1. Who we are
Num Null (the "Game") is a number puzzle game for Android, iOS and the web, including the website at numnull.com and the web app at app.numnull.com (together, the "Services").
The Services are provided by ROGUE TREASURE PRIVATE LIMITED ("Rogue Treasure", "we", "us" or "our"), a private limited company incorporated in India (CIN U62011TS2026PTC224953). We are the data controller (in India, the "Data Fiduciary") responsible for your personal information.
Registered office: 8-1-284/OU/49, 1st Floor, OU Colony, Shaikpet, Golconda, Hyderabad, Telangana 500008, India. Email: main@numnull.com. Phone: +91 92814 92887. See also our Legal Notice.
This Privacy Policy should be read together with our Terms and Conditions.
2. The short version
- You can play as a Ghost with only a display name and a country. No email address or real name is needed.
- If you sign in with Google, we receive your name and email address from Google to create your account.
- We store your game progress (scores, stats, bits and power-ups) so the Game works and leaderboards are fair.
- Your display name, avatar, country and XP appear on public leaderboards and to opponents in Compete matches.
- Only if you agree, the Game uses Google Firebase to measure how it is played and to report crashes. Until you choose, both are off, and you can change your mind any time under Profile → Data sharing. We do not sell your personal information, show ads, or use advertising trackers.
- The numnull.com website itself sets no cookies, uses no analytics and loads nothing from other companies' servers. The only thing it can store is a theme choice, if you switch away from the default Day look.
- You can ask us to access, correct or delete your data at any time by emailing main@numnull.com.
3. Information we collect
Information you give us
- Profile details: the display name you choose, your avatar style, and the country you select.
- Google sign-in (optional): if you choose "Continue with Google", Google shares your name, email address and a unique account identifier with us. We never receive your Google password.
- Messages to us: if you email us, we keep your email address and the contents of your message so we can reply.
Information created when you play
- Account identifiers: a unique user ID. For Ghost accounts we create an internal placeholder address (for example ghost-<id>@mail.numnull.com) that is not a real inbox and is never used to contact you.
- Gameplay data: board seeds, game mode and type, moves, Nulls, time taken, scores, star ratings, match results and opponents, XP and statistics.
- Wallet data: your balance of bits (in-game coins) and power-ups such as Undo and Flip, plus daily reward and streak history.
- Session data: sign-in session tokens that keep you logged in.
Information collected automatically
- Technical data: when your device connects to our servers, our hosting provider receives standard technical information such as your IP address, device and browser type, and request times, which is used for security, abuse prevention and keeping the Services running.
- Usage analytics (only with your consent; apps and app.numnull.com): Firebase Analytics records events such as screens viewed, app opens and session length, sign-in method (Google, Apple or Ghost, never your name or email), games started and finished with their mode, board size, score, moves and duration, power-ups used, daily rewards and store items claimed, tutorial and prompt interactions, and leaderboard and stats views, together with an app-instance identifier, device model, operating system, app version, language and approximate (country/region-level) location derived from your IP address. It is not linked to your name or email, and we don't use it for advertising.
- App performance (only with your consent; Android and iOS apps): Firebase Performance Monitoring measures how fast the app starts and how long screens and network requests take, together with device model, operating system, app version, network type and an installation identifier. We use it to find and fix slow spots, not for advertising.
- App integrity (only with your consent; Android and iOS apps): Firebase App Check confirms that requests to Firebase come from a genuine, unmodified copy of the app. It uses Google Play Integrity on Android and Apple App Attest or DeviceCheck on iOS, and sends an attestation token and device integrity signals to Google. We use it to prevent abuse, not for advertising.
- Crash reports (only with your consent; Android and iOS apps): Firebase Crashlytics collects crash reports, stack traces and device state when the app crashes, with an installation identifier.
- Suggested country: when you create a Ghost player, our backend estimates your country from your IP address to pre-select it in the country list. You can pick any country, and the IP address isn't stored for this.
- Settings on your device: preferences such as whether in-game sound is muted and whether you've seen the tutorial are saved locally on your device (see section 12).
