The short version
- To play, you create an account with a username, an email address and a password. Other players see your username, never your email address.
- We keep what’s needed to run the game: your friends, your battles and results, your ranked rating and your Daily Challenge results.
- The camera check runs entirely on your phone. No photo or video is recorded, saved or sent to us.
- There are no ads, no analytics and no tracking, and we don’t sell your information.
- You can delete your account in the app at any time: Profile → Account & privacy → Delete account.
1. Who we are
SolveOffs (the iPhone app and the website at solveoffs.live) is operated by Tijn Jansen, trading as GymVow, Goedentijd 27b, 5131 AR Alphen (NB), Netherlands, registered with the Netherlands Chamber of Commerce (KVK) under number 42126676 (“we”, “us”). We decide how and why your personal information is processed, so we are its “controller” under data protection laws such as the EU and UK General Data Protection Regulation (GDPR).
You can reach us about anything in this policy at solveoffs@outlook.com or on +31 6 23442566. For requests about your account, please email us from the account’s email address, so we can confirm it’s you.
2. Information we collect
Information you give us when you sign up
- Username. 3–24 letters, numbers or underscores. It is your name in SolveOffs and other players can see it.
- Email address. Used to sign in, to email you a code when you ask to reset your password, and to contact you about your account. It is never shown to other players.
- Password. We never store your password itself, only a salted, one-way scrypt hash of it, so we can’t read it.
- Terms acceptance. The version of our Terms of Service shown when you created your account, and when.
We don’t ask for your real name, date of birth, phone number, country, photo or address.
Information created when you play
- Your ranked rating (an Elo number, starting at 1000) and the rank it gives you.
- Friends: the friend requests you send and receive, and who you are friends with.
- Challenges and battles (friend battles and ranked matches): who played, the scramble, when the challenge or match was made, accepted and started, each player’s progress through the battle (ready, inspecting, solving, finished), whether they were connected, their solve time, the colours of the solved faces the camera verified, the result and, for ranked matches, each player’s rating before and after.
- Ranked search: while you are searching for a ranked match, the fact that you are searching, since when and whether your app is connected.
- Daily Challenge: your verified solve time for each day you play.
- Blocks and reports: players you block, and reports you send about other players (the reason you choose, an optional note you write, and the battle it concerns, if any).
Solo levels and Random Scramble run entirely on your phone. Their results are not sent to us; your Solo level progress is stored only on your phone (see below).
Sign-in sessions
When you sign in, our server creates a random session key. Your phone keeps it in the iOS Keychain so you stay signed in. Our server keeps only a one-way hash of it, with when it was created and when it expires (30 days after you sign in). Logging out ends that session on our server immediately, and resetting your password ends all of them.
Password resets
If you use Forgot password? in the app, we email a one-time 8-digit code to the address you enter, if it belongs to an account (the app doesn’t say whether it does). The email contains your username and the code; it has no tracking pixels or tracked links, and it is sent for us by Resend (see “Service providers and sharing”). Our server keeps only a one-way hash of the code, when it was sent, how many wrong codes were tried and how many codes were sent that day, which limits codes to one a minute and five a day per account. A code works once, for 15 minutes. Using it sets your new password, signs you out on every device and signs you in on the one you used.
Technical information
Like any internet service, our server receives your device’s IP address and basic connection details (such as the app’s request headers) with each request. We use your IP address only briefly, in the server’s memory, to deliver our response and to limit how many requests one address can make (which protects accounts against password guessing and the service against overload). We do not store IP addresses in our database, and our web server is not set up to keep access logs. Our server’s error logs record what kind of error happened, not who caused it.
The app does not collect advertising identifiers, device identifiers, your location, your contacts, your photos or anything from your microphone. It does not include any third-party analytics, advertising or crash-reporting software.
Information that stays on your phone
The app stores a few things only on your phone, and we never receive them:
- your session key (in the iOS Keychain);
- whether you have seen the welcome screens, and, for each account used on the phone, whether it has seen the battle tutorial;
- your Solo level progress, for each account used on the phone.
Logging out removes the session key. Deleting your account in the app also removes that account’s tutorial flag and level progress from the phone.
When you contact us
If you email us, we receive your email address and whatever you write or attach, and we use it to help you. If you phone us, we see your phone number (unless you withhold it) and use what you tell us only to help you; we don’t record calls.
3. The camera
SolveOffs needs your camera to check your cube during battles. We want to be precise about what that means, because camera access (iOS letting the app see the camera picture) is different from collecting camera data (keeping or sending what the camera sees).
- When the camera is used. iOS asks for camera permission the first time a battle needs the camera, after you press Ready or Scan scramble, never during sign-up or the welcome screens. The camera is on only during a battle’s camera steps. You can turn camera access off at any time in the iPhone’s Settings; battles then can’t be played, but the rest of the app still works.
- Processed on your phone only. While a battle needs it, the app analyses the camera picture on your phone, in memory, several times a second. Each analysed frame is reduced straight away to the colours of the nine stickers on the cube face it sees. Frames are then discarded.
