Privacy Policy — Waxlane

Last updated: October 2026 · App: Waxlane (com.fluttech.waxlane) · Publisher: MJK APPS SRL

Waxlane is a single-player maze puzzle game with a daily maze. This page explains what information the app handles, where it goes, how long it is kept, and how you control it.

1. Summary

• The whole game is playable without signing in, and offline. Your progress is stored on your device.
• Signing in with Google or Apple is optional. It keeps a copy of your progress so it can follow you to a new phone, and keeps your chosen nickname with your account.
• The app has three leaderboards: Today (the daily maze), Top (the whole campaign) and Streak (the longest run of daily mazes). A row carries a name and a number, and everyone using the app can see it. Nothing of yours goes up until you say so.
• Usage analytics are switched off until you answer the question the app asks once, inside the game. Crash reports are collected so we can fix what breaks.
• Advertising: the app shows only non-personalised ads from Google AdMob — a video you choose to watch for a reward, and one banner beneath the dyed cloth at the end of a level. There is no tracking across apps, and the app never asks for App Tracking Transparency.
• Purchases go through the App Store or Google Play. The store handles the payment; our server only checks the receipt and records what you bought, so it can be credited and restored.
• We do not sell your data.

2. What information is handled, and why

2.1 Always, whether or not you sign in

• Game state stored on your device — cleared levels with their stars, steps and times, unlocked chapters, the cloths you have dyed, ink drops, hints, seals, the daily ladder and streak, daily-maze results, and settings (language, sound, haptics, reduced motion, daily reminder, paper theme). This is kept in the app's local storage and is never uploaded unless you sign in (2.4).
• The daily reminder, if you switch it on, is scheduled on the device itself. The app uses no push-notification service.
• Sharing — a share card is drawn on your device and handed to your phone's own share sheet. It shows your path, never the solution, and nothing about it is sent to us.
• Crash reports (Firebase Crashlytics) — if the app crashes, a report with the crash trace, the app version, the device model and operating-system version and a random installation identifier is sent to us. It contains no name, e-mail or location.
• App integrity (Firebase App Check) — when the app talks to our backend, the device attests that the request comes from a genuine copy of Waxlane (Apple App Attest or DeviceCheck / Google Play Integrity). The attestation token identifies the app instance, not you.

2.2 Only when you first write to the cloud

• An anonymous account (Firebase Authentication) — the app does not create an account when it starts. An anonymous identifier is created the first time something of yours would be written to the cloud: joining a leaderboard, sending feedback, or checking a purchase. It is not tied to your name, your e-mail or your device's advertising identifier.

2.3 Only if you are on the leaderboards

• Your leaderboard rows (Cloud Firestore) — one row per board, stored under your user identifier:
  • Today: name, score, stars, steps, attempts and seconds for that day's maze;
  • Top: name, score, stars and the number of levels solved across the campaign;
  • Streak: name and your longest streak of daily mazes.
  Nothing else: no e-mail address, no device information, and no free text other than the name.
• Earlier boards — when you post a daily result, the app also keeps two summary rows that earlier versions showed as boards: a weekly and an all-time tally (name, score, the number of days and stars). They are public in the same way, are not shown as tabs in the current version, and go with your account like every other row. A monthly board used during testing is no longer written; any row left on it is deleted the same way.
• The name on the row — the nickname you chose, or, if you have not chosen one, a name the app generates from your anonymous identifier (for example Indigo·7f3a). A chosen nickname is at most 16 characters and has to pass an automatic profanity filter. The name your sign-in provider knows you by is never used on a board.
• Who can see it — everyone using the app. The boards are public by design; the row does not say who you are beyond the name.
• How your row gets there — if you are not signed in, the app asks first and nothing is uploaded until you accept. Declining is a real answer, and the whole game is complete without ever joining.
• Taking it down — deleting your account deletes your leaderboard rows, name and score together (section 5).
• Reporting a name — write to contact@fluttech.com and we remove it.

2.4 Only if you sign in with Google or Apple

• Provider-issued user identifier — used by Firebase Authentication to associate your sign-in with a stable account.
• E-mail address and display name — received from the provider (or Apple's private relay address if you chose Hide My Email) and stored only in Firebase Authentication, so the app can show whose account is signed in.
• Your nickname — kept in a private profile document, so the name you chose follows you to another phone.
• Your progress — the app keeps a copy of your saved game in a private document tied to your account: cleared levels with their stars, steps and times, unlocked chapters, daily-maze results, the ink-drop ledger, hints, the daily ladder, gifts and your seals. It does not include your settings, which stay on the device. The copy is merged with what is on the device rather than replacing it — the better result of the two always wins.
• These documents are private: only your own account can read them, which the server's security rules enforce. They are deleted together with your account, and a guest session never has them.

