Last updated: July 30, 2026
Knight to 100 is operated by its developer ("we"), who is the controller of any personal data described here. For anything in this policy — questions, requests, complaints — contact support@knightto100.app.
On first launch, the app generates a random, anonymous device ID and stores it on your device. It isn't your advertising ID, IMEI, or any hardware identifier — it's just a token the app makes up so our server can recognize your account. Like any web server, ours also sees your IP address; we use it only briefly for abuse protection (such as limiting login-code emails) and never store it with your account.
Leaderboards, friends, and multiplayer duels are optional. Using them sends: a display name you pick yourself (display names are unique across players) and an emoji avatar (no phone number or real name needed); your scores, times, and win/loss record per mode; friend codes and connections you create; and, during a duel, your moves, live score, and emoji reactions so we can sync the board with your opponent. If you block someone, we remember that connection so they can't reach you again; unblocking — or deleting your account — removes it.
In the iOS/Android app you can link an email address so you can restore your account on a new phone. It's verified with a 6-digit one-time code — there is no password, and the code itself is stored only in hashed form. We use the address solely for account recovery: it's never shown to other players, never used for marketing, and never shared. You can replace it any time from the Account screen, and it's deleted with your account.
Game settings (mode, random-start/preview toggles, theme), in-progress saved games, and your personal best/today scores never leave your device. Your phone's own backup (iCloud on iOS, Google backup on Android) may carry this local data — including your account identity — to your next device so the game restores seamlessly; those backups are governed by Apple's or Google's terms and your device settings.
Scanning a friend's QR code to join a duel uses your camera live to read the code. No photo or video is captured, stored, or transmitted — the camera feed never leaves your device.
In the iOS/Android app, you can choose to watch a short rewarded ad — served by Google AdMob — to refill your undos. Google may process your device's advertising ID and related device data to serve, limit, and measure these ads, as an independent controller under Google's own privacy policy. You can reset your advertising ID or limit ad personalization in your device settings, and you're never required to watch an ad.
Buying Knight Club, a puzzle pack, or the annual subscription is handled entirely by the Apple App Store or Google Play — we never see your card number, name, or Apple/Google account. Once a purchase completes, the app sends our server the product you bought and a verification token from the store (not your payment details), so we can confirm it's genuine and unlock it on your account. We store which product you bought, when, and whether it's still active — including subscription status, since Apple and Google can also notify us directly when you renew, cancel, or get a refund, so your access updates automatically.
If you allow notifications, we use Google's Firebase Cloud Messaging to deliver them — things like duel and rematch invites, friend requests, leaderboard passes, and streak reminders. This means a push token (a code your device gets from Firebase, not your name or number) is stored on your account so we know where to send them. You can turn notifications off anytime from your device settings; we simply stop sending them, and the token is deleted if you delete your account.
Account data (display name, avatar, friend code, recovery email, scores, times, win/loss records, friend links, and duel history): for as long as your account exists, then deleted when you delete it.
One-time login codes: valid for 10 minutes; the hashed code records (including the requesting IP used for rate limiting) are deleted within about an hour.
After account deletion: everything above is removed immediately. Board positions from finished shared-board duels may remain so other players keep their result, but they carry only an internal number — nothing that identifies you. We also keep a basic record of any purchase (which product, when, and the store's transaction ID) for financial recordkeeping, but once your account is gone it's no longer linked to your name, email, or anything else about you.
Hosting logs: our hosting provider keeps standard, short-lived web-server logs (IP address, URL, timestamp) for security and operations.
On your device: local data stays until you uninstall the app or delete your account; device backups follow Apple's or Google's retention rules.
Where a legal basis is required, we rely on: performance of a contract — running the game features you ask for (leaderboards, friends, duels, purchases); legitimate interests — keeping the service secure and abuse-free (rate limiting, unique names, code hashing); consent — linking a recovery email or allowing push notifications, both of which you can withdraw at any time (by replacing the email, turning off notifications, or deleting your account); and legal obligation — keeping basic purchase records for financial and tax purposes.
Online-feature data is stored on our hosting provider's servers in the United States and is processed there wherever you play from. We don't sell your personal information, and we don't use it for advertising ourselves (ads are handled by Google as described above).
Depending on where you live (for example the EU/UK GDPR, California's CCPA/CPRA, Brazil's LGPD, and similar laws), you may have the right to access, correct, delete, restrict, or receive a copy of your personal data, to object to processing, and to withdraw consent. You can do most of this directly in the app: edit your name, avatar, and email in Account, and use Account → Your data → Delete account (in the iOS/Android app — the same screen shows a plain-words summary of everything we hold) to erase your account and server-side data instantly. For anything else — including a data copy — email support@knightto100.app; we respond within the timelines your local law requires and never treat you differently for exercising your rights. EU/UK residents may also complain to their data-protection authority.
Knight to 100 isn't directed at children under 13 (or the higher minimum age your country sets for consent to data processing), and we don't knowingly collect data from them. If you believe a child has given us data, contact us and we'll delete it.
All traffic between the app and our server uses HTTPS; login codes are stored hashed, expire quickly, and are rate-limited. No online service can promise perfect security, but data we don't collect can't leak — so we collect very little.
We may update this policy as the app changes; the date above reflects the latest revision. For significant changes we'll show a notice in the app.
Questions about this policy or your data: support@knightto100.app