Shardfield
Privacy Policy
Last updated: 26 September 2026
This policy explains what the Shardfield game stores about you, why, who can see it, how long we keep it and how to delete it. We wrote it in plain words. If something is unclear, write to us (see "Contact").
Who we are
Shardfield is made by fluttech (MJK APPS SRL). We decide what data the game uses and why, so we are the "controller" of your data under the EU and UK GDPR.
Contact for privacy questions and requests: contact@fluttech.com.
The short version
- You can play without giving us your name or email. The game creates an anonymous account for you.
- We save your progress online so you do not lose it, and (when boards are on) we show the name you pick next to your scores.
- We use Google Firebase to run the game. Your game data is stored in the EU. Some Google services process data in the United States.
- We count how the game is used, without your name or account id. You can switch this off in Settings.
- You can delete your account in the game at any time: You > Account > Delete account. You can also ask us by email.
- The game is not for children under 18.
What we collect, and why
When you play (all versions)
Your saved games on your device. Boards you have not finished, your settings and your progress are saved on your phone, tablet or computer. They stay there until you delete the app or your account.
Your account and cloud save
An anonymous account. A few seconds after your first board, the game creates an account without asking for any details. It has a random id (for example a8Xk2...). We use it to save your progress online and to keep it the same on your devices. Why: to give you the game you asked for.
Your progress online. Which boards you solved, your best times, hints and mistakes, your shards and unlocked packs, the days you played (for streaks), and some play counters (for achievements). Only you can read it through the game. Why: so you can continue on another device or after reinstalling.
If you link Google or Apple (You > Account). Firebase Authentication stores your Google or Apple account id and the email address and profile the provider shares. With Sign in with Apple this can be a private relay address. We do not copy your email anywhere else and we do not use it for marketing. Why: so you can get your progress back on a new device.
Names and scores on boards
Your display name and avatar. When you post your first daily result, the game asks for a name (1-20 characters) and lets you pick an avatar. If you skip, you appear as "Player" and a number.
Board rows. Your name, avatar and time (daily board), or your number of solved boards (weekly and all-time boards), are shown to everyone who plays Shardfield. Your account id is part of each row, although the game does not display it. Why: boards are part of the game.
Reactions. If you react to someone’s row with an emoji, other players can see your name and the emoji.
Favourites. Players you mark as favourites are saved in your account with their name. Only you see your list. Other players may have you in their list in the same way.
Share links. If you share a board, the link contains the board and your time. You decide who gets it.
Purchases and ads (applies when purchases and ads are enabled)
The "Complete" purchase. Payment is handled by Google Play or the App Store; we never see your card. To check that a purchase is real, we send the store receipt to Google or Apple and keep a record: your account id, the product, the transaction id, the store country, the price and currency shown to you, the app version and the date. Why: to give you what you paid for, and to stop one purchase being used on unlimited accounts.
Ads. Free players see one small banner ad on menu screens, never while playing. Ads come from Google AdMob. Before any ad, the game asks for your permission where the law requires it (on iPhone and iPad, Apple’s tracking prompt; in the EEA and UK, a consent form). Without your permission you only get non-personalised ads, and the advertising id of your device is not used for tracking. Once you own "Complete", the game makes no ad requests. There are no ads on Mac.
Cheat checks. If a posted result is faster than the board allows, the game removes it and records the reason against the account id. Only our servers can read these records. They are deleted after 180 days.
Leagues, notifications and invites (applies when leagues, notifications and invites are enabled)
Leagues. Each week you are placed in a room of about 20 players. Other players in your room see your name, avatar and weekly score. The server counts your points from the boards you solve.
Push notifications. Only if you switch them on: we store a push address for your device, your language and which notifications you want. Why: to tell you your league result or that a friend passed you.
Follow links and invites. If you share a follow link, it contains your account id, your name and a secret that proves the link is yours; we keep that secret on our servers so nobody can forge a link in your name, and you can reset it at any time in Settings, which stops every link you shared before. If you hide a player, we also keep their account id in your own settings so they cannot follow you through a link and you get no notification about them. If you invite a friend with a code, we store the code and whether your invite counted. You need a linked Google or Apple account to invite.
Usage statistics (analytics)
We use Google Analytics for Firebase to learn which boards are too hard, which settings people change, and where players stop. Events describe game actions (for example "board solved, band 3, 142 seconds"). They never contain your account id, your name or anything you typed. Google Analytics also receives technical data such as device model, operating system, app version, language and an approximate country.
- In the EEA and UK we only collect this after you agree in the consent form the game shows before its first ad; until you agree, nothing is collected.
