Shape Attack privacy policy
Last updated October 21, 2026
Shape Attack is a game. It collects only what it needs to run its online Top 10s, groups, multiplayer and daily challenge. There are no ads, no analytics services and no tracking (we only count totals, like games played each day), and nothing is sold.
What the app sends to our server
- A random install ID. The app makes it up when it's first used. It isn't linked to your phone, your Google or Apple account, or any advertising ID.
- The player name you choose, if you choose one.
- A 6-digit code you choose for your name. We store only a scrambled (salted and hashed) form of it, never the code itself.
- Your scores and when you set them, and whether you've started that day's daily challenge. When someone's score passes one of yours in a Top 10's top three, we keep a note for you of who, on which level and with what score, until the app has shown it to you.
- Groups. The names of groups you make, which groups you're in, and invites you send or get. When someone in your group beats your best score, we keep a note for you of who, on which level and with what score, until the app has shown it to you.
- Reports. If you report a player name or a group name, we record that name, your install ID and when you reported it. A player name you report is also kept hidden from you (you can show it again in Settings), so we keep that link for as long as both of you are around. If we remove a name you reported, the app tells you once.
- Push notifications. If you allow them, a push address for your phone (made for this by Expo and Google) and which notifications you want. We delete it when you turn notifications off.
- Usage counts. When the app is opened for the first time, and the first time each day and week, it tells our server so, without your install ID or name. With the games started, these only ever add to totals per day (how many installs and games), which tell us how much the game is played. Nothing in them says who.
- Multiplayer games. For each game: the level, which installs joined it (with their player names), and each player’s score and when each point came (so players who join later can play against a replay). Finished games go on the Top 10 like any other. If someone invites you to a game by name, we keep that invite until your app has shown it, and at most a day.
- Sponsored daily challenges. On a day a sponsor supports, when your game ends the app sends your score and how long the game lasted, with your install ID so each phone counts once. We use them only to count totals for the sponsor's report: how many played, how often the sponsor's logo was matched, and time played.
Our server runs on Cloudflare. Like any website, Cloudflare handles your IP address to deliver each request, and to limit how many requests one address can make in a minute; we don't store it.
How we use it
Only to run the game's online features: showing the Top 10 boards, running the daily challenge with one try per player, running groups and their Top 3s, telling you when someone in your group beats your best or someone takes one of your top three places, running multiplayer games, keeping each player name unique, letting you move your name to a new phone with its code, and reviewing names that players report. We don't use it for advertising, profiling or anything else.
Who we share it with
No one. We don't sell, rent or share your data with third parties. The only other party involved is our hosting provider, Cloudflare, which stores and processes it on our behalf to run the server. Push notifications are delivered through Expo's push service and Google's Firebase Cloud Messaging, which get your phone's push address and the notification's text. A sponsor of a daily challenge gets a report of totals only, never anyone's install ID or name. When a player name is reported, we're told through a Telegram message that contains only that name, how many reports it has, and the player name of whoever reported it with how many names they've reported. The exception is what the game shows on purpose: player names and scores on a Top 10 are visible to everyone who plays, and the people in a group see each other's names and scores.
What stays on your phone
Your personal best scores, your sound settings and the last level you played are saved only on your phone. Uninstalling the app removes them.
What others can see
Player names and scores that make a Top 10 are shown to everyone who plays. The people in your groups see your player name and your scores on that group's Top 3s, and a player you invite sees your name and the group's name. When players look up a name to invite, yours can show among the names that start with what they type. In a multiplayer game, the other players see your name and your score as you play. A name several players report shows as "Hidden name" until we've checked it. Your install ID and code are never shown.
How long we keep it
We keep each player's 10 best scores on each level, which is all a Top 10 can show; the rest are deleted automatically. A couple of days after a daily challenge, only its Top 10 is kept. Your player name stays until you delete it. A group stays until everyone has left it. Records of who started each daily challenge are deleted after a few days, notes that someone beat your score once the app has shown them (or after 14 days), and unanswered invites after 30 days. Multiplayer games are deleted a week after they're made, and sponsored days' scores and game lengths after 90 days. Reports are deleted once we've reviewed them.
Deleting your name and scores
In the app, tap Playing as … on the main screen, then Delete my name and scores. That removes your player name and every score posted under it, including sponsored days', and takes you out of your groups, straight away.
If you no longer have the app, email contact@shape-attack.com with your player name and we'll delete it and its scores within 7 days.
Children
Shape Attack isn't directed at children under 13, and we don't knowingly collect information from them. If you believe a child has created a player name, email us and we'll remove it.
Changes
If this policy changes, we'll update it here and change the date at the top.