Handyman Puzzle

Privacy policy

Privacy Policy for Handyman Puzzle

Effective date: October 12, 2026

Handyman Puzzle is published by stackwiz labs OÜ (`stackwiz labs`, "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use Handyman Puzzle, our related services, and our support website.

Contact

Summary

Handyman Puzzle is a puzzle game with optional sign-in, in-app purchases, rewarded ads, leaderboards/missions when enabled, push notification support, and backend-synced inventory. We use Firebase and Google AdMob services to operate the game, authenticate players, sync purchases and inventory, show ads on supported mobile platforms, measure basic gameplay events, and diagnose service issues.

We do not sell personal information for money. Some advertising identifiers, ad interactions, or device information may be shared with advertising partners to show, measure, and improve ads. Depending on your location, this may be treated as "sharing", "targeted advertising", or similar terms under privacy laws.

Scope

This policy applies to Handyman Puzzle on iOS, Android, macOS, and other native platforms we may support. The first public beta may be iOS-only, but this policy covers the product as implemented in the app.

This policy does not cover third-party websites, stores, or services that have their own privacy policies, including Apple, Google, Firebase, Google AdMob, Facebook, or other sign-in providers.

Public Leaderboards and Nickname Safety

Public rankings are off until you choose to join. Adults can join after reading the participation notice and Competition Rules. If your account has no age information, you may declare an age band; declaring an adult band does not itself publish your profile. Players on your saved country leaderboard can see your generated nickname, score, rank and ranked-job count. Your email is not public. Your consent to public participation can be withdrawn in Profile as easily as it is given, without affecting the lawfulness of earlier processing. Nicknames cannot be typed or edited: you may generate as many alternatives as you like before confirming one. Your country is suggested from device region, with a correction before confirmation; it stays fixed when travelling. Later corrections use support. The app does not browse other countries. Eligible adults can leave rankings in Profile. Leaving hides public entries and stops new ranking credit and prizes, while preserving progress and prizes already earned. Rejoining does not add private play or retrospectively award prizes.

Custom nickname editing and new in-app nickname reporting are not offered in this release. Existing reports and appeals can still be reviewed. Contact support@stackwiz.io for help or an appeal, or privacy@stackwiz.io for privacy requests.

Information We Collect

Account and Authentication Data

Handyman Puzzle can create a Firebase anonymous guest account automatically so the game can sync backend inventory and purchases. If you choose a sign-in provider, we may receive account information from that provider through Firebase Authentication.

Depending on the sign-in method, this may include:

  • Firebase user ID.
  • Anonymous account identifier.
  • Provider identifiers such as Apple, Google, or Facebook provider ID.
  • Available email address and sign-in provider identifiers. Game profiles do not store real names, profile photos or birth dates.
  • Firebase Authentication and your sign-in provider may supply or retain basic provider profile metadata. We clear optional top-level Firebase names/photos and do not copy provider metadata into game profiles.
  • Generated nickname, confirmed country code, age band or platform eligibility status and source, and public-ranking participation preferences. We also retain the participation notice version and acceptance time.
  • Account metadata such as creation time and last sign-in time.
  • IP address, user agent, and security signals processed by Firebase Authentication to provide authentication and prevent abuse.

Supported sign-in options may vary by platform and release. Current app features may include anonymous guest accounts, Sign in with Apple, Google Sign-In, and Facebook Login where available.

Gameplay, Inventory, and Progress Data

We collect and store gameplay-related information needed to operate the game and its backend features, including:

  • Player ID.
  • Puzzle mode activity such as Carpentry, Bricklaying, and Plumbing play.
  • Scores, level starts, level completions, puzzle failures, and selected gameplay events.
  • Inventory counts for consumable items.
  • Ad-free entitlement status.
  • Rewarded-ad grant status.
  • Purchase fulfillment status.
  • Leaderboard and mission summaries when those backend features are enabled.

When a backend URL is configured, inventory, purchases, rewards, and paid consumable spending are backend-authoritative. The app sends authenticated requests to our backend, and the backend derives player identity from the Firebase ID token.

Purchase Data

Handyman Puzzle offers consumable game items and an optional monthly Ad Free subscription on iPhone and iPad. Ad Free removes automatic ads; optional rewarded ads remain available.

For Apple App Store purchases, the app sends purchase verification information to our backend, including:

  • Product ID.
  • App Store transaction ID and original subscription transaction ID.
  • Subscription expiry, renewal and revocation status, and Apple verification timestamps.
  • Local App Store verification data.
  • Purchase status needed to complete or restore purchases.

For Google Play purchases, the app may send:

  • Product ID.
  • Google Play purchase token.
  • Purchase status needed to complete or restore purchases.

We use this information to verify purchases, grant inventory or entitlements, prevent duplicate grants, process restores, and investigate purchase support requests. Apple and Google process payment details directly; we do not receive your full payment card or bank account details.

