Privacy Policy
This policy explains what the Tic Tac Toe: Slide XO Duel mobile game (the “app”) does with data, on every platform it is published for. It is written to be read, not to be skimmed past.
The short version: the app has no accounts and asks you for nothing. Your settings, scores, coins and player names stay on your phone. Two things do involve outside services — the advertising that keeps the app free, and the optional online multiplayer mode — and both are described in full below.
1. Who is responsible
The app is published by RANK9 LABS, which is the data controller for the purposes of the GDPR and equivalent laws.
Questions, requests or complaints: support@rank9labs.com
2. What stays on your device
The following is stored locally on your phone or tablet and is never transmitted anywhere. The app has no server of its own for it, and no backup or sync feature:
- Sound, music, haptics and theme settings
- Chosen difficulty and match length
- Win, loss and match counts, and daily-streak progress
- In-game coins, claimed rewards, and which mark themes and board skins you own
- Whether you have seen the tutorial
- The name you choose for yourself, and the second name in two-player mode
Deleting the app deletes all of it. There is no copy elsewhere for us to return or erase — with one exception, the friend profile described in section 5, which lives on our server and has to be deleted separately.
One exception: your name in an online match. If you set a name and then play online, it is sent with the room so your opponent's scoreboard can show who they are playing. That is the only thing you type which ever leaves your device, it is optional — the game asks once and you can skip it, or clear it later in Settings — and without one you simply appear as “Opponent”. The second name in two-player mode never leaves the device at all, because that game is played on one screen.
Choose a name you are happy for a stranger to see. It is limited to 16 characters and is stored only for the life of the room, which is deleted when the match ends.
3. Advertising
The app is free and is funded by advertising, served by Google AdMob. It shows banner ads, an ad on the match-finished screen, an optional ad you can choose to watch in exchange for coins, and an occasional ad when you return to the app.
To serve and measure those ads, the Google Mobile Ads SDK collects data directly — it does not pass through us, and we never see it tied to you. Google describes this collection as including:
- Your device's advertising identifier — the Android Advertising ID, or Apple's Advertising Identifier (IDFA) on iOS — and the equivalent per-vendor app ID
- IP address, and the approximate location it implies
- Device and app information — model, operating system version, language, screen size, and which app is showing the ad
- Ad interaction data — that an ad was shown, viewed or tapped
How Google uses this is governed by its own policies, not ours:
- How Google uses information from sites or apps that use its services
- Google Privacy Policy
- AdMob and privacy
Your choices about ads
- In the European Economic Area, the UK and Switzerland, the app shows a Google-certified consent form the first time you open it, and does not serve personalised ads unless you agree. You can decline and keep playing — you will see non-personalised ads instead.
- Anywhere, you can turn off ad personalisation or reset your advertising identifier at any time from your device's own settings — Settings → Privacy → Ads on Android, Settings → Privacy & Security → Tracking on iOS. Resetting it disconnects future ad data from everything collected before. Where the platform runs its own tracking permission, that permission governs regardless of anything here.
3a. Crash reports and usage statistics
The app uses two Google Firebase services to keep itself working: Crashlytics, which reports crashes, and Google Analytics for Firebase, which counts a small set of gameplay events.
When the app crashes, Crashlytics sends a technical report — the state of the code at the moment of failure, your device model, operating system version, and how long the app had been running. It exists so that a bug which never happens on our test devices still gets found and fixed.
The analytics events are deliberately few: which game mode was started, whether a match was finished and won or lost, whether an online room was created or joined, whether the optional rewarded ad paid out, and which screens are used. They carry no name, no board moves, and nothing you type. Analytics is configured app-wide so that none of it feeds ad personalisation.
Both services are operated by Google under the Firebase Privacy and Security terms. Neither runs in development builds.
4. Online multiplayer
Online mode is entirely optional. If you only play against the computer or pass the device to a friend, the app never contacts a game server and nothing in this section applies to you.
When you do create or join an online room, the app uses Google Firebase (Realtime Database and Anonymous Authentication). Here is everything that is written:
| What | Why |
|---|---|
| Your chosen name, if you set one | So your opponent's scoreboard can show who they are playing. Optional and capped at 16 characters. It goes when the room does — unless you have created a friend profile, in which case section 5 applies. |
| A random anonymous ID | To tell the two players apart and to stop anyone else writing moves into your game. It is generated on your device, is not linked to any account, email or phone number, and identifies nothing about you. |
| The five-character room code | So the other player can find the room. |
| Board state, whose turn it is, round and match scores | So both screens show the same game. |
| A “still connected” timestamp | So the app can tell the difference between your opponent losing signal and leaving. It is removed automatically the moment your connection drops. |
No messages, contacts, photos or location data are involved, and there is no chat. If you have used Friends, a player profile and friend list also exist — section 5 covers exactly what they hold and how to delete them.
