Zero Flash privacy policy
Zero Flash is an online numbers game for Android and iOS: practice games, asynchronous duels against other players and a monthly leaderboard, with diamonds and optional purchases. This page says what data the game records, why, for how long, and how to exercise your rights.
Data controller
Zero Flash, a NOSIS Games game, is published by NOSIS CONSULTING, the controller of your data. Contact: contact@nosis.fr.
In short
- No ads, no audience measurement tool, no tracking by any third-party service.
- No data is sold or transferred.
- The game asks for neither your location, nor your contacts, nor your photos, nor your microphone.
- You can delete your account at any time from the game: see how.
What the game records
| Data | Why | How long |
|---|---|---|
| Sign-in identity, held by our host: the identifier of your Google account (Android) or Apple account (iOS); the e-mail address, the name and the address of the profile picture that Google attaches to the sign-in, or the e-mail address (yours or an Apple relay address) and the name that Apple passes on; the dates the account was created and last signed in, and the sign-in sessions of your devices | Signing you in to your game account, on one or several devices. The game neither shows nor uses your e-mail address, nor the name or the picture of your Google or Apple account. | Until the account is deleted in the last NOSIS Games game that uses it (see “One account for every NOSIS Games game”) |
| Game account: an internal identifier, the display name (generated, then the one you choose) and the date it last changed, the number of grids played, the diamond balance, the bonus and the practice games of the day | Running the game | Until the account is deleted |
| Sign in with Apple (iOS): the authorization token Apple issues | Revoking with Apple the game's sign-in authorization when you delete your account | Until the account is deleted, when it is revoked then erased |
| After an account is deleted: a non-reversible fingerprint of each of its sign-in identities (a salted hash of the Google or Apple account's identifier, which cannot be traced back to it), and the date of the deletion. Neither e-mail address nor name. | Fighting fraud: an account created again with the same identity within 30 days starts without diamonds, its bonus and practice games resuming the next day, instead of receiving each time the free diamonds and practice games of a new player | 30 days after the deletion, then erased |
| Notifications: the notification token of each device where you allowed them, its platform and its language; for each notification to send, the player told, the opponent named and the duel | Telling you when an opponent has played your grid. Only if you accepted; you can withdraw it at any time in the phone's settings. | Until the account is deleted, or as soon as the notification service no longer knows the token. At most 5 devices per account: beyond that, the token of the one that opened the game least recently is erased. Each notification to send is erased after 7 days. |
| Games, practice and duel alike: the grid, the version of the app, the start and end times, each trace with its time and duration, the traces the replay left out, the paths that scored and the score | Checking and counting the result: the server replays your traces and computes the score itself. Never giving you a grid you have already played. | With no time limit. When the account is deleted, they are detached from it and carry neither your identifier nor your name any more. |
| Duels: the two games, the state of the duel, its result, the points each player won or lost, and whether each has opened the result | Playing the duel and showing its result in “My duels”, to both players | With no time limit; “My duels” shows those of the current season and the previous one. When the account is deleted, your games are detached from them (see below). |
| Leaderboard: your points, wins and number of duels in each monthly season | The leaderboard of the current season and the archive of past seasons | Until the account is deleted |
| Purchases: the end date of your 30-Day Pass and the store where it was bought; your diamond reserve; the date you acquired the Double Pack; for each purchase, the store's transaction identifier, the product, the store, the date, what it gave (diamonds or days) and, if it was refunded, what was taken back and when; for each purchase event RevenueCat sends us, only its identifier, its type (purchase, refund…) and the date it was received, nothing of its content: no product, price, country or account | Granting what you bought, once, on all your devices; taking back what a refunded purchase gave, once | The pass, the reserve and the Double Pack, until the account is deleted: the pass and the reserve are then erased and cannot be restored on another account. The purchase records, which carry neither name nor e-mail address, are kept even after, detached from the account: a purchase must never be credited twice, nor a refunded purchase taken back twice. So are the purchase events: they carry only their identifier, type and date, and point to no account. |
| Technical logs of the server: IP address, date, request, errors | Security and fixing failures | A few days, at our host |
Legal bases: performing the service you ask for by playing (account, games, duels, leaderboard, purchases); our legitimate interest in keeping a fair and safe game (fingerprints of the identities of deleted accounts, technical logs, purchase records); your consent for notifications.
What other players see
Your display name, with your points and your rank in the leaderboard of each season. In a duel, your opponent sees your display name, your score and the paths you found on the grid. Nothing else: neither your Google or Apple account, nor your e-mail address.
On your device
The game keeps on your phone your sign-in session, the game in progress and its traces, the results not yet sent (to send them again after a network cut), the purchases the server has not yet taken into account, the sound setting, and what it needs not to repeat the tutorial or the request for a review. Uninstalling the game erases them.
One account for every NOSIS Games game
Your account is shared by the NOSIS Games games, all published by NOSIS CONSULTING: your sign-in identity (your Google or Apple account and what it passes on, described above) signs you in to each of them, and each game keeps its own game data apart. Deleting your account in Zero Flash erases the data of Zero Flash; your sign-in identity is deleted only once no NOSIS Games game uses it any more.
Service providers and hosting
- Supabase hosts the game's server, its database and the sign-in of the accounts.
- Google: sign-in with Google, notifications on Android (Firebase Cloud Messaging) and payments on Google Play.
- Apple: sign-in with Apple, notifications on iOS, distribution of the game and payments on the App Store.
- RevenueCat keeps track of purchases: it receives the internal identifier of your game account, the store's purchase receipts and technical information about the device (model, system, language, country).
Payments are made through Google Play or the App Store: Zero Flash never sees your bank details. Some of these providers are established outside the European Union, notably in the United States; their data transfers are covered by the safeguards the GDPR provides (standard contractual clauses of the European Commission or the EU–US Data Privacy Framework). These web pages are published on nosis.fr, the site of NOSIS CONSULTING, hosted by OVHcloud.
Deleting the account
In the game: Profile → “Delete my account”, then confirm. The deletion is immediate and final. Your 30-Day Pass and your diamond reserve are erased with the account and cannot be restored on another account. A non-reversible fingerprint of your sign-in identity is kept for 30 days: an account created again with it within that time starts without diamonds, with no practice game on the first day. Your sign-in identity itself remains as long as another NOSIS Games game uses your account. What is erased and what remains: account deletion page.
Your rights
You have a right of access, rectification, erasure, restriction, objection and portability over your data. You change your display name from your profile and delete your account yourself; for anything else, write to contact@nosis.fr from the address of your Google or Apple account. We answer within one month. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Changes
This page changes with the game; the date of its last update is at the top.