Refunds and optional Apple usage sharing

We record delivery and the quantities used and remaining from each consumable purchase to fulfill purchases and reconcile refunds. A refund removes available items only from that purchase; it does not remove earned items or items from another pack, create a negative balance, or undo completed gameplay. For partial refunds, fractional item quantities are rounded down. Apple decides refund eligibility and the amount returned.

Adults can optionally enable “Share purchase usage with Apple” in Settings → Account & privacy. Sharing is off by default. If you enable it and request a refund, we may provide Apple with the transaction reference, delivery status, whether product information was provided, and the proportion of consumables used. Apple calculates subscription usage from elapsed time. We provide facts without recommending a refund outcome. This choice is separate from advertising consent. Purchases and refunds remain available without sharing. You can withdraw at any time to stop further reports; withdrawal does not recall information already sent. Sharing is unavailable for minors and unknown ages.

Canceling a subscription stops future renewals and normally preserves access until the paid period ends; it does not itself request a refund. An approved refund may revoke Ad Free earlier. Apple retains information it receives under its own privacy policy. For access or deletion requests concerning information held by Apple, visit Apple’s privacy portal.

Advertising Data

Handyman Puzzle uses Google AdMob on iOS and Android. Ads are not supported on macOS/desktop in the current implementation.

AdMob and related advertising partners may collect or process information such as:

  • IP address, which may be used to estimate general location.
  • Device identifiers, including the advertising identifier when available and permitted.
  • Advertising data such as ads shown, ad views, ad interactions, and video reward completion.
  • App interaction and performance data, such as app launches, ad interactions, and ad performance.
  • Crash logs and diagnostic information related to the ad SDK.

Before mobile ad requests, the app uses Google's User Messaging Platform to check whether consent or privacy-choice messages are required. If required, the app presents Google's consent form and only requests ads after UMP reports that ads may be requested. If UMP reports that privacy options must remain available, the app shows an in-app privacy-options entry point.

This release uses only non-personalized ads, restrictive under-age treatment and a general-audience ad-content cap. There is no personalization choice or app-initiated tracking-permission prompt. These settings do not mean that advertising involves no data processing. Ad providers still process necessary delivery, measurement, fraud-prevention and diagnostic information. Google privacy options remain available in Profile when required.

Rewarded ads may use server-side verification data so our backend can validate that a reward was earned before granting inventory.

Analytics and Remote Configuration Data

Behavioral Firebase Analytics collection is disabled before the SDK starts in this release. Necessary gameplay/account processing, crash diagnostics, performance monitoring and ad-provider measurement are separate. Disabling Analytics does not retroactively erase historical data.

We use Firebase Remote Config to fetch configuration values such as ad cadence, reward amounts, mission count, and puzzle-mode weighting. Remote Config may use Firebase installation identifiers to return configuration values.

Push Notification Data

Push notifications are optional. In Settings → Notifications, you can explicitly agree to promotional messages about events, prizes, streaks and reminders to return to play. A separate, optional choice covers account changes, security and privacy alerts without promotions. Both choices start off. Accepting the Terms or the device permission prompt does not itself provide either consent. Promotional push is available only to adults under our launch age policy.

We may collect:

  • Your separate promotional and account/security push choices, the notice version, and server-recorded consent or withdrawal times, linked to your account and a random identifier for this app installation.
  • Notification permission status, checked on your device. Only full authorization allows token registration.
  • Firebase Cloud Messaging delivery token, collected only after you enable at least one category and authorize notifications on your device.
  • Device platform, such as iOS, Android, or macOS.

Automatic Firebase messaging token generation is disabled. We request device permission only after you save an enabled category. Existing device permission and older token records are not treated as promotional consent. Choices apply to your current account on that installation and do not transfer to a different account. Losing adult eligibility disables promotional consent; becoming eligible again requires a new affirmative choice.

You can withdraw either choice in Settings → Notifications and save, as easily as enabling it. This stops future delivery for that category; a message already sent may still arrive. Turning off account/security push does not stop necessary security emails or in-app notices, which have separate purposes and legal bases. Notification previews will avoid sensitive account details. Campaign scheduling and account push delivery are not active in the current release; any future delivery must respect these saved choices.

Firebase/Google, Apple on Apple devices, and the device operating system process delivery identifiers and notification data to provide this service. Other Firebase services may use a shared installation identifier independently of push; turning push off does not delete that identifier or all provider-held records. Provider retention is described in our data-retention policy.

Device, Network, and Diagnostic Data

We and our service providers may process technical data needed to operate and secure the app, including:

  • Device model, operating system, app version, bundle ID, and platform.
  • IP address and approximate region derived from IP address.
  • Firebase installation identifiers.
  • Backend request metadata and error responses.
  • Crash, performance, and diagnostic data from service providers where enabled.

