ONE MORE — Privacy Policy
Publisher / controller: AMCRAFTS ("AMCRAFTS", "we", "us")
App: ONE MORE for Android (com.amcrafts.onemore) and its backend services
Effective date: 2026-09-14
Privacy contact: contact@amcrafts.in
Postal address: Ace City, Noida, Uttar Pradesh, India
> *Plain-language template prepared for AMCRAFTS. It is not legal advice. Have qualified counsel review it for every market where ONE MORE is distributed before publishing.*
1. The short version
- You can play without creating an account with an email, phone number or real name. ONE MORE creates an anonymous guest account for you.
- To recognize your device, the app generates a random ID. It is not a hardware identifier, and our server stores it only in hashed form.
- We store gameplay data (results, streaks, stats, achievements) so the game works across sessions and leaderboards stay fair.
- The free version shows ads through Google AdMob. We ask for your consent where the law requires it (for example in the EEA, UK and Switzerland) using Google's consent tool (UMP).
- Payments for ONE MORE PRO are handled entirely by Google Play. We never see your card details.
- You can delete your account and data in the app at Settings → Privacy → Delete account.
- ONE MORE is not directed to children under 13.
- We do not sell your personal information.
2. What we collect
2.1 Data you or the app create while playing
| Data | Details | Why |
|---|---|---|
| Guest account | A random public account id, a friend code, and account creation/last-seen timestamps | Create and keep your game account |
| Device-generated random ID | A random UUID the app generates on first launch and keeps in app storage. It is not your IMEI, serial number, Android ID or advertising ID. Our server stores only a keyed hash of it (SHA-256), never the raw value | Sign you back in to the same guest account on this device |
| Nickname and avatar (optional) | A display nickname (by default a generated one) and an emoji avatar. Please don't use your real name | Leaderboards and friends list |
| Settings | Language, time zone offset, difficulty group, notification preference, theme and accessibility settings | Show the right content and daily challenge for your local day |
| Gameplay data | Daily Challenge sessions and results, per-puzzle answers, answer times and reaction times, hints used, Quick Play attempts, scores, streaks and shields, achievements, hint balance, per-category statistics, Brain Profile ratings and history, leaderboard positions | Run the game, calculate scores and streaks, show stats, run fair leaderboards and anti-cheat |
| Friends | The friend codes you add | Friends leaderboard |
| Recovery codes | If you ask for one, a one-time code. We store only its hash and expiry | Move your guest account to a new device |
| Puzzle reports | The reason you pick and an optional short comment | Fix wrong or unclear puzzles |
| Push token | A Firebase Cloud Messaging token, if you allow notifications | Send daily reminders and streak alerts |
| App interactions (analytics) | Events such as "daily challenge completed", "hint used" or "paywall viewed", with non-personal parameters (category, difficulty, score, app version). Analytics never include your nickname, device ID or free text | Understand what works and improve the game |
| Technical and security data | App version, platform, request timestamps, and a hashed IP address used for rate limiting and abuse prevention | Security, fraud and cheating prevention, and service reliability |
2.2 Data from Google services
- Advertising (Google AdMob): in the free version, the Google Mobile Ads SDK may collect your device's advertising ID, IP address, approximate location derived from IP, and ad interaction data. Google uses this to serve, measure and prevent fraud in ads, and to personalize ads if you consent. If you don't consent, or if your region requires it, non-personalized ads are requested. Google acts under its own terms: <https://policies.google.com/technologies/partner-sites>.
- Google Play Billing: when you subscribe to ONE MORE PRO, Google processes the payment. We receive a purchase token, product id, order id, subscription state and dates, which we verify with Google so we can unlock Pro. We never receive your payment card or billing address.
- Firebase (optional): if a build has Firebase enabled, Firebase Analytics may collect app usage events and an app-instance identifier, and Firebase Cloud Messaging delivers notifications. If crash reporting is enabled in a build, crash logs and diagnostics (device model, OS version, stack trace) may be collected. See <https://firebase.google.com/support/privacy>.
2.3 What we do NOT collect
Your name, email address, phone number, contacts, precise location, photos, microphone or camera data, and hardware device identifiers (IMEI, serial number).
3. Legal bases (EEA/UK)
- Contract / providing the service: guest account, gameplay data, Pro entitlement, recovery codes.
