HIE-YA ("we", "us", "our") operates Guess & Draw Mania ("the Game"), a mixed-age drawing and guessing app. This page explains what we collect, why, how ads and purchases work, and how to delete your data. English is the canonical, legally binding version. The same policy is shown in the app under Settings → About → Privacy Policy.
01 Information we collect
- An account identifier from the sign-in provider you choose (Firebase Auth: guest, email, or Google)
- Birth year, immediately reduced to an age band (child / teen / adult). We do not collect a full date of birth
- Nickname, avatar, language, and theme choices
- Gameplay statistics: matches played, scores, coins, achievements
- Optional contact hashes if you opt in to friend discovery (see section 04)
- Technical data needed to run a match: connection events and error reports
02 What we do not collect
We do not collect your real name, address, precise location, or photos. We do not read your contacts as phone numbers or emails. Players never type a public player ID. We do not build advertising profiles of children.
03 Drawings
Drawings are sent to the other player in your match so the round can be played. They are discarded when the match ends, except where a drawing was reported. Reported drawings are kept only for review and then deleted.
04 Contacts
Finding friends from your address book is optional and is switched off for child accounts. If you use it, your device converts each phone number and email address into an irreversible SHA-256 code. Only those codes are sent. Your contacts themselves never leave your device and we never store them.
05 Children's privacy
The Game is mixed-audience. We show a one-time age gate. Anyone whose age band is child-directed gets those protections automatically:
- Nickname is generated; there is no free-text name field
- Ads are non-personalised and limited to a general-audience rating
- Purchases are blocked
- Public scoreboard and contact-based friend finding are off
Ad SDKs are not initialised until after the age gate. Parents and guardians can delete the account from Profile → Delete my account, or email us with the nickname.
06 Advertising
Free play is supported by Google AdMob (including optional rewarded ads). For anyone under the age of consent, and for anyone we treat as child-directed, ads are non-personalised. Personalised ads require an adult age band. Rewards are granted only after server-side verification, not by the device claiming a watch.
07 Purchases
Purchases are processed by Google Play or the Apple App Store and by RevenueCat, which tells us only whether an entitlement is active. We never see your card details. Purchases are blocked for child accounts. Coins are a virtual item with no cash value.
08 Third-party services
The Game uses the following third-party services:
- Firebase Authentication (Google) — sign-in for guests and linked accounts (Privacy Policy)
- Google AdMob — advertising, including rewarded ads (Privacy Policy)
- RevenueCat — purchase entitlements (Privacy Policy)
- Fly.io — hosts the game API (REST and live match sockets)
- Supabase (PostgreSQL) — stores profiles, stats, and related game records in the European Union
09 Storage, retention, and deletion
Profile and progression data are processed on our API and stored in the European Union. Data is kept while your account exists. Unused guest accounts are removed after a retention period. You can delete everything in-app at Profile → Delete my account. That removes your profile, coins, stats, achievements, friend links, contact hashes, and the Firebase user. Deletion cannot be undone. You can also email us; we aim to complete deletion within 30 days where technically feasible (backups may lag).
10 Changes to this policy
We may update this Privacy Policy. The date at the top will change when we do. Inside the Game, a new version also re-prompts you to accept before you continue playing.
11 Contact us
If you have questions about this Privacy Policy, or want us to delete an account on a child's behalf, contact us at: