Privacy Policy

Applies to: Topper10 (Android, package com.tezzvo.topper10). Publisher: TEZZVO.
Effective date: 3 September 2026 · Last updated: 20 September 2026

The short version

• The game needs no account. You can play the daily puzzle, keep a streak and finish Journey without ever signing in.
• Your answers and guesses never leave your device, and nothing you type into a puzzle is ever shown to another player. A finished puzzle is recorded as a score, not as the words you entered, and the half-finished board the app saves so you can pick a category puzzle up where you stopped is stripped out of the backup before it is uploaded — the same treatment the daily and Journey boards already had (§2). (Two things you type are meant to be seen, and only by a group you chose to join: the nickname you pick for a friends leaderboard and the name of a group you create — §2.)
• Your profile display name stays on your device. Neither it nor your avatar is ever included in a cloud backup. Your avatar leaves the device in exactly one case: if you opt in to a friends leaderboard, it is published beside your nickname and score inside that group (§2).
• Cloud save is on, and there is nothing to switch on. The app backs up your progress — streak, coins, achievements, Journey position, recent results — to Google Firebase under an anonymous account it creates for itself, so a reinstall or a new phone doesn’t wipe it. It happens without being asked for, and nothing switches it off before the first upload; what there is, is Settings → Data → “Delete my cloud data”, which removes the copy whenever you like and then leaves cloud backup off on that device until you ask for it back (§6).
• Two further things are opt-in and stay off until you choose them: the invite-code friends leaderboard (a nickname, your avatar and your daily score, visible only to the small group you join), and signing in with Apple or Google so your backup survives a new device. Cloud save itself is not one of them — see the bullet above.
• The app shows ads served by Google AdMob, which use a resettable advertising ID. In the EEA and the UK a Google consent prompt asks you first.
• We do not sell personal data.

1. Who we are

Topper10 is published by TEZZVO, which is the data controller for everything described on this page. Privacy contact: privacy@tezzvo.com — a monitored mailbox, read by the person who runs TEZZVO. Write to it for any request under this policy, wherever you live; we answer within one month.

We have not appointed a Data Protection Officer. The app processes no special-category data and carries out no large-scale systematic monitoring, so GDPR Art. 37 does not require one.

2. What we collect, why, and the lawful basis

We do not collect your phone number, contacts, photo library, precise location, calendar, microphone or camera input, health data or files. We collect no name and no email address at all unless you choose to sign in. Three pieces of text you type can leave the device at all: the nickname you choose for a friends leaderboard and the name of a group you create — both deliberate, both visible only to that group’s members; and the note you write in “Found an error?” after a puzzle, which your own mail app sends to corrections@tezzvo.com when you tap send — that one reaches us with the address you send it from, and is used only to fix the question. Puzzle text never reaches a leaderboard and never reaches analytics.

What analytics can never carry. This is two mechanisms, not a promise. The event list is closed — every event is declared in advance with the exact fields it may carry, and none of those fields is free text. The event recorded for each guess carries the puzzle, the guess’s position, whether it was right and which rank it filled; there is no field for the words themselves. Behind that, a filter strips any property whose name contains name, avatar, answer, guess, label, email, phone, token or secret before anything is handed to a provider. So your display name, your avatar, the answers, and the words you type are not sent to PostHog — and would still not be if someone added the wrong field tomorrow. That promise is load-bearing in every build that carries the analytics key (§8). The installation id that travels with these events is a random 128-bit value the app generates on your device: not a hardware identifier, not an advertising ID, not an install referrer. Clearing the app’s data resets it.

Notifications. If you turn on the daily reminder, the app schedules a local notification on your device. No push tokens are sent to us and no server is involved.

Cloud save

Cloud save mirrors the progress part of your local save to Google Firebase under an anonymous, app-scoped identifier that the app creates for itself the first time it backs up. It is on in a released build and nothing switches it off before the first upload — it is how a reinstall or a new phone keeps your streak, and it is the reason the filter described next exists. It carries no display name and no avatar — both are stripped on the device before every upload, so they stay per-device by construction. It keeps the most recent 90 days of daily results — anything older is never uploaded — and your Journey record up to a 200-entry ceiling, which is set above a complete run of the campaign, so no level you have cleared is left behind. Delete it at any time from Settings → Data; your local progress is untouched.

No typed text is carried. If you leave a category puzzle part-way through, the app saves that board so you can pick it up where you stopped, and the saved board includes the guesses you had already entered — on your device only. That board is stripped out of the backup before every upload, and so are the equivalent boards for the daily puzzle and for a Journey level. What the backup carries from a category puzzle is your best score on it and whether you finished it: numbers, not words. If you reinstall, your scores come back and the half-finished boards do not.