We do not collect your precise location, contacts, photos, microphone or camera data, and we do not ask for your date of birth or payment card details.
4. How we use your information
- To create and maintain your account and let you sign in.
- To run the Game: save your progress, balances, rewards and statistics, and restore them on your devices.
- To match you with opponents in Compete mode and to show results.
- To display global and regional leaderboards.
- To prevent cheating, fraud and abuse, enforce our Terms, and keep the Services secure.
- To respond to your questions, requests and feedback.
- To understand how the Game is used, fix crashes and bugs, and improve performance.
- To comply with legal obligations and protect our rights.
We do not use your information for targeted advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Legal bases for processing
Where laws such as the EU/UK General Data Protection Regulation (GDPR) apply, we rely on:
- Performance of a contract — to provide the Game you asked to use, including accounts, progress, matches and leaderboards.
- Legitimate interests — to keep the Services secure, prevent cheating and abuse, and show avatars, balanced against your rights.
- Consent — for usage analytics, app performance and app integrity (Firebase Analytics, Performance Monitoring, App Check) and crash reports (Firebase Crashlytics), which stay off until you allow them, and when you choose to sign in with Google or Apple. You can withdraw consent at any time under Profile → Data sharing, as easily as you gave it.
- Legal obligation — where we must keep or disclose information by law.
Under India's Digital Personal Data Protection Act, 2023, we process your personal data for the purposes described in this policy on the basis of your consent and for legitimate uses permitted by the Act.
6. What other players can see
Num Null is a social game. The following is visible to other players:
- Leaderboards: your display name, avatar, country flag, rank and XP.
- Compete matches: your display name, avatar, score, Nulls, moves and time are shown to your opponent, and theirs to you.
- Shared boards: if you share a board or result, the text you share (seed, score and a link) goes wherever you send it.
Your email address is never shown to other players. Please don't use your real full name or any personal information in your display name if you'd prefer to stay anonymous.
8. International transfers
We are based in India. Our game backend (Appwrite Cloud) stores your account and game data in Frankfurt, Germany (EU). Google processes Firebase and email data on its servers worldwide, including in the United States. DiceBear serves avatar images from servers that may be outside your country. When personal data is transferred internationally, we rely on safeguards required by applicable law, such as the European Commission's standard contractual clauses offered by our providers, or on the transfer being necessary to provide the Game you asked for.
9. How long we keep your information
- Account, profile, progress and wallet data: for as long as your account exists. If you ask us to delete your account, we delete or anonymise this data within 30 days.
- Ghost accounts: a Ghost account lives on the device where it was created. If you log out, it can't be recovered. We may delete Ghost accounts that have been inactive for 12 months or more.
- Match and leaderboard records: past match results may be kept in anonymised form so leaderboards and opponents' histories stay accurate.
- Emails with us: for up to 24 months after our conversation ends.
- Server and security logs: for a limited period, normally no longer than 90 days, unless needed to investigate abuse.
- Analytics data: Firebase Analytics event data is kept for 14 months and then deleted automatically. Crashlytics crash reports and Performance Monitoring data are kept for 90 days.
We may keep some information longer where the law requires it or to resolve disputes and enforce our agreements.
10. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and get a copy of it.
- Correct information that is inaccurate. You can change your display name, avatar and country in the Game at any time.
- Delete your account and personal information.
- Object to or restrict certain processing (including usage analytics), and withdraw consent where we rely on it, as easily as you gave it.
- Opt out of the sale or sharing of personal information. We don't sell or share personal information, so there is nothing to opt out of, but we treat a browser's Global Privacy Control signal as a valid opt-out request.
- Data portability — receive your data in a common, machine-readable format. In the Game, tap Profile → Download my data to get a JSON copy straight away.
- Nominate another person to exercise your rights in the event of death or incapacity (India).
- Complain to a data protection authority or the Data Protection Board of India.
To exercise any of these rights, email main@numnull.com from the address linked to your account, or include your display name and user ID for Ghost accounts. We'll respond within 30 days, or sooner where the law requires. We may ask you to verify your identity first. We won't treat you differently for exercising your rights.
