Sort Hurdle Privacy Policy

You can play Sort Hurdle without giving us your name, your email, or anything else about you — signing in is optional. The game creates an anonymous identifier on your device the first time you open it, and that identifier, not you, is what your daily runs, coins and purchases are attached to, along with a copy of your progress so it can come back on another phone. If you choose to create an account — with Apple, with Game Center, or with an email address — you can sign back in to it anywhere; see section 1.

One thing is worth knowing before you read the rest: your results are public— the moves, hints and time of each daily you clear, the stars and moves your week’s dailies add up to, and how far you have reached on the journey with the stars you earned there — shown on the leaderboards under a name the game generates for you, or one you choose in Settings. Section 11 explains how to have everything erased, and the one thing that stays.

On first launch the app obtains an anonymous identifier from Sendora Cloud, our identity provider, and stores it on your device — including in the device keychain, so reinstalling on the same phone keeps it. Everything the game records on our server is attached to that identifier. It is not derived from your name, your email, your phone number, your advertising ID or your hardware.

Signing in is optional.If you create an account — with Sign in with Apple, or with an email address and a password — Sendora Cloud keeps the account’s email address (with Apple, the address Apple shares, which can be a private relay address that keeps your own hidden) and, for an email account, your password — which Sendora Cloud holds and we never see. Creating an account keeps the same identifier, so nothing you have moves; signing in to an account you made earlier switches the game to that account’s identifier.

Game Center.If your iPhone is signed into Game Center, the game connects it to your identifier the first time it opens, without showing you anything: Apple confirms which Game Center player you are, and Sendora Cloud keeps that player’s Game Center identifier — not an email address or a name. That makes your identifier an account you can sign back into on another iPhone. It is not done again on a phone where you chose to sign out, and you can connect Game Center yourself at any time in Settings, then Account.

Signing in to an account you made earlier switches the game to that account’s identifier and brings back that account’s progress and coins. The progress and coins of the guest you were playing as do not carry into it.

Without an account, there is no way for us to connect the identifier to a person.

Your settings, such as colour-blind symbols, are stored on your device only. Your progress is kept on your device too, so the game plays without a connection, and a copy of it is kept on our server (section 3) and brought up to date whenever you are online.

Signing out clears your progress from the device; it stays with your account, and comes back when you sign in again, on this phone or another.

Attached to your identifier, the server keeps:

• Daily runs — which day you played, how long the clear took, how many moves it took, and how many hints you used. Your moves are sent so the server can replay them to check the clear; the replay happens in memory and only the move count is kept.
• Journey wins — each journey level you win is sent with its moves, so the server can replay them and check the win. The replay happens in memory; what is kept is the level, the stars and the number of moves of your best win on it, and whether that win used the easier board, an extra tube or a shuffle. The levels you had already cleared when this began are taken once from your progress. These are what the Journey leaderboard ranks (section 4).
• Coins — a running ledger of every coin earned and spent, including what each spend was for (a hint on a particular board, an extra tube or a shuffle on a particular level, a past day you opened) and what each grant came from (a purchase, a rewarded ad, the daily bonus or a chapter chest).
• Your progress — the levels you have cleared and the stars you have earned on the journey, in each ladder, in the restaurant and in each special event, so it can come back on another phone, after a reinstall, or after you sign out and back in.
• Chapter chests you have opened— the chest at the end of each chapter of the journey pays its coins from our server, so the server records which chapters’ chests you have claimed.
• Past days you opened, and the days you claimed a daily bonus.
• Your timezone offset— a number of minutes from UTC, declared by your device and then fixed, so that “today’s board” means the same thing every day. It is a timezone band, not a location.
• Your leaderboard name — one the game generates, such as an adjective and a noun, or one you choose in Settings. See section 4.
• Names you report— if you report another player’s leaderboard name, we keep your identifier, the name you reported, the player it belonged to, and when you reported it. See section 4.

There are three, and each shows the leaderboard name of everyone on it. The daily board shows everyone who filed a ranked run that day, with the moves, hints and time their clear took. The weeklyboard adds up each player’s dailies from Monday to Sunday and shows the stars and moves they came to, and how many days they played; past weeks stay readable. The Journeyboard shows the furthest level each player has reached and the stars they earned on the way, and never resets. All three are served without any sign-in requirement, so they are readable by anyone on the internet, not only by people who have the app. The name is one the game generates for you unless you change it in Settings — and if you do, the name you type is published there, so don’t use your real name or anything that identifies you. A name you choose is checked against a list of words that are not allowed, and the only thing you ever type that is published is that name.

You can report another player’s name from the board: tap it, then Report name. We are told about every reported name — the name and how many players have reported it, never who reported it — so that we can look at it, and once two different players have reported the same name it is replaced with a generated one. A name you report is hidden on your own boards straight away. You can also hide a name without reporting it; the names you hide are kept on your device, not on our server, and are cleared when you sign out or switch accounts.

If your own name is reported by two players, or is one our list of words that are not allowed comes to refuse, it is replaced with a generated name, which you can change in Settings.

The game shows ads through Google AdMob. Two kinds arrive on their own: a banner, and a full-screen ad that can appear when you leave a finished level or restart one — never on the daily board. Plus and the one-time Remove Ads purchase both remove those two.

The third kind is never removed, on any tier: rewarded videos you choose to watch — for coins, for a hint, for more undos, for an extra tube when a board has run out of moves, to shuffle a board’s colours, to open a past day, or to double your daily bonus. You are always the one who starts them, and they pay you for the time rather than interrupting you.

Where the law requires it, the app shows Google’s consent form when you first reach its home screen; on iOS it then asks for permission to track through Apple’s App Tracking Transparency prompt, on that same visit. No ad is requested before you have answered. Your answers are what Google uses to decide whether the ads you see are personalised. Declining does not change the game in any way — you will still see ads, they will simply be less targeted.

