Privacy Policy

This policy explains how Fragment Builder handles information when you visit the Fragment Builder website, play Fragment Builder in your browser, optionally create an account, or use the Fragment Builder mobile app when it's available. Fragment Builder is made and published by Adnan Vehabović, an independent developer based in Sarajevo, Bosnia and Herzegovina (the "data controller", "we", "us"). Questions? Email adnan.vehabovic@hotmail.com.

1. Playing without an account

You can play the entire single-player game — Journey, Practice, Challenge and Daily — without signing up. We don't ask for your name, email, or any personal details to start, and single-player progress works entirely on your device. An account is only needed for the optional online features (cloud sync across devices, global leaderboards and live multiplayer).

2. Data stored on your device

Fragment Builder saves your progress locally in your browser (in localStorage, under the key fragment-builder-progress) so it's there when you return. This includes:

• Levels solved, stars, times, streaks and daily results;
• Hint balance, rewards, unlocks and collected colour palettes;
• Settings — theme, skin, sound, haptics and reduced-motion preferences;
• A player name and, optionally, an email you type into the "link" screen — this email stays on your device and is not transmitted unless you sign in;
• A small record of which one-time events have fired, and your last-seen date, used to avoid duplicate analytics.

This data stays on your device and is removed when you clear your browser storage. If you sign in, the Firebase sign-in library also keeps your session (an auth token) in your browser's IndexedDB so you stay logged in.

3. Account information

Accounts are optional and handled by Firebase Authentication (a Google Cloud service). You can sign in with Google or with an email address and password. Depending on how you sign in, we receive:

• your email address (from you directly, or from Google if you use Google sign-in);
• a unique account identifier assigned by Firebase Authentication;
• which sign-in method you used;
• the display name you choose.

If you sign in with email and password, your password is never seen or stored by us — it is handled entirely by Firebase Authentication using industry-standard hashing. We do not collect your Google profile photo.

4. Cloud save

When you're signed in, your game progress is synced to a private record tied to your account (a users/<your-id> document in Cloud Firestore) so you can continue on another device by signing back in. This cloud save is private: the database security rules allow only your own signed-in account to read or write it — no other player can see it.

5. Leaderboards & multiplayer

Some information you choose to submit is visible to others:

• Leaderboards. If you post to the global or daily boards, we store your display name, aggregate scores (stars, challenge points, streak, daily stars) and a timestamp. Your display name and scores are readable by anyone viewing the board.
• Live multiplayer. In a live match we publish your display name, account id, and your per-game stars and solve times to that match, so the other players see the scoreline in real time. We don't transmit your board or moves. (Fragment Builder also has an offline "pass-a-code" multiplayer that involves no server at all.)

Please choose a display name you're comfortable showing publicly.

6. Analytics & technical data

We use analytics to understand how Fragment Builder is used — which pages and modes are popular, how far players get — so we can improve it. Two tools are involved:

• Vercel Web Analytics — a cookieless, privacy-friendly measure of aggregate usage, such as a page visited, a game started, or a puzzle solved with a star count. These events do not include your name, email or account id.
• Google Analytics (via Firebase) — collects standard analytics data such as device and browser type, approximate location derived from your IP address, and an analytics/client identifier, and may use cookies or similar technologies to do so.

We use this data to measure and improve the game, not to build advertising profiles unrelated to showing you an ad in the app, and not to track you across other apps or websites. Our hosting and infrastructure providers may also process standard technical data (IP address, browser type, timestamps, and the pages you request) in their server logs to deliver and secure the service.

7. Advertising (mobile app)

The mobile app shows ads through Google AdMob. Ads are optional to your progress — currently they appear only as rewarded ads you choose to watch in exchange for in-game hints. The website and the browser game do not show ads.

To serve ads, AdMob may collect and process:

• an advertising identifier (Android Advertising ID) and similar device identifiers;
• general device and technical information, and approximate location derived from your IP address;
• information about your interaction with ads (for example, that a rewarded ad was completed).

Whether ads are personalised depends on your choice. On first use in the EU/EEA (and where else it is required) the app shows Google's consent request (via the User Messaging Platform); your choice governs whether AdMob may use your data for personalised advertising. You can reset or change this later in the app or in your device's Google settings, and you can limit ad personalisation through your Android Ads settings. Google acts as an independent controller for some of this ad data; see how Google uses AdMob data and the Google partner policy.

