Privacy Policy
The short version
- You can play LetterLock as a guest without giving us anything. Guest progress stays on your device.
- If you create an account we store your email, username, XP and level, friends list, saved games and scores. Nothing else.
- The mobile apps show ads (Google AdMob). You are asked for consent first where the law requires it, and you can choose non-personalised ads.
- We collect basic usage statistics (a random install id and simple events like "game started") on our own server, and crash reports through Sentry, to keep the game working. No third-party analytics trackers.
- "Remove Ads" is a one-time purchase handled by the App Store or Google Play. We never see your card details.
- We never sell your data and we do not use it for anything other than running the game.
- You can delete your account at any time, inside the app or at letterlock.raltech.dev/account/delete/index.html.
- LetterLock is for players aged 13 and over. It is not directed at children.
1. Who we are
LetterLock ("the game", "the app", "the website") is developed and operated by RAL Technologies, a company based in the Kingdom of Bahrain ("we", "us"). We are the data controller for the personal data described here. You can reach us at info@raltech.dev.
This policy covers the LetterLock website (letterlock.raltech.dev), the installable web app, and the LetterLock apps for iOS, Android and Android TV.
2. Playing as a guest
You do not need an account to play. When you play as a guest:
- Your settings, in-progress match, and the "questions already seen" tracker are stored only on your device (browser storage or app storage). We do not receive them.
- If you join an online room, the room code, the display name you type, and your answers are sent to our game server so the host's screen can show them. They are kept only for the life of the room (rooms are removed when the host ends the game or after a period of inactivity).
- Guest play does not earn XP, friends or leaderboard entries, because there is no account to attach them to.
3. Data we collect when you create an account
| Data | Why we need it | Where it comes from |
|---|---|---|
| Email address | To sign you in with a one-time code, to link a Google or Apple sign-in to your account, and to contact you about your account (never marketing). | You, or your Google / Apple account when you use those sign-in buttons |
| Username | Shown to other players (leaderboards, friends, rooms). You choose it. It can be changed once a month. | You |
| XP, level, prestige, unlocked content | Your progression in the game. | Generated by playing |
| Friends list and friend requests | So you can add friends and invite them to rooms. | You |
| Saved game | So an unfinished match can be resumed on another device. One saved match per account. | Generated by playing |
| Scores and match results | Leaderboards per question pack (score, moves, time). Your username appears next to your score. | Generated by playing |
| Custom question packs | If you create packs in the pack editor and choose to save them to your account. | You |
| Purchase entitlement | A yes/no flag that says whether your account has "Remove Ads" (see section 6). | The app store, via RevenueCat |
We do not collect your real name, phone number, contacts, location or photos. We do not read your device's advertising identifier ourselves; only Google AdMob uses it, inside the mobile apps, to show ads (see section 5). We do not use any third-party analytics or tracking service.
Usage statistics (our own, first-party)
To understand how the game is used and fix what does not work, the app and website send simple events to our own server, never to a third party. Examples: a session started, an ad was shown, a rewarded ad was watched, an extra skip was used in a pack, "Remove Ads" was bought or restored. Each event carries a random install id created on your device (it is not your advertising identifier and is not linked to your name or email), the time, and, if you are signed in, your account id. From these we count daily players and how many come back after 1, 7 and 30 days. You can reset the install id by clearing the app's data or your browser's site data. Events are deleted automatically after 13 months.
Crash reports (Sentry)
When the app hits an error, it sends a crash report to Sentry (sentry.io), stored in Sentry's EU region. A report contains the error message, where in our code it happened, the app version and basic device and browser details (type, operating system, version). It does not contain your email, username, account id or your answers. We collect errors only: no performance tracing and no screen or session recording.
Sign in with Google or Apple
If you use "Continue with Google" or "Sign in with Apple", the provider sends us your email address (Apple may send a private relay address if you choose to hide your email) and a technical account identifier. We use them only to create or find your LetterLock account. We do not receive your password.
Technical data
Like every online service, our servers keep short-lived logs (IP address, browser or app version, time of request) to keep the service running, prevent abuse (for example rate-limiting sign-in codes) and diagnose errors. Logs are kept for no more than 30 days. The app may also store a small configuration file (minimum supported version, maintenance notices) that it fetches from our server.
4. How we use your data
- To run the game: sign you in, save your progress, show leaderboards, connect you with friends and rooms.
- To keep the service safe: block abuse, enforce our Terms, rate-limit sign-in codes.
- To honour your purchases: hide ads on every device where you are signed in.
- To answer your support requests.
Our legal bases (where the GDPR or similar laws apply) are: performance of our contract with you (running the game you asked for), our legitimate interest in keeping the service secure, and your consent (for personalised advertising).
5. Advertising
The LetterLock mobile apps are free and supported by ads served by Google AdMob. Ads appear between games and on menu screens, never during a question. On the website, ads may later be shown through Google AdSense in the same places.
