Who this policy is for

This Privacy Policy explains how YVB ("we", "us", or "our") handles information when you use the SU2KU mobile application on iOS or Android.

Information we use

Account and social features

If you create an account, we collect your email address, username, password in securely hashed form, session tokens, and basic account timestamps. Your username can be found by other players. Your email address and password are not shown to other players.

YVB stores account records, device registrations, friend requests, and accepted friendships. Multiplayer boards remain on the players’ devices. Players in the same match can see each other’s public username, moves, progress, mistakes, and result as required by the selected mode. In Coop, the selected friend can also see the quick reply, custom text, reaction, or drawing you choose to send.

Solo play and device data

Solo progress, settings, streaks, unfinished boards, onboarding status, and multiplayer board state are stored on your device. Collaborative moves are sent directly between the two devices through an encrypted, media-disabled WebRTC data channel when available; SU2KU does not use that connection for camera or microphone media. If the direct connection is unavailable, the app sends one coalesced state snapshot to YVB over HTTPS. YVB stores it in a secret-addressed mailbox encrypted at rest until the other device acknowledges it, or for no more than 30 days. Coop quick replies, custom text, reactions, and drawings use only a version-negotiated, encrypted direct data channel. During normal delivery they do not use HTTPS, the YVB mailbox, push, SQL, or the fallback gameplay snapshot, and YVB cannot read, receive, or store their content. If the selected friend is offline, uses an incompatible version, or the direct channel is unavailable, the interaction is not delivered or recovered later. The only content-upload exception is an explicit recipient-submitted safety report, described below. Gameplay relay envelopes are not stored in the YVB SQL database.

The version and time of a signed-in account’s acceptance of the Coop Terms and Community Rules are stored only on the device and are not sent to YVB. Until the current version is accepted, incoming Chat and Draw interactions remain hidden in a bounded, temporary in-memory queue and are not added to YVB or durable device storage by this gate. A rules-version change, cleared app data, reinstall, or another device can require acceptance again.

When the app contacts YVB, we may receive ordinary technical request information such as IP address, app or operating-system version, request time, and security or error logs. We use it for account security, abuse prevention, delivery, and reliability.

Player safety reports

A recipient can deliberately submit a report from the selected player menu. When a recent received Coop interaction is available, the report screen says that the latest interaction will be included; otherwise the report contains no interaction content. For an interaction report, the app sends the report reason, interaction type and content, reporter and reported account identifiers, match and source-interaction identifiers, and request time to YVB over HTTPS. YVB stores the report metadata in SQL and encrypts attached interaction content at rest so authorized moderators can investigate abuse and enforce these Terms. Normal direct interactions are not uploaded.

Submitting a report is optional. Safety reports and attached evidence are kept only as long as reasonably needed for review, enforcement, disputes, legal obligations, and backups. If either account is deleted, YVB removes or anonymizes its account link where applicable, but may retain the moderation evidence for those limited safety and legal purposes.

Feedback and support

The optional Contact / Feedback form sends YVB the message you choose to write, an email address only if you add one, a protected hash of the app installation identifier, platform, language, app version, build number, campaign, and submission time. You do not need an account or an email address to send feedback. If you omit your email address, we can read and use the message but cannot reply to you directly.

We use these messages to investigate problems, answer users who provide an email address, and improve SU2KU. Feedback records are kept only as long as reasonably needed to respond, diagnose the issue, improve the app, prevent abuse, and meet legal or security obligations.

Direct connection setup

To establish a WebRTC data channel, SU2KU’s bundled libdatachannel/libjuice ICE process exchanges connection candidates with the selected Coop friend and queries the configured Google STUN service at stun.l.google.com. This setup can reveal your public IP address, connection metadata, and, depending on the device and network, local network addresses to that friend. Google receives your source IP address and STUN request metadata to return your public-facing address and handles that information under its privacy policy. ICE offer/answer signaling passes through YVB over HTTPS and can include those candidates; signaling envelopes are encrypted at rest and expire sooner than gameplay snapshots. Google STUN does not relay game or interaction content. Normal quick replies, custom text, reactions, and drawings remain encrypted between the two devices and are not sent to Google STUN or YVB. The explicit safety-report exception is described above.

Optional game and friend alerts

Game and friend alerts are off by default and are available only to a signed-in player who enables them in Profile. After you opt in, SU2KU gives OneSignal a random, opaque account alias. Your operating system and push provider supply a push subscription token, and OneSignal processes the IP address plus device, app, language, time-zone, session, permission, delivery, and notification-open information needed to deliver, secure, and measure the alerts you requested. OneSignal acts as YVB’s notification service provider for this purpose; SU2KU does not give it your email address, username, password, Chat or Draw content, Sudoku board, moves, solution, snapshot, or game result.