How long online data is kept
A room is marked ended as soon as a player leaves it, and any room is automatically treated as abandoned and its code released 12 hours after it was created. Rooms hold nothing that identifies you once the game is over.
Firebase is operated by Google and covered by the Firebase Privacy and Security documentation.
5. Friends and Quick Match
This section only applies if you open the Friends screen. Playing offline, playing a stranger through Quick Match, or joining a room by code creates no profile and leaves nothing behind beyond what section 4 describes.
The first time you open Friends, the app creates a profile for you on Firebase. Unlike everything in section 4, this outlives the match, and outlives uninstalling the app. Here is everything it holds:
| What | Why |
|---|---|
| Your display name | So friends can tell who you are. The same optional name from section 4. |
| A six-character friend code | So you can be added. You choose who to give it to; nobody can find you without it. |
| Whether you are online, and when you were last seen | So friends know if it is worth inviting you. Visible only to people you have added and who have added you back. |
| Your friend list | So the app can show it to you. Readable only by you. |
| Game invites sent to or from you | So an invitation reaches the other player. Removed once accepted, declined or expired. |
Nobody can add you, see you, or invite you unless you gave them your code. This is enforced by the database rules themselves, not by the app being polite: adding a friend requires presenting that person's code, so knowing a user's ID alone is not enough to friend, watch or message them.
Quick Match
Quick Match pairs you with whoever is searching at the same time. While you are searching, your room code sits in a shared queue so the next searcher can claim it. It holds no name and no profile, it is removed when you are matched or when you cancel, and any stale entry is discarded after two minutes. Quick Match works whether or not you have a friend profile.
Deleting your friend profile
Open Settings and tap Delete friend profile. That removes the profile, releases the six-character code for reuse, and clears you from the friend list of everyone who had added you. It takes effect immediately and cannot be undone.
If you have already uninstalled the app, email support@rank9labs.com with the display name and friend code you used — we hold no email address or account for you, so those are the only things that identify your profile. Full details are on our data deletion page.
6. What the app does not do
- It never asks for your email address, phone number, date of birth or real identity — the only thing you are asked to type is a display name, and only once, and you can skip it
- Its analytics are a handful of anonymous gameplay events — which mode was played, whether a match finished, whether an online room was joined — never your name, your moves, or anything typed into the app
- It does not request access to your contacts, photos, microphone, camera, files or precise location
- It does not sell or share personal information for money or for cross-context behavioural advertising outside the ad serving described in section 3
- It contains no in-app purchases — every mark theme and board skin is earned by playing
The game itself asks only for network access, which online play and ad loading require. The advertising libraries it bundles add the advertising-identifier permission described in section 3, along with routine housekeeping ones such as keeping the device awake while a request completes. None of them reach your contacts, photos, microphone, camera, files or location.
7. Children
The app is not directed at children under 13 (or the equivalent minimum age where you live), and we do not knowingly collect personal information from them. It is rated for general audiences but carries advertising, so it is not enrolled in the app stores' children's programmes (Google Play's Designed for Families and the equivalents elsewhere). If you believe a child has provided personal information through the app, contact us and we will act on it.
8. Your rights
Because the app holds no account and no personal profile, most data-subject requests resolve directly on your device:
- Access and portability — everything the app stores about you is visible in the app's own Settings and Stats screens.
- Erasure — clearing the app's data or uninstalling it removes everything stored locally. Online room data expires on its own within 12 hours.
- Objecting to advertising — decline the consent form, or reset your advertising identifier in your device's settings, as described in section 3.
If you are in the EEA, the UK or Switzerland, our legal basis for serving personalised ads is your consent, and for non-personalised ads and online play it is the legitimate interest in running and funding the app. You may withdraw consent at any time. You also have the right to lodge a complaint with your local data-protection authority.
If you are a California resident, you have the right to know what is collected, to delete it, and to opt out of its sale or sharing. We do not sell personal information. The advertising described in section 3 may qualify as “sharing” under the CPRA; opting out of ad personalisation in your device's settings, or declining consent where offered, exercises that right.
To make any request, email support@rank9labs.com. We will respond within 30 days.
9. Data outside your country
Google's advertising and Firebase infrastructure operates globally, so data described in sections 3 and 4 may be processed on servers outside your country, including the United States. Google's transfer safeguards are described in the policies linked above.
10. Security
Online rooms are protected by server-side rules that allow only the two players in a room to read or change it, and that reject any move which is not legal for the player making it. No transport is perfectly secure, but nothing sent by the app is sensitive: the most an intercepted message contains is a tic-tac-toe board.
11. Changes to this policy
If this policy changes materially, the date at the top will be updated and the new version published at this address before the change takes effect. Continuing to use the app after that means you accept the revised policy.
12. Contact
RANK9 LABS
support@rank9labs.com