Privacy Policy

Hot & Cold is operated by Lambda 7 Tech LLC (“we”, “us”). This policy explains what data the app may process, why we process it, and your choices.

1. Data we generally do not collect

This list covers the app, our website, and our backend — and, where a third-party component is involved, what that component receives through us. The third parties themselves are described in §10 (analytics) and §14 (advertising); anything they do get is set out there rather than denied here.

• No contact list and no photo library. The app never asks your device for either.
• No location permission, and no GPS or other precise location data — neither we nor any SDK in the app asks your device for your location. Approximate location is a separate question: any internet service sees the IP address a request came from, and an IP can be resolved to a rough, city-level area. Our web analytics does that (§10); we have switched that lookup off in our product analytics, which still receives the IP as part of the request (§10); and the ad SDK in the mobile app, which runs from launch whether or not you watch anything, may do it too (§14).
• No email address. Sign-in (described in §4) deliberately uses minimal scopes that exclude email and profile name, and no other part of the app or site asks for one.
• No mandatory sign-in for core gameplay.
• No push notifications in the iOS and Android apps: no push token, and no notification content sent from our servers to them. The optional daily reminder there is scheduled by your own device. On the web, the same reminder is an opt-in push for signed-in players, and we store the browser subscription it needs (see §15).
• No selling of personal data, and no sharing of your account identity, display name, or gameplay content with advertisers or data brokers.
• No attribution or install-tracking SDK. The only advertising SDK in the iOS and Android app is the one behind the optional rewarded video described in §14; on the web we currently show no third-party ads at all, though Google's AdSense script is present on our pages (§14). Product analytics are described in §10.

2. Data stored on your device

The app stores gameplay state locally so your experience can resume between sessions, including progress, stats, display preferences, and a locally-generated identifier used for multiplayer presence.

Some things stay on the device on purpose and are never attached to an account: an unfinished single-player round so it survives a crash, the settings that describe this device rather than you (the daily reminder switch in §15, sound effects, keyboard suggestions), and — on the web — the identifiers of any of our own promo cards you have clicked, so we stop showing you the same one (§14).

You can wipe local data via Settings → Reset data → Reset everything, or by uninstalling the app. That only affects local storage. For server-side data tied to a signed-in account, see §11.

3. Multiplayer (challenge rooms)

When you join or host a challenge room, the display name you choose and the gameplay data needed to run the match are processed by our backend. Challenge rooms are temporary and retained only as long as needed to operate active sessions. A room that goes unused is deleted outright, along with everything in it.

What other players can see. By default the room relays only similarity scores and each player's public identity: the display name, plus the supporter badge (§14) and the achievement title (§7) if that player wears them. Opponents never receive the secret word or the words you guessed, so nobody's progress can spoil the answer for you. Cooperative team mode is the deliberate exception: a team plays one shared board, so the players on your team do see the words you guess and the hints you reveal, live, for as long as you are seated on that team. Players on other teams do not. Once a round is over the secret is shown to everyone who played it.

Room chat. Online rooms include text chat between seated players, with up to 3 channels: everyone in the room, your own team, and a spoilers channel that only opens to players who have finished the round. We store the messages sent in a room so they can be delivered and replayed to the seats entitled to see them — the server enforces those channel rules when a message is sent, delivered, and replayed, so a player who is still guessing never receives spoiler-channel messages at all. Individual messages are limited to 280 characters and only the most recent messages in a room are kept.

Chat history lives with the room and is destroyed with it when the room expires — we keep no long-term chat archive and no chat history attached to your account. Spoiler-channel messages are cleared even sooner: they are discarded with the round they discussed. Chat is not used for advertising, profiling, or training anything, and is not shared with third parties. Do not put anything sensitive in it: like any group chat, the other people in the room can read, screenshot, or repeat what you send.

4. Optional sign-in (Apple / Google)

Sign-in is optional and only required for the public leaderboard, cross-device stats sync, and reporting other players' display names. You can play Daily, Endless, and Challenge modes anonymously without signing in.