2.5 Only if you allow analytics

• Usage analytics (Firebase Analytics) — collection is disabled when the app starts. After you clear your first level, the app asks once, in the menu, whether it may measure how the game is played: which level was started and finished, how many steps it took, which hint was used, whether a board was opened or a card shared. Nothing is collected before you say yes. These events carry a random app-instance identifier and coarse device information, never your name, e-mail, nickname or account identifier, and are used to balance the levels.
• In the European Economic Area and the United Kingdom, storing that app-instance identifier also needs your consent in Google's consent form (2.7); without it, analytics stays off.

2.6 Feedback you send

• If you write to us from Settings → Feedback, what you type is stored in our database together with your account identifier, the language the game is set to and the app build you sent it from. Any player can send feedback, signed in or not.
• Feedback is not public: no other player can read it, and the security rules allow only us to. Because it is correspondence, we keep it after an account is deleted, but the account identifier on it is blanked at the same time, so it is no longer linked to you. Write to contact@fluttech.com if you would rather have a note removed entirely.

2.7 Advertising

• Where ads appear — a rewarded video, only when you tap an offer for it (more ink drops at the end of a level, or in the Shop), and one banner beneath the results bar when the dyed cloth stops after a level. There are no ads on the home screen or on the board while you play, and no full-screen ad ever appears that you did not ask for. The first 20 completed levels show no ads at all.
• Who serves them — Google AdMob. Every ad request is marked non-personalised (npa=1): the ads you see are not chosen from a profile of you.
• What the ads software receives — to show an ad, count it and keep invalid traffic out, Google's Mobile Ads SDK receives your IP address (from which an approximate location is derived), device and app identifiers, the device model and operating-system version, and how the ad performed (shown, tapped, watched to the end). The app does not request the device's advertising identifier: on Android its permission is removed from the app, and on iOS the app never asks for App Tracking Transparency. Google's own use is described at policies.google.com/technologies/partner-sites.
• Consent — in the European Economic Area and the United Kingdom, Google's User Messaging Platform shows a consent form on the menu after your first completed level, never at launch and never during play. You can reopen it any time from Settings → Ad privacy and change your choice.
• Remove Ads — the Remove Ads purchase (2.8) takes the banner away. The rewarded video stays available, and stays optional.

2.8 Purchases

• What can be bought — Remove Ads (bought once, kept, and restorable) and two packs of ink drops (used up as you spend them). In the version you are using the Shop may still show them as "Coming soon"; until it opens, nothing can be bought.
• Who handles the payment — Apple (App Store) or Google (Google Play). We never see your card or payment details; the store sends the app a receipt.
• What our server records — the app sends the receipt to our server (Cloud Functions), which checks it with Apple or Google before anything is credited. For each verified purchase it keeps a purchase record: the store's transaction identifier, the product, the store, your account identifier, the time, the country and price the store reported, the app version, and a short history of which account identifiers verified it and when. For Remove Ads it also writes an entitlement to your account, which is what turns the banner off. The record exists so a purchase is credited exactly once, can be restored, and can be traced when you ask us for help.
• Restore — the Shop's Restore button asks the store for your earlier purchases and checks them again; Remove Ads follows the store account it was bought with.
• Refunds are handled by the store, under its own rules.

2.9 Legal basis (EEA and UK)

• Providing the game you asked for — the cloud save, the leaderboards you joined, sign-in, feedback and checking purchases — rests on our agreement with you (the Terms of Use).
• Crash reports, app integrity checks and fraud prevention rest on our legitimate interest in an app that works and cannot be cheated.
• Analytics and storing information for ads rest on your consent, which you can withdraw (section 5).
• Purchase records are also kept to meet our accounting obligations.

2.10 How long it is kept

• Leaderboard rows, the private profile, the cloud save and the Remove Ads entitlement — as long as your account exists; they are deleted with it.
• Crash reports — up to 90 days, then they expire on their own.
• Analytics — at most 14 months, then deleted automatically.
• Feedback — kept as correspondence, with the account identifier blanked when the account is deleted (2.6).
• Purchase records — as long as accounting law requires. When an account is deleted, its link to the ink-drop purchases is removed; the history of which account verified a purchase stays with the record for support and fraud prevention.

3. Processors

Our database and functions run in Google's European region. Some of these services may process data in other countries; Google does so under the European Commission's standard contractual clauses.

4. Children

The app is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us something, write to contact@fluttech.com and we delete it.

5. Your rights and how to use them

• Delete everything — Settings → Delete account (at the bottom, while signed in). It removes your leaderboard rows, your private profile, your cloud save and your account itself. The progress stored on your device stays unless you tick the box to erase it too; deleting the app removes it as well. The full list is on the account deletion page.
• Play without any of it — do not sign in and do not join the boards. The game is complete that way.
• Change your mind about ads consent — Settings → Ad privacy (shown where the consent form applies).
• Change your mind about analytics — in the EEA and the UK through the same consent form; anywhere, by writing to us.
• See, correct or move your data, or object to its use — write to us. You may also complain to your data-protection authority.
• Ask us anything — contact@fluttech.com.

6. Changes

If this policy changes in a way that affects what is collected, the date at the top changes with it and the app shows the new page.