Legal

Privacy Policy

Last updated: August 30, 2026

This policy explains what ShapeMorph (the "Service") collects, why it collects it, who it is shared with, and how you can get it deleted. It describes the app as it actually works — if you find anything here that does not match what the app does, please tell us and we will correct it.

1. Playing without an account

You can play ShapeMorph as a guest, without giving us an e-mail address or any name. In guest mode we create an anonymous identifier so the game can save your progress on that device. Guest play is limited: ranked modes, tournaments, referrals and most rewards require a real account.

2. What we collect when you create an account

We do collect personal data. Specifically:

• Account details — your e-mail address, the display name you choose, and the country you select. Accounts can be created with an e-mail and password, or through Sign in with Google or Sign in with Apple; in those cases we receive the e-mail address associated with that account.
• Your display name is public. It is shown to other players in leaderboards, tournaments and challenges. Your e-mail address is never shown to other players.
• Game data — scores, game history, daily and weekly rankings, tournament results, level and experience, achievements and badges, and the challenges you take part in.
• In-game economy — your N'Joy balance and the history of transactions that change it, and the cosmetic items you own.
• Referrals — if you use or share a referral link, we record the link between the two accounts so the reward can be granted.
• Purchases — the history of your in-app purchases and subscriptions, so we can restore what you bought and grant what you paid for.
• Rewarded ads — a record that a rewarded ad was watched and credited, which is also what prevents the same reward from being claimed twice.
• Support requests — if you contact us through the app, we keep the message you send and the account it came from, so we can answer you.
• Technical data — device type, operating system version, app version, and diagnostic information when the app encounters an error.
• Advertising identifier — your device's advertising ID, used by Google AdMob to serve ads. On iOS this is only shared if you allow tracking when the system asks you. In the European Economic Area and the UK, a consent screen is shown before personalised ads are used.

3. Why we collect it, and on what legal basis

Under the GDPR, every purpose needs a legal basis. Ours are:

• To run your account and save your progress across devices — performance of our contract with you.
• To operate leaderboards, tournaments, challenges and referrals — these cannot work without a shared, server-side record of scores. Performance of our contract: they are the service you signed up for.
• To deliver and restore the purchases you make — performance of our contract, and legal obligation for the accounting records that follow a sale.
• To show personalised ads, which is how the free version is funded — your consent, asked for on a dedicated screen in the European Economic Area and the UK, and withdrawable at any time from the app's settings. Refusing it does not stop you playing: you get non-personalised ads instead.
• To detect cheating and abuse — scores and rewards are validated on our servers. Legitimate interest: a leaderboard that can be faked is worthless to every honest player.
• To answer your support messages — legitimate interest in replying to someone who wrote to us.

We do not sell your personal data, and we do not use it for any purpose beyond running the game.

4. Who it is shared with

We use the following providers, and only for what is described above:

• Google Firebase — authentication, database (Firestore) and server functions. This is where your account and game data are stored. Servers are located in the European Union. Firebase Privacy Policy
• Google AdMob — advertising. AdMob receives your advertising identifier and technical data about your device to select and measure ads. Google Privacy Policy
• RevenueCat — purchase and subscription management. RevenueCat receives your purchase history and an anonymous user identifier to validate transactions. RevenueCat Privacy Policy
• Apple and Google — as the app stores, they process the payment itself. We never see or store your payment card details.
• Cloudflare — hosting of this website, and cookie-free audience measurement (Cloudflare Web Analytics) on the website only, not in the app. It counts page views and records which site referred you. It sets no cookie, uses no fingerprint, stores no IP address and does not follow you across other sites, so it cannot identify you. This is why you are not asked for consent for it. Cloudflare Web Analytics

This website loads nothing else

Apart from the audience measurement above and our own game server, this site loads no third-party resource at all. Its fonts, animation libraries and 3D engine are served from our own domain — they used to come from Google Fonts, jsDelivr and unpkg, which meant your IP address reached companies not listed here. That was fixed on 30 August 2026.

Transfers outside the European Union

Your account and game data are stored on Firebase servers located in the European Union. Two providers, however, are American and may process data outside the EU:

• Google (AdMob), for advertising — and only if you consented to personalised ads.
• RevenueCat, for purchase validation.

Both rely on the European Commission's Standard Contractual Clauses, and Google is certified under the EU–US Data Privacy Framework. If you refuse personalised ads, no advertising identifier is shared with Google for that purpose.

5. How long we keep it

Your account data is kept for as long as your account exists. When you delete your account, your profile, game history, wallet, inventory and support messages are deleted from our database. Records we are legally required to keep — proof of purchase, for example — are retained by Apple, Google and RevenueCat under their own policies, and anonymised aggregate statistics that can no longer identify you may be kept.

6. Deleting your account and your data

You can delete your account and its data at any time, directly from the app: Profile → Settings → Delete account. The deletion is immediate and permanent — it cannot be undone. Full instructions, including what to do if you can no longer sign in, are on our account deletion page.

7. Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access your data, to have it corrected, to have it deleted, to object to certain processing, and to receive a copy of it. Most of this is available directly in the app; for anything else, contact us using the link below and we will answer.

You also have the right to lodge a complaint with your national data protection authority. In France, that is the CNIL.

8. Children

ShapeMorph is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

If we change what we collect or what we do with it, we will update this page and change the date at the top. Significant changes will also be announced in the app.

10. Contact

For any question about this policy, or to exercise any of the rights above, write to [email protected], or use the Support page from inside the app. We answer within 30 days, as the GDPR requires.

11. Legal notice

Publisher and controller of your data — Arnaud Vasse
Résidence Gais Logis, bâtiment D7
Rue Théodore Aubanel
13127 Vitrolles, France
Director of publication: Arnaud Vasse. Contact: [email protected]

Host — Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States. Telephone +1 (650) 319-8930. cloudflare.com

Supervisory authority — Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. cnil.fr