Friends leaderboard (opt-in)

The leaderboard is closed and invite-only: you see, and are seen by, only the group of up to 50 people you explicitly joined or created with a code someone gave you. There is no public or global board, no chat, no messaging, and no way to browse or search for other players.

• Consent gate. Before your nickname or a single day’s score ever leaves your device, the app asks you to agree that they will be visible to the people in that group.
• Nickname, not name. The leaderboard field is a separate value from your profile display name, and your display name is never copied into it. If you create a group, the name you give it is stored with the group and shown to everyone who joins, so keep it as impersonal as your nickname.
• Moderation. A nickname is checked on the device against a length, character-set and word-list filter, then re-checked against a server-enforced allow-list before it can be stored. That stops malformed and obviously abusive input; it cannot catch every offensive string in every language, which is what the next two controls are for.
• Report. Any member can report another member’s row from inside the app. Reports come to us; we aim to review and act within 24 hours.
• Group owner controls. Whoever created a group can remove a member, rotate the invite code (instantly invalidating the old one), or blank a member’s nickname for the day.
• Leaving. Any member can leave a group at any time from the leaderboard screen. Leaving deletes every score row you posted in that group — your nickname, your avatar and your score, on every day — and ends your membership. It touches nothing else: your cloud save and your other groups are unaffected. If the deletion cannot finish, because you are offline or the app is closed part-way, the app tells you so and tries again the next time you open the leaderboard.
• Being removed. If a group’s owner removes you from inside the app, your row for the current day is deleted immediately by them, and the rest of your rows in that group are deleted by your own app the next time you open the leaderboard, or finish a daily puzzle while you are still listed in a group. It is the same outcome as leaving, a little later. Until then those older rows still exist, although the group’s board only ever shows the current day; if that phone never comes back to the app, they stay: they carry a 90-day expiry stamp (§5), but nothing acts on that stamp — there is no expiry sweep on this plan and none is pending — so a row can outlive it. If we remove you as a moderation action, every one of your rows in that group goes at once instead, because we run that from our own tools rather than from your phone. “Delete my cloud data” (§6) remains the one action that clears your rows out of every group at once.

Signing in (opt-in)

By default the app is anonymous. If you turn on Settings → Back up your progress you can sign in with Sign in with Apple (iOS) or Google (Android) — each platform offers exactly one provider. Signing in links your existing anonymous save to a provider account so it is recoverable on a new phone, which an anonymous-only save cannot be. The name and email the provider shares are used for account management only: never for analytics, never for advertising, never shared onward, never visible to other players. Signing out returns you to a fresh anonymous session; deleting your account removes the account record itself (see §6).

3. Children

The app is not directed to children under 13 (or the applicable age of digital consent in your country, up to 16 in parts of the EEA). We do not knowingly collect data from children. Content rating: we completed the Google Play / IARC content-rating questionnaire — no violence, sex, language or gambling content of any kind, and alcohol appears only as the subject of production and consumption statistics in four questions — and the band the questionnaire returns is the one shown on the store listing, which differs by territory. We will list it with a target age group of 13+, carrying a Google Play “users interact” notice because of the opt-in friends leaderboard. The app is not enrolled in Google Play’s Designed for Families programme. If you believe a child has provided us data, contact us and we will delete it.

4. Who we share data with

We do not sell personal data. We share it only with the recipients below, each acting as our processor under a data-processing agreement (Google AdMob acts as an independent controller for ad serving).

International transfers. Two of our processors are in the United States, and a third serves globally.

• PostHog (product analytics) — United States. The project is on PostHog’s US Cloud (us.i.posthog.com), and a build made after we attached the key on 14 September 2026 sends the events and the installation id described in §2 there, to be processed in the US — however that bundle reached the device: a Google Play release, closed testing included, an over-the-air update, or one of our internal test builds (§8). Until 14 September 2026 this page named PostHog’s European region and described these events as remaining inside the EEA. That was wrong — we are correcting it here rather than quietly dropping it, because anyone who read the old sentence read the opposite of the truth about where their data goes. The US is where the data centre is, not a limit on where processing happens. The agreement we signed puts the data in the region we chose — the US — and then says plainly that PostHog will process it “outside of the Protected Area including in the US and elsewhere as identified on the Subprocessor Page”. There is no EU-only guarantee and we are not implying one: the current list is at posthog.com/subprocessors, and PostHog owes us fourteen days’ notice, with a right to object, before adding to it.
• Google Firebase (cloud save, friends leaderboard, account records) — United States, the nam5 multi-region.
• Google AdMob serves ads from Google’s global infrastructure.
• Sentry (crash reporting) is the one configured for the EEA (ingest.de.sentry.io). It sends nothing today, because no crash-reporting SDK is in the shipped build at all (§8).