YVB sends only generic game-invitation and friend-request alerts. Notification data is limited to the event type and an opaque match or friend-request identifier, and the app retrieves the current information from YVB after it opens. You can turn alerts off in Profile or in your device settings; SU2KU then opts the push subscription out and logs the account alias out on that device. When you delete your account, YVB deletes its private push alias and requests deletion of the corresponding OneSignal user where available. OneSignal retains user, subscription, message, delivery, and security records only under its published retention and deletion practices.

Advertising and purchases

Our own promotions

From iOS 1.0.10 and Android 1.0.19, the free game displays YVB-managed promotions selected from a common catalog, without behavioral targeting, advertising identifiers, ad-network SDKs or cross-company attribution. The app requests the catalog from YVB and may cache it on the device. Tapping a promotion opens the destination you choose; no account email, purchase record or unique user identifier is attached to that link. The destination processes an ordinary visit under its own privacy policy.

No cross-company tracking

The current versions do not include AppsFlyer or Google Mobile Ads and do not request Apple’s tracking permission. We do not upload account emails or purchase histories to Meta, Google or other advertising networks for targeting, lookalike audiences or advertising measurement. Older installed versions may still use their previously included advertising or attribution SDKs under the permissions and privacy choices available in those versions; update the app to use the current implementation.

Ad-free purchase

Purchases are processed by Apple App Store, Google Play or Samsung Galaxy Store and managed through RevenueCat. These services process transaction and product identifiers, storefront, purchase history and entitlement status, pseudonymous account or installation identifiers and technical request information. After sign-in, we associate the email supplied for your account with its opaque RevenueCat customer identifier for purchase support and account administration. YVB records verified purchase and refund events and associates them with the current account email for internal administration. This is not used for external advertising audiences. Guest individual purchases and Restore remain available without registration. YVB does not receive full payment-card details.

How information is used and shared

We use information to operate and secure accounts, connect friends, deliver multiplayer events and optional alerts, administer purchases, review reports, answer support requests and improve reliability. Limited onboarding and paywall events sent to YVB help us understand whether our own screens and offers work; they are not combined with other companies’ data for advertising. We do not sell personal information or disclose it to data brokers or advertising networks. Necessary providers include YVB hosting, RevenueCat, OneSignal, the platform stores and push services, and the connection-setup service described above. Other players receive what is necessary for the match or what you choose to send. Authorized moderators receive reports you deliberately submit. Providers process data to perform these functions, and disclosures may also occur at your direction or where required by law.

Retention, choices, and deletion

Device-only game data remains until you clear it or uninstall the app. YVB keeps account and friendship information while your account is active and only as long afterward as reasonably needed for security, dispute handling, legal obligations, and backups. A fallback gameplay snapshot is deleted after acknowledgement and otherwise expires within 30 days; signaling and other lifecycle envelopes expire sooner. Normal Coop quick replies, custom text, reactions, and drawings are never placed in that mailbox or otherwise retained by YVB. Content deliberately attached by the recipient to a safety report is retained under the limited moderation schedule described above. Purchase, notification and hosting providers retain necessary records under their published retention and deletion practices. Any information previously collected by older advertising SDKs remains subject to the former providers’ retention and deletion processes; contact us for assistance with an erasure request.

To delete your SU2KU account, open the Profile tab in the app, select "Delete account", and confirm the deletion. Account deletion removes the active account and associated authentication and friendship data from normal use, subject to limited legal or security retention and backup cycles. Safety-report account links are removed or anonymized where applicable, but report evidence may be retained for safety, enforcement, disputes, or legal obligations. If you cannot access the app, contact support@yvb.app from the account email address and request SU2KU account deletion.

You can play solo and buy or restore individual ad-free access without an account. Current versions use no advertising-tracking permission. Optional game and friend alerts remain off unless you enable them and can be disabled in Profile or system settings. You can contact us to request access, correction or deletion of account information. Store transactions may be retained as required for purchase restoration, refunds, security and legal obligations.

Security and children

We use reasonable administrative and technical safeguards, including hashed passwords and protected session tokens. No transmission or storage system is completely secure, so keep your password and device protected and do not reuse your password elsewhere.

SU2KU is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and delete it where required.

Changes and contact

We may update this policy when the app, providers, or legal requirements change. The current version and effective date will remain available on this page.

For privacy questions or requests, contact us at support@yvb.app.