We use Apple's “Sign in with Apple” and Google Sign-In with the minimal scope needed to identify your account (the provider's “subject” identifier). We do not request your email address or your provider profile name. After sign-in we store on our backend:

• The provider (Apple or Google) and the opaque subject identifier returned by that provider.
• An internal account ID we generate.
• The display name you set inside the app (you choose it; we never copy a name from the provider).
• The date the account was created and, if applicable, a flag indicating the name has been hidden by moderation (see §6).
• A record of any pre-release features the account was granted access to while we tested them (a list of feature names, nothing about you). We are not currently testing anything this way, but records from past tests may remain.

Apple and Google receive standard authentication metadata (your IP address, the redirect to Hot & Cold, etc.) when you sign in. Their privacy policies apply to that exchange.

Pairing a second device. Because “Sign in with Apple” isn't offered everywhere the game runs, a device you are already signed in on can show a short, single-use pairing code that another device enters to link itself to the same account. We store only a keyed hash of the code, never the code itself; it expires within minutes, only one is live per account at a time, and it stops working the moment it is used. Redeeming a code links that device to the account exactly as signing in would, so treat it like a password: we will never ask you for it, and anyone who has it can reach the account's data and delete it.

5. Display name and public leaderboard

The display name you set when signed in is shown publicly on the daily leaderboard and to opponents in challenge rooms. We display it together with a short tag derived from your account ID (for example, Cooper #A1B2) so two players with the same name aren't visually identical. The leaderboard also shows your score, guess count, whether you completed the puzzle, the achievement title you have chosen to wear next to your name (if any; picking one is optional and done in the app), and (if any) a small supporter badge described in §14.

Fair play. We run automated checks over leaderboard entries to spot results that were probably not played fairly, such as a suspiciously fast solve shortly after another player finished the same puzzle. The checks read only the gameplay records described in this policy; nothing new is collected. A flagged entry may be hidden from the public boards, and a flag can be reviewed and cleared. Flags affect leaderboard visibility only, never your stats, streak, or account.

The same entries also feed a rolling multi-day board, which ranks signed-in players on their best recent days. It shows nothing beyond what the daily board already shows.

Anonymous players appear on the leaderboard as a generic Player #XXXX handle, recorded against the device's locally-generated identifier rather than an account. Signing in claims the guest results that identifier recorded over a bounded window of recent days onto your new account, so the days you played before signing in still count towards your streak, your synced stats, and the boards above. Guest days older than that window, and guest days played on a device you never sign in on, stay anonymous and are not claimed.

6. Reports and display-name moderation

Signed-in players can report another player's display name from the leaderboard. When you submit a report we store the report (your account ID, the target's account ID, the category you chose, a snapshot of the offending name at the time of report, and a timestamp) so we can act on it. Reports are visible to our moderators. They are not shown to other players.

When enough distinct reporters flag the same display name, we automatically hide that name on the leaderboard and replace it with the generic Player #XXXX handle. The affected player can recover by picking a new display name in the app.

Hidden names are also added to a permanent banlist so the same name (and trivial morphs of it) can never be reused on Hot & Cold. The banlist stores the offending name and a normalized form used for matching. It does not store who originally used the name.

Challenge rooms are moderated by their host rather than by us. Rooms are private — reachable only through the invite link, with no friends list, no direct messages, and no way to message anyone outside the room. The host can remove any player from their room, or ban them so the invite link stops working for them; a ban also discards that player's stored points and records for the room. Because room chat is destroyed with the room, we generally have nothing to review after the fact. If someone is behaving badly in a room you're in, ask the host to remove them, leave the room, and email [email protected] if you need to escalate.

7. Cloud-stored stats (signed-in players)

When you are signed in, your aggregate stats are stored on our backend so they sync across devices that sign in to the same account. That covers your Daily-mode career (games played, won, current and best streak, total and best score) and the counters behind the game's achievements for the other modes beside it, single-player and multiplayer — how many rounds you have played and won, your best results, and how far you have got. It also stores which achievement title, if any, you have chosen to wear next to your name; that choice is shown wherever your name is (§5). Beyond that the record is counters only: it holds no round contents and none of the words you guessed (rounds themselves are covered in §9). Anonymous play stays on your device only.

Most of those counters are recorded by your own device rather than by our backend, so the app sends them up periodically and takes back the merged result. Totals that can only go up are merged by keeping the higher of the two values, which is why a device that has been offline can't lower a number another device already earned.

