01In brief
- NonoGuess shows no advertisements and contains no advertising software.
- You do not create an account with an email address or password. The first time you use the team screen, the game creates an anonymous account for you at Google Firebase; it is a random ID, not linked to your name.
- Your progress, coins, boosters, cards and settings are stored on your device. We receive none of this information.
- If you create or join a team, the player name and team name that you type, the team’s emblem and colour, your points and your card requests are stored at Google Firebase and are visible to the members of your team. A team’s name and its weekly total are also visible in the weekly ranking of all teams. Do not use your real name or other personal information as a player or team name.
- You can buy coins, boosters and unlimited hearts for real money in the in-game shop. Google Play takes the payment, and your card details never reach us. RevenueCat processes the purchases on our behalf.
- The game connects to Google Firebase to read the current version number each time it opens, so that it can tell you when a new version is available.
02Who is responsible
NonoGuess is published by MercanWorks OÜ, registry code 17413775, Paavli tn 5a/1, 10412 Tallinn, Estonia (“MercanWorks”, “we”). You can reach us at info@mercanworks.com or by telephone on +372 553 6572.
This policy applies to the NonoGuess app for Android (application ID com.mercanworks.nonoguess). The game is in testing and has not yet been released in an app store. The policy describes the version prepared for release.
03Data stored on your device
The game saves the following information in its private storage area on your device:
- the levels you have completed, the unfinished board and your answers
- your coins, boosters, hearts and the time your unlimited hearts end
- your collection of cards, the monthly card season, your daily login series and your tickets for bonus games
- your settings for language, sound and vibration, and which introductions you have seen
- the player name and team that you entered and your team’s points, together with the data that the game needs to keep your anonymous Firebase account signed in (a renewal token), the team ID and the join code
- the transaction IDs of the purchases the game has processed, which prevent the same purchase from granting an item twice
This information stays on your device. It is not linked to your identity and we have no access to it. When the game starts for the first time, it reads the language of your phone to choose the language of the game.
04Teams, rankings and card requests
What is stored and who sees it
When you open the team screen and create or join a team, the game connects directly from your device to Google Firebase (Firebase Authentication and Cloud Firestore, servers in Frankfurt, Germany). The following information is stored there:
- an anonymous account ID that Firebase assigns to you
- the player name that you typed, which is visible to the members of your team
- the team’s name, emblem, colour, six-letter join code, owner and the number of members; a team has at most ten members
- your points for each of the last 21 days, which the members of your team can see, and the weekly total of the team, which appears in the ranking of all teams together with the team’s name, emblem and colour
- your open card requests, with the card, the month, the name of the requester and, once a team member has fulfilled a request, the name of that member
A team name and a player name are free text that you choose. They are shown to other players, so please do not use your real name, contact details or other personal information. If a name offends others or contains personal data, write to info@mercanworks.com and we will remove it.
Google processes this information on our behalf as a service provider under the Google Cloud and Firebase data processing terms. When the game connects, your IP address and technical information about your device reach Google. We receive no IP addresses and do not use Firebase for analytics, crash reports or advertising. Google explains how it processes data in the Firebase privacy information and in its privacy policy.
Legal bases
Creating the anonymous account, storing and showing your team and points and exchanging cards are services that you ask for when you create or join a team and are necessary to provide them (Article 6(1)(b) GDPR). Reading the version number each time the game opens is based on our legitimate interest in telling players about updates (Article 6(1)(f) GDPR). Storing the account renewal token on your device is strictly necessary to provide the service you requested (Article 5(3) of Directive 2002/58/EC).
Your choices
You do not have to use teams; the game can be played fully without opening the team screen, and no anonymous account is created until you do. You can leave a team on the team screen. Your membership record, with your name and your daily points, and your open card requests are then deleted. A small record that holds your anonymous account ID and the player name you last used remains until you ask us to delete it. The “Reset” button in the profile screen leaves the team first and then clears the data on your device. Records that other players have already received, such as the card you gave, remain with them.
05Purchases
What the shop offers
The in-game shop offers ten products for real money: a one-time starter pack, two sets of boosters, three periods of unlimited hearts and four coin packs. Prices, including taxes, come from Google Play and are shown in your local currency. The terms of purchase, who the seller is and the ways to obtain a refund are explained on our purchases, withdrawal and refunds page.
Google Play
Google Play takes the payment through the Google Play Billing system and processes it under its own terms and its privacy policy. Your card or payment account details never reach us. Google gives us sales reports, which contain the order number, the product, the price, the amount charged and regional information about the buyer such as the country, state, city and postcode. We use these reports to keep accounts of sales, to meet our tax obligations and to answer enquiries about purchases.
RevenueCat
Purchases are processed on our behalf by RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA, through RevenueCat’s software built into the game. RevenueCat verifies with Google Play that a purchase is valid and makes sure that an item is granted once and that refunds are reflected. For this work RevenueCat is a processor acting on our instructions; our data processing agreement governs the relationship.
The software is started each time the game opens and connects to RevenueCat to obtain prices and the status of purchases. It generates a random, anonymous user ID on your device; if you uninstall and reinstall the game, a new ID is usually generated, and where the installation is restored from a device backup the previous ID may come back. According to RevenueCat, the following data is processed in these connections: this user ID; the purchase history, such as the products bought, the purchase dates, the transaction ID, the Google Play purchase token and price information; the device type and operating system; the locale and currency code; and the time the software last connected. Your IP address also reaches RevenueCat during the connection. The game does not pass your name, your player name, your Firebase account ID or your email address to RevenueCat. We do not use RevenueCat’s connections to advertising and analytics services; the advertising ID of the device is not passed to RevenueCat. RevenueCat explains how it processes data in its privacy policy.