The transfer basis for PostHog, named — we signed their data-processing agreement on 15 September 2026. Until that date this page said we had verified no transfer mechanism for PostHog at all, because no controller–processor agreement existed. One does now, and it carries two mechanisms that stand at the same time.

• The EU-US Data Privacy Framework. PostHog confirms that it participates in the EU-US Data Privacy Framework, the UK Extension to that Framework and the Swiss-U.S. Data Privacy Framework, and undertakes to keep that self-certification up and to tell us if it lapses or is terminated.
• The Standard Contractual Clauses, which do not merely stand behind it. The agreement incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum as though set out in full — expressly “notwithstanding” the Framework clause, with us as data exporter and PostHog as data importer — and makes the Clauses prevail over the rest of the agreement if the two ever conflict.

So the Clauses are not conditional on the Framework surviving. That matters, because the Framework’s two predecessors — Safe Harbour and Privacy Shield — were both struck down; if that happened again, or if PostHog left the Framework, the Clauses already apply on their own terms and the agreement has the parties settle an alternative as well.

Two things this does not settle, and we are not going to blur them. First, Google’s basis is still open: the Firebase and AdMob transfers would ordinarily rest on Google’s own EU Standard Contractual Clauses and UK Addendum under its Data Processing and Security Terms, and that has not been reviewed by a lawyer for this app. Second, no lawyer has read any of this, the paragraphs above included — signing a counterparty’s agreement establishes a mechanism, it is not a legal review of our processing as a whole. Both are open items in our legal review. A build made after 14 September 2026 does send the §2 events to the United States, however it reached your device — a Google Play release, closed testing included, an over-the-air update, or one of our internal test builds (§8) — and if you would rather not take part while the second point is open, Settings → Privacy → “Analytics & crash reporting” turns it off (§6). We may also disclose data if required by law.

5. Retention

• Anonymous analytics events (PostHog): collected by builds made after 14 September 2026 — see §8 for which builds those are. They are kept for 30 days and then deleted or aggregated. That is the retention our analytics plan applies; it is not a window we chose, and configurable retention is a paid-tier feature we do not use.
• Crash reports (Sentry): 90 days — Sentry’s standard error retention — then deleted. Also not collected today (§8).
• Advertising data (AdMob): per Google’s retention policy.
• On-device data: until you clear app data or uninstall — under your control, not ours.
• Cloud save (Firebase): kept until you delete it. There is no inactivity expiry, so nothing disappears behind your back. The save itself only ever holds the most recent 90 days of daily results, because that is all the app uploads.
• Friends-leaderboard nickname, avatar and score: every row is written with a 90-day expiry stamped on it. Being straight with you about what that stamp does: nothing, today, and we are not going to imply otherwise. Acting on it would need Firestore’s automatic expiry sweep, which is only available on the paid plan; this game runs on the free one by choice, so no such sweep is switched on and none is pending, and a row can outlive the 90 days it is stamped with. What removes a row now, rather than on that stamp, is you leaving the group, you being removed from it, “Delete my cloud data” (§6), which takes every one of your rows out of every group at once, or a moderation removal by us. If none of those reaches a row you want gone, email privacy@tezzvo.com and we will remove it. Leaving a group deletes every row you posted in it (§2), and being removed from one reaches the same end — the current day at once, the rest the next time your own phone opens the leaderboard or finishes a daily. The group being deleted reaches it too, on that same next-open sweep: whoever deletes a group can reach their own rows in it, never yours, so yours are cleared by your own phone. A row only waits for the stamp above if none of those ever happens.
• The leaderboard group itself — its name and the anonymous id of whoever created it: kept until the group is deleted. Deleting your cloud data deletes every group you created (§6), and the copy of its name held against the invite code goes at the same moment. A group you merely joined is not yours to delete: it stays until the person who created it deletes their data, or until we remove it.
• Account name and email (Firebase Authentication), if you signed in: kept while the account exists, deleted immediately when you delete your account.
• Reports filed by or against a leaderboard row: stamped to expire 12 months from the day the report is filed, as moderation history — and on the same footing as the row above, which is to say nothing acts on that stamp, for the same paid-plan reason, so an untriaged report can outlive it. What does remove one is closing it: a report that has been looked at is deleted outright. A report records who filed it, whose row it was about, and the reason, so it outlives the row it concerns and is not removed by deleting your cloud data.
• Support emails: up to 24 months after the matter is closed.