- Nothing is recorded or uploaded. The app does not take photos, does not record video, does not save frames to your phone or photo library, and never sends images or video to us or to anyone else. The app does not use the microphone.
- Not in logs or reports. Camera images are not included in any logs, error reports or diagnostics, and no third party receives anything from the camera.
- What we do receive. In online battles and the Daily Challenge, the app sends us the result of the check, not the picture: that the scramble was accepted, your solve time, and the colour names of the solved faces that were verified (for example “white, red, blue, yellow”).
4. How we use information, and our legal bases
We use your information only for the purposes below. Where the GDPR applies, each purpose has a legal basis:
| Purpose | Information | Legal basis |
|---|---|---|
| Create your account, sign you in and keep you signed in | Username, email, password hash, sessions | Performing our contract with you (the Terms) |
| Let you reset a forgotten password by email | Email, username, password reset records | Performing our contract with you |
| Run the game: friends, challenges, battles, ranked matchmaking and ratings, the Daily Challenge and its leaderboard | Gameplay information, username | Performing our contract with you |
| Offer ranked opponents when nobody is free: replaying a past winning ranked performance to another player (see “What other players see”) | Your username, rating at the time and the verified solve from a ranked match you won | Our legitimate interest in keeping ranked waiting times short. You can object (see “Your rights”) |
| Keep the service safe and fair: limiting requests, checking battle events, handling reports and blocks, and acting on cheating or abuse | IP address (briefly, in memory), gameplay information, blocks, reports | Our legitimate interests in security, fair play and a respectful community |
| Keep backups so we can recover from failures | All information in our database | Our legitimate interest in not losing your account and results |
| Keep a record of which Terms you agreed to | Terms version and time | Our legitimate interest in being able to show what was agreed |
| Answer your messages and requests | Your email and message | Performing our contract with you, and our legitimate interest in supporting players |
| Comply with the law and protect rights | What a legal request concerns | Legal obligations, and our legitimate interests in protecting players and the service |
We don’t use your information for advertising or marketing, we don’t build profiles about you for any other purpose, and we don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. (Matchmaking by rating and the camera’s check of your cube are automated, but they only decide game matters.)
5. What other players can see
- Anyone signed in can find you by your exact @username, and sees your username (and the time of your solve) if you appear on a Daily Challenge leaderboard. Leaderboards for past days stay visible.
- Your friends see your username and can challenge you.
- Your opponents see, during and after a battle, your username, your progress through the battle, whether you are connected, your solve time and the result, and in ranked matches your rating and how much it changed.
- Recorded ranked opponents. When a player searching for a ranked match can’t be paired with anyone live within about 30 seconds, they may race the recorded performance of a player who won an earlier ranked match on the same scramble. If you win a ranked match, your username, your rating at that time and your verified solve (its time and timing) from that match may be shown to another player this way. Your account and rating are not changed by this, and these replays never use performances of deleted accounts.
- Never shown to other players: your email address, your password, your internal account ID, your IP address, your full stats or your friends list.
If you block someone, they are not told. Players you report are not told who reported them.
6. Service providers and sharing
We do not sell your personal information and we don’t share it with anyone for their own marketing or advertising. We use a small number of service providers to run SolveOffs:
- Google Cloud hosts our server, database, backups and server logs. Google processes this data on our behalf under its cloud data processing terms.
- Resend (Resend, Inc., United States) sends password reset emails for us. It receives the email address, your username and the code in the message, and keeps each message and its delivery status for 30 days. Resend processes this data on our behalf under its data processing agreement. We use it for no other emails.
- Apple distributes the app through the App Store and TestFlight. If you choose to share analytics or crash reports with app developers in your iPhone’s settings, Apple may give us aggregated app statistics and technical crash reports under Apple’s own privacy policy; these don’t include camera images.
- Microsoft provides our contact mailbox (solveoffs@outlook.com, an Outlook.com account). The emails you send us are stored and processed by Microsoft under its own terms and privacy statement.
We only use service providers whose terms require them to protect personal information and to use it only to provide their service to us.
We may also disclose information if the law requires it, if it is necessary to protect the safety or rights of players or others, or as part of a transfer of SolveOffs to a new operator who will continue to protect it under this policy (we would tell you first).
7. No ads, no analytics, no tracking
SolveOffs shows no ads and contains no third-party analytics or advertising software. We don’t track you across other companies’ apps or websites, and we don’t share your information with data brokers. Our website uses no cookies, no analytics and no trackers.
8. Where your information is stored
Our server and database run on Google Cloud in the United States (Iowa), and Resend stores the password reset emails it sends in the United States. If you use SolveOffs from outside the United States, including from the European Economic Area, the United Kingdom or Switzerland, your information is transferred to and stored in the United States. Where the law requires a safeguard for such transfers, we rely on the protections in Google Cloud’s and Resend’s data processing terms, such as the European Commission’s Standard Contractual Clauses. Emails you send us are held by Microsoft, which may store them outside the European Economic Area, including in the United States.
