Upsies Privacy Policy
Last updated: 5 November 2026
This policy explains what happens to your data when you use Upsies. It covers the website at upsies.samarpit.dev ("the web game") and the Android and iOS apps ("the app"). Upsies is run by Samarpit Santoki (samarpit.santoki@gmail.com) ("we", "us"). We are the data controller.
The short version
- You can play with no name, email or password. We give your browser or phone a random ID.
- We store your game results, streak and scores on Google Firebase servers.
- We measure how the game is used with Google Analytics. In the UK, EEA and Switzerland, this stays off on the web until you say yes, and it stays off in the app.
- The web game has no ads. The app shows ads through Google AdMob, and Google collects data for them.
- You can delete your account in Settings, or at upsies.samarpit.dev/delete with your delete code.
- Upsies is for people aged 13 and over.
What we collect
| Data | Web | App | Why | Legal basis (UK/EEA) |
|---|---|---|---|---|
| Random user ID (Firebase anonymous sign-in) | Yes | Yes | Run the game, keep your progress | Contract |
| Game data: runs, answers, answer times, streak, Chalk, freezes, scores, duel results, Ladder rank | Yes | Yes | Run the game, check fair play, show rarity stats | Contract |
| Time zone offset | Yes | Yes | Open each day's game at the right time, and check fair play | Contract |
| Player label. Today everyone shows as "Climber". You cannot type a name. | Yes | Yes | Show on boards and in duels | Contract |
| Friend list, friend code and delete code. Players in the same duel become friends on the boards. | Yes | Yes | Run the friends board, and let you delete your account | Contract |
| Age check: we ask your birth month and year. We keep only your age group (under 13, 13–17, or 18 and over), on your device. We do not keep the date. | At "save progress" | At first open | Keep under-13s out, and choose the right ads. Analytics gets only "pass" or "blocked", never your age. | Legal duty / legitimate interest |
| Link and share codes | Yes | Yes | Make duel, share and claim links work, and count how many people they reach | Legitimate interest or consent |
| Country, from our web host | Yes | No | Decide if we must show the cookie banner. We do not store it. | Legal duty |
| Usage events, including your random user ID, device and browser type, app-instance ID, general location from IP, and screen errors | Yes, if allowed | Yes, if allowed | Improve the game | Consent where needed |
| Install source (Play Install Referrer) | No | Android, if allowed | Measure invite links | Legitimate interest |
| Remove Ads purchase: a flag on your device, and an event with the product and price | No | If you buy | Unlock what you bought, and measure sales | Contract |
| Technical logs, such as IP address and time, kept by Google when your device connects | Yes | Yes | Run and protect the service | Legitimate interest |
| Emails you send us | Yes | Yes | Answer you | Legitimate interest |
Your cosmetics, level and settings stay on your device. We do not collect precise location, contacts, photos or the microphone.
What other players see. Boards, the Ladder and duels show your player label, score and rank. The data sent to other players' devices also holds your random user ID. Anyone with a duel link can see that duel's results.
Where it is stored and who gets it
| Provider | What it does | Role |
|---|---|---|
| Google Firebase (Hosting, Auth, Firestore, Functions) | Runs the game. Firestore and Functions run in the US region us-central1. | Processor |
| Google Analytics for Firebase | Usage measurement | Processor. Google Signals and ad personalisation are off. |
| Google BigQuery | Holds a copy of analytics events for our own analysis | Processor |
| Google AdMob and UMP (app only) | Ads and consent | Independent controller for some uses |
| Apple and Google | Store payments | Independent controllers |
We do not sell your data for money. Ad data in the app can count as "sharing" under US state law: see "Your choices".
The web game
We use cookies and browser storage. See the Cookie and storage notice.
- UK, EEA and Switzerland, and when we cannot tell where you are: we show a banner. Analytics does not load until you click Accept. You can change this at any time through Cookie settings in the footer or in Settings.
- Elsewhere: analytics runs when you visit. If your browser sends Global Privacy Control, we treat it as an opt-out, wherever you are.
- The web game has no ads.
