Figureout Privacy Policy
This policy applies to the Figureout iPhone and iPad app and its multiplayer service. It describes the information we process, why it is needed, who receives it, and your choices.
Who is responsible
Ashish Debnath / AXPO Creations operates Figureout. For privacy questions or requests, contact aaxpocreation@gmail.com.
Account and sign-in information
We store a Figureout user ID, a display name, your Apple or Google provider-specific account identifier, your chosen difficulty, and account/session timestamps. Apple and Google verify your identity; Figureout does not receive your Apple or Google password.
Apple authorization credentials needed to revoke access are encrypted on the server. Figureout sessions are stored securely in the device Keychain; the server stores session-token hashes. Google’s SDK also manages its sign-in credentials on your device.
A sign-in provider may include an email address or profile information in its identity response. The current Figureout database does not store a profile email or photo. If you email support, we receive your email address and the information you send. Your display name is visible to other players, so avoid using sensitive personal information.
Gameplay, safety and device information
- Rooms and membership, drawings as stroke coordinates, guesses, chat messages, reactions, turn timing, scores and results are processed on our server to run the match. Other participants can see shared game content, but not your sign-in credentials or private prompt choices.
- A bounded recent-prompt history is linked to your account to reduce repeated words. Difficulty is stored with your account. Sound preferences are stored locally using UserDefaults.
- If you report a player, we store the reporter/target account IDs, reason, optional details, relevant recent messages and the reported player’s current drawing when available. Reports are visible to authorized operators, not other players. We store blocks and temporary multiplayer restrictions to enforce safety actions.
- Google Cloud may process IP addresses, request metadata, timestamps and operational/security logs when serving traffic. The application hashes IP addresses for short-lived abuse rate limits and avoids logging authorization headers, request bodies and drawing/chat content as routine request logs.
Why we use information
We use necessary account and gameplay data to authenticate you, connect players, synchronize a match, award points, save preferences and avoid recent prompts. Safety and technical information helps us prevent abuse, investigate reports, support users and keep the service reliable. We do not sell personal information or use gameplay drawings to train AI models.
Where a legal basis is required, we rely on providing the service you request, legitimate interests in security and fair play where permitted, and applicable legal duties. Optional support content is provided by you. You can stop playing, sign out or delete your account. We do not seek blanket permission for unrelated uses.
Service providers and sharing
Google Cloud hosts the API and PostgreSQL database in the configured Mumbai region (asia-south1). Apple provides Sign in with Apple; Google provides Google Sign-In. Their services, infrastructure and support systems can process information in other countries. Providers have their own privacy terms and we use them to supply the service, not to sell your information.
Information may be disclosed when necessary to comply with a valid legal obligation, protect users and rights, or investigate misuse. Authorized support/moderation personnel have access only for those duties. Anyone in a room can copy or screenshot visible content; do not post information you want to keep private.
No ads, tracking or sensitive device permissions
This release does not integrate advertising, cross-app tracking, a separate product-analytics service, in-app purchases or subscriptions. Figureout does not request your contacts, precise location, microphone, camera, photo library or health data. Drawing input comes from touch or Apple Pencil, not a camera.
The bundled Google Sign-In SDK has its own privacy disclosures covering name, email, phone number, user/device identifiers, approximate location, other data and usage data for functionality and some analytics purposes. Which fields are processed depends on the sign-in flow and provider configuration; Figureout requests no extra Google scopes beyond basic sign-in and does not save phone numbers in its account database. Google states that it may use IP addresses to estimate general location for fraud prevention. SDK processing is distinct from Figureout’s own stored gameplay data.
Retention and deletion
Account data and recent-prompt history remain until you delete your account. Sessions expire after 30 days; sign-in challenges expire after five minutes. The service cleans expired records during scheduled in-process cleanup. Inactive room records are eligible for removal after 24 hours without updates; abandoned rooms may be removed sooner. These are cleanup targets, not a guarantee of deletion at an exact second while the service is stopped.
Safety reports are eligible for removal after 90 days. Blocks remain until you unblock a player or an involved account is deleted. Account deletion removes profile, sessions, prompt history, blocks and room identity, clears room chat and the account’s current drawing, and erases identifying evidence from reports involving that account. A non-identifying report record may remain until its retention period ends.
The current Cloud SQL configuration retains seven automated backups (a count, not a guaranteed seven-day deadline) and seven days of recovery transaction logs. The default operational-log bucket retains logs for 30 days. Google Cloud’s required administrative/audit log bucket has a longer provider-defined retention period; it is not used as game history. These backups and logs are not available as normal game data and can outlive deletion from the active database. Retention may be extended where a specific legal obligation requires it. Contact us for a data request. Uninstalling the app does not remove server data.
Your choices and rights
Use the top-right account menu → Delete account from the home lobby for in-app deletion. Sign out only ends that device session. Removing the app or revoking a provider connection alone does not delete Figureout’s account records.
Depending on your location, you may have rights to access, correct, delete, restrict or object to certain processing, receive a copy of your data, or complain to a privacy authority. Email us to exercise these rights. We may need proportionate account-ownership verification; never send passwords, sign-in codes, private keys or access tokens.
Age suitability and safety
Figureout includes live content created by other players. Follow the age rating shown in your App Store region and any local account-consent requirements. The app is not presented as a Kids Category service. If you believe a child has provided personal information without required permission, contact us so we can investigate and address it.
Security and changes
Connections to the production service use encrypted HTTPS/WSS, with authenticated sessions and access controls. No online service can guarantee absolute security. We update this policy when practices change, revise the date above and provide additional notice or consent where required.