Google receives standard advertising signals directly from its SDK on your device; we do not see them and do not control them. How Google uses them is set out in how Google uses information from sites or apps that use its services. When you watch a rewarded video, and only then, the app passes your Sort Hurdle identifier to Google so that Google can confirm back to our server that the video really was watched and the reward is owed. Banner and full-screen ads carry no such identifier.

The app sends crash and error reports to Sentry so that faults can be found and fixed. Reports carry the stack trace, a trail of what the app was doing, and basic device context such as the model, the OS version and the app version.

They are configured not to attach personal information: no IP address is recorded with the report and no identifier or leaderboard name is attached to it, and anything after a ? in a URL is stripped before the report leaves your device.

To learn whether the game’s features work for the people playing it — where players stop, which help they reach for, whether a screen is ever found — the app sends Sendora Cloud events about how it is used. They are attached to your identifier (section 1) — never to your email address:

• The app and its screens — when the app is opened, brought back or put in the background, which screens you open, and how long each one stays in front of you.
• Levels— each board you start, win or leave: which mode and level (or which day’s daily), how many moves, hints, undos and shuffles it took, how long, and the stars it earned.
• The help you take — a hint (free, paid in coins, or after a video), a restart, an extra tube offered or added, and a shuffle offered or used.
• Ads — when a full-screen ad is shown, and how a rewarded video ended: watched, closed early, or none available.
• The shops— which button opened the coins or Plus screen, which product you tapped, and how the purchase ended — bought, cancelled or failed, with Apple’s error code.
• Your account — when you create one, sign in or sign out, and with which method.
• Ratings — when the app asks Apple to show its rating prompt, and when you tap Rate Sort Hurdle in Settings.

Sendora Cloud’s software adds the kind of device (phone or tablet), its model, its operating system and version, and the app’s version to each event. The events never contain your email address, anything you type, your leaderboard name or your advertising identifier. We use them only to understand and improve the game: they are not used for advertising, not sold, not shared with anyone else, and not combined with information from other companies’ apps or websites.

The app also sends a small number of technical events about its own plumbing: once per launch, a check that the anonymous session is valid (with your identifier, how old the session token is, and which server environment the app is using), a report if that check or the token fails, and a note when you use Restore purchases (how many purchases Apple returned, and whether Apple could be reached).

The app does not ask for permission to send notifications. If you have turned notifications on for Sort Hurdle yourself, in your device settings, the app registers your device’s push token with Sendora Cloud, along with the platform and the app’s bundle identifier, and if you tap a notification it reports which message it was.

Coins, Remove Ads and Plus are bought through Apple. We never see your card, your billing address or your Apple ID.When you buy, the app gives Apple a token made from your identifier, so that Apple’s notices name the right player. Apple tells our server that a purchase happened, and we record the transaction identifier, what was bought, whether it was a live or a test purchase, and the identifier it belongs to — so the purchase reaches the right player and a refund can be honoured.

Apple also notifies our server about renewals, cancellations, refunds and billing problems. Those notices are recorded so that Plus turns off, and a refunded purchase is withdrawn, when it should be.

Our server does not store your IP address, your user agent, or any device fingerprint, and there is no request log. It does read your IP address from each request in order to limit abusive traffic — that is held briefly in memory only, is never written to the database, and is not attached to your identifier. Our API sits behind Cloudflare, which carries the connection and so sees the IP address of every request, as any network provider between you and us would.

There is no Firebase Analytics, Amplitude, Mixpanel, Facebook SDK or AppsFlyer in this app. The services involved are:

• Google AdMob — serves the ads, and confirms rewarded videos. See section 5.
• Apple — takes the payment and tells us the outcome (section 9), and, if you use Sign in with Apple or Game Center, confirms who is signing in (section 1).
• Sendora Cloud— issues the anonymous identifier, keeps your sign-in if you create an account (section 1), receives the usage events and diagnostics in section 7, would deliver notifications (section 8), and carries our server’s alerts to our team’s Slack — a reported leaderboard name among them (section 4).
• Sentry — receives crash reports from the app. See section 6.
• Cloudflare — carries traffic between your device and our server, and serves this website.

Our database is one we run ourselves, not a hosted service belonging to somebody else.

Game records are kept for as long as the game runs; there is no automatic expiry. Deleting the app removes what is on your device, but not what our server holds.

If you have an account, you can delete it in the app: Settings, then Account, then Delete account. That deletes your sign-in and erases the records held against your identifier — your progress, your daily runs, your journey wins, your coin ledger, the past days you opened, your bonus claims, the chapter chests you opened, the reports you made and the reports made about your name, your subscription record, and your leaderboard entries, which disappear from the public boards. Sendora Cloud erases the usage events sent about how you play (section 7) along with it. If the deletion is held for a grace period, the app says how long; signing back in before it ends cancels it, and otherwise the records are erased when it does. Deleting an account does not cancel a Sort Hurdle Plus subscription — Apple bills it until you cancel it in your Apple ID settings.

Without an account, erasure is by request: email [email protected] with the leaderboard name the game shows for you, and we erase the same records, the usage events included.

One thing is kept, and it is not about you. A receipt for a purchase — the store’s transaction number and what it was for — stays, with your identifier and purchase token stripped off it, so that it belongs to nobody. That is what lets a refund be matched to a payment months later, and stops the same transaction being credited twice. It cannot be traced back to you.

To ask what we hold about you, or for a copy, write to the same address.

Sort Hurdle is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, write to the address below and we will remove it.

If this policy changes in a way that affects what we collect or who we share it with, the date at the top changes and the new version is published here before the change takes effect in the app.

For privacy questions, data requests, erasure requests, or complaints, email [email protected].