Privacy Policy

1. Introduction

Powered Sciences ("we," "us," or "our") built TicTacToku, a free multiplayer Sudoku × Tic-Tac-Toe game available on Android and Web. This Privacy Policy explains what information we collect, how we use it, and your rights.

Questions? Email us at alfred.gamulo@gmail.com.

2. Information We Collect

When you play TicTacToku, we store the following on our servers (AWS DynamoDB):

3. Information We Do Not Collect

We do not store:

• Your email address — it passes through Google's OAuth flow to create your account but is never written to our database or sent to the game client
• Your full name or profile picture
• Device identifiers (GAID, IDFA, Android ID)
• Precise location
• Contacts, calendar, or other on-device data
• Payment or financial information

4. Guest Play

You can play without a Google account. Guest accounts receive the same opaque player ID and can store a username and match stats. No email or Google account data is involved. Guest accounts can be linked to a Google account at any time in the app.

5. Google Sign-In

If you choose to sign in with Google, we use Google OAuth via Amazon Cognito. During sign-in, Google shares your email address with Cognito solely to create or identify your account. That email address is not written to our game database and is not accessible within the app — after account creation it is discarded.

Google's handling of your data during sign-in is governed by Google's Privacy Policy.

6. Advertising

TicTacToku is free to play. The web version has no ads. The Android app is supported by advertising.

We do not control what data Google's ad SDK collects. That data is governed by Google's Privacy Policy.

7. How We Use Your Data

We use the data we store solely to:

• Identify you across game sessions
• Display your username and stats on the leaderboard
• Validate moves and compute match outcomes server-side
• Match you with opponents based on ELO rating

We do not use your data for marketing, profiling, or any purpose beyond running the game.

8. Data Sharing

We do not sell or rent your data. We share data only as required to operate the game:

• Amazon Web Services — hosts our backend (Cognito, DynamoDB, Lambda, API Gateway) under AWS's standard data processing agreements
• Google (AdMob) — serves ads on Android as described in Section 6

9. Data Retention

Your player record (ID, username, stats, auth provider) is retained while your account is active. You may request deletion at any time (see Section 10). We do not retain data beyond what is needed to operate the game.

10. Your Rights & Data Deletion

Depending on where you live, you may have the right to access, correct, or delete the data we hold. EU, UK, and Swiss users have rights under the GDPR and UK GDPR, including the right to erasure.

To request deletion of your account and all associated data, email us at alfred.gamulo@gmail.com with the subject "Data Deletion Request." We will delete your record within 30 days and confirm by reply.

Note: deleting your account removes your player ID, username, and stats from our servers. It does not affect data held by Google (AdMob / Cognito) — contact Google for that.

11. Security

All communication between the app and our backend uses HTTPS/WSS. Our backend is authoritative — the client sends only game intents, never scores or state. All moves are validated server-side. AWS infrastructure follows least-privilege IAM policies.

12. Children's Privacy

TicTacToku is not directed at children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has created an account, contact us at alfred.gamulo@gmail.com and we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by updating the effective date at the top of this page. For significant changes we will update the app store description. Continued use of the game after changes constitutes acceptance of the updated policy.