Quick links (each opens an email to us): access · correct · delete · object to analytics / withdraw consent · do not sell or share · grievance
11. Deleting your account
You can delete your account in the Game: open your profile, tap Edit, then Delete account. This removes your profile, games, stats and wallet straight away, unlinks your Google or Apple sign-in and signs you out. A bare sign-in record (your email address and name from Google or Apple) can remain on our authentication service until you ask us to erase it: email main@numnull.com and we remove it within 30 days.
You can also use the account deletion page or ask us to do it, for example if you no longer have the app: email main@numnull.com with the subject "Delete my account" and include your display name (and, for Google accounts, send it from the same email address). We'll confirm when the deletion is complete. Records of past Compete matches stay with your opponent's history, but no longer point to you.
Deleting your account permanently removes your profile, progress, bits and power-ups. This can't be undone, and unused virtual items are not refunded.
12. Device storage and cookies
The Game stores a small amount of information on your device to work properly:
- Session tokens / cookies that keep you signed in.
- Preferences such as sound on/off and whether you've completed the tutorial.
Session tokens and preferences are strictly necessary for the Services. Only if you allow analytics, the apps and app.numnull.com also store Firebase identifiers (described in section 3); on app.numnull.com, Firebase isn't even loaded until you agree. We don't use advertising cookies. You can clear stored data through your browser or device settings, but you may be signed out and lose a Ghost account that hasn't been linked.
The numnull.com website sets no cookies. It stores nothing on your device unless you switch the theme button away from the default Day look, which saves that one choice in your browser. Our Cookies and Device Storage page lists every cookie and storage key by name.
13. Children
Num Null is a family-friendly puzzle game, but our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age for consent, or under 18 where Indian law requires verifiable parental consent). Players below these ages should only use the Services with the involvement and consent of a parent or guardian.
If you believe a child has given us personal information without the required consent, please contact us at main@numnull.com and we will delete it.
14. Security
We use reasonable technical and organisational measures to protect your information, including encrypted connections (HTTPS), access controls and reputable hosting providers. No system is completely secure, so we can't guarantee absolute security. If we learn of a data breach that affects you, we will notify you and the relevant authorities as required by law.
15. Regional notices
European Economic Area, United Kingdom and Switzerland
You have the rights described in section 10 under the GDPR and UK GDPR. You can lodge a complaint with your local supervisory authority.
India
We process personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. As a Data Principal you can ask for a summary of your data and how it is processed, correct, complete, update or erase it, withdraw consent, nominate another person, and seek redress for grievances.
Grievance Officer: Sajid Shaik, Director, ROGUE TREASURE PRIVATE LIMITED, 8-1-284/OU/49, 1st Floor, OU Colony, Shaikpet, Golconda, Hyderabad, Telangana 500008, India. Email: main@roguetreasure.com. We will acknowledge your grievance and aim to resolve it within the time required by law. If you are not satisfied, you may complain to the Data Protection Board of India.
United States (including California)
We collect the categories of information described in section 3 for the purposes in section 4. We do not sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics about you. In the last 12 months we collected identifiers (user ID, email for Google accounts, IP address, app-instance identifiers), internet or other network activity (gameplay and usage events) and approximate geolocation (country), from you and your device, for the purposes in section 4, and disclosed them only to the service providers in section 7. California and other state residents may request to know, access, correct and delete their information as described in section 10, and may use an authorised agent. We honour Global Privacy Control signals: in the web app, a Global Privacy Control or Do Not Track signal turns analytics off without asking.
16. Changes to this policy
We may update this Privacy Policy from time to time. We'll change the effective date at the top, and if the changes are significant we'll let you know in the Game or by other reasonable means before they take effect.
17. Contact us
Questions, requests or complaints about privacy? We're happy to help.
ROGUE TREASURE PRIVATE LIMITED (Num Null)
CIN U62011TS2026PTC224953
Registered office: 8-1-284/OU/49, 1st Floor, OU Colony, Shaikpet, Golconda, Hyderabad, Telangana 500008, India
Email: main@numnull.com · Phone: +91 92814 92887
Grievance Officer: Sajid Shaik, main@roguetreasure.com