Almost

1. Overview

This Privacy Policy explains how Almost collects, uses, shares, and protects information when you use the app.

Last updated: August 10, 2026

2. Information We Collect

• Account A Firebase user ID. If you sign in with Apple or Google, we may also receive your name, email address, sign-in provider, and provider account identifier, depending on the information you choose to share.
• Gameplay Puzzle identifier, language, guesses and gameplay actions, completion result, score, clue progress, elapsed-time values, and streak information.
• Leaderboard Your first name or the generic label "Player," average score, number of eligible games, ranking status, and recent activity date.
• Purchases Product, transaction, coin balance, grant, and coin-use information associated with your Almost account. We do not receive your full payment-card details.
• Referral If you use the invite-a-friend feature, we store a referral code, a one-way hashed identifier derived from your sign-in provider account, and a redemption record linking the inviting and redeeming accounts, along with the related coin grants. This is used to deliver referral rewards and prevent referral abuse.
• Notifications If notifications are offered and you enable them, an Expo push token and related delivery information needed to send notifications.
• Technical Basic app, device, network, request, and error information that our infrastructure providers may process to operate, secure, and diagnose the service.
• Usage Anonymous interaction events (such as starting a game, unlocking a clue, or submitting a guess) and anonymized recordings of in-app screens, collected under a random device identifier that is not linked to your name, email, or account. On-screen personal details are masked. We use this to understand where players get stuck and improve the game.

3. Guest Play and Accounts

Almost creates an anonymous Firebase session so core online features can work before you sign in. You can buy and use coins as a guest — no account is required to make a purchase. You may optionally sign in with Apple or Google to receive a one-time welcome bonus, keep your coins on your account (coins bought as a guest carry over when you sign in), and take part in the leaderboard.

• Apple and Google handle their own sign-in interfaces and credentials.
• Almost does not receive or store your Apple ID or Google account password.
• Apple may provide your name and email only on the first authorization, and you may choose Apple's private email relay.
• A provider authorization token or code may be processed when needed to authenticate you or revoke Apple authorization after account deletion.

4. Information Stored on Your Device

Almost uses local device storage to remember your current daily game, completed result, streak, and pending score submissions. This allows you to resume a puzzle and retry a score submission after an interruption or temporary network failure.

Local data generally remains on that device until it is replaced, cleared by the app, or removed when you delete the app or its data. Guest progress may not transfer to another device or account.

5. Gameplay, Scores, and Leaderboard

When a game is completed, Almost may send its puzzle identifier and score-related action history to Firebase Cloud Functions. The server replays those actions to calculate an authoritative result and stores one score record for that account and day.

The leaderboard is public. Eligible permanent accounts may display a first name or "Player," average score, eligible game count, and rank. A technical account identifier is used to associate the entry with your account. Please do not use sensitive information as your public name.

6. Coins and In-App Purchases

Coin packs are processed by Apple through the App Store and managed in Almost through RevenueCat. Apple handles payment authorization. Almost and RevenueCat receive information needed to confirm the product, transaction, account entitlement, and virtual-currency balance.

• Your Firebase user ID is used as the RevenueCat customer identifier so coins remain linked to the signed-in Almost account.
• Server records may include coin grants, purchases, balances, clue unlocks, timestamps, and idempotency or fraud-prevention references.
• We do not receive your full credit-card or bank-account details.

RevenueCat's privacy practices are described in its Privacy Policy. Apple's privacy practices are described in the Apple Privacy Policy.

7. Notifications

If Almost offers push notifications and you grant permission, we may use an Expo push token to send daily puzzle reminders, service messages, or other app-related notifications. You can disable notifications at any time in your device settings.

Notification delivery may be handled by Expo and the platform push service. Expo's practices are described in its Privacy Policy.

8. Result Sharing

When you choose Share, Almost creates a result image or text summary on your device and opens the operating system's share sheet. The app does not automatically upload that result. Information you send is handled by the destination app or service under its own privacy policy.

9. How We Use Information

• Provide daily puzzles, resume progress, calculate results, and maintain streaks.
• Authenticate users and keep account-based features associated with the correct account.
• Verify scores, operate the public leaderboard, and reduce manipulation or duplicate rewards.
• Process coin purchases, balances, grants, and clue unlocks.
• Operate the invite-a-friend referral program, deliver referral rewards, and prevent referral abuse.
• Send notifications you have permitted.
• Maintain security, prevent abuse, troubleshoot errors, and improve reliability.
• Comply with legal obligations and enforce our Terms of Use.

10. Service Providers and Sharing

We do not sell or rent your personal information, and we do not share it for third-party targeted advertising. Information may be processed by providers that help operate Almost:

• Google Firebase for authentication, Firestore database, Cloud Functions, and service infrastructure. See Firebase Privacy and Security.
• Apple and Google for account sign-in and, where applicable, App Store purchase processing.
• RevenueCat for purchases and virtual-currency management.
• Expo for the app platform and, if enabled, push-notification delivery.
• PostHog (hosted in the EU) for anonymous product analytics and session replay: we collect gameplay interaction events (such as starting a game, solving a clue, or making a guess) and anonymized recordings of in-app screens under a random device identifier. These are not linked to your name, email, or account, and on-screen personal details are masked. This helps us understand where players get stuck and improve the game. See the PostHog Privacy Policy.

We may also disclose information where required by law, to protect users or the service, to investigate abuse, or as part of a business transfer subject to appropriate safeguards.

11. Legal Bases

Where applicable law requires a legal basis, we process information to perform our agreement with you, pursue legitimate interests such as service security and improvement, comply with legal obligations, and rely on consent for optional permissions such as push notifications. You may withdraw consent through your device settings where applicable.

12. Data Security

• Network communication with our service providers uses encrypted HTTPS connections.
• Authentication is handled through Firebase Authentication and supported identity providers.
• Server-only operations use Cloud Functions, and Firestore security rules restrict client writes to protected records.

No storage or transmission method is completely secure, so we cannot guarantee absolute security.

13. Retention and Account Deletion

We retain information for as long as reasonably necessary to provide Almost, maintain security and transaction integrity, resolve disputes, and meet legal obligations.

• You can delete your permanent authentication account from Profile > Delete Account. Apple authorization is also revoked where available.
• Device-local progress may remain until the app's local data is cleared or the app is removed.
• Score, leaderboard, purchase, coin, referral, anti-abuse, and transaction records may be retained after authentication-account deletion where needed for integrity, fraud prevention, accounting, or legal compliance.
• Where deletion is legally required, retained records will be deleted or de-identified unless an exception applies.

To request access to or deletion of associated server records, contact us using the details below. We may need to verify your identity before completing the request.

14. International Data Transfers

Our service providers may process information in countries other than your own. Where required, we rely on contractual, organizational, or legal safeguards designed to protect information transferred internationally.

15. Children's Privacy

Almost is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information without appropriate consent, please contact us so we can review and address the request.

16. Your Privacy Rights

Depending on your location, including under applicable laws in Turkiye, the European Economic Area, or the United Kingdom, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information, and to lodge a complaint with a data-protection authority.

These rights may be subject to legal limitations. To exercise a right, contact us using the details below.

17. Changes to This Policy

We may update this Privacy Policy as Almost, its service providers, or legal requirements change. The latest version will be published at this URL with a revised "Last updated" date. Where appropriate, we may also provide an in-app notice.

18. Contact