TileFeud — Privacy Policy
Last updated 25 September 2026
TileFeud is a turn-based board game for phones. This policy says what the app collects, why, who else sees it, and how to get rid of it. It covers the TileFeud app on iOS and Android and the server behind it.
The app is made and run by Deverity AB, a Swedish company, which is the data controller for everything described here. Contact: support@tilefeud.com.
What is collected, and why
| What | Why |
|---|---|
| Username | Names you to other players. It is public — it appears on boards you play and on the high-score lists. |
| Email address | Confirms the account is yours, and is how a forgotten password comes back. It is never shown to another player and is not used for marketing. A six-digit code is mailed when you register, and the account cannot be used until it is typed back. |
| Password | Stored only as a salted PBKDF2 hash. The password itself is never written down and cannot be recovered from what is stored — a reset replaces it rather than revealing it. |
| Games you play | Boards, moves, racks, scores and the times of each, for as long as the game exists. This is the game — without it there is nothing to come back to. |
| Finished-game scores | One score per player per finished game, which is what the high-score lists rank. Your username is read from your account when a list is drawn, so renaming yourself renames you everywhere at once. |
| Sign-in sessions | A token, stored hashed, plus when it was made and last used. It is what keeps you signed in. |
| Push token | Only if you allow notifications. It identifies the installation to Apple or Google so your phone can be told it is your turn. Declining notifications means no token is sent and none is stored. |
| Server logs | The web server records the IP address, time and path of requests it handles, as web servers do. Used to keep the service running and to investigate abuse. |
There is no analytics or tracking SDK in the app beyond what advertising requires, described below. The game does not read your contacts, your location, your photos or your files.
Advertising
The free version of TileFeud shows a full-screen advertisement occasionally, when you leave a game. Advertisements are supplied by Google AdMob. To do that, Google's advertising SDK collects and processes:
- your device's advertising identifier (the IDFA on iOS, the Advertising ID on Android);
- your IP address, and coarse location derived from it;
- device information — model, operating system version, language;
- interactions with the advertisements themselves.
How Google uses this is described in How Google uses information from sites or apps that use our services.
If you are in the EEA, the UK or Switzerland
You are asked for consent before any of this happens, on a form supplied by Google, the first time the app has an advertisement to show. You can consent, refuse, or choose per purpose. Refusing does not cost you anything in the game — you are shown non-personalised advertisements instead, and every part of TileFeud works exactly the same. You can change the answer later from the privacy options in the app.
If you are on iOS
Apple's own tracking prompt appears alongside the consent form. Declining it means the app cannot read the IDFA, and advertisements are non-personalised.
Who else sees any of this
Four services, each doing one job:
- Resend — delivers the verification and password-reset emails. It sees the address the mail is going to.
- Apple Push Notification service and Google Firebase Cloud Messaging — deliver notifications. They see the push token and the text of the notification, which names the game and what happened in it.
- Google AdMob — supplies the advertisements, as above.
- DigitalOcean — rents the server the game runs on.
Nothing is sold, and nothing is shared with anybody else. There are no advertising networks in the app other than AdMob and no data brokers of any kind.
Where the data is kept
In the European Economic Area. Your account, your games and your scores are held in one database on a single virtual server in Amsterdam, the Netherlands, rented from DigitalOcean. Backups, when taken, are copies of that database on the same machine — no third-party backup service holds any of it.
The advertising, email and notification services named above process data on their own infrastructure, which is partly outside the EEA, under their own terms and safeguards.
How long it is kept
- Account, games and scores — until you ask for the account to be deleted.
- Sessions — until you sign out, or the token is replaced.
- Push tokens — until the installation goes away. A token Apple or Google reports as dead is deleted immediately.
- Verification and reset codes — minutes. They expire, and a new one replaces the old.
- Server logs — rotated on the usual system schedule, a few weeks at most.
Deleting your account
In the app, open Account from the main menu and tap Delete Account. It is done at once.
If you no longer have the app, email support@tilefeud.com from the address on the account, or with the username, and ask. That is done by hand, within 30 days and usually the same week.
Deleting an account removes the account itself, its email address and password hash, its sessions, its push tokens, its invitations, its seats at every game and its high-score entries. Deleting from the app first resigns every game still being played, so the other player wins it. Finished games stay on the other player's list, with their opponent shown as a deleted player; a game nobody is left in is deleted with the account.
Your rights
If you are in the EEA or the UK, the GDPR gives you the right to ask for a copy of what is held about you, to have it corrected, to have it deleted, to object to how it is used, and to complain to your data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
The legal bases are: contract for the account and the games, which is what makes the app work at all; consent for advertising and for push notifications, either of which you can withdraw; and legitimate interest for server logs and keeping the service secure.
Ask at support@tilefeud.com.
Children
TileFeud is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has registered, write and the account will be removed.
Changes
If this policy changes, the date at the top changes with it and the new version replaces this page. A change that affects what is collected will be announced in the app before it takes effect.