Tic-Tac-Toe

Privacy Policy

The Tic-Tac-Toe app and website. We keep it plain: what we store, what we don't collect and how the ads work.

Effective date: · Last updated:

1. Data controller

The controller of personal data within the scope of this policy is Piotr Świst AI Solutions (Piotr Świst), https://swistai.com.

Contact for all privacy matters: piotr@swistai.com.

When showing ads, Google processes data on its own behalf and under its own terms (see section 5).

2. Scope of this policy

This policy covers:

  • the Tic-Tac-Toe app for Android (package name com.swistai.tictactoe),
  • the website tictactoe.swistai.com in all language versions, including the browser game (/en/play/ and its equivalents in other languages), the download page and this policy.

It does not cover other websites and services we link to (for example swistai.com or Google services).

3. In short

  • There are no accounts and no sign-in. We don't ask for any personal data (name, email, phone number).
  • There are no in-app purchases or payments.
  • We don't run a server of our own that collects game data. Your settings and score stay on your device. The only server-side data are the website host's technical logs (section 11).
  • The website remembers the language you choose in a functional cookie, nf_lang (section 4).
  • The only third party involved in the game is Google, which serves the ads (AdMob in the app, AdSense on the website). You control your consent to ads (section 6).
  • The app has no access to your contacts, GPS location, camera, microphone or files.

4. Data stored on your device

The app and the browser game store the following locally:

  • settings: game mode (against the computer or 2 players), the symbol you play (X or O), computer level, who goes first, board size (3×3 to 6×6), theme (dark, light, system), sounds and vibration,
  • whether the welcome screen has already been shown (so it doesn't appear on every visit),
  • score: the number of wins for X, draws and wins for O.

This data is kept in the app's storage (Android) or in your browser's local storage (localStorage). It is not sent to us or to anyone else. Its only purpose is to let the game remember your settings and score. It doesn't identify you and isn't used for profiling.

Website language. When you pick a language in the website's language switcher or in the browser game's settings, your browser stores a cookie called nf_lang containing the code of the chosen language (for example en) for 1 year. Your browser sends it to our hosting provider (Netlify, section 11) so that tictactoe.swistai.com opens straight in your chosen language. The cookie contains no information about you, is not used for ads or statistics, and is strictly necessary to remember the choice you asked for (a functional cookie). Without it, the server picks the language version based on your browser's language setting (the Accept-Language header) and stores nothing. The Android app follows your system language and doesn't use this cookie.

We don't use any analytics tools or tracking pixels of our own.

How to delete stored data:

  • the “Reset score” button in the game settings deletes the saved score,
  • uninstalling the app or clearing its data in Android settings (Apps → Tic-Tac-Toe → Storage → Clear storage; option names vary by Android version) deletes everything it has stored,
  • in a browser, clear the site data for tictactoe.swistai.com (including cookies) in your browser settings.

5. Google ads

The game is free and funded by ads. In the app we use Google AdMob, on the website Google AdSense. Both services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

We show two ad formats:

  • a banner at the bottom of the screen,
  • a full-screen ad every few finished games, only after a game has ended and you tap “New game”. Never during play.

When showing ads, Google may process:

  • the advertising ID (Android Advertising ID) and the app set ID (App Set ID),
  • your IP address,
  • information about your device, operating system and app or browser (for example model, system version, language),
  • approximate location derived from your IP address (we don't use GPS location),
  • data about interactions with ads (impressions, clicks),
  • diagnostic data from the ad library (for example about errors and performance),
  • cookies and similar technologies (on the website).

Purposes: serving ads and measuring their performance, preventing abuse and fraud and, only with your consent, personalizing ads. As the publisher, we only see aggregate statistics and ad revenue, with no data that could identify a specific person.

In the current version, Google ads and the consent tool load only on the game page (/en/play/ and its equivalents in other languages). The home page, the download page and this policy don't load ads.

More on how Google processes data:

If you play in the European Economic Area, the United Kingdom or Switzerland, you'll see a Google consent form the first time you start the game. In the app this is the Google User Messaging Platform (UMP); on the website it's Google's consent management tool (CMP). You can give consent, refuse it or adjust your choices. We only request ads once your decision allows it.

Your decision is stored on your device by the Google tool (in the app's storage, or in cookies or browser storage on the website) and passed to Google along with ad requests. That way the form doesn't appear every time you start the game.

You can change your decision at any time:

  • in the app: Settings → Privacy → Ad privacy settings,
  • on the website: game Settings → Privacy.

Without consent to personalization, Google may still show non-personalized ads (not tailored to your profile) or limited ads. Refusing consent doesn't limit your ability to play.