Google AdMob and Firebase services may process diagnostic data as part of their SDK operation. If we add additional crash or performance monitoring services, we will update this policy as needed.

Local Device Storage

The app stores music, menu-effect, game-effect and haptic preferences on your device, along with account-derived caches, broad age-check status and timing, ad pacing and pending-ad state, purchase replay-protection keys, and completed online results awaiting delivery. Unfinished boards in the current gameplay session are discarded when you leave them or terminate the app. Completed online results are retained for delivery without turning offline play into ranked play. Offline Classic results are not submitted to leaderboards. Owned inventory remains backend-authoritative and cannot be spent offline. Audio playback does not record your microphone or collect voice data.

Support Communications

If you contact support, we may collect the information you provide, such as:

  • Name or display name.
  • Email address.
  • Device and app information you include.
  • Support message content.
  • Screenshots, logs, or purchase details you choose to send.

We use support information to respond to your request, troubleshoot issues, verify purchases, and improve the app.

The two founders, who comprise the company, have access to support and privacy requests. We use Google Workspace (Gmail), Linear and OpenAI Codex to help review and track support requests and nickname reports. An AI assistant helps sort requests and prepare replies or proposed moderation decisions. A human reviews replies and moderation actions before they are sent or applied. Please do not send passwords, access tokens or full payment-card details.

Information We Do Not Intentionally Collect

The app does not intentionally request access to precise location, contacts, calendar, photos, camera, microphone, health data, or financial account data. Apple and Google may process payment information separately when you make an in-app purchase.

How We Use Information

We use the information described above to:

  • Provide and operate the game.
  • Create and maintain guest or signed-in player sessions.
  • Sync inventory, purchases, rewards, missions, and leaderboard data.
  • Verify purchases and prevent duplicate purchase or reward grants.
  • Authorize backend-controlled consumable spending.
  • Show interstitial and rewarded ads on supported mobile platforms.
  • Maintain gameplay state and diagnose service reliability. Behavioral Firebase Analytics collection is disabled in this release.
  • Fetch Remote Config values.
  • Send promotional push messages about events, prizes, streaks and returning to play only with your separate promotional consent; send non-promotional account, security and privacy push alerts only if you enable that separate category.
  • Detect, prevent, and investigate fraud, abuse, security issues, and service failures.
  • Respond to support requests.
  • Comply with legal obligations and app-store requirements.

Legal Bases for Processing

Where GDPR, UK GDPR, Swiss data protection law, or similar laws apply, our legal bases may include:

  • Contract: to provide the game, account, purchases, inventory, rewards, and support you request.
  • Legitimate interests: to secure the service, prevent fraud, maintain backend reliability, diagnose bugs, and improve gameplay.
  • Consent: for optional public leaderboard participation, separately chosen promotional push messages and account/security push alerts, and other processing where consent is required. This release does not offer personalized advertising.
  • Legal obligation: to comply with payment, tax, fraud-prevention, consumer protection, and app-store obligations.

How We Share Information

We may share information with:

  • Firebase and Google Cloud services, for authentication, backend operation, Firestore storage, Remote Config, messaging, diagnostics, and infrastructure.
  • Google AdMob and advertising partners, to show and measure non-personalized ads.
  • Apple App Store and Google Play, to process purchases, validate transactions, and support restores.
  • Sign-in providers such as Apple, Google, or Facebook, when you choose to sign in or link an account through those providers.
  • Service providers that host, monitor, secure, or support the app and website.
  • Legal, safety, or compliance recipients when required by law, legal process, or to protect rights, users, or service security.
  • A successor entity if the business is involved in a merger, acquisition, reorganization, or asset transfer.

We require service providers to process information only for the services they provide to us, subject to their terms and applicable law.

International Transfers

We may process and store information in countries other than your own. Firebase and Google services may process data on global infrastructure unless a service or configuration provides a specific location selection. When required, we rely on appropriate transfer mechanisms such as data processing agreements, standard contractual clauses, or recognized transfer frameworks.

Retention

We keep information only as long as reasonably necessary for the purposes described in this policy, unless a longer retention period is required by law, fraud prevention, dispute resolution, tax/accounting, or app-store obligations.

