Privacy Policy
This describes what Valeon collects, why it collects it, who can see it, and how to get rid of it. It is written to be accurate rather than reassuring — every field listed below is a field that genuinely exists in our database.
The short version
- You can play the entire game without an account. No sign-up wall, no email required.
- There are no advertising or analytics SDKs in Valeon. No ad ID, no tracking, no third-party trackers.
- We never sell or share your data for advertising or any other cross-context purpose.
- Signing in is only ever about your scores — so they survive a lost or replaced phone.
- Only your display name and your scores are public. Your email address never is.
- You can delete everything from inside the app, permanently, without emailing anyone.
01Who we are
Valeon is an independent game. In this policy, “Valeon”, “we” and “us” mean the developer and operator of the Valeon mobile game and the website at valeongame.com. For data-protection purposes we are the controller of the data described here.
Questions, requests and complaints: [email protected]. We aim to answer within 30 days, which is the deadline the GDPR and the CCPA both set.
02What we collect
Valeon's leaderboards are the only reason any data leaves your device. The game itself keeps your progress on the phone — the phone is the record, and the server holds a published copy.
If you never sign in
On first play the app generates a random identifier on your device. It is not derived from your hardware, your phone number, your advertising ID or anything else about you — it is a fresh random value, and it exists so that your scores can be attributed to somebody on a leaderboard.
| Data | What it is | Why |
|---|---|---|
device_id |
A random identifier generated by the app on your device | Attributes scores to one install without knowing who you are |
name |
A display name — Player until you sign in or change it |
Labels your row on a public board |
| Progress | Per level: best score, fewest moves, best time, stars earned | The leaderboards themselves |
| Totals | Lifetime shards shattered, ice broken, levels completed, and a shatter count per shard family | Career statistics and the community totals shown on the site |
| Timestamps | When your record was created and last updated | Breaks ties on a board — first to a score ranks higher |
If you do sign in
Signing in attaches the anonymous record above to an account, so it survives a new phone. We receive from your chosen provider, and store, only the following:
| Data | What it is | Why |
|---|---|---|
provider_user_id |
The stable account identifier the provider issues for you, specific to Valeon | Recognises you on your next sign-in. It is the only thing providers guarantee will not change. |
name |
The display name the provider returns, trimmed to 24 characters | So your leaderboard row is not a number |
email |
Your email address, stored only if the provider states it is verified | Account recovery and, if it ever becomes necessary, contacting you about your account |
We ask each provider for the narrowest set of permissions that can identify you — your name and email, and nothing else. We never receive your password. We have no access to your posts, friends, contacts, photos, files, calendar, servers, pages or any other content in your provider account, and we cannot post anything as you.
Technical data
Our servers are operated by Cloudflare. Like any web service, requests to them carry an IP address and a user-agent string, which Cloudflare processes to route traffic and to block abuse. We do not build profiles from this, do not join it to your player record, and do not retain our own copy of it beyond short-lived operational logs.
03Signing in, provider by provider
Valeon uses a broker design: your device never talks to a sign-in provider directly, and no provider SDK is built into the app. The app opens your system browser at our own server, our server is the OAuth client, and the result comes back to the app as a single-use code redeemed over an encrypted connection. One practical consequence is that no provider receives any information from inside the game, and none of them can observe your play.
| Provider | What we request | What we store |
|---|---|---|
openid, email, profile |
Your Google account's subject ID, your name, your verified email | |
| Apple | name, email |
Your Apple subject ID, your name, your email or Hide My Email relay address |
public_profile, email |
Your Facebook app-scoped ID, your name, your email if you grant it | |
| Discord | identify, email |
Your Discord user ID, your display name, your verified email |
Google — Limited Use
Valeon's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: we use Google user data only to create and operate your Valeon player account; we do not transfer it except as required to provide the game, comply with law, or in a merger where it remains subject to this policy; we do not use it for advertising of any kind; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with law, or where the data is aggregated and anonymised. You can review and revoke Valeon's access at any time at myaccount.google.com/permissions.
Apple — Sign in with Apple and Hide My Email
If you use Hide My Email, Apple gives us a private relay address instead of your real one. We treat it as your address and never attempt to resolve it to anything else. Apple also returns your name exactly once, on your very first authorization; if you decline to share it, your account is simply labelled with a generic player name until you change it. You can review or stop using Sign in with Apple at any time in Settings → your name → Sign-In & Security → Sign in with Apple.
Facebook issues Valeon an app-scoped ID — an identifier unique to Valeon that cannot be used to identify you on any other service. Email is a permission you may decline, and declining it does not prevent you from playing or from appearing on a leaderboard. You can remove Valeon at any time under Settings & Privacy → Settings → Apps and Websites. See also our data deletion instructions.
Discord
The identify scope returns your user ID and display name; it does not
grant access to your messages, servers or connections. You can revoke Valeon under
User Settings → Authorized Apps.
04What we deliberately do not collect
This list is a design commitment, not an oversight:
- No advertising. Valeon contains no ad network and no advertising identifier (no IDFA, no Android Advertising ID).
- No analytics or attribution SDKs. No third-party analytics, crash-reporting or attribution library is linked into the game.
