Hiccup Hop Privacy Policy

Effective date: 24 October 2026

Hiccup Hop ("the game") is published by NAQQAT AL-TOSEIL FOR INFORMATION TECHNOLOGY, a company registered in the Kingdom of Saudi Arabia ("we", "us"). This policy explains what the game collects, why, how long we keep it, and the choices you have. We keep it short because we collect very little.

In short

• No ads, no purchases and no advertising IDs in version 1.0.
• We do not track you across other companies' apps or websites, and we do not sell your data.
• You play with an anonymous player ID. We do not ask for your name, email, phone number or precise location.
• You can turn analytics off and delete your data in the game at any time.

What we collect

• Anonymous player ID. Created when you first open the game, with no sign-up. It is not linked to your real identity.
• Game progress and cloud save. Your highest level, best stars per level, Daily Puzzle streak, the preset pal name and color you choose, and settings such as language. This lets you get your progress back after reinstalling the game or on a new phone.
• Recovery code. Stored only in a scrambled (hashed) form that cannot be turned back into the code. To stop people guessing codes, we count failed attempts per player and per network address. We keep only a scrambled form of the address, for at most 30 days.
• Invite codes and referrals. Your invite code, and who invited whom, so that invite rewards are paid correctly (once, after the invited friend reaches level 10).
• Pillow Points. Your balance, items you unlocked, and a record of how points were earned and spent. Points have no cash value and cannot be bought or transferred.
• Sign in with Apple or Google (optional). If you choose to sign in, Apple or Google tells us an account identifier, and Google also shares your email address. We ask Apple for no name and no email. We use these only to keep your progress safe on a new phone, never to contact you or for advertising. Signing in is optional unless we tell you in the game that it is required.
• Gameplay analytics (unless you turn analytics off). We use Google Analytics for Firebase to record events such as level started, level completed, Daily Puzzle played and invites shared. Google Analytics also assigns a random app-instance ID and records technical data such as device model, operating system, app version, language and an approximate location (country, region or city) derived from your IP address. This analytics data is not linked to your player ID.
• Server logs. When the game talks to our servers, Google Cloud records the IP address and device user agent of the request. We use these logs only for security and fixing problems.
• Messages you send us through the contact form: your email address, topic and message, kept up to 12 months.

What we do not collect or do

• No advertising IDs (such as IDFA or the Android advertising ID), and no tracking across apps or websites.
• No sale of personal data, and no sharing of personal data for advertising.
• No ads and no in-app purchases in version 1.0.
• No precise location, contacts, photos, microphone or camera, and no free-text chat.
• No crash reporting tool is included in version 1.0.

Why we use it, and our legal bases

• To run the game you asked for: save and restore your progress, deliver the Daily Puzzle and pay invite rewards. Legal basis: performance of our agreement with you (the Terms of Use).
• To keep the game fair and secure: prevent cheating, abuse of Pillow Points and recovery-code guessing. Legal basis: our legitimate interest in a fair and secure game.
• To understand how the game is played and improve it, using analytics. Legal basis: our legitimate interest in improving the game. You can object at any time by turning analytics off in Settings.
• To answer you when you contact support. Legal basis: our legitimate interest in helping you, or our legal obligations where a request concerns your rights.

Who processes your data

Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Remote Config, Hosting and Google Analytics) processes data for us as our service provider, under Google's data processing terms, which require Google to protect it. We do not share your data with anyone else, except where the law requires it. When you send an invite, only the invite code or link is shared, through your device's share menu.

Where data is stored

Game data is stored on Google Cloud in the asia-south1 (Mumbai, India) region. Analytics and server logs may be processed by Google in other countries. Where the law requires it, these transfers rely on safeguards such as the standard contractual clauses included in Google's data processing terms.

How long we keep it

• Account and game data, including the points record: until you delete it, or until the player has been inactive for 24 months, after which we delete it.
• Recovery-code attempt counters and other abuse-prevention counters: up to 30 days.
• Server logs: up to 30 days.
• Analytics events: up to 14 months.
• Emails to support: up to 12 months after the conversation ends.

Your choices

• Analytics: turn it off at any time in Settings. The game then stops sending analytics events.
• Delete your data in the game: Settings, then "Delete my data". This deletes your player record, cloud save, recovery code, invite code and points, and removes your anonymous account. It can't be undone.
• Delete your data without the game: follow the steps on hiccuphop.com/delete-account, or email support@hiccuphop.com.
• Delete your data with your recovery code: you can also delete your data on our website with your recovery code.

We act on requests within one month. Analytics data is not linked to your player ID, so it can't always be found per player. It is deleted when its retention period ends.

Your rights

Depending on where you live (for example Saudi Arabia, the EU, the UK or some US states), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict some processing, and to complain to a data protection authority. To use these rights, email us. We may ask for your recovery code or invite code so we can find your record.

Children

The game is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has used the game, contact us and we will delete the data. In some countries the minimum age is higher (up to 16).

Security

Data is sent over encrypted connections. Points and progress can only be changed by our servers, not by the app, and recovery codes are stored only in hashed form. No system is perfectly secure.

Changes

If we change this policy we will update the date above and, for important changes, tell you in the game. If ads or purchases are added later, this policy will be updated before they launch.

Contact

NAQQAT AL-TOSEIL FOR INFORMATION TECHNOLOGY
Email: support@hiccuphop.com