MorphMove for Android

Privacy

Last updated 27 October 2026

Leaderboard

Your assigned or chosen player name, rating and rank are public on the leaderboard. A random device credential keeps your player profile separate from other players. We store a hash of that credential, your rating progress, submitted game records and name-change time to synchronize results and prevent abuse. Offline results stay on your device until it reconnects. We also keep hourly submission counts and validation outcomes to monitor abuse, with routine cleanup of records older than 30 days. These checks do not collect additional IP addresses or device fingerprints and do not automatically ban players.

Custom names are sent to OpenAI for automated moderation. This is separate from optional usage analytics. Clearing this device’s data may create a new profile; it does not delete the old public entry. To request correction or deletion, contact admin@morphmove.com and include your player name.

Analytics

Starting with Android 1.4 (25), first-party usage analytics is on by default to help us understand and improve MorphMove. The app sends product events that can cover app sessions, pages and instructions viewed, game starts and results, moves and blocked attempts, ratings and difficulty, AI reliability and latency ranges, restarts, review actions, settings, sharing, multiplayer interactions, and notification choices. You can turn sharing off in the app’s Privacy screen and keep playing.

Events use random identifiers for this app installation, each session, game, and event. They can include bounded details such as move method, move count, outcome, duration, rating, difficulty tier, runtime, and selected setting. A coarse country, device category, operating-system family, and browser family may be derived when events arrive at the server. Country may reflect a VPN or where offline events are later uploaded. Names, email addresses, room access tokens, full user-agent strings, full referring URLs, and free-form text are not saved in this event stream. We do not use these events for advertising or tracking across other companies’ apps.

While sharing is on, compact lifetime totals and up to 300 pending events can be stored on this device, including while offline. The Android app does not keep a detailed analytics archive. Turning sharing off stops new collection and queued uploads and clears the local identifiers, totals, and pending events. A request already in progress may finish; previously uploaded events remain subject to the retention period below; you can request their deletion by emailing us.

Multiplayer rooms

Multiplayer games use an eight-character room code, random participant credentials, game state, scores, presence timestamps, and anonymous room and match identifiers so the game can synchronize between players. Participant credentials are sent only to the relevant player; server-side credentials are stored in hashed form. Rooms are temporary and expire after about 24 hours unless renewed by activity.

Recent players and invitations

MorphMove stores recent-player connections and associates room participation with the same device-based player profile used by the leaderboard. Recent players can see your player name, level and a short-lived indication of whether you are online. Direct invitations store the sender and recipient profile identifiers, the referenced room, creation and expiry times, and invitation status. These service records are separate from optional usage analytics.

Removing a recent player removes the connection from both players’ lists and cancels pending invitations between them. The removed connection record is retained so an old game does not automatically restore it; accepting a new shared invitation can reconnect the players. Invitations remain usable for at most 24 hours and can end earlier if cancelled or the room becomes unavailable. Expiry does not automatically delete the invitation record. Room/profile associations, recent-player connections and invitation records currently have no scheduled automatic deletion; you can request deletion using the contact details below. Presence entries older than three minutes are removed during subsequent presence updates.

Notifications

If you choose to enable notifications, the app obtains a Firebase Cloud Messaging registration token and sends it to MorphMove. Google Firebase processes that token to deliver optional daily practice reminders at 12:00 local time and Friend room alerts when someone joins or makes a move while you are away, including when the game ends. The token is an app-specific device identifier and is not used for analytics, advertising, or cross-app tracking.

Multiplayer notification registrations expire after about 30 days unless refreshed. Daily practice reminder registrations have a rolling ten-year expiry, renewed when the registration is refreshed or a reminder is successfully sent; invalid registrations are removed sooner. Daily reminders also store a random management token, your time zone, the next reminder time, and the latest practice or reminder day handled so duplicate alerts can be avoided. A completed CPU or Friend game, or a finished Daily attempt, can skip that local day’s reminder. The weekly workout and Daily share this reminder preference. Your selected language is stored with each registration so alerts can use that language. You can stop all alerts in Android Settings; this stops delivery on that device but does not necessarily delete the daily reminder registration from MorphMove’s server.

With notification permission already granted for Daily or weekly workouts, MorphMove also uses the existing Firebase Cloud Messaging token for direct friend invitations. Invitation alerts include the inviting player’s name and an invitation reference. Their registrations are linked to your player profile and selected language, and expire after 30 days without refresh. Invalid registrations are removed when reported by Firebase. Notifications remain optional; declining permission does not prevent friend games or in-app invitations.

Daily Puzzle progress

Detailed Daily Puzzle attempts, moves, solved dates, and streaks are stored on this device. They are not linked to your rating or synchronized across devices. Removing the app removes that progress.

Weekly workout progress also stays on this device. It records local practice dates and completion identifiers to count each day once, independently of analytics. It is not synchronized across devices. Removing the app removes this progress too.

Security and abuse prevention

MorphMove applies rate limits and other request protections to reduce spam and abuse. Hosting and infrastructure providers may process short-lived technical identifiers derived from connection data for those purposes and for ordinary service security.

Purpose, retention, and providers

Data is used to operate and secure MorphMove, provide multiplayer and notifications, and improve the app while usage analytics is on. It is not sold and is not used to create advertising profiles. Analytics maintenance removes live events older than 360 days; provider recovery systems may retain deleted records for up to 30 additional days. Temporary multiplayer rooms expire as described above. Google Firebase processes Android notification delivery data on MorphMove’s behalf. You can request deletion at admin@morphmove.com. Hosting, database, and other infrastructure providers may process the minimum data needed to provide their respective services.

Your choices and rights

You can turn analytics sharing off in this Android privacy screen and decline notification permission. For access, correction, deletion, objection, or other privacy questions, email admin@morphmove.com. You may need to provide your random installation identifier when asking about specific analytics history. You may also lodge a complaint with your applicable data-protection authority, including Portugal’s CNPD.