Alongside those stats we store the state of the streak features described in §14: how many streak protections you have earned and spent, the date of your most recent streak repair, and whether you have auto-protect switched on. These are account-scoped rather than device-scoped on purpose — the protections you earn are meant to be spendable only once, no matter how many devices you sign in on. All of it is deleted with your account (§11).

8. App content

The app may download and cache game content over HTTPS so features work reliably across sessions.

9. Daily mode

Daily mode uses our backend to run the puzzle and keep your progress consistent across sessions. The backend records anonymous gameplay (guess counts, hints used, time taken, final result) tied to a per-day identifier so we can build aggregate statistics and, for signed-in players, the public leaderboard described in §5.

To be clear about what that involves: Daily rounds are scored on our servers, not on your device, so the round in progress is held there — the words you have guessed, the hints you have taken, and the result — against your account if you are signed in, or against the device's locally-generated identifier if you are not. That is what lets you close the app mid-puzzle and come back to the same board on the same or another device. Online Endless rounds work the same way and are discarded about 7 days after you last play them; a challenge room's gameplay lives with the room and dies with it (§3). Each day's Daily storage is purged in full roughly 30 days after that puzzle goes quiet. We use these records to run and score the game and to compile aggregate statistics; they are not used to profile you and are not shared with third parties.

To keep the puzzle fair we apply rate limits at the network edge, keyed on the IP address making the request. Those limits are enforced in the moment and are not attached to your gameplay records or your account. IP addresses may also appear briefly in our hosting provider's operational logs, which are kept for a short period for security and debugging.

10. Analytics and diagnostics

On the web (hotandcold.app and related pages, including the in-browser game at /play), we use Google Analytics 4 to understand aggregate usage. Google Analytics may collect standard web request metadata such as IP address (used to derive approximate, non-precise location), user agent, device and browser information, referrer, page path, and interaction events. It may set cookies or use local storage to operate. See Google's Privacy Policy and How Google Analytics handles data for details. You can opt out using the Google Analytics opt-out browser add-on or by blocking analytics cookies in your browser.

Across all platforms — the iOS and Android apps as well as the web game — we use PostHog for product analytics. PostHog receives a fixed set of gameplay events, along with app open and close events and basic device, operating system, and app version information. The events are:

• Which mode you chose, and whether you arrived in it from a link rather than the menu.
• That a round started, that you submitted your first guess in it, and that it finished — with the outcome, how many guesses it took, and how long it lasted.
• That you shared a result, and how you shared it.
• Multiplayer: that you created a room, shared its invite, joined one, or started a match, and how many players were seated.
• That a sign-in prompt was shown and where in the app it appeared, and whether it ended in a completed sign-in.
• Whether an optional rewarded ad was requested, watched, or failed to load (§14), and — on the web — whether one of our own promo cards was shown or clicked, identified by the campaign.
• Changes to a small number of settings, and failures we want to catch, such as the daily puzzle failing to open.

These events carry counts, outcomes, timings, and identifiers for our own features. They do not carry the words you guess, the secret word, hint words, display names, or the contents of room chat.

The PostHog SDK also attaches technical information of its own to every event: a random device identifier it generates, a session identifier, the app version and build, the operating system and version, the device type, and the screen size. Because the events are sent over the internet, PostHog's servers receive the IP address they came from, as any service does. We have disabled PostHog's location lookup, so no location is derived from that IP address or stored on the event. We do not enable session replay or autocapture, so PostHog does not receive recordings of your screen or a log of everything you tap. Until you sign in, all of this is tied only to the random identifier; after you sign in it is associated with your account. See PostHog's Privacy Policy.

Feedback and bug reports. The app can open a short in-app form for feedback or for reporting a problem with a feature still in testing. These are optional, and unlike everything else in this section they carry text you write yourself — whatever you type in the form is sent to us through PostHog and stored with the same identifier as the events above, so please leave out anything you would not want us to hold. Nothing is submitted unless you send it.

PostHog also receives automatic reports when the app hits an unexpected error, containing the error message and a stack trace, so we can fix crashes. If our use of diagnostic data changes materially, we will update this policy.