- Consent. Before any ad is shown, the app displays a consent screen (Google's User Messaging Platform). In the European Economic Area, the United Kingdom and Switzerland this lets you accept or refuse personalised ads and see the list of ad partners. You can change your choice at any time from the app's Settings.
- iOS App Tracking Transparency. On iPhone and iPad the app asks for permission before allowing ad tracking. If you tap "Ask App Not to Track", you still see ads, but they are not personalised across apps.
- What AdMob receives. AdMob may collect your device's advertising identifier, IP address, approximate location derived from it, device type and app usage signals to select and measure ads. This is governed by Google's privacy policy. We do not share your email, username or game data with ad networks.
- No ads at all. Buy "Remove Ads" (section 6), or play on the website, where ads are not currently shown.
6. Purchases
"Remove Ads" is a one-time in-app purchase made through the Apple App Store or Google Play. The store processes your payment; we never receive your card or bank details. We use RevenueCat to verify the purchase and to remember that your account has it. RevenueCat receives the store's purchase receipt, an anonymous app-user identifier, and, when you are signed in, your LetterLock account identifier, so the entitlement follows your account to other devices and to the website. RevenueCat's own privacy policy is at revenuecat.com/privacy.
Refunds are handled by the store you bought from, under its rules (see our Terms).
7. Where your data is stored and who can see it
Account data is stored on our own backend, running on servers operated by RAL Technologies. Until our migration to that backend is complete, account data is processed by our hosted database provider, Supabase (supabase.com), under its data-processing terms. Access to the database is limited to the RAL Technologies team and is protected by per-user access rules, so one player can never read another player's private data.
We share data only with the service providers we need to run the game, and only what each one needs:
| Provider | What they process | Why |
|---|---|---|
| Resend (email delivery) | Your email address and the one-time sign-in code | To deliver sign-in emails |
| Sentry (Functional Software, Inc.) | Crash reports (error details, app version, device type), stored in the EU | Finding and fixing errors |
| Google (Sign-in, AdMob, Play) | Sign-in identity; advertising signals in the apps; purchase receipts on Android | Sign-in, ads, purchases |
| Apple (Sign in with Apple, App Store) | Sign-in identity; purchase receipts on iOS | Sign-in, purchases |
| RevenueCat | Purchase receipts and account identifier | Verifying "Remove Ads" |
| Cloudflare | Website traffic (DNS and content delivery) | Serving the website securely |
We do not sell personal data, we do not share it with data brokers, and we do not use it for advertising of our own. We may disclose data if the law requires it or to protect the rights and safety of players. Some providers above are located outside Bahrain (for example in the EU or the United States); where required we rely on their standard contractual safeguards.
8. Other players
Your username, level, rank badge and scores are visible to other players on leaderboards and in rooms you join. Your email address is never shown to anyone. Custom packs you publish carry your username as the author.
9. Children
LetterLock is intended for players aged 13 and over (or the higher minimum age in your country, for example 16 in some EU countries). It is not directed at children, and we do not knowingly collect personal data from anyone under 13. The "Kids" question pack is content for families to play together on one screen; it does not change who the game is for. If you believe a child has created an account, email info@raltech.dev and we will delete it.
10. How long we keep data
- Account data: until you delete your account.
- Online room data: until the room ends, at most a few hours.
- Server logs: up to 30 days.
- Usage statistics: deleted automatically after 13 months.
- Crash reports: kept by Sentry for up to 90 days.
- Sign-in codes: expire within minutes and are then deleted.
- Backups: encrypted backups are rotated within 30 days, so deleted data leaves backups within that time.
11. Deleting your account
You can delete your account and all of its data at any time:
- In the app: Home → tap your username (👤) → Delete account → confirm.
- On the web: follow the steps at letterlock.raltech.dev/account/delete/index.html.
- By email: write to info@raltech.dev from the email address on the account. We delete within 7 days and confirm by reply.
Deletion removes your profile, email, username, XP, friends, saved game, leaderboard entries and custom packs. Anonymous aggregate statistics (for example how many players answered a question correctly) contain no personal data and are kept. A "Remove Ads" purchase is tied to your store account and can be restored in a new LetterLock account through the store's "Restore purchases" button.
12. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, to withdraw consent (for personalised ads, from the app's Settings), and to complain to your local data protection authority. Bahrain's Personal Data Protection Law (Law No. 30 of 2018) gives residents of Bahrain equivalent rights. To exercise any right, email info@raltech.dev. We answer within 30 days.
13. Security
All traffic between your device and our servers is encrypted (HTTPS and secure websockets). Passwords do not exist in LetterLock: sign-in uses one-time codes or Google / Apple. Sign-in codes are stored hashed and rate-limited. Database access is limited per user by server-side rules.
14. Changes to this policy
If we change this policy in a meaningful way we will update the date at the top and, for significant changes, show a notice in the app. Older versions are available on request.
15. Contact
RAL Technologies, Kingdom of Bahrain
Email: info@raltech.dev
Website: letterlock.raltech.dev