Privacy Policy

In short

Beyond 24 is a free 24-point puzzle game. You do not create an account with an email address, a phone number or your real name: an account is generated automatically the first time you launch the app. We keep what is needed to run the game — your nickname, account identifiers, progress, scores, leaderboard entries, diamonds and settings. In the Android app, Google’s advertising SDK also processes limited device and advertising data to show ads. We do not sell your personal information, and we do not use it to train AI models.

Who we are and how to contact us

Beyond 24 is developed and operated by an individual developer. The app is published on Google Play under the developer name thunderj; DWonNut is the brand used for the website and the contact address.

Privacy questions and requests: [email protected]. We try to reply promptly. This policy covers the Android app distributed through Google Play and the web version at dwonut.com/games/beyond24.

What we collect

Account and profile

• Nickname: generated from a built-in word list. You can change it to another generated nickname; there is no free-text name field.
• UserID: a generated account identifier. It is not a password: on its own it cannot sign in to or delete an account.
• Recovery Key and device session secret: the Recovery Key restores your account on a new device; the device secret keeps you signed in on the current device. Our server stores only salted HMAC-SHA-256 digests of both, protected by a server-side secret. The plaintext Recovery Key is kept in the app’s secure storage (Android Keystore-backed) so you can view it; on the web it is kept in browser storage protected by the browser’s Web Crypto, with a local-storage fallback only where Web Crypto is unavailable (for example plain-HTTP testing on a local network).
• Settings and timestamps: interface language, gameplay preferences, account creation time and last activity time.

Game data

• Campaign progress and best scores, daily-challenge results, leaderboard entries, wins and losses, games played, diamonds and daily check-ins.
• The math expression you submit is used to check your answer. The result is stored with your submission; the expression itself is not kept as part of your account history. A pending answer may be kept on your device until it is submitted.
• Room codes, room membership and match results for online games. Room codes and invitation links are temporary and live in server memory while the room exists.

Data kept on your device

• Game progress, best scores, settings, pending submissions and your session/Recovery Key are stored in app storage or secure storage. On the web version they are stored in your browser’s local storage (including an interface-language preference and a session record).
• Android cloud backup and device-to-device transfer are disabled for app data, so the operating system does not copy your session to another device.
• Clearing the app’s data or your browser storage removes the local copy and signs you out; the copy on our server remains until you delete your account.

Technical and security data

• When you connect, our server and our content-delivery provider see your IP address, request time, requested URL and browser/app user agent. We use this for rate limiting, security, abuse prevention and troubleshooting. It is not linked to your account in our database.
• Rate-limit counters are kept in server memory (keyed by IP address and by a digest of the presented credential); they expire within 24 hours and are not written to the database.
• Technical logs may contain your UserID and a summary of game actions (for example mode, level and score) for troubleshooting. They do not contain your Recovery Key, device secret or math expressions.

Advertising data (Android app only)

If ads are enabled in the build you use, the Google Mobile Ads SDK starts with the app. Google’s documentation states that the SDK automatically collects and shares the following data with Google for advertising, analytics and fraud prevention:

• IP address, which may be used to estimate your approximate location.
• App interactions, such as app launches, taps and video views.
• Diagnostics, such as app launch time, hang rate and energy use.
• Device and account identifiers, such as the Android advertising ID (AAID), the app set ID, and other identifiers associated with accounts signed in on the device.

We do not pass your UserID or nickname to the ad SDK. Google receives this data directly under its own privacy policy. The web version has no ads.

Email

If you email us, we receive your email address and the contents of your message. We use them to answer you and keep them as long as needed for that purpose.

What we do not collect

• No chat, direct messages or other user-generated content. Neither the Android app nor the web version offers chat or any way to send text to another player. There is no free-text profile field either: nicknames come from a built-in word list. The only text you submit while playing is a math expression, which is used to check your answer and is never shown to other players as content.
• Your email address, phone number, real name, birthday or postal address, unless you send them to us by email.
• Your contacts, call log, precise location, photos, microphone or camera. We do not request those permissions.
• Health, financial, biometric or political data.
• We do not run a separate analytics or crash-reporting SDK. The ad SDK’s own diagnostics are described above.
• We do not use advertising cookies on the web version.

What other players can see

In leaderboards and online rooms, other players can see your nickname, scores, rank, room membership and game activity. Your UserID is not displayed to other players. They cannot send you messages, and there is no chat in any version of the service. We do not publish your email address or any real-world identity.

How we use data and our legal bases

• To provide the game: create your account, save progress, calculate scores, run leaderboards and online rooms, and restore your account on a new device.
• To keep the service secure: rate limiting, fraud and abuse prevention, debugging and service reliability.
• To show ads in the Android app, including measuring ad performance and preventing ad fraud.
• To answer you when you contact us, and to comply with legal obligations.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (running the game and your account), our legitimate interests (security, abuse prevention, service reliability), consent (personalized advertising and any non-essential processing where consent is required), and legal obligation. You can withdraw consent at any time without affecting processing that already took place. We do not make automated decisions that have legal or similarly significant effects on you; ad personalization is controlled by Google and your consent choices.

