Privacy Policy
Last updated: 3 October 2026
This policy explains what information the Zedmo app and this website collect, why, who else handles it, how long it is kept, and the choices and rights you have. It applies to the Zedmo mobile app for Android and to zedmo.plagueworks.org (together, the "Service").
The short version
- You can play without giving us your name or email. The app creates an anonymous account identifier so your results can be backed up.
- If you choose to sign in with Google, we receive the name and email address Google shares.
- We store your puzzle results, streaks and statistics so they are kept safe and can be restored.
- There is no advertising in Zedmo. We do not use advertising or analytics tools, we do not track you across other apps or websites, and we do not sell or share your personal data for advertising.
- You can delete your account and its data at any time from inside the app.
1. Who we are
Zedmo is developed and published by Mervin Hemaraju, trading as Plagueworks, based in the Republic of Mauritius ("Plagueworks", "we", "us"). We are the controller of the personal data described in this policy.
For any privacy question or request, email [email protected].
2. What we collect
2.1 Information created when you use the app
- Account identifier. On first launch the app signs in anonymously and receives a random user ID. It is not linked to your name, phone number, or any other account.
- Game history. For each puzzle you finish: the game, the puzzle's date, whether you solved it, the time taken, the number of wrong guesses and hints used, whether it was a daily or an archive play, and when it was submitted. Your streaks and statistics are calculated from this history.
- Subscription status. Whether you have an active Zedmo Plus subscription, which plan, and when it expires, together with a log of purchase and renewal events (event type, product, date and your user ID). We never receive your card or payment details.
2.2 Information you choose to give us
- Sign-in details (optional). If you sign in with Google, we receive the email address and name Google shares with us, and a Google account identifier. Google may also share a link to your profile picture, which we do not use.
- Puzzle suggestions (Zedmo Plus). The puzzle you suggest and any note you add.
- Bug reports and feedback. What you write, the game it concerns, your topic, and, only if you enter one, an email address to reply to. A bug report also includes technical details that are shown to you before you send: the app version and build, your device's operating system and version, and your device model.
- Why you deleted your account. When you delete your account in the app, we ask why. We keep the reason you choose and any message you add, with no user ID, name or email, so nothing links them to you.
- Emails to us. Your email address and whatever you write.
2.3 Information kept only on your device
Your chosen avatar, appearance setting, reminder settings, the puzzles downloaded for offline play, and a local copy of your game history are stored on your device. Daily reminders are scheduled by your device itself; no reminder data is sent to us.
2.4 Technical information
Like any internet service, the servers that answer the app's requests receive your IP address and basic request details (such as the time of the request and the app's software version). These are used to deliver the request, keep the Service secure, and diagnose faults.
2.5 What we do not collect
We do not collect your location, contacts, photos, microphone or camera input, advertising identifier, or browsing activity. The app contains no advertising, analytics, or tracking software. This website uses no cookies, no analytics and no scripts.
3. Why we use it, and our legal bases
Where data protection laws such as the Mauritius Data Protection Act 2017, the EU and UK GDPR, or similar laws apply, we rely on the following legal bases:
- To provide the Service you asked for (performance of our agreement with you): running the games, saving and syncing your history and streaks, restoring them when you sign in on another device, providing Zedmo Plus and its archive, and processing account deletion.
- To keep the Service working and secure (our legitimate interests): preventing abuse, protecting unpublished puzzles, investigating bugs, answering reports and feedback, and adjusting game settings such as hint timings remotely.
- With your consent: signing in with Google, sending a suggestion or report, and daily reminders, which only run after you allow notifications. You can withdraw consent at any time, for example by turning reminders off or deleting your account.
- To meet legal obligations: keeping records of subscription events where the law requires it, and responding to lawful requests.
We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who else handles your data
We use a small number of service providers ("processors") who handle data on our behalf, under contracts that require them to protect it and to use it only to provide their service to us.