Current intended retention:

  • Account and backend profile data: retained while your account is active. A deletion request starts a 30-day cancellation period; the deletion worker then removes active game data and retries Firebase Auth deletion until it succeeds.
  • Active inventory, active entitlements, and mission progress: retained while your account is active, then removed through account deletion where technically and legally possible.
  • Push notification choices and consent records: retained for the current account on that installation until account deletion or replacement by another account on the installation. A successful choice change removes the stored delivery token; it is registered again only for enabled categories with device authorization. Tokens are removed from the active registration on withdrawal of both categories, replaced on rotation, and disconnected on sign-out. Registrations not refreshed for 30 days are ineligible for delivery; this is suppression, not an automatic deletion schedule.
  • Public leaderboard scores: available for the current and two previous periods. Leaving leaderboards removes public visibility immediately. Supporting correctness and security records follow their applicable retention schedules.
  • Nickname reports and moderation audit records: 90 days. Personal nickname blocks and active restrictions remain until changed or account deletion; appeals do not require retaining expired reports.
  • Purchase, reward, spend, fraud-prevention, tax/accounting, support, and dispute records: retained as long as reasonably needed to restore purchases, prevent duplicate grants, prevent fraud, resolve disputes, provide support, and satisfy legal or app-store obligations.
  • Support messages: retained for 24 months, unless needed longer for an unresolved issue, dispute, legal obligation, security issue, or fraud-prevention reason.
  • Firebase Analytics collection is disabled in this release. Historical data remains subject to the provider retention settings; our retention policy for that data is two months.
  • Google Cloud mandatory administrative and system audit logs: retained for 400 days in the provider’s locked audit bucket.
  • Normal backend application/request logs: retained for 30 days.
  • Application security, fraud and abuse-prevention records: retained for 90 days, unless a longer legal, dispute, security, or fraud-prevention hold is needed.
  • AdMob data: retained according to applicable Google AdMob settings and policies.
  • Local device data: remains on your device until deleted by the app, app data reset, uninstall, or operating system cleanup. After successful account deletion, the app clears local gameplay cache on the current installation.

More detail is available at: Handyman Puzzle Data Retention.

Your Choices and Rights

Depending on where you live, you may have rights to:

  • Access personal information we hold about you.
  • Correct inaccurate information.
  • Delete information.
  • Object to or restrict certain processing.
  • Withdraw consent where processing is based on consent.
  • Receive a portable copy of certain information.
  • Opt out of sale, sharing, targeted advertising, or profiling where applicable.
  • Appeal a privacy request decision where applicable.

To make a privacy request, contact privacy@stackwiz.io. We may need information to verify your request, such as your Firebase user ID, App Store or Google Play purchase details, or the email address used for support.

You can request account deletion in the app from Profile -> Delete account. If you cannot access the app, contact support at support@stackwiz.io or use the StackWiz contact page.

You can also control certain data uses through your device or app settings:

  • iOS tracking permission: Settings -> Privacy & Security -> Tracking.
  • In-game Settings -> Notifications: turn either category on or off and save. Both start off; declining has no effect on gameplay or rewards. Device settings can also block all notification delivery (on iOS: Settings -> Notifications -> Handyman Puzzle).
  • Advertising personalization: Apple or Google advertising settings.
  • App data: uninstall the app or clear app data where your platform supports it.

Children

Handyman Puzzle is intended for a general audience and is not directed to children. The puzzles are designed for a broad casual-game audience rather than for small children.

We do not ask for a birth date. On supported Apple devices, the app requests an age range from Apple and retains only a broad eligibility status, its source and update time. Exact Apple age bounds are not stored. When no age information is available, an optional age-band declaration offers Under 13, 13–17 and 18 or older. This declaration is not identity verification or parental consent. Known minors cannot override their status with an adult declaration. An unsupported device does not erase saved age information. Public rankings remain unavailable to minors in this release. A required age check that cannot complete blocks entry until resolved. Where an age signal or declaration indicates an under-13 range, account use is blocked because this release does not support parental-consent flows; deletion and support remain available.

If you believe a child has provided personal information without required parental consent, contact privacy@stackwiz.io. We will review and delete the information where required.

Security

We use reasonable technical and organizational measures to protect information. Backend requests use HTTPS, Firebase ID tokens are used for authenticated app API calls, and the backend is expected to derive player identity from Firebase Authentication rather than trusting client-submitted user IDs.

No system is perfectly secure. If you believe your account or data has been compromised, contact support@stackwiz.io.

Third-Party Services

Handyman Puzzle currently uses or may use these service providers:

  • Firebase Authentication
  • Firebase Analytics (collection disabled for this release)
  • Firebase Crashlytics and Performance Monitoring
  • Firebase Cloud Messaging
  • Firebase Remote Config
  • Google Cloud / Cloud Run / Firestore backend services
  • Google AdMob
  • Apple App Store / StoreKit / In-App Purchase
  • Google Play Billing / In-App Purchase, if Android IAP is released
  • Sign in with Apple
  • Google Sign-In
  • Facebook Login, where available

These providers may process information under their own privacy policies and terms. You should review their privacy practices if you use those features.

Changes to This Policy

We may update this Privacy Policy when the app, website, services, or legal requirements change. We will update the effective date and, when required, provide additional notice.

Contact Us

For privacy questions or requests: privacy@stackwiz.io

For support: support@stackwiz.io

Postal address: Uus tn 2-11, Ervita 73002 Järva county, Estonia