Privacy and data protection policy

1. Controller and contact

David Nieves Coronado is the controller of personal data processed by Nonoqo at nonoqo.com and in its applications. For privacy questions or to exercise your rights, email support@nonoqo.com. This notice is provided under the General Data Protection Regulation (GDPR) and Spanish data protection law.

2. Data we use

When you create or edit an account, we collect your username, email address and password, which is stored as a hash rather than readable text. An optional avatar is also processed. We keep account and session identifiers, access dates, and the version and date of acknowledgment of this notice. Servers may generate technical connection logs, including IP addresses, requests and errors, for operation and security.

Puzzle progress, times, marks, errors and already discovered pixels are saved in the database under your account so that signing in on any device restores the current state. A local copy and pending changes protect progress during connection failures; an older game cannot overwrite a more recent version. Language preferences remain on your device or browser. Some moves are sent to the server for validation and to return their result.

When available, Google or Apple sign-in uses the identifier and verified email supplied by the provider and technical data needed to verify access. Purchases generate transaction identifiers and collection access records. Nonoqo does not receive your full card number or security code. Support requests include any information you choose to provide.

If you participate in referrals, we store the invitation code, inviter, new account using it, verification and points earned or redeemed. For an invitation bound to a specific email, the address is encrypted and compared using a protected derived identifier. The email is not included in the link. You share the invitation; Nonoqo does not send automatic marketing or invitation emails to your friend. The verification email is sent when that person requests an account.

Your username, your optional profile image, best puzzle completion times, penalties and game statistics are shown to other registered players in leaderboards and your player profile. These screens do not show your email, password, board marks or purchase information. Best results are retained when you retry or discard a game; deleting the account also deletes its records. You can change the image to a photo or a preset avatar in My account. Photos are cropped and resized, metadata is removed, and they are served only to registered users. Replacing a photo removes the previous file.

In My puzzles we process the square crop of your chosen photo, puzzle size, background-removal option, your instructions, the preview and resulting matrices. Before generating, we ask for permission to send the cropped photo and instructions to OpenAI through its API for content checks and artwork preparation. We do not send your email or username. Automated checks may reject brands, video game characters or sexual content; you can change the photo or details. Each creation allows five generations. The photo and preview are private. We remove metadata and delete the working photo when you confirm or cancel; drafts expire after 24 hours and hourly maintenance deletes their files. Downloaded puzzles and clues are stored on the device per account. Your first image and AI creation is free. We count confirmed AI creations; deleting them does not restore uses. You can also draw and save unlimited manual puzzles for free. Manual drawings are stored in Nonoqo and are not sent to OpenAI.

Your friends list, requests and invitations are linked to your account to provide social features. If you allow notifications, Firebase Cloud Messaging uses an installation identifier and Apple or Android tokens to deliver room invitations. The token is linked to your account and removed when you sign out or disable notifications. We do not access your phone address book.

Firebase Crashlytics collects crashes and technical diagnostics in the iOS and Google Play mobile releases: stack traces, installation identifiers, app version, operating system and technical device state. We do not add your email, account identifier, photos, gameplay contents or purchase receipts to these reports. Flutter exception messages are replaced with technical categories. Sign-in SDKs may also process names, phone numbers, identifiers and approximate location derived from the connection for authentication and security under the provider’s policy.

3. Purposes and legal bases

We process data needed to create and maintain your account, authenticate you, provide gameplay, recognize purchases and handle service requests to perform our contract with you or take steps you request before entering into it (GDPR Art. 6(1)(b)). A username, email and valid sign-in method are required to create an account; without them we cannot provide the account service.

Fraud prevention, access controls and fault diagnosis rely on our legitimate interest in keeping Nonoqo secure and operational (GDPR Art. 6(1)(f)). Handling data rights and applicable tax or accounting requirements rely on legal obligations (GDPR Art. 6(1)(c)).

The registration checkbox acknowledges that you have read this notice. It does not give general permission to process data or consent to advertising. We do not use your data for marketing without an appropriate legal basis. Any optional consent requested in future can be withdrawn without affecting earlier processing.

We manage requested invitations and point redemption as part of the service. Email verification and checks against duplicate rewards rely on our legitimate interest in preventing abuse. Points are free rewards: they cannot be purchased, transferred or converted into money.

4. Recipients and external services

Hosting, maintenance and email providers may access data as needed to provide their services under applicable data protection arrangements. Data may also be disclosed to authorities where legally required. We do not sell your personal data.

If you choose Google or Apple sign-in, those providers process their own data under their policies. Mobile in-app purchases are handled by Apple, Google or Huawei when enabled. On the web, Stripe Checkout handles payments when available: we send the price, currency and an account identifier to assign the purchase; card details are entered directly into Stripe. We receive payment confirmation and status, including refunds or disputes, to manage collection access.