6. Your rights & how to delete your data

Under the GDPR/UK GDPR (and comparable laws such as CCPA/CPRA and LGPD) you can request access, rectification, erasure, restriction, objection, and portability, and withdraw consent at any time.

• Delete your cloud save: open Settings → Data → “Delete my cloud data” in the app. It permanently deletes the copy of your progress stored on our servers (streak, coins, achievements, Journey position) and your anonymous account itself. If you had connected an Apple or Google account, that account is deleted too, and the sign-in you used is no longer linked to anything here. We also remove your rows from any friends leaderboards you joined — your scores, your membership and your list of groups. If part of that cannot be reached at the time — a group pass the server refuses, say — the rest still goes, and the delete does not undo itself. It also does not run twice: once it has reported success the control is replaced by “Turn cloud backup back on”, and turning it back on gives you a brand-new account rather than the one you deleted, so a second attempt has nothing left to reach. If you think something was left behind, write to us with the date you deleted and we will finish it by hand. Your local progress on the device is untouched.
  
  It also switches cloud backup off on that device, and leaves it off. We stop syncing, and we do not create a new anonymous account to sync into — not then, not on the next launch, not ever, until you ask for one. That stays true every time you open the app.
  
  Two things turn it back on, and both are something you do on purpose. Tapping Settings → Data → “Turn cloud backup back on”, which starts a new anonymous account: the one you deleted is gone and nothing from it comes back. The row in the app does not spell that out, which is why it is written here. Or completing a sign-in to an Apple or Google account you already have, which adopts that account instead of making one. What comes down with it depends on what is there: if that account holds a saved game further ahead than this device, the app asks which copy you want to keep before it applies anything; otherwise nothing is brought down, which after a delete is the ordinary case, because the account you deleted was that one. One honest limit on that last part, and one guarantee. The limit: the app says “there was nothing to bring back” only when you sign in from Settings, and says nothing at all when the sign-in comes from a prompt elsewhere in the app. The guarantee: if the read of that account’s backup fails, the app says so rather than reporting an empty account — “we couldn’t check this account’s backup… we won’t overwrite the backup until we can read it” — and it holds every upload until a read succeeds, so a bad connection cannot overwrite a backup nobody managed to see. Until one of those two finishes, nothing is created and nothing is uploaded: opening the sign-in screen and cancelling it, a sign-in that fails, or the phone closing the app while the sign-in screen is open all leave your deletion exactly as it was.
  
  While cloud backup is off, friends leaderboards do not work. You cannot join or create a group, because a group needs an account on our servers and you no longer have one. The app tells you so and points you back at the setting; turning cloud backup back on makes them work again.
  
  One thing it does not reach, and we would rather name it than let you assume otherwise: a moderation report filed by or about you, which is kept for the window in §5.
  
  A group you created is deleted along with everything else. An earlier version of this page said the opposite, because it was true: the group’s record — the name you gave it and the anonymous id of its creator — used to be left standing, and so did the copy of that name held against the invite code, because nothing in the app could remove either. Both are deleted now, as part of the same action and before your account itself goes. The group then disappears for everyone who was in it, and each of their own scores in it is cleared by their own phone the next time they open the leaderboard — nobody deleting a group can reach anybody else’s scores directly. If the server refuses that step, the rest of the deletion still goes ahead and the group can be left behind; email privacy@tezzvo.com and we will remove it for you.
• Leave one leaderboard group from the leaderboard screen, without deleting anything else. Read this one carefully: leaving ends your membership and stops any further score being published, but it does not remove the scores you already published to that group. They are stamped to expire on the 90-day schedule in §5, but nothing acts on that stamp — there is no expiry sweep on this plan and none is coming (§5) — so a row can outlive it. What removes them now is “Delete my cloud data” above, immediately and from every group at once. If you want them gone from one group sooner, email us and we will remove them.
• Delete your account (if you signed in with Apple or Google to back up your progress): the same Settings → Data row reads “Delete my account” once you are signed in. That deletes your cloud save, the sign-in link and the account record itself. If the provider asks you to sign in again first, that is a one-time security check for a destructive action — sign in and the deletion completes. See the dedicated account deletion page for the full in-app steps and a contact route if you no longer have the app installed.
• Object to analytics, or withdraw consent: open Settings → Privacy in the app and turn off “Analytics & crash reporting”. With it off, no new event, screen view or crash report is collected: each one is suppressed at the source. Events already queued on your device before you switched it off may still finish sending to PostHog. Analytics is on unless you turn it off, and in a build made after 14 September 2026 it does send the §2 events until you do (§8).
  