  • Article 6(1)(a) GDPR (consent): personalized ads, and cookies and similar technologies used for ads. You can withdraw your consent at any time.
  • Article 6(1)(f) GDPR (legitimate interests): funding a free game with non-personalized ads, keeping the service secure and working properly, and preventing abuse (including the hosting provider's technical logs).
  • Article 399 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej; formerly Article 173 of the Telecommunications Law, Prawo telekomunikacyjne): storing information on your device and accessing it (cookies, localStorage, advertising ID). Information that the game and the website need in order to work, i.e. settings, score and the chosen website language (the nf_lang cookie), is stored without separate consent. Everything else, used for ads, is stored only with your consent.

8. Advertising ID on Android

The advertising ID (Android Advertising ID) is tied to your device, not to you by name. You can reset or delete it:

Settings → Google → All services → Ads → Delete advertising ID

The path may differ depending on your phone's manufacturer and Android version. Once the ID is deleted, apps, including ours, can't use it. Ads may still appear, but they won't be tailored to your interests.

9. App permissions

The Android app declares the permissions listed below. Some are added automatically by Google's ad libraries (the Google Mobile Ads SDK and its dependencies). None of them requires separate approval in a system dialog.

  • Internet and network state (INTERNET, ACCESS_NETWORK_STATE): loading ads and checking whether the device is online,
  • Vibration (VIBRATE): a short buzz on each move (you can turn it off in settings),
  • Advertising ID (com.google.android.gms.permission.AD_ID): lets Google ads read the advertising ID (section 8),
  • Android ad services (ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_TOPICS): let Google's ad library use the Privacy Sandbox ad APIs on newer Android versions (ad topics, ad measurement). You control them in your system's ad privacy settings,
  • Short background tasks (WAKE_LOCK, FOREGROUND_SERVICE): added by libraries used by Google ads (ad measurement, the WorkManager task scheduler) so they can finish tasks such as sending ad statistics. The game itself doesn't run any background tasks of its own,
  • Internal permission (com.swistai.tictactoe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION): added by the AndroidX library. It protects communication within the app and gives no access to any data.

The app has no access to your contacts, GPS location, camera, microphone or files on your device.

10. Transfers outside the EEA

Google may process data in the United States and other countries where it operates infrastructure. Such transfers rely on the mechanisms provided for in the GDPR: the EU-US Data Privacy Framework and standard contractual clauses approved by the European Commission. You'll find the details in the Google Privacy Policy.

11. Website hosting

The website is hosted by Netlify, Inc. (USA). On every visit the server records technical logs: IP address, user agent (browser and system type), the requested address and the time of the request. We use them solely to keep the service secure and working properly (Article 6(1)(f) GDPR) and never combine them with any other data. The logs are kept in line with Netlify's policies. Transfers of data to the USA are based on safeguards provided for in the GDPR (including standard contractual clauses or the EU-US Data Privacy Framework).

Netlify's server also sends visits to addresses without a language (for example / or /play/) to the matching language version, based on your browser's language or the nf_lang cookie (section 4).

We host fonts ourselves, on the same domain. Your browser doesn't connect to Google's servers for them (we don't use Google Fonts).

12. Retention periods

  • Local data (settings and score): until you delete it yourself (section 4).
  • Language cookie (nf_lang): 1 year from the last time you chose a language, or until you delete it in your browser.
  • Ad data: in line with Google's policies.
  • Server logs: in line with Netlify's policies.
  • Emails sent to piotr@swistai.com: for as long as needed to reply and deal with your request.

13. Your rights

Under the GDPR you have the right to:

  • access your data,
  • have your data corrected,
  • have your data erased,
  • restrict processing,
  • object to processing based on legitimate interests,
  • data portability,
  • withdraw your consent at any time. Withdrawal doesn't affect the lawfulness of processing carried out before it.

Send your requests to piotr@swistai.com.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR): the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, UODO; ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl), or the supervisory authority in the Member State where you habitually reside, where you work or where the alleged infringement took place. The European Data Protection Board publishes a list of supervisory authorities in the EU and EEA.

What this means in practice. We don't store any data that could identify you (no accounts, email addresses or identifiers), so we usually can't link a request to a specific person. Your settings and score are under your control on your own device (section 4). For ad data, the most effective options are the consent settings (section 6), the advertising ID (section 8) and the ad settings in your Google Account.

14. Children

The game is intended for a general audience. It isn't directed at children under 13 and we don't knowingly collect personal data from children. You can consent to ad personalization yourself if you are at least 16, or younger if the law of your country sets a lower age (not below 13, Article 8 GDPR). Younger users need the consent of a parent or guardian.

If you are a parent or guardian and believe your child has given us personal data, email piotr@swistai.com. We'll delete it.

15. Changes and language versions

The current version is always available at https://tictactoe.swistai.com/en/privacy/. The date of the last update is shown at the top of the page. We'll let you know about significant changes, such as a new scope of data processing, in the app or on the website.

This policy is available in several languages. The Polish version is the binding one: if the language versions differ, the Polish text prevails.

Questions? Email us: piotr@swistai.com.