- No tracking. We do not track you across other apps or websites, and therefore do not need to ask you to.
- No location data of any kind, precise or coarse.
- No contacts, photos, microphone, camera or health data. The app does not request these permissions.
- No passwords. Valeon has no password of its own and never sees your provider's.
- No payment details. Should Valeon ever sell anything, it is Apple and Google who process the payment; we would not receive your card details.
- No purchased or brokered data. We do not buy, rent or enrich player data from anyone.
05What is public
The leaderboards are public — on the website and in the game — and they show your display name and your scores. That is the whole of it.
Your email address is never published, never shown to other players, and never appears in any API response we serve. Neither is your device identifier. If you would rather not be identifiable on a public board, change your display name to something that is not your real name — nothing in the game requires it to be.
06Why we process it, and on what legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR) |
|---|---|---|
| Running the leaderboards and your career statistics | Player ID, display name, scores, totals | Contract — it is the service you asked for |
| Letting you sign in and recover your progress on a new device | Provider ID, name, email | Contract |
| Keeping the service up and preventing abuse or fraudulent scores | Request metadata, timestamps | Legitimate interests — a leaderboard nobody can cheat is the point of a leaderboard |
| Answering a support or privacy request | Whatever you send us, plus your account record | Legal obligation and legitimate interests |
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
08How long we keep it
| Data | Kept for |
|---|---|
| Your account and scores | Until you delete them — a leaderboard record is meant to stand |
| An in-progress sign-in | 10 minutes, then deleted automatically |
| The one-time code from a completed sign-in | 2 minutes, single use, stored only as a hash |
| Your session token | 1 hour; expiry is how it is revoked |
| The token that renews your session | 90 days, replaced each time it is used, stored only as a hash |
| Operational server logs | Short-lived, per Cloudflare's platform defaults |
09Your rights
Depending on where you live, you have some or all of the following rights. We honour all of them for every player, wherever they are, because operating two standards would be worse than operating the stricter one.
- Access — a copy of what we hold about you.
- Correction — your display name is editable in the app; write to us for anything else.
- Deletion — see below; it is a button in the app.
- Portability — your data in a machine-readable form.
- Objection and restriction — to processing based on legitimate interests.
- Withdrawing consent — revoke Valeon's access at your provider at any time.
- Non-discrimination — exercising any of these never degrades the game for you.
Write to [email protected] to exercise any of these. If you are in the UK or EU and think we have got it wrong, you may also complain to your national supervisory authority — in the UK, the Information Commissioner's Office.
10Deleting your data
Deletion is permanent and immediate. It removes your player record, every level score, your lifetime totals, your per-family statistics, your linked sign-in accounts and any active sessions. Your name disappears from every public leaderboard. None of it is recoverable, by us or by you.
From inside the game — the fastest route
This works whether or not you ever signed in, and needs no email to anyone.
- Open Valeon.
- Open the account panel from the main menu — tap your name if you are signed in, or SIGN IN if you are not.
- Tap DELETE ACCOUNT (signed in) or DELETE MY DATA (signed out), then tap again to confirm.
The progress saved locally on your own phone is deliberately left alone — you asked to leave the leaderboard, not to lose your game. Deleting the app removes that local copy.
If you were playing without an account, your device is also issued a brand new random identifier at the same moment. The one we held is discarded with everything else, so the record your next game creates cannot be connected to the one you just deleted.
By email
You can always write to [email protected] instead — from the address associated with your account, or telling us the display name you play under. We will confirm within 30 days.
Deleting your Valeon account removes your data from Valeon, but your provider will still list Valeon among the apps you have used until you remove it there: Google · Apple, under Settings → your name → Sign-In & Security · Facebook, under Settings & Privacy → Settings → Apps and Websites · Discord, under User Settings → Authorized Apps.
11Children
Valeon is not directed to children under 13 (or under 16 where local law sets that threshold), and we do not knowingly collect personal information from them. The game is fully playable without an account, which means a child can play it without any personal information being collected at all.
If you believe a child has signed in and provided us with personal information, write to [email protected] and we will delete the account promptly.
12Security
- All traffic between the game, the website and our servers is encrypted in transit with TLS.
- No sign-in secret is ever built into the app. Our server is the OAuth client, so there is nothing in the binary to extract.
- Session and renewal tokens are stored hashed, so a database disclosure would not hand anyone a working session.
- Renewal tokens rotate on every use, which turns a stolen one into a visible failure rather than a silent compromise.
- The single-use code that completes a sign-in expires in two minutes and cannot be replayed.
No system is perfectly secure, and we will not pretend otherwise. If you find a vulnerability, please tell us at [email protected] — we would much rather hear it from you.
13International transfers
Our infrastructure runs on Cloudflare's global network, so your data may be processed outside your own country, including in the United States. Where data leaves the UK or the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses and the UK Addendum, which Cloudflare incorporates into its data processing agreement.
14Changes to this policy
If we change this policy we will update the “last updated” date above. If a change materially affects what we collect or what we do with it, we will say so in the app before it takes effect — a quietly rewritten privacy policy is not a policy.
Questions about any of this: [email protected].