9. How long we keep information
| Information | How long |
|---|---|
| Username, email, password hash, rating, Terms acceptance | Until you delete your account |
| Sign-in sessions | Until you log out, or until they expire 30 days after you sign in (removed from our server within an hour of expiring). All are removed at once when you reset your password or delete your account |
| Password reset records (a hash of the code and when codes were sent) | Deleted when the code is used, otherwise within 25 hours of the last code being sent. The code itself stops working after 15 minutes |
| Password reset emails at Resend | 30 days |
| Friends and friend requests | Until you or the other player removes them, or either account is deleted |
| Challenges that were declined, cancelled or never answered | Until either player deletes their account |
| Battles that were played (finished or called off) | As long as the service runs, because they are part of both players’ match history and ratings. If you delete your account, your side stays with no link to you (see “Deleting your account”) |
| Ranked search | Until you are matched, cancel, or your app stays disconnected |
| Daily Challenge results | Until you delete your account |
| Blocks | Until you unblock the player, or either account is deleted |
| Reports | Until we have reviewed them, then 180 days. Reports about you are deleted when your account is deleted; reports you sent are kept for that time without your name |
| IP addresses | Only in the server’s memory, for request limits, and removed within about 16 minutes; never stored or logged |
| Server error and system logs | They contain no IP addresses or account details. They are kept on our server and in Google Cloud’s logging service for a limited period (Google Cloud keeps them for 30 days by default) |
| Database backups and server disk snapshots | Made daily (and before each update), kept for 14 days, then deleted automatically. A deleted account’s information therefore disappears from backups within 16 days |
| Emails you send us | As long as needed to help you, then up to 12 months, unless we need them longer to comply with the law or resolve a dispute |
We may keep information longer where the law requires it or where it’s needed to establish, exercise or defend legal claims, and only for that purpose.
10. Deleting your account
You can delete your account at any time in the app: Profile → Account & privacy → Delete account. You’ll be asked for your password to confirm. When you delete your account:
- your email address, password hash, username, sessions, password reset records, friends and friend requests, blocks, Daily Challenge results, ranked search, unplayed challenges, Terms acceptance record and any reports about you are deleted, and every device signed in to the account is signed out;
- your username becomes available to others;
- a challenge or battle you are in ends (as if you had left it);
- battles you played stay in your opponents’ match history, shown as “Deleted player”, so their results and ratings stay correct. What remains of your side (times, battle progress, rating changes) is no longer linked to your email or username, and is never used for recorded ranked opponents again;
- reports you sent about other players are kept for review without your name;
- the app removes that account’s level progress and tutorial flag from your phone;
- copies of your information in our backups are deleted automatically within 16 days.
Deletion can’t be undone. If you can’t sign in to delete your account yourself, email us from the address on the account and we will delete it for you.
11. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct information that is wrong (for example, your email address);
- delete your information (you can delete your account in the app);
- data portability: receive the information you gave us in a commonly used, machine-readable format;
- object to processing based on our legitimate interests, including the replay of your past ranked wins to other players;
- restrict our processing in certain cases;
- not be discriminated against for exercising these rights.
To use any of these rights, email us at solveoffs@outlook.com from the email address on your account (so we can confirm it’s you). We’ll answer within one month. If you aren’t satisfied with our answer, you can complain to a data protection authority: in the Netherlands, where we are established, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live or work elsewhere in the EEA, the UK or Switzerland, you can also complain to the authority there.
Residents of some US states have similar rights under state law. We don’t sell personal information, don’t share it for cross-context behavioural advertising and don’t use it for targeted advertising.
12. Children
You must be at least 13 years old to create a SolveOffs account, and players under the age of majority where they live need a parent’s or guardian’s permission. SolveOffs is not directed at children under 13 and we don’t knowingly collect their personal information. If you believe a child under 13 has created an account, contact us and we will delete it.
13. Security
We take reasonable measures to protect your information, including:
- all connections between the app and our server are encrypted with HTTPS;
- passwords and password reset codes are stored only as salted scrypt hashes, and session keys only as hashes;
- a reset code works once, for 15 minutes and for five tries, and asking for one never reveals whether an email address has an account;
- our database can’t be reached from the internet, and access to the server is restricted to the people who operate SolveOffs;
- sign-in attempts, password reset codes and other requests are rate-limited.
No service can guarantee perfect security. If a security incident affects your personal information, we’ll notify you and the authorities where the law requires.
14. Changes to this policy
We may update this policy as SolveOffs changes. We’ll post the new version here with a new effective date, and if the changes are significant we’ll tell you in the app or by email before they take effect.
15. Contact us
Tijn Jansen, trading as GymVow
Goedentijd 27b, 5131 AR Alphen (NB), Netherlands
Email: solveoffs@outlook.com
Phone: +31 6 23442566
Netherlands Chamber of Commerce (KVK) number: 42126676