HASHI

Privacy Policy

Effective / updated October 17, 2026

1. Operator and scope

Next Studio (South Korea) operates Hashi (com.osj.hashi). This policy covers the app and this support website. Privacy contact: dhalska2@gmail.com.

2. Game data on your device

Puzzle progress, time, bridges, completions, undo history, free hints, language, theme, haptic and error-display settings are saved on your device. Full game progress is not synchronized to our server. The web preview has no mobile ads, push or purchasing. We do not use separate Firebase Analytics or Crashlytics SDKs.

3. Advertising and privacy choices

The mobile app uses Google AdMob interstitials and optional rewarded ads. The advertising SDK may process IP addresses and inferred approximate location, device/ad identifiers, ad views and clicks, diagnostics and consent choices to serve and measure ads and prevent fraud. We do not request precise-location permission. Consent messages depend on your region and choices; where required, use the advertising privacy option in Settings to change them. Rejecting personalized ads does not stop all technical processing. Advertising disclosures may constitute sale or sharing under local law; we do not claim that no data is collected or shared. Exercise applicable opt-out rights through the consent controls or by email. Rewarded hints are issued after our server verifies Google's signed callback. We store a pseudonymous request token, ad transaction ID and time to prevent duplicate rewards.

4. Optional notifications

Notifications are off by default. If enabled, Google Firebase Cloud Messaging and Apple APNs on iOS process installation identifiers, push tokens, language-topic subscriptions and delivery information. Turning notifications off in Settings asks FCM to unsubscribe and delete the token. You can also block notifications in OS settings. We do not maintain a separate database of per-device push tokens. Automatic notification sending is not currently enabled.

5. Accounts and purchases

Supabase processes email, account ID, authentication/access records, product and transaction IDs, purchase environment, entitlements, paid-hint balance, spend request ID, puzzle ID and time for authentication, verification, recovery and prevention of duplicate charges to hint balances. We do not collect payment-card details. The database region is Seoul, South Korea; Supabase and its subprocessors may provide authentication and operational support from other countries, including the US. Apple handles payment and transaction verification. Where required, processing relies on contract performance, legitimate interests in security and fraud prevention, legal obligations, or consent for optional features. On Android, Google Play handles payment. When you buy or restore, the app sends the Google Play purchase token and product ID to our server, which verifies them with the Google Play Developer API, stores the product ID and a one-way SHA-256 hash of the token (not the token itself), credits the purchase once, and then acknowledges or consumes it with Google Play. Google Play notifications and refund/cancellation checks may update your entitlements and hint balance.

6. Server retention and international processing

Account, entitlement and paid-hint records are kept while needed to provide and restore the service; unnecessary data is removed on a deletion request. Records needed for a transaction dispute or legal retention duty are kept only as necessary, with the reason and applicable period explained to the requester. Account deletion does not erase store transaction records. Google/Firebase, Apple, Supabase, GitHub and email providers may process data outside your country, including South Korea and the US, subject to their policies and applicable safeguards. Contact us for transfer details and to exercise your rights.

7. Support and website providers

If you email us, we receive your email address, message and any attachments you choose to send, solely to answer your request and resolve issues. Do not send passwords, codes or card details. We use Gmail for email and GitHub Pages for this website. These pages have no advertising, analytics scripts or submission forms. GitHub may process IP addresses and request logs for hosting/security. Apple, Google, GitHub and device backup services handle their own information under their policies. Providers may process information outside your country, including the United States. We do not upload local game saves to them ourselves; operating-system backups are controlled separately.

8. Retention and deletion

Local progress remains until app storage is cleared. Delete the app on iOS (offloading may retain data), clear app storage on Android, or clear site data for the web game. Manage device/cloud backups separately. We retain support messages only while needed to resolve the request, then delete them when no longer necessary. Information required by law or an ongoing dispute may be retained as necessary; we explain the reason and applicable period on request. Provider-controlled records follow their own retention policies.

9. Your rights and processing grounds

Depending on local law, you may request access, correction, deletion, a portable copy, restriction, objection, withdrawal of consent or appeal of a decision. Contact us without discrimination for exercising your rights; you may also complain to your local data-protection authority. We may request proportionate identity verification. Where a legal basis is required, support processing relies on responding to your service request, legitimate interests in resolving issues, legal obligations, or consent where required. Withdrawing consent does not affect prior lawful processing.

10. Children, safeguards and changes

The app does not require personal details to play. We do not knowingly solicit children’s personal information; a parent or guardian may contact us about information a child sent to support. We limit access to support information and use reasonable safeguards without promising absolute security. Material changes will be reflected here with a new date and any legally required notice or consent.