- Legitimate interests: security, anti-cheat, fair leaderboards, service analytics limited to non-personal parameters, and fixing puzzles. We balance these interests against your rights.
- Consent: personalized advertising and related storage/access on your device (collected through Google's UMP consent message), and push notifications (Android permission). You can withdraw consent at any time.
- Legal obligation: keeping purchase records where tax or accounting law requires.
4. How we use data
We use data to run ONE MORE; to schedule the Daily Challenge for your local day; to calculate scores, streaks and your Brain Profile (a gameplay profile for entertainment, not a scientific, medical or IQ assessment); to show leaderboards; to verify subscriptions; to show ads in the free version; to send reminders you opted into; to detect cheating and abuse; to understand aggregate usage; and to fix bugs.
We do not use your data for automated decisions with legal or similarly significant effects. Anti-cheat checks can hide a result from leaderboards. If you think that happened by mistake, contact us.
5. Sharing
We share data only with:
- Google (AdMob, Google Play Billing, and Firebase when enabled), as described above.
- Hosting and infrastructure providers that run our servers and backups under contract, only on our instructions.
- Other players, who see your nickname, avatar, score and rank on leaderboards and friends lists.
- Authorities, if the law requires it or to protect rights, safety and security.
- A successor, if AMCRAFTS is involved in a merger or acquisition. This policy continues to apply to your data.
We do not sell personal information and we do not "share" it for cross-context behavioral advertising as defined by the CCPA/CPRA, except for the ad personalization performed by Google AdMob when you have consented. You can opt out in Settings → Privacy → Ad privacy choices.
6. Advertising & consent
- On first launch in regions where it is required, ONE MORE shows Google's User Messaging Platform (UMP) consent message before any ad is requested.
- You can change your choice anytime in Settings → Privacy → Ad privacy choices.
- Ads are requested with a "G" (general audiences) maximum content rating.
- ONE MORE PRO subscribers don't see ads.
- You can reset your advertising ID or opt out of ad personalization in Android Settings → Privacy → Ads (the wording varies by device).
7. Retention
| Data | Retention |
|---|---|
| Account, gameplay data, stats, achievements | While your account exists. Deleted when you delete your account |
| Analytics events | 180 days, then deleted |
| Server and security logs | 30 days, then deleted |
| Refresh tokens | Up to 90 days, or until used, revoked or the account is deleted |
| Recovery codes | Until used or expired, and always deleted with the account |
| Anonymized leaderboard rows | May be kept in anonymized form after account deletion |
| Purchase records | As long as tax, accounting and fraud-prevention laws require, de-linked from deleted accounts |
| Backups | Overwritten on a rolling basis within 35 days |
8. Your choices and rights
- Delete your account: Settings → Privacy → Delete account in the app. This hard-deletes personal data and anonymizes leaderboard rows. See DATA_DELETION.md for exactly what is deleted and for how to request deletion without the app.
- Nickname: change it anytime in Settings.
- Notifications: turn them off in Settings or in Android system settings.
- Ads consent: Settings → Privacy → Ad privacy choices.
- Analytics: when an analytics opt-out toggle is available in Settings → Privacy, switching it off stops sending analytics events.
EEA / UK (GDPR / UK GDPR): you have the right to access, rectify, erase, restrict and object to processing, the right to data portability, and the right to withdraw consent. You can also lodge a complaint with your local data protection authority.
California (CCPA/CPRA): you have the right to know, delete and correct personal information, the right to opt out of sale or sharing (we don't sell), the right to limit use of sensitive personal information (we don't collect any), and the right not to be discriminated against for exercising your rights.
India (Digital Personal Data Protection Act, 2023): you have the right to access information about processing, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights. Grievances can be sent to our contact below. If they aren't resolved, you may approach the Data Protection Board of India.
Brazil (LGPD) and other jurisdictions: you have equivalent rights under local law.
Because accounts are anonymous, we may ask you for your friend code or a recovery code to confirm which account a request relates to. We answer within the time the law requires (normally within 30 days).
9. Children
ONE MORE is not directed to children under 13 (or the higher minimum age required in your country), and we don't knowingly collect personal data from them. Ads are limited to general-audience content. If