual case-review procedure; this is not an automated Gmail purge. Provider recovery and residual copies can remain longer: Google's data-processing terms allow up to 180 days to remove customer-deleted data from its systems after it can no longer be recovered by the customer, subject to applicable legal requirements.
• Exceptions: specific records may be kept longer for an applicable legal obligation or an unresolved dispute. Access is limited to that purpose, and the information is removed when the reason ends. Scheduled deletion can be delayed during an outage; expired credentials are still rejected.

Your choices and privacy rights

You can choose whether to link a provider account and whether to use optional platform features available in your release. Pigment Run includes in-app account deletion; you can also contact support with an account or privacy request. Deleting Pigment Run data does not delete your Google account, Apple Account or platform profile.

Depending on the law that applies to you, you may have rights to access, correct, delete or receive a portable copy of personal information, restrict or object to certain processing, and withdraw consent where processing relies on it. Withdrawal does not affect processing already carried out lawfully. You may also complain to your local data protection authority. Where applicable, you may use an authorized agent or appeal a refused request. We do not penalize you for exercising these rights.

Send requests to [email protected]. We may need proportionate information to verify that the request concerns your account. Never send a password, sign-in token, device secret, purchase token or complete save file. If we must retain particular information or cannot complete a request, we will explain the applicable reason.

Age and family use

Pigment Run is intended for players aged 13 and over. If you are under 18, use the game with a parent or legal guardian's permission. Where local law requires a higher age or verified parental consent for a feature, that requirement applies; do not use that feature until it is met.

The game is not intended for children under 13. We do not claim to verify a player's date of birth or to have a parental-consent system in the current build. If we learn that an ineligible child has provided personal information, we will investigate and remove it unless a specific legal obligation requires retention.

If you are a parent or guardian with a question about a child's information, use the contact details on this page. The store's age rating describes the game's content and does not by itself establish eligibility to use an account or make purchases.

Changes and contact

We will update this page when our information practices change. Material changes will be explained through an appropriate notice, and any consent required by law will be requested before the relevant new processing begins.

The operator and data controller is Dalal (Dalal.io). Privacy contact: [email protected]. Mailing address for correspondence: Dalal.io / Pigment Run, 9901 Brodie Lane, Suite 160 PMB841, Austin, TX 78748, United States.