- Supabase (database, authentication and server functions). Holds your account identifier, sign-in details, game history, subscription status, suggestions and reports. Our database is hosted in Mumbai, India.
- RevenueCat (subscription management, United States). Receives your Zedmo user ID and the purchase information Google Play provides, so it can confirm and track your subscription.
- Google Play (payments). Handles the purchase itself, including payment details, under its own privacy policy. We receive only confirmation of the purchase.
- Google sign-in (only if you choose to sign in). Confirms your identity and shares the details described in section 2.2, under Google's own privacy policy.
- GrowthBook (remote settings, United States). The app downloads game settings from GrowthBook. No user ID or personal information is sent; its servers see only your IP address as part of the request.
- Cloudflare (hosts this website). Processes visitor IP addresses to deliver pages and protect against attacks.
We may also disclose information if required by law, to protect the rights, safety or property of our users, ourselves or others, or as part of a transfer of the Service to a new owner, who would be bound by this policy.
5. International transfers
We are based in Mauritius, and our providers process data in India, the United States and other countries, which may have different data protection laws from yours. Where the law requires it, these transfers are protected by appropriate safeguards, such as the standard contractual clauses included in our providers' data processing terms. You can ask us for more information about these safeguards.
6. How long we keep it
- Account, game history, suggestions and subscription status: for as long as your account exists. We may delete anonymous accounts that have been inactive for a long period.
- Bug reports and feedback: up to 24 months, or until you delete your account, whichever comes first.
- Why you deleted your account: up to 24 months. It is not linked to you, so it cannot be found or deleted by account.
- Subscription event records: for as long as needed to handle billing questions, disputes and our legal record-keeping obligations, and no longer than 7 years. These records hold only the event type, product, date and user ID.
- Server and security logs: kept by our providers for a short period, typically days to weeks, then deleted.
- Emails to us: as long as needed to deal with your message, and no longer than 24 months after the conversation ends.
When you delete your account, your account, game history, suggestions, reports and subscription status are deleted from our database immediately, and we ask RevenueCat to delete its record of you. Copies in backups are overwritten within 30 days. A suggestion we already re-authored into a published puzzle stays published, but it is no longer linked to you. Google Play keeps its own purchase records under its own policies.
7. If you play without signing in
Your anonymous account exists only as a secure token stored inside the app on your device. If you uninstall the app, clear its data, or move to a new phone without signing in, that token is lost and your previous history cannot be restored, because nothing can prove it belongs to you. Signing in with Google links your existing history to that account, so it can be restored after a reinstall or on a new device.
8. Your choices and rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate;
- delete your data;
- receive your data in a portable format;
- object to, or ask us to restrict, certain processing;
- withdraw consent at any time, without affecting processing that happened before; and
- complain to a data protection authority. In Mauritius this is the Data Protection Office; in the EU or UK it is the authority where you live or work.
To delete your account, open Zedmo and go to Settings, then Delete account. If you no longer have the app, see our account deletion page.
For any other request, email [email protected]. We may need to verify that the account is yours before acting on a request, and we will reply within one month. Because anonymous accounts carry no contact details, we may be unable to find or verify an anonymous account from an email alone; in that case, use the in-app options.
Notifications can be turned off at any time in the app's settings or your device's settings.
California and other US state residents: we do not sell your personal information or share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information. You may exercise the rights described above without being treated differently.
9. Security
Data is encrypted in transit between the app and our servers. Access to player data is restricted at the database level so that each player can read only their own records, and administrative access is limited to us. No method of storage or transmission is completely secure, so we cannot guarantee absolute security, but if a breach affects your personal data we will notify you and the relevant authorities where the law requires it.
10. Children
Zedmo is not directed to children under 13, and you must be at least 13 to use it (or older, if the law where you live requires a higher age to consent to data processing without a parent's approval). We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows when it was last changed. If a change materially affects how we use your personal data, we will tell you in the app before it takes effect.
12. Contact
Mervin Hemaraju, trading as Plagueworks, Republic of Mauritius.
Email: [email protected]