Privacy Policy

Who we are

Florabixx is made and run by Styves Goupil, an independent developer in Quebec, Canada. In this policy, “we” means Styves Goupil.

Person in charge of the protection of personal information, under Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25): Styves Goupil, [email protected].

Information we collect

Your account

Depending on your device, your Florabixx account works in one of these ways:

• Game Center (when available): the app signs you in automatically with Game Center. We receive the Game Center player identifier that Apple assigns to you for our games only (an opaque code), along with Apple’s signature so we can verify it. We do not receive your Apple ID email address or your real name.
• Device account: without Game Center, the app creates a random secret code and keeps it in the iOS Keychain (synced by iCloud Keychain if you use it). Our server only keeps a hashed version of it.

For every account, we also keep:

• Your username, which you choose yourself (the app may pre-fill it with your Game Center alias). It is public: see What other players can see. You don’t have to use your real name.
• Your friend code, generated automatically so your friends can add you.
• The date your account was created.

Your games

• Scores and words found, for each puzzle, mode (Zen, Hardcore, Blitz) and language (French, English, Quebec French).
• Games in progress: words found, mistakes, Blitz time and hints used, so you can pick up where you left off.
• Streaks, medals and achievements, calculated from your games.
• Suggested words: words you propose for the Quebec French dictionary, with your username.
• Preferences: game language and notification choices.
• Purchases: if you buy “Remove Ads”, Apple handles the payment and the app sends us the transaction signed by Apple, so we can activate the purchase on your account. We keep the transaction ID, the product, the date and the environment (real or test purchase). We never see your payment details.

Your interactions with other players

• Friends: your friend requests and friendships.
• Reactions: the ones you send and receive between friends. They are preset, emoji-style messages: there is no free text.
• Blocks: the players you block.
• Reports: the ones you file or that are filed about you, with the reason, the place in the app and the optional note written by the person reporting.

Technical data

• Sign-in log: when you sign in, create an account or come back after at least an hour away, we record your IP address, your device type (iOS app, mobile web or desktop) and your user agent (name and version of the app or browser and of the operating system).
• Abuse protection: your IP address is used, in memory only, to limit the number of attempts (for example, account creations).
• Notifications: if you turn them on, your device’s notification token (provided by Apple) and your device language.
• Website: our web pages use no cookies, neither for signing in nor for advertising.

Usage statistics and crash reports

• Usage statistics: to improve the game, the app sends usage statistics to our own servers (Hetzner, in Helsinki, Finland): app opens, session length, puzzles started and finished, words found, hints, ads shown and purchases. We don’t use any analytics tool from another company.
• These statistics are linked to your account when you are signed in. Otherwise, they are linked to a random installation ID created by the app, which is not an advertising identifier. We look at them in aggregate; they are never shared with an ad network and are not used to target you with ads.
• Crash reports: if the app crashes or hangs, the app sends us the diagnostic report produced by iOS (Apple’s MetricKit): device model, iOS and app versions, and details of the crash or hang. It is only used to fix the problem.

What we don’t collect

Florabixx does not ask for access to your location, contacts, photos, camera or microphone. We don’t ask for your real name, date of birth or address.

Why we use it

• To run the game: your account, saving your progress, leaderboards, the podium, friends and reactions.
• To send you notifications, if you turned them on.
• To activate your “Remove Ads” purchase and keep our accounting records.
• For security and moderation: preventing fraud, cheating and abuse, handling reports and enforcing the Terms of Use.
• To keep the game free through advertising.
• To improve Florabixx using our usage statistics and crash reports.
• To answer you when you write to us.

What other players can see

• All players can see your username and scores on the leaderboards (daily and all-time).
• Your friends also see your results among friends, your medals, the weekly podium and the reactions you send them.
• Your friend code is meant to be shared: anyone who has it can send you a friend request.
• No one can see your Game Center identifier, your secret code, your IP address, or the players you block or report. A blocked player is not notified.

Ads, consent and tracking

Florabixx is free thanks to ads, served by Google AdMob.

• On first launch, a Google consent form asks whether you accept personalized ads. Then iOS asks whether you allow Florabixx to track your activity (Apple’s tracking request).
• If you accept, Google may use your device’s advertising identifier and data about your usage to show you more relevant ads and measure their performance.
• If you decline, you still see ads, but they are not personalized. Google still processes some technical data (IP address, device type, approximate region inferred from the IP address) to serve ads, cap how often they appear and prevent fraud.
• You can change your mind at any time: in Florabixx, under Settings → Ad choices, and in iOS Settings, under Privacy & Security → Tracking.
• Rewarded ads (to get an extra hint) are always optional: you choose whether to watch them. The “Remove Ads” purchase removes all ads, these included.
• We limit ad content to a level suited to the app’s 13+ rating.
• Inappropriate ad? Report it in Settings → Report an ad, or with the AdChoices icon shown on the ad itself (that report goes straight to Google). When you report an ad to us, we receive its format, where it was shown in the app, the ad network and the ad’s technical identifier, along with the reason and your optional note.

To learn how Google uses data: policies.google.com.

Notifications

Notifications are optional and iOS asks for your permission. If you agree, we keep your device’s notification token and language so we can write to you in your language when a friend beats you on a puzzle, to help you keep your streak, or for the Sunday podium.

Choose which ones you get in Profile → Push notifications, and turn them all off in iOS Settings (Notifications → Florabixx). The token is deleted when you sign out or delete your account.