Legal bases
Verifying a purchase, delivering the item and handling refunds are necessary to perform the sales contract that you conclude with us or that Google concludes on our behalf (Article 6(1)(b) GDPR). Where MercanWorks is the seller, keeping accounting and tax records is a legal obligation (Article 6(1)(c) GDPR). The connection made each time the game opens is necessary to deliver purchases that have been paid for but not yet added to the game, or whose payment is completed later (Article 6(1)(b) GDPR); the random user ID on your device is strictly necessary to provide the service you have requested (Article 5(3) of Directive 2002/58/EC).
06Links to our website
The links to the privacy policy and the terms of use in the game open these pages in a browser. When you tap one of them, your device connects to mercanworks.dev. That visit is handled as described in our website privacy policy.
07How the data is protected
The saved information is kept in the storage area that Android reserves for the game, which other apps cannot read. The game’s connections to Google Firebase and to RevenueCat are encrypted in transit. Access to the team data is limited by security rules: a player can write only their own records, only members can read the details of a team, and a team can be joined only with its join code. We run no servers of our own; the team data is held on our behalf at Google and the purchase records at RevenueCat.
08Device backup
If you have switched on the backup service of your Android device, the device may include the game’s saved data in the backup of your Google account so that it can be restored on a new device. This backup is controlled by your device settings and by Google. We have no access to it. If a backup restores the anonymous account’s renewal token, you keep your team on the new device.
09Transfers outside the European Economic Area
Google stores the team data on servers in Frankfurt, Germany. Google may process technical data in other countries, including the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google uses the European Commission’s standard contractual clauses for other transfers.
RevenueCat processes purchase data in the United States, on the servers of its sub-processors. Our data processing agreement with RevenueCat includes the European Commission’s standard contractual clauses for this transfer.
10Storage period and deletion
The information stored on your device remains there until you delete it. To delete it, open the settings of your device, select Apps, NonoGuess and Storage, and choose “Clear storage” (on some devices “Clear data”), or uninstall the game. The “Reset” button in the game’s profile screen clears your progress.
Your Firebase account, your player name and your daily points remain stored while you are a member of a team. If you leave a team, your membership record is deleted; the small record with your anonymous account ID and your last player name remains. Clearing the game’s storage or uninstalling it removes the renewal token, so you can no longer reach the account; the account cannot be recovered, and its records remain until we delete them. To have your records at Firebase deleted, write to info@mercanworks.com with your team’s name and the player name you used, and we will delete them and confirm within one month. The weekly total of a team, which contains only the team’s name, emblem, colour and points and no name of a player, remains for the ranking of that week.
Purchase records at RevenueCat are kept for as long as they are needed for the items you buy to reach you and for refund requests and complaints to be resolved. Accounting records of purchases for which MercanWorks is the seller are kept for seven years under the Estonian Accounting Act. Uninstalling the game does not delete the record at RevenueCat. To have it deleted, write to info@mercanworks.com and include your Google Play order number (it starts with GPA) so that we can find the record; we delete it and confirm within one month, except for accounting records we must keep under the law.
Google keeps payment data for the periods described in its privacy policy. Uninstalling the game does not delete data that Google has already collected; requests concerning that data are made to Google.
11Children and parents
NonoGuess is made for a general audience. The game asks for no age and has no chat; you can play it without opening the team screen. The team screen shows names that other players have typed, and these are not reviewed before they appear; if you see an inappropriate name, write to info@mercanworks.com. Parents can require verification for every purchase in the Google Play settings. We do not knowingly collect personal data from children under 13 beyond what is described here. Parents and guardians can ask us at any time what the game does with data, and can ask us to delete any information a child has sent us. Write to info@mercanworks.com.
12Your rights
For the team data at Firebase and the purchase records at RevenueCat, which are held on our behalf, you can exercise your rights of access, rectification, erasure, restriction, data portability and objection with us. Because these records do not contain your email address, please tell us your team’s name and player name, or your Google Play order number (it begins with GPA), so that we can find your record.
Regarding other data that we hold about you, for example from correspondence, you can exercise the same rights, and your right to object to processing based on legitimate interests, by writing to info@mercanworks.com. We reply within one month. Our website privacy policy explains the procedure. Comparable rights under the law of your country apply in the same way.
13Complaints
You have the right to lodge a complaint with a data protection authority, in particular in the EEA country where you live. The authority responsible for us is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, +372 627 4135, www.aki.ee.
14Additional information for players in Türkiye
If you live in Türkiye, the Turkish Law on the Protection of Personal Data No. 6698 (KVKK) may apply in addition. The data controller is MercanWorks OÜ, which is established in Estonia. The team data described in this policy is collected automatically through the game and goes directly from your device to Google, whose servers are in Germany. Purchase data is collected automatically through RevenueCat’s software in the game and goes to RevenueCat, which is located outside Türkiye in the United States.
The legal grounds under Article 5 of the KVKK are the conclusion and performance of a contract for the team, ranking and card services and for verifying, delivering and refunding purchases (Article 5(2)(c)); our legitimate interests for the update notice (Article 5(2)(f)); and our legal obligation for accounting and tax records (Article 5(2)(ç)). The game shows no advertisements and requests no explicit consent.
Your rights under Article 11 of the KVKK and the way to apply are described in our website privacy policy. You can apply in Turkish to info@mercanworks.com; we reply within 30 days. You may then lodge a complaint with the Personal Data Protection Board within the time limits described there.
15Changes
We will update this policy before a version of the game is released that processes data differently, for example when advertisements, a cloud save or new software that processes data is added. The date shown on this page identifies the current version.