Live player count. Separately from PostHog, our own backend keeps a short-lived count of how many people are playing right now, so we can see the service is healthy. Each authenticated request records the device's player identifier, which mode it was for, and the app build, replacing the previous entry rather than accumulating a history. Entries are discarded once they are older than the widest window we report on — a matter of minutes — and nothing is reconciled against them.

11. Your rights and account deletion

You can:

• Wipe local data inside the app at any time (Settings → Reset data).
• Sign out from inside the app to unlink the device from your account. Your account row, leaderboard entries, and synced stats remain on our backend.
• Permanently delete your account from inside the app: Settings → Account → Delete account. This removes your account record, every leaderboard entry tied to your account, your synced stats, reports you submitted, any outstanding device-pairing code, and any web-push reminder subscriptions (§15). The action is immediate and cannot be undone.
• If you can't sign in (lost device, etc.), email [email protected] from a device that's previously been signed in, or include your account ID (visible in Settings → Account when signed in) and we'll perform the deletion for you.
• Uninstall the app to remove all local data from your device.

Three narrow exceptions apply on deletion: (a) entries on the display-name banlist (§6) are kept for ongoing moderation integrity; (b) the per-round records described in §9 are keyed to an internal account ID that no longer resolves to anything once the account row is gone, and they age out on their own timers rather than being deleted in the moment; and (c) we may retain limited records required to comply with legal obligations.

12. Service providers

We rely on infrastructure, identity, hosting, and analytics providers to operate the Service. As with any internet service, providers may receive standard request metadata (for example IP address and user agent) in transit.

• Cloudflare: hosting, edge compute, and database infrastructure.
• Apple: “Sign in with Apple” identity verification.
• Google: Google Sign-In identity verification, Google Analytics 4 web analytics, and the Google AdSense script, which loads on our web pages today although no ads are served through it yet (see §14).
• Unity / ironSource (LevelPlay): rewarded-ad mediation in the iOS and Android app. Watching an ad is optional, but the SDK starts with the app (see §14).
• PostHog: product analytics and error reporting across web and the mobile apps (see §10).

13. Children

Hot & Cold is suitable for general audiences and does not knowingly collect data from children under 13. If you believe a child has provided personal data via our Service, contact us and we will delete it.

14. Advertising

Web. The web version (hotandcold.app and the in-browser game at /play) currently shows no third-party advertising. Where wide screens have room beside the game we show our own promotions for other games we make; those are served by us and involve no ad network. Google AdSense tags are present on the site so that advertising can be switched on later — if and when it is, ads will be served by Google AdSense and Google may set cookies or process device and browsing information to select and measure them, subject to Google's partner-sites policy. Because the AdSense script loads on our pages today, Google may set cookies or read device information when it runs even while no ad is shown; you can block it with an ad blocker or by blocking third-party cookies in your browser.

Our own promotions are simple cards we serve ourselves. We record that one was shown or clicked (§10) and, on that device only, remember which cards you have clicked so we stop showing them to you. They involve no ad network, no cookies from a third party, and no profile of you.

Mobile app. The iOS and Android app includes an optional rewarded video you can choose to watch, served by Unity LevelPlay (ironSource) ad mediation. It is entirely voluntary. No part of the game is gated behind watching an ad, and the app shows no other ads.

When that SDK runs is worth stating plainly: LevelPlay is started when the app launches, not at the moment you tap to watch, so an ad is ready if you ask for one. From then on it is active in the app whether or not you ever watch anything, and it may process device and advertising identifiers (such as Apple's IDFA / Google's Advertising ID), device, operating system and network information — including the IP address the request came from, which an ad network can resolve to an approximate area — and, if you do watch, ad interaction events used to serve and measure the ad. On Android it may also collect information about the apps installed on your device, which ad networks use to avoid advertising apps you already have and to detect fraud. That collection is the SDK's, not ours: we never see the list, and nothing about the apps on your device reaches our servers. We tell it that this app is not directed at children; we do not send it your account, display name, or anything about your game. On iOS, Apple's App Tracking Transparency prompt is shown at that start-up moment, before any cross-app advertising identifier can be used; you can decline and still use the app (ads, if you choose to watch one, are then non-personalized). You can reset or limit your advertising identifier in your device settings (iOS: Settings → Privacy & Security → Tracking / Apple Advertising; Android: Settings → Privacy → Ads). See Unity's privacy policy for how LevelPlay handles this data.

