Privacy Policy

Who we are

DOODLE5 is operated by Greatest Ventures LLC. This policy applies to the DOODLE5 website, web app, and distributed mobile apps. It does not replace the privacy policies of services you choose to use with DOODLE5, such as Google, Apple, Stripe, or Google Play.

Age positioning

DOODLE5 is a family-friendly daily puzzle designed for people ages 13 and older. It is not directed to children under 13, and under-13 age groups are not part of our intended audience. When account creation asks for an age range, the selection is used on that screen only to determine account eligibility. We do not send or store the selected range or a date of birth.

If you believe a child under 13 has provided personal information to DOODLE5, contact privacy@doodle5.com so we can investigate and take appropriate action.

Information we collect

• Authentication and account information: your account identifier, email address, display name, authentication provider, session information, consent records, and chosen picture from the DOODLE5 avatar library. Supabase Auth handles password authentication; DOODLE5 does not store passwords in readable form.
• Google or Apple sign-in information: the provider account identifier and information the provider makes available with your permission, such as your email address and name. Google and Apple control their own account data and sign-in services.
• Anonymous guest account information: a Supabase user identifier, generated display name, default profile picture, session credentials, and an anonymous-account status. A guest can later add email/password, Google, or Apple sign-in to the same player account.
• Game information: puzzle guesses, clue guesses, hints used, results, scores, solve times, streaks, statistics, achievements, unlocks, and game history.
• Friends and rivals: friend requests and relationships, rival assignments, blocks, and the profile, ranking, and comparison information displayed through those features.
• Device, network, and usage information: IP address, request and security logs, browser and device type, operating system, page or screen viewed, referrer, timestamps, approximate location derived from IP, app performance, and feature interactions.
• Push notification information: a Firebase Cloud Messaging token, device/platform information, notification preferences, and delivery or error information when you enable push notifications.
• Purchase information: product, provider, provider transaction reference, amount or price, currency, purchase status, and timestamps. We do not store full payment-card details.
• Support information: the messages and attachments you send to our privacy or support contacts and information needed to resolve the request.
• Cookies and preferences: cookie-consent choices, theme and background settings, notification choices, and other saved preferences. See our Cookie Policy.

Information we do not currently collect from players

The current version of DOODLE5 has no player-to-player messages, comments, discussion boards, profile biographies, or shared player content. Profile pictures come from the DOODLE5 library. The only player-entered text shown to other players is a display name. Display names are normalized and screened for personal information, links, impersonation, profanity, sexual content, hate, and slurs before they are saved.

How we use information

• Create and authenticate accounts, including anonymous guest accounts and guest-to-permanent account conversion.
• Operate puzzles; save guesses, results, scores, streaks, and achievements; and provide statistics, leaderboards, friends, and rivals.
• Process server-verified purchases, prevent duplicate grants, provide entitlements, and handle refunds or disputes.
• Provide opted-in push notifications and service communications.
• Measure traffic, feature use, and performance; diagnose errors; and improve DOODLE5.
• Display and measure advertising according to your consent choices and applicable law.
• Detect fraud, cheating, attacks, and abuse; enforce our House Rules; and protect users and the service.
• Respond to support, privacy, billing, and legal requests and comply with applicable obligations.

Analytics and infrastructure providers

• Google Analytics (GA4): measures visits, page use, engagement, referrers, general device/browser information, and approximate geography. Google Consent Mode keeps analytics storage denied until you opt in where consent is required.
• Vercel and Vercel Analytics: host and deliver the web service and provide aggregated traffic, page-use, device/browser, geography, performance, deployment, and server-log information.
• Supabase: provides authentication, database, file storage, and server infrastructure for account, gameplay, social, preference, and purchase-entitlement data.
• Firebase: provides Firebase Cloud Messaging for optional push notifications and processes push tokens and delivery-related device data.
• Cloudflare: provides network, DNS, delivery, and security services and may process IP addresses, request metadata, and security events.

These providers process information for us under their applicable terms and privacy commitments. Information may be processed in the United States and other countries where they operate.

Advertising — Google AdSense

DOODLE5 uses Google AdSense on eligible pages. Google and its advertising partners may receive device, browser, IP address, page, ad-interaction, cookie, and advertising-identifier information to deliver, limit, secure, and measure ads. Personalized advertising and advertising storage follow your consent choices and applicable law. You can change DOODLE5 cookie choices from the Cookie Preferences control and manage Google ad personalization in Google Ad Settings. Google describes its practices in the Google Privacy Policy.

Purchases

• Web purchases: Stripe processes payment details and web checkout. DOODLE5 receives the purchase and transaction information needed to verify payment and grant the item.
• Google Play-distributed Android purchases: Google Play Billing processes digital-item purchases. DOODLE5 sends the purchase token to Google for server verification before granting the item.
• Our records: Stripe and Google Play both write to the same provider-neutral purchase and entitlement system. A client-side payment claim alone never grants an item.

Stripe and Google process payment information under their own privacy policies and legal obligations. DOODLE5 does not store complete card numbers or card security codes.

When we share information

We share information with the service providers described above only as needed to operate, secure, analyze, advertise, support, and take payment for DOODLE5. We may also disclose information when required by law, to protect rights or safety, to investigate fraud or abuse, or as part of a merger, financing, acquisition, or sale of business assets subject to appropriate safeguards. We do not sell personal information for money.

Data from earlier versions

Earlier test releases included direct messages, discussion boards, and mentions. Those features are disabled. Historical message, discussion, and mention records remain in restricted database systems until the associated account is deleted or an earlier valid deletion request is completed. Access is limited to systems and authorized administrators for support, safety, legal, and deletion purposes.

To request a copy or early removal of historical content, email privacy@doodle5.com.

Retention and account deletion

We generally keep account and game information while the account remains active. You can permanently delete an account in the app at Settings → Account → Delete Account. You can also initiate deletion without installing the app at doodle5.com/delete-account, or request help from privacy@doodle5.com if you cannot sign in.

Account deletion removes the Supabase Auth identity and associated profile, gameplay, guesses, scores, streaks, achievements, social relationships, push tokens, preferences, historical content, and entitlements. Residual copies in backups and security logs age out within 30 days.

We may retain a minimized purchase record for up to seven years when needed for refunds, fraud prevention, accounting, tax, or legal obligations. It is detached from the deleted DOODLE5 account, stripped of unnecessary account metadata, and cannot grant an entitlement. Stripe and Google may independently retain processor records under their own policies and obligations. Non-identifying proof that a deletion completed may also be retained.

Your choices and rights

• Update eligible profile and preference information from your account pages.
• Manage optional analytics and advertising choices from the Cookie Preferences control.
• Enable or disable push notifications in your account settings and device settings.
• Request access, correction, deletion, or a copy of your information by emailing privacy@doodle5.com.
• Depending on where you live, you may also have rights to restrict or object to processing, withdraw consent, appeal a privacy decision, or complain to a data-protection authority.

We may need to verify your identity before completing a request. Some rights are subject to legal exceptions. Authorized agents should contact us and provide proof of authority.

Security

We use administrative, technical, and organizational safeguards intended to protect information, including authenticated access, restricted administrative credentials, row- and column-level data controls, server-side purchase verification, encrypted transport, and monitoring. No system can be guaranteed completely secure.

Changes to this policy

We may update this policy as DOODLE5 or applicable requirements change. We will post the revised policy here, update the date above, and provide additional notice when a change is material.

Contact

Greatest Ventures LLC
Privacy, data, and deletion requests: privacy@doodle5.com
Product, account, and billing support: support@doodle5.com