8. In-app purchases (mobile app)

The mobile app offers optional purchases — one-off hint packs and a Premium subscription. Payment is processed by Google Play; we never see or store your card or bank details. Purchases are managed with RevenueCat, which on our behalf records purchase and subscription information such as the product bought, the purchase and any renewal/expiry dates, an anonymous purchase/customer identifier, and whether your Premium entitlement is active — so the app can unlock what you paid for and restore it on a new device.

Your name, email and payment method are not shared with us by this process. Subscriptions renew through your Google Play account until cancelled; manage or cancel them in Google Play → Subscriptions. See the RevenueCat privacy policy and Google Privacy Policy.

9. Information we do not collect

Beyond what's described above, Fragment Builder does not collect:

• your real name, postal address, or phone number;
• your precise location, contacts, photos, camera, or microphone;
• tracking data used to follow you across unrelated apps or websites (the advertising identifier the mobile app uses, described in "Advertising", is only for showing ads in this app);
• your card or bank details — in-app purchases are processed by Google Play, which does not share your payment method with us.

10. Service providers & international transfers

To deliver Fragment Builder, we rely on a small number of providers that process information on our behalf. They may process data outside your own country (for example, in the United States); where required, appropriate safeguards such as Standard Contractual Clauses apply.

• Firebase / Google Cloud Platform — account sign-in (Firebase Authentication), cloud save, leaderboards and multiplayer (Cloud Firestore), and analytics (Google Analytics via Firebase). See Firebase privacy and the Google Privacy Policy.
• Vercel — hosting and cookieless web analytics; like any web host, it may process standard request data (IP, browser type, pages requested) in server logs. See the Vercel Privacy Policy.
• Google Fonts — the fonts used on this website and in the browser game are served by Google Fonts, so loading our pages sends your IP address to Google as part of that request. See the Google Privacy Policy.
• Google sign-in — if you choose to sign in with Google, that provider processes your sign-in under its own privacy policy in addition to this one.
• Google AdMob (mobile app) — serves the in-app ads and processes the ad-related data described in "Advertising". See Google Privacy Policy.
• Google Play Billing (mobile app) — processes in-app purchases and payments; we never receive your payment details.
• RevenueCat (mobile app) — manages purchases and subscription entitlements on our behalf. See the RevenueCat Privacy Policy.

We do not sell your personal information. Beyond serving the in-app ads described above (subject to your consent where required), we don't use your data to advertise to you elsewhere. We may disclose information if required by law, or to protect the rights, safety and property of players and of us.

11. Legal basis for processing (EU/EEA)

Where the GDPR applies to you, we process your account, cloud-save, leaderboard/multiplayer and in-app-purchase data because it is necessary to provide the features you've asked to use (performance of a contract); we rely on your consent where relevant — for example, optional analytics and personalised advertising (which you accept or decline in the app's consent request); and on our legitimate interest in operating, securing and improving the game, including preventing cheating and abuse and showing non-personalised ads where you have not consented to personalised ones.

12. Children

Fragment Builder is suitable for a general audience but its account system is not directed at, and is not knowingly used to collect personal information from, children under 13 (or under 16 where a stricter age applies under EU/EEA member-state law). There is no age-verification step, so we rely on this policy and on parental supervision. If you believe a child has created an account or provided us personal information, contact us and we will delete it.

13. Retention & deletion

Data on your device stays until you clear your browser storage. If you create an account, we keep the associated data (your profile, cloud save, and any leaderboard or match entries) for as long as your account exists.

You can delete your account and its data from inside the app: open Settings → Account & backup while signed in and choose Delete account. This permanently removes your sign-in credentials, cloud save (users/<your-id>), leaderboard entry and recent tournament scores. Single-player progress saved on your own device is not touched — you can clear that any time by clearing your browser or app storage. Full instructions, including how to request deletion without the app, are on our account deletion page, or you can email adnan.vehabovic@hotmail.com and we'll remove it.

14. Your rights

Depending on where you live, you may have rights to access, correct, delete, and receive a copy of your personal data, to object to or restrict our processing of it, to withdraw consent, and to complain to a supervisory authority — for example the Personal Data Protection Agency of Bosnia and Herzegovina, your local EU/EEA authority, or, in the United States, your state attorney general or the FTC. To exercise any of these, contact us at adnan.vehabovic@hotmail.com; for most single-player data you can also simply clear your browser storage. We'll respond to verifiable requests within the timeframe required by applicable law.

15. Changes

We may update this Privacy Policy from time to time, for example as new features are added. The "last updated" date above reflects the current version; any material change will be shown here.

16. Contact

Questions about privacy? Email adnan.vehabovic@hotmail.com or use our contact page.