If you watch a rewarded ad while signed in, we increment a supporter count on your account. That count doubles as your bank of streak protections, each of which can cover a missed day of your daily streak. It has no effect on your score or your position on the leaderboard. The count is shown on your own menu and, for signed-in players, as a small badge next to your display name on the public leaderboard. Anonymous play keeps the count on your device only until you sign in.

A signed-in player whose streak has just been broken by a missed day can also choose to watch one ad to repair it. When you do, our backend works out what the streak was worth by reading the days you previously completed, which it already stores for the leaderboard (§5) and your synced stats (§7). No new data is collected to run a repair, and your app never tells us what your old streak was — the server reconstructs it from your own recorded results. We store the date of the repair so repairs can be rate-limited.

If web advertising is switched on, Google and its ad partners may use cookies, device identifiers, and similar technologies to serve and measure ads, including to show ads based on your prior visits to this and other websites. Google may collect standard request metadata such as IP address (used to derive approximate, non-precise location), user agent, and the pages you view, and may combine it with data it holds. Either way, we do not share your account identity, display name, or gameplay data with advertisers.

Because no ads are served on the web today, no advertising consent message is shown. Before personalized web ads are ever served to users in the European Economic Area, the United Kingdom, or Switzerland, we will present a Google-certified consent message (a Consent Management Platform) so you can grant or refuse consent for ad personalization, and you will be able to change that choice from a control on the page.

In the iOS and Android app, the rewarded video described above is the only advertising, and iOS asks separately through Apple's App Tracking Transparency prompt before any cross-app advertising identifier is used. We do not currently operate a separate consent flow for ad personalization in the app, so where an ad network requires consent it has not been given: in those regions ads are served non-personalized, or not at all. If that changes we will add a consent prompt and update this policy.

You can manage or opt out of personalized advertising through Google My Ad Center, the controls at aboutads.info and youronlinechoices.eu, or by blocking ad cookies in your browser. See How Google uses cookies in advertising for details.

15. Notifications

The app can send you one optional reminder a day (in the evening on iOS and Android, around midday on the web) to play the Daily puzzle before your streak lapses. It is off until you turn it on, and you can turn it off again at any time from Settings → Notifications or in your device's own notification settings.

On iOS and Android these reminders are local notifications: your device schedules and shows them by itself. They are not push notifications. That means:

• We do not create or store a push token, and we operate no device registry.
• No reminder is ever sent from our servers, and no server is told whether one was shown, opened, or dismissed.
• Your timezone and local clock are used only on the device to pick the delivery time. Neither is sent to us or to anyone else for this.
• The reminder text is composed on your device from data already on it (your current streak and the upcoming puzzle number).
• Your on/off choice is stored on that device only. It is not part of your account and does not sync between devices, so each device you play on is set separately.

On the web, a closed browser cannot schedule anything by itself, so the same reminder works differently there: it is a web push notification sent by our server, available only while you are signed in. If you turn it on, we store the push subscription your browser creates — its delivery URL and two encryption keys issued by your browser vendor's push service, plus your timezone name, the next delivery time, and routine bookkeeping (when the subscription was created, last confirmed, and last sent to, and a count of consecutive delivery failures) — linked to your account. The record identifies a browser profile, not a person. The reminder text is composed on our server from your account's streak and the day's puzzle number, encrypted so the push service relaying it cannot read it, and expires after an hour if your browser is offline. We are not told whether it was shown, opened, or dismissed. Turning the reminder off, signing out, or deleting your account (§11) removes the subscription, and we drop any browser that has not opened the game for about 60 days.

Before your device's operating system asks for notification permission, we ask inside the app first, so you can decline without spending the one-time system prompt. Declining either prompt leaves reminders off and changes nothing else about the game. If you later grant permission and turn reminders on, only the schedule above applies — we do not use the notification channel for marketing.

16. Changes

We may update this policy. Material changes will be reflected by an updated date at the top of this page.