- Your web progress stays linked to your browser. If you clear your site data, or your browser removes it, you can lose your link to it. To move it to the app, use your link code from Settings.
The app: analytics
In the UK, EEA and Switzerland, and when the app cannot tell where you are, analytics stay off. The app has no analytics consent screen. Elsewhere, analytics run when you play. The app guesses your country from your phone's time zone and language.
The app: ads
The app uses the Google Mobile Ads SDK and User Messaging Platform (UMP). It can show a banner on Home, an ad between endless runs, and an optional video that gives a reward. There are no ads on the Daily 5, the Daily Climb or their results. When ads are on, Google may collect:
- your advertising ID and app set ID
- your IP address, which can show your general location
- how you use ads and the app, such as launches, taps and video views
- performance data, such as launch time and hangs
Google uses this to show and measure ads, for analytics and to stop fraud. Ad partners can receive some of it. See Google's privacy policy and how Google uses data from partner apps.
If you are under 18, the app asks only for non-personalised ads. Google can still collect the data above for those ads.
If you buy Remove Ads, the app stops showing ads and does not start the ad SDK on later launches.
Your choices
UK, EEA and Switzerland. The app shows a consent form before ads start, when the law needs it. Change it in Settings > Privacy options.
United States. Under the California Consumer Privacy Act (CCPA) and similar laws, ad data in the app can count as "sharing" or "selling" personal information. Opt out in Settings > Privacy options where shown, and through your device settings. We will not treat you worse for opting out.
Android. Reset or delete your advertising ID under Privacy > Ads or Google > Ads in your phone's settings.
iPhone. The app asks permission through Apple's App Tracking Transparency prompt only if you are 18 or over, and not before your third session. If you are not asked, or you say no, the app does not use your advertising identifier, and it asks for non-personalised ads. Change this in Settings > Privacy & Security > Tracking.
How long we keep data
| Data | Kept for |
|---|---|
| Account and game data, including boards and link codes | Until you delete your account. We do not yet delete inactive accounts. |
| Duels | Duel links end after 7 days. We delete the duel soon after, usually within a day. |
| Analytics events | 14 months in Google Analytics, then deleted by Google. Our BigQuery copy: 14 months |
| Technical logs | 30 days |
| Emails to support | Up to 1 year after we reply |
| Backups | 14 days |
| Totals that cannot identify you | With no limit |
Delete your account
You can delete your account in Settings > Delete account, in the app or on the web. You can also enter your delete code, shown in Settings, at https://upsies.samarpit.dev/delete. We delete your user ID and game data at once. Backups clear within 14 days. Analytics events are not deleted at that time: they stay until they expire. Purchases stay with your store account. Totals that cannot identify you stay. Full steps: https://upsies.samarpit.dev/delete.
Children
Upsies is for people aged 13 and over. It is not designed for children under 13, and we do not knowingly collect their data. The app asks your age at first open, before it makes an account. On the web you can play first, and the game asks your age at "save progress". If you say you are under 13, the game stops on that device and we delete any account on it. If you think a child under 13 has given us data, email samarpit.santoki@gmail.com and we will delete it.
Your rights
Depending on where you live, you may have the right to:
- ask what we hold about you, and get a copy
- correct or delete it
- object to or restrict how it is used
- withdraw consent at any time
- complain to your regulator, such as the UK's Information Commissioner's Office (ICO), or your EU data protection authority
California residents can also opt out of selling or sharing. Canada (PIPEDA), New Zealand (Privacy Act 2020), Singapore (PDPA) and Australia (Privacy Act 1988) give similar rights.
To use your rights, email samarpit.santoki@gmail.com. Because you have no name on file, we need your delete code, shown in Settings, to find your data.
International transfers
We are based in India. Your data is processed in the United States and other countries. Where the law needs it, these transfers rely on safeguards such as standard contractual clauses.
Security
Data is encrypted in transit. Access to production systems is limited. No system is perfectly secure.
Changes
We will update this page when Upsies changes, and change the date at the top. If a change is important, we will tell you in the game.
Contact
Samarpit Santoki
samarpit.santoki@gmail.com
Email: samarpit.santoki@gmail.com