Some international providers may process data outside the European Economic Area. Where they process data on behalf of Nonoqo, valid GDPR safeguards must apply, such as an adequacy decision or standard contractual clauses. Ask support@nonoqo.com for information about providers and safeguards. We do not make decisions with legal or similarly significant effects based solely on automated processing.

If you gift a puzzle, the recipient receives an in-app notification and service email with your username and the puzzle name. Acceptance creates a fixed copy without your source photo or progress. If you voluntarily publish in Community, review makes your username and the puzzle version available to other registered players, who may save copies. Withdrawal prevents new additions but does not remove saved copies. Share only images you have rights to use and permission from depicted people. Personal challenges, accepted by both players, share only the fixed board and round information with participants.

Google/Firebase provides sign-in, notification delivery and crash diagnostics. They support functionality and technical service improvement without advertising tracking across apps or websites. Huawei handles AppGallery purchases when enabled; its optional SDK call statistics are disabled.

OpenAI receives only the cropped photo and instructions you authorize sending when generating, together with a derived technical identifier that does not contain your email. Classification responses are requested without conversation storage. OpenAI processing and technical retention are governed by its API terms and applicable data protection safeguards; deleting the photo in Nonoqo does not mean immediate deletion of the provider’s technical records. OpenAI information is linked at the end of this policy.

5. Retention and security

You can delete your account from My account → Delete account in the app or at nonoqo.com/play/. Identity verification and confirmation of permanent deletion are required. Your profile, photo, games, records, invitations, points and access grants are deleted; sessions and linked Apple access are revoked. Purchases are not automatically refunded. Only minimal payment records needed for legal obligations, refunds and disputes are retained separately from your account for the applicable periods. Private backups are retained for 30 days, excluded from ordinary use and must not be restored to reactivate deleted accounts.

Technical logs are kept as long as needed to diagnose incidents, prevent abuse and resolve possible claims, depending on the purpose and seriousness of the incident. Session tokens expire and are revoked when you sign out or where required for security. Local data remains until you remove it or clear your device or browser storage.

We use encrypted connections, hashed passwords and access controls. No system can guarantee absolute security. Please contact us if you discover a problem.

Email-bound invitations expire after 30 days and are deleted by daily maintenance. Deleting your account removes your points and redemptions. Points other players already earned are retained without identifying you. Only a protected invited-email fingerprint is retained for 90 days to prevent repeated rewards; after that, its association with the email is removed.

Account deletion removes your personal collections and puzzles, withdraws publications and cancels pending gifts. Copies accepted by other players and fixed boards in ongoing challenges remain independent. A recipient can delete their copy at any time. Deleting a puzzle removes its game and local copy when synchronization completes; it does not remove other players’ copies.

6. Your rights

You can request access, correction, deletion, restriction, objection and, where applicable, portability by emailing support@nonoqo.com from your account email and describing your request. You can also delete your account in My account → Delete account or request it at https://nonoqo.com/delete-account without installing the app. We may request proportionate additional information to verify your identity. We respond within legal time limits, normally one month; any permitted extension will be explained.

You can edit your username, email and password in My account. Clearing local browser data does not by itself delete your account or server records. If you believe your rights have not been handled properly, you can complain to the Spanish Data Protection Agency (AEPD).

7. Local storage and children

The app and web player use storage needed for sessions, language preferences and games. The game does not incorporate advertising analytics or personalized ads. This policy does not authorize adding them.

If you are a minor, ask your parent or guardian to review this notice with you and help when their involvement is required to use the service or make purchases. We will not seek a child’s consent where the law requires that of their legal representative.

8. Changes and further information

Updated versions will be published on this page. If we substantially change how we use your data, we will notify you appropriately and seek fresh consent where necessary. This policy describes data processing and does not replace purchase terms.

Website cookies and analytics

The nonoqo.com landing page uses Google Analytics 4 only when you accept analytics cookies. Rejecting prevents the Google tag from loading. You can change or withdraw consent using “Cookie settings” in the landing page footer. Rejecting removes analytics cookies accessible on this domain.

With your permission, we measure visits, language, traffic sources and clicks to play or view premium plans. We do not send names, email addresses, accounts, games or solutions. Google provides analytics and may process data outside the European Economic Area under its terms and transfer safeguards.

The _ga and _ga_* cookies distinguish visits and sessions; their configured maximum lifetime is 180 days. Your choice is stored for 180 days in browser local storage (nonoqo.analytics-consent.v1). Necessary session, security and language cookies operate independently of analytics. Advertising signals and ad personalization are disabled.

Google privacy policy · Return to the website and manage cookies