Privacy Policy

1. Who we are (data controller)

For purposes of applicable privacy laws, the data controller is:

Android app package name: com.ayosem.vocross. API host: api.vocross.com.

2. Scope and agreement

By using the Service, you acknowledge this Privacy Policy. If you do not agree, do not use the Service. This Policy applies to information we process as a controller. It does not cover third-party websites, app stores, or services that we do not operate (for example, Google Play or Google AdMob), which have their own policies.

Not legal advice. This document is provided for transparency. It does not create contractual rights beyond what applicable law requires.

3. Information we collect

We collect information in the categories below. We do not require a password or traditional account login.

3.1 Information you provide

• Public username (3–24 characters: letters, numbers, underscore) chosen for gameplay, leaderboards, and device binding.
• Game preferences stored with your profile: clue language, answer language, difficulty level (CEFR band where applicable), grid size, concept/domain pack selection, board theme, help mode, and optional country code you select or confirm.
• Gameplay and progress data: puzzle completion counts, words marked correct, scores (including weekly leaderboard scores), and in-progress puzzle answers while you play (stored to resume sessions and validate completion).
• Support messages if you contact us through in-app support: your username and message text (stored as support tickets on our servers).

3.2 Information collected automatically

• Device install identifier: a random identifier generated on your device (stored locally in app preferences and, on supported platforms, secure storage) and sent to our API in the X-Vocross-Device-Id header to bind your device to your username, prevent abuse, and restore your session. It is not your hardware serial number or advertising ID.
• Network and device data: IP address and request metadata when you call our API (used for rate limiting, security, fraud prevention, and approximate country detection). Country may be inferred server-side from IP via our HTTPS API and, where needed, third-party geo lookup over encrypted connections (for example ipapi.co) when you use features such as default country suggestion; the app does not call geo providers directly over unencrypted HTTP. We typically store a two-letter country code on your profile, not your full IP address as a permanent profile field.
• Local app storage: onboarding state, UI language, username, and device identifier cached on your device via Capacitor Preferences (and secure storage where available).
• Server logs: standard web server and application logs (timestamps, endpoints, error diagnostics). Rate-limit counters may temporarily associate your IP or device identifier with request counts in Redis.

3.3 Information we do not intentionally collect

• Passwords, government ID numbers, payment card data, precise GPS location, contacts, photos, or microphone recordings.
• We do not operate a social graph or sell personal information as “personal information” under California law (see Section 10).

3.4 Advertising and analytics (mobile app)

On native Android builds, we may show interstitial advertisements through Google AdMob after a certain amount of in-game activity. AdMob and its partners may collect device identifiers, ad interaction data, and similar information under Google’s policies and any consent choices presented via Google’s User Messaging Platform (UMP) or your device settings. We use AdMob for monetization; we do not use AdMob data to build a separate marketing profile on our servers.

See Google’s privacy information: Google Privacy Policy and AdMob & user data.

3.5 Text-to-speech

Optional pronunciation and celebration audio uses your device’s text-to-speech (TTS) engine (via a Capacitor plugin). Spoken words are processed on your device or by your platform provider’s TTS service according to their policies; we do not receive audio recordings of your voice.

4. How we use information

We use information for legitimate purposes including:

• Providing and operating the Service (generating crosswords, saving progress, leaderboards).
• Authenticating API requests tied to your device identifier and username.
• Personalizing defaults (languages, theme, difficulty, country).
• Measuring aggregate performance and fixing bugs.
• Enforcing our terms, preventing abuse, and protecting security (rate limits, binding rules).
• Responding to support requests.
• Displaying ads in the mobile app where enabled.
• Complying with legal obligations.

Legal bases (EEA/UK users): performance of a contract (providing the Service), legitimate interests (security, improvement, advertising where permitted), and consent where required (for example, ad personalization or non-essential cookies on web, if applicable).

5. How we share information

We do not sell your personal information. We may share information only as follows:

• Service providers who process data on our behalf under contract (for example: cloud hosting on Amazon Web Services or similar infrastructure, Redis caching, geo-IP lookup providers, email routing if configured). They may access data only to perform services for us.
• Google (AdMob) when ads are shown, as described in Section 3.4.
• Public leaderboard: your username and scores may be visible to other users in leaderboard views.
• Legal and safety: if required by law, court order, or to protect rights, safety, and integrity of the Service.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy or notice to you.

6. International transfers

We are based in the United States. If you access the Service from other regions, your information may be processed in the U.S. and other countries where our providers operate. Those countries may have different data protection laws. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses with processors) or your consent.

7. Retention

We retain profile and gameplay data while your username remains active and as needed to provide the Service. Support tickets are retained for a reasonable period to resolve issues and maintain records. Server logs and rate-limit data are kept for short periods appropriate to security and operations. You may request deletion subject to Section 9. Some data may persist in backups for a limited time before automatic purge.

8. Security

We use administrative, technical, and organizational measures designed to protect information (HTTPS in transit, access controls on servers, rate limiting, device binding). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

9. Your choices and rights

• In-app: open Profile → Your data to reset game statistics, delete support messages, release this device, or delete your entire account (returns you to the welcome screen). Web instructions: Delete account & data.
• Ads: manage ad personalization through in-app consent flows (UMP) and your device’s advertising settings (for example, “Opt out of Ads Personalization” on Android).
• Access, correction, deletion: email hello@ayosem.com with your username and request. We may verify ownership via the bound device or reasonable questions before fulfilling requests.

Depending on where you live, you may have additional rights (for example, under the GDPR, UK GDPR, or U.S. state privacy laws) to access, delete, correct, port, or restrict processing, and to complain to a supervisory authority. We will not discriminate against you for exercising privacy rights where prohibited by law.

10. U.S. state notices

California (CCPA/CPRA)

In the preceding 12 months we may have collected identifiers (username, device install ID), internet activity (gameplay interactions with our Service), and approximate location (country code). We use these for the business purposes in Section 4. We do not “sell” or “share” personal information for cross-context behavioral advertising as defined under California law in connection with our own processing; AdMob’s processing is governed by Google and your ad choices.

California residents may submit requests to know, delete, or correct personal information by emailing hello@ayosem.com. Authorized agents may submit requests with proof of authorization.

Other U.S. states

Where state comprehensive privacy laws apply, we provide comparable access and deletion rights upon verified request, unless an exception applies.

11. Children’s privacy

The Service is not directed to children under 13 (or under 16 in certain jurisdictions), and we do not knowingly collect personal information from them. If you believe a child provided us personal information, contact hello@ayosem.com and we will take steps to delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may be communicated through the app or website where appropriate. Continued use after the effective date constitutes acceptance of the updated Policy where permitted by law.

13. Contact us

Questions about this Privacy Policy or our data practices:

hello@ayosem.com
AYOSEM VENTURES LLC
131 Continental Dr, Suite 305, Newark, DE 19713, USA