Tile Torpedo privacy policy

Last updated: October 9, 2026. This policy covers the Tile Torpedo Android app (tile.torpedo) and its closed-test online services. For privacy questions, email joshuagramp@gmail.com.

Data used by the game

• Account: Firebase Authentication assigns a user ID, including for a guest session. If you link an email, Firebase Authentication processes the email, password credential, verification status, and sign-in activity. We do not ask you to send us your password.
• Daily tournament: For eligible closed-test players, the isolated service receives and stores authenticated session requests, game moves, attempt timing, verified scores and results, and leaderboard entries. The server checks and scores official play.
• Public name: A verified player may choose a public player name after accepting the name rules. Authorized players can see that name alongside the player’s verified leaderboard score. Your email address is not shown on the leaderboard. Players can report names; reports are reviewed by an authorized operator.
• Security and diagnostics: Firebase Authentication processes IP address, user-agent, app identifiers and sign-in metadata to secure accounts. Firebase App Check uses Play Integrity to check that requests come from the registered app. The online service processes request metadata and limited abuse-prevention records.
• Support: If you contact us about deletion or a public-name report, we process your email and the information you choose to provide so we can verify ownership and respond. Do not send passwords, sign-in tokens or identity documents.

Campaign saves, practice progress and preferences are stored on your device. Tile Torpedo does not upload them as cloud account backups. The Android app disables automatic app-data backup.

Why and with whom data is used

We use account and security data to sign players in and protect the service; tournament data to run and verify official games; optional names to display a leaderboard; and support information to handle requests and reports. We use Google Firebase Authentication, Firebase App Check, Play Integrity and Google Cloud as service providers for those functions. We do not use an advertising or analytics SDK in this closed-test build, sell personal data, or award cash prizes.

Only authorized closed-test players can view leaderboard names and scores. Operator access to private account and report data is restricted. We do not show a player’s email address or Firebase user ID on the leaderboard.

Security

The app communicates with Firebase and the pilot service over HTTPS. Online actions require Firebase Authentication and App Check; official tournament access also requires verified email and pilot authorization. Access to the isolated database and operator procedures is restricted by cloud permissions. No system can guarantee absolute security.

Retention and deletion

We keep cloud account and tournament records while the account is active and needed for the closed test. We have not set an automatic deletion period for an active account. You can request deletion in Player account → Account security → Request account deletion, or from our account deletion page without reinstalling the app. Linked accounts reauthenticate in the app or complete a one-time challenge sent to their registered email on the web path. A guest can request from its current authenticated device session. An uninstalled, unlinked guest may require individual support to establish ownership.

After ownership is verified and the request is reviewed, an authorized operator removes the Firebase sign-in account, public name, active account records, pilot admission, tournament sessions and moves, verified scores, leaderboard entries, and related reports from the isolated Tile Torpedo service. The Firebase sign-in identity is shared by the Tile Torpedo pilot and Play test builds, so deletion ends access from both. We do not retain a separate tournament-results copy after account deletion. Device-local saves remain until you clear the app’s data or uninstall it.

We do not currently keep a separate 30-day backup of Tile Torpedo account or tournament records. The pilot Firestore database has no managed backup schedule or point-in-time recovery; its prior-version history is configured for about one hour. Technical logs are separate: the pilot service’s standard Cloud Logging bucket is configured for seven days, the shared Firebase sign-in project’s standard bucket for 30 days, and required audit-log buckets for 400 days. These logs may include request metadata and are used for security and operations, not for restoring deleted accounts.

A web deletion challenge expires after one hour. Its record is removed when used or during daily cleanup after expiry. We keep support correspondence while processing a case; our operator procedure calls for removing it from the active mailbox when the case closes. Email service providers may keep residual copies under their own retention rules. We have not identified a separate legal requirement to keep deleted account or tournament records. If one applies to a particular request, we will explain what is retained and why before completing it.

Contact and updates

For privacy questions, account access, or deletion, email joshuagramp@gmail.com. We will update this page if the game’s data practices change and revise the date above.