- Everywhere, you can stop it at any time: Settings > Share anonymous usage data.
Why: to improve the game. We keep this data for 14 months.
Crash reports
If the app crashes, Firebase Crashlytics sends us a crash report: the error, device model, operating system, app version and a random installation id. It does not contain your name, email or account id. Why: to find and fix bugs. Kept for 90 days.
Security and settings from our servers
App Check asks Google Play Integrity (Android) or Apple App Attest (iPhone, iPad, Mac) to confirm that requests come from the real Shardfield app, so bots cannot fill the boards. We do not keep this information.
Remote Config lets us change game settings (for example switching a feature off) without an update. It uses a random installation id and contains no personal data.
Server logs. Our servers write technical logs that can include your account id. They are deleted after 30 days.
What we do not collect
We do not collect your location, contacts, photos, files, microphone or camera. We do not ask for your email unless you link Google or Apple. We do not sell your data. We do not use your data for ads before you allow it.
Who else handles your data
We use these services. They process data for us under their terms.
| Service | What for | Where |
|---|---|---|
| Google Firebase Authentication | your account, linked sign-in | United States |
| Google Cloud Firestore | your saved progress, boards, leagues | European Union (Belgium, europe-west1) |
| Google Cloud Functions | purchase checks, leagues, cheat checks, clean-up | European Union (Belgium) |
| Google Analytics for Firebase | usage statistics | United States and other Google locations |
| Firebase Crashlytics | crash reports | United States and other Google locations |
| Firebase Remote Config, App Check, Cloud Messaging | settings, anti-bot checks, notifications | Google locations worldwide |
| Google AdMob (when ads are enabled) | ads | Google locations worldwide |
| Google Play, Apple App Store | payments and purchase checks | the store’s own |
| Google Sign-In, Sign in with Apple | linking your account | the provider’s own |
Other players see only what is described under "Names and scores on boards" and "Leagues". We share data with authorities only when the law requires it.
Transfers outside the EU
Your saved game data is stored in the EU. Firebase Authentication, Analytics and Crashlytics process data in the United States, and some services use Google’s worldwide infrastructure. Google covers these transfers with the EU-US Data Privacy Framework and the standard contractual clauses in its data processing terms.
How long we keep it
| Data | How long |
|---|---|
| Your account, cloud save, name, favourites, all-time board row | until you delete your account; an account nobody uses any more is kept until then |
| Daily board results | 35 days after that day, once our daily clean-up runs; at the latest when you delete your account |
| Weekly boards | 10 weeks (same note) |
| League weeks | 12 weeks |
| Cheat-check records | 180 days |
| Server logs | 30 days |
| Crash reports | 90 days |
| Usage statistics | 14 months |
| Purchase records | kept after account deletion (see below) for as long as our accounting duties and the store’s refund and dispute windows require |
Your rights
You can:
- see your data - most of it is in the game (You, Ranks); for a copy, email us;
- correct it - change your name and avatar in the game;
- delete it - in the game or by email (next section);
- object to analytics - Settings > Share anonymous usage data; in the EEA and UK you can also withdraw consent for ads in Settings > Ad choices;
- turn off notifications - in Settings or in your device settings;
- complain to your data protection authority.
To use a right by email, send us your account id (Settings > About, Account ID) or the email of the Google or Apple account you linked. We answer within one month.
Deleting your account
In the game: You > Account > Delete account. This deletes, on every device: your progress, shards and unlocks, your name and times on the boards, your reactions, favourites, league history, invite data and your account. The app then starts fresh.
Without the app: see https://fluttech.com/shardfield/delete_account.html.
What we keep after deletion, and why. If you bought "Complete", we keep the purchase record and the record that it was granted. Without them, one purchase could be restored onto unlimited new accounts. They contain your old account id, not your name or email. Your purchase itself stays with your Google or Apple store account, so you can restore it on a new account. Also: usage statistics and crash reports are not linked to your account and expire on their own (14 months and 90 days); server logs expire after 30 days; and Google removes deleted data from its backups within 180 days.
Children
Shardfield is not directed at children and is intended for players aged 18 and over. We do not knowingly collect data from children. If you believe a child has used the game, write to us and we will delete the account.
Changes to this policy
If we change this policy, we update the date at the top. If a change affects what we collect, we tell you in the app before it applies.
Names on past boards
When you change your name, the boards you are on today (today’s daily board, this week’s board and the all-time board) show the new name right away. Boards from earlier days and weeks keep the name you used then until those boards are removed (older daily boards are removed after 35 days and weekly boards after 10 weeks once our clean-up job runs) or until you delete your account.
See also: Delete your account · Terms & Conditions