Ads, consent and your choices

• Ads are served by Google AdMob. We do not control which ad is shown. See Google’s privacy policy and Google’s advertising page.
• In the EEA, the UK and Switzerland, we use Google’s User Messaging Platform to ask for consent before requesting ads, and you can change your choice later. Where U.S. state privacy law requires it, the same in-app Ad privacy options entry lets you opt out of personalized ads.
• You can also reset or delete your Android advertising ID, or turn off ad personalization, in Android Settings → Google → Ads. This applies to ads served by Google on that device.
• Banner ads appear on the home, level, leaderboard and account screens. A rewarded ad can be offered in the wrong-answer dialog. Watching it is optional: if no ad is available, the solution is offered without an ad, and core play never depends on an ad loading.
• We do not sell your personal information for money, and we do not share it with data brokers. Personalized advertising through Google may be considered “sharing” for cross-context behavioral advertising under California law; you can opt out using the choices above or by emailing us.

Who we share data with

• Google — AdMob receives the advertising data described above. Google Play distributes the app and processes installation and account data under Google’s own policies.
• Cloudflare — our content-delivery and security provider processes IP addresses and request metadata to deliver the site, block attacks and keep the service available. It may set a strictly necessary security cookie on the website.
• Our hosting provider — provides the server and database on which the service runs.
• Authorities or advisers — only where required by law, to respond to a valid legal request, or to protect the rights and safety of users and the service.

These providers process data on our behalf or under their own terms; where required, we rely on their data-processing terms. We do not sell personal information. Google’s use of advertising data is governed by its own privacy policy and your consent choices. We do not use your data to train AI models.

Where data is stored and international transfers

Our server and database are hosted in the United States. Google and Cloudflare operate global networks, so data may be processed in other countries. Where required, transfers rely on safeguards offered by those providers, such as standard contractual clauses. You can contact us for more information about the safeguards used.

How long we keep data

• Account and game data: until you delete your account. There is no separate expiry.
• Device sessions: a session that has not been used for 30 days is deleted. Recovering the account or changing the Recovery Key revokes the old session immediately.
• Deletion request record: after deletion, one record containing the old UserID, status and timestamps is kept for up to 30 days so the deletion page can report completion. It contains no game data or credentials and is then deleted automatically.
• Server and CDN logs: kept for a limited period for security and troubleshooting, then deleted or overwritten through routine log rotation. We do not set a fixed retention period for these logs.
• Rate-limit counters: in server memory only, for at most 24 hours.
• Rooms and invitation links: in server memory while the room exists; they are not kept as account history.
• Backups: we may keep database backups for disaster recovery. If backups exist, they are used only to restore the service, are not used for advertising or analytics, and are deleted when replaced or no longer needed. A backup may contain data from an account deleted after the backup was made until that backup is replaced.
• Support email: kept as long as needed to handle your request.

How we protect data

Traffic between the app and our server uses HTTPS and WSS. Credentials are stored as salted HMAC-SHA-256 digests protected by a server-side secret; the plaintext Recovery Key and device secret are held in the device’s secure storage. Access to the server and database is limited to what is needed to operate the service. No method of transmission or storage is completely secure, so we cannot promise absolute security.

Deleting your account and data

• In the Android app: My Account → Delete account. A valid current session is enough, because the credential is already in this device’s secure storage.
• Without the app: use the deletion page in any browser with your UserID and Recovery Key. We show the account’s nickname and creation date so you can confirm it is the right account, then delete only after you press confirm. The key travels in the request body over an encrypted connection, never in the URL or page history.
• Deletion removes your account row, nickname, progress, verified scores, leaderboard rows, game results, diamonds, check-ins, daily-challenge records, Recovery Key digest and all device sessions from the live database. The request is retried in the background if a step fails. It cannot be undone.
• In-app deletion also clears the app’s local copy of your session, Recovery Key, progress and settings. On the web, clear your browser storage to remove the local copy.
• One deletion-request record (old UserID, status, timestamps) remains for up to 30 days as described above. Backup copies may remain until they rotate out.
• If you have lost both the device and the Recovery Key, there is no channel to recover or delete that account. A UserID, nickname or high score is not proof of ownership, and we do not delete accounts by email. You can still start a new account.

Your privacy rights

• Access and portability: there is no self-service export yet. Contact us and we will explain a secure way to verify that you control the account and to provide the data. A UserID or nickname alone is not enough.
• Correction: you can change your nickname at any time; the rest of the data is system-generated game state.
• Deletion: use the in-app or web route above.
• Objection, restriction and withdrawal of consent: contact us; for ad personalization, use the Ad privacy options or Android settings.
• Complaint: you can complain to your local data-protection authority. We would appreciate the chance to resolve it first.
• California residents: we do not sell personal information. You can opt out of personalized advertising using the choices above; we will not discriminate against you for exercising your rights.
• We aim to respond within the time required by applicable law. We may need to verify your identity before acting on a request.

Children and teenagers

The service is aimed at users aged 13 and over and is not directed at children under 13. If you are between 13 and the age of majority where you live, use it only with permission from a parent or guardian where the law requires it. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has an account, email us and we will delete it. Ads in the Android app are not configured as child-directed advertising.

Cookies and local storage

Our web app does not set cookies. It uses browser local storage for your interface language, session and local game data. Cloudflare may set a strictly necessary security cookie to protect the site. We do not use advertising or analytics cookies on the web version. You can clear local storage in your browser settings; this signs you out and removes the local copy of your progress.

Changes to this policy

We publish changes on this page with a new “last updated” date. If a change is material, we will also note it in the app or the store listing and, where the law requires it, ask for your consent. If you do not agree with a change, stop using the service and delete your account.