Our service providers

A few providers help us run Florabixx. They process your information only to provide these services to us, under their data protection commitments.

• Hetzner Online Finland (EU)

  Hosting for our servers, database, usage statistics, crash reports and backups, in a data centre in Helsinki.

• Cloudflare United States · global network

  DNS, network proxy, caching and attack protection. Every request goes through Cloudflare, which therefore processes your IP address.

• Resend United States

  Sending our internal moderation alerts, to the person in charge only (usernames of the players involved, reason and note of the report).

• Apple United States

  Push notifications, Game Center identity and App Store purchases.

• Google United States

  AdMob: serving ads and managing your ad consent. Google Drive: storing a copy of our backups, encrypted on our server before it is sent. Google cannot read it.

Definitions: to show a word’s definition, our server queries Wiktionary with that word only. No information about you is sent.

We may also disclose information when the law requires it (for example, a court order) or to protect someone’s safety.

Transfers outside Quebec

Our servers are in Finland and several providers are in the United States. Your information may therefore be communicated and stored outside Quebec, including in Finland (Hetzner, European Union) and the United States (Cloudflare, Resend, Apple, and Google for ads and for the encrypted copy of our backups in Google Drive).

Before communicating personal information outside Quebec, we carry out a privacy impact assessment, as the law requires: how sensitive the information is, why it is used, the protection measures in place (including contractual ones) and the legal framework where it will be processed. We only proceed if the assessment shows the information will be adequately protected. Once abroad, it may be subject to the laws of those countries.

How long we keep it

• Account and game data: as long as your account exists. It is erased when you delete your account.
• Sign-in log (IP address, device): up to 12 months, and erased as soon as you delete your account.
• Abuse protection: in memory only, cleared after about an hour.
• Usage statistics: up to 400 days, then erased automatically. Those linked to your account are erased as soon as you delete it; those linked only to an installation ID stay until the end of that period.
• Crash reports: 90 days, then erased automatically.
• Reports (about players or ads): until they are handled, then kept in the moderation history as long as the accounts involved exist.
• Approved suggested words: they stay in the dictionary after you delete your account, with no link to you.
• Deletion log: when an account is deleted, we keep only its internal number and the date, with no name or contact details.
• Purchase transactions (“Remove Ads”): kept for our accounting records, even after you delete your account, but with no link to you.
• Backups: a copy of the database is made every night and kept for 30 days on our server. An encrypted copy is also sent to Google Drive (Google LLC, United States): it is encrypted before it leaves our server, and Google cannot read it. It is also kept for 30 days. The copies are then erased automatically. Deleted data therefore also disappears from backups no later than 30 days after it is deleted.
• Your emails: as long as needed to answer you and follow up on your request.
• Ads: Google keeps its advertising data under its own policies.

Security

We take reasonable measures to protect your information: encrypted connections (HTTPS), hashed secret codes, server and admin access limited to the person in charge, attempt limits and daily backups, encrypted before they are copied off our server. No measure is perfect: protect access to your device and to your Game Center account.

If a confidentiality incident creates a risk of serious injury, we notify the Commission d’accès à l’information and the people affected, as the law requires.

Your rights

At any time, you can:

• access the personal information we hold about you;
• have it corrected if it is inaccurate, incomplete or ambiguous;
• have it deleted, along with your account (see Deleting your account);
• withdraw your consent, for example to notifications or personalized ads;
• get a copy of it in a structured, commonly used technological format (portability).

To exercise a right, email us at [email protected] with your username. We may ask you to confirm that the account is yours. We respond within 30 days.

If you are not satisfied with our answer, you can file a complaint with the Commission d’accès à l’information du Québec.

Deleting your account

In the app: Profile → Delete my account. You confirm, then the deletion is immediate and permanent. You can also email us at [email protected].

Deletion erases everything tied to your account from our server: your username, your secret code, the link to your Game Center identifier, your friend code, scores, games, medals and streaks, friendships, reactions sent and received, notification preferences and tokens, blocks, reports you filed or that were filed about you, your sign-in log, the usage statistics and crash reports linked to your account, and your suggested words that were not approved.

The only exceptions:

• suggested words that were already approved stay in the dictionary, with no link to you;
• the deletion log keeps the account’s internal number and the date;
• purchase transactions are kept for our accounting records, with no link to you;
• statistics linked only to an installation ID, not to your account, stay until they are erased automatically (400 days at most);
• backups, including the encrypted copy in Google Drive, are erased no later than 30 days afterwards.

The “Remove Ads” purchase is tied to your Apple ID, not to your Florabixx account: you can restore it on a new account.

Players under 14

Florabixx is rated 13+ on the App Store: the game is built around daily leaderboards, and its dictionaries include informal words and Quebec swear words (sacres).

In Quebec, collecting personal information from a minor under 14 requires the consent of a parent or guardian. If you are under 14, you need that consent before creating an account.

If we learn that an account was created by someone under 14 without that consent, we delete it. A parent or guardian can write to us at any time to access, correct or delete their child’s information.

Changes

We may update this policy, for example when a new feature requires it. The date at the top of the page shows the latest update. If a change is significant, we will announce it in the app or on this page before it takes effect, and ask for your consent where the law requires it.

Contact us

• Styves Goupil

  Person in charge of the protection of personal information
  [email protected]
  Quebec, Canada

Have a question about the game rather than your information? See the Support page.