  Note what it is not doing. Crash reporting is not running at all — no crash-reporting SDK is in any build we make (§8) — so the crash half of that switch has nothing to stop, in any build. In a build made before 14 September 2026, neither has the analytics half. And permanently: this switch reaches our analytics only — it does not switch off ads or the advertising ID. AdMob has its own, separate consent path (the Google prompt in the EEA and the UK) and reads the advertising ID regardless of this toggle. They are independent controls; neither is a master switch over the other. Use the ads controls below for ads.
  
  You can also object in writing to the address below. To reset the anonymous installation id, clear app data or reinstall.
• Access / erasure / portability: email privacy@tezzvo.com, and quote your anonymous installation id so we can find the matching analytics and crash records — it is shown in the app under Settings → Privacy → “Your data”, with a Copy button. We will still act on your request without it. We respond within one month, extendable by two months for complex requests.
• Ads: reset or delete your Advertising ID in Android Settings → Privacy → Ads, and use the Google consent prompt to change your ad-personalisation choices.
• Complaint: you may complain to your supervisory authority — in the EU/EEA your national data-protection authority, in the UK the ICO (ico.org.uk), in Brazil the ANPD (gov.br/anpd). You are always free to complain to the authority where you live.

Because analytics data is not linked to your identity, we may be unable to single out those records without the installation id (GDPR Art. 11). Cloud save, leaderboard and account data are keyed to your account and are deletable in the app whether or not you can quote an id.

7. Security

Data in transit to Google and to PostHog — and to Sentry once crash reporting is activated, which it is not today (§8) — is encrypted with HTTPS/TLS. On-device data uses the platform’s app-private storage. Access is enforced server-side by security rules: your cloud save is readable and writable only by your own account, and a leaderboard group’s rows only by the members of that group. Inside a group those members do see each other’s nickname, avatar and score — that is the feature, and §2 sets out exactly what it publishes; outside it, one player cannot reach another’s data. No system is perfectly secure, but we keep third parties to a minimum.

8. What is switched on today

A released build does not necessarily run every component described above, so here is the honest state as of the “last updated” date:

• Ads: on. The released build serves Google AdMob ads and uses the advertising ID, with the Google consent prompt in the EEA and the UK.
• Cloud save: on, automatically. A released build mirrors your progress to Google Firebase under an anonymous account it creates for itself. You are not asked, and nothing switches it off before the first upload; “Delete my cloud data” (§6) is the control you have, and it leaves cloud backup off afterwards until you ask for it back. The friends leaderboard and Apple/Google sign-in: available, and inert until you opt in.
• Analytics: on in every build made after 14 September 2026. Crash reporting: still not, in any build. The PostHog SDK is part of the app, and on 14 September 2026 we attached a PostHog key to the environments we build from. That key is written into a JavaScript bundle at the moment that bundle is built, so a build made after that date does create the analytics client and does send the §2 events to PostHog’s United States region (us.i.posthog.com), while a build made before it carries no key at all: it never creates the client, and it sends nothing. Which side your copy is on: it is on the sending side from the moment it runs a bundle built after 14 September 2026, however that bundle reached it: a Google Play release (closed testing included), one of our internal test builds, or an over-the-air update — which does not go through Play, so a copy can cross over without Play updating anything. On 16 September 2026 a build made after we attached the key was released to testers on Google Play’s closed testing track, and an over-the-air update built after the key was published the same day, so a copy installed from Google Play sends once it has taken either of them. Wherever it is on, it is on unless you turn it off — Settings → Privacy → “Analytics & crash reporting” — and turning it off stops new events at the source, though events already queued on your device may still finish sending (§6). What is sent is the fixed list in §2 and nothing else: no display name, no avatar, no answers, and none of the words you type. Our own crash reporting is a different matter and is not running: there is no crash-reporting SDK of ours in the shipped build at all, so we receive no crash reports, and the Sentry rows above describe what would happen if that changes rather than what happens now. The Google Mobile Ads SDK still reports its own faults to Google, which is why Crash logs appears on our Play data-safety form. Note also that this switch covers our analytics only — it does not reach ads or the advertising ID, which have their own controls (§6).
• The automatic 90-day leaderboard expiry: not switched on, and not pending. Rows are written stamped with the expiry, but the sweep that would act on it is a paid-plan feature and this game runs on the free plan by choice, so there is nothing scheduled here to wait for — see §5 for what does remove a row.

9. Changes

We’ll update this page and the “last updated” date for material changes, and surface an in-app notice for significant ones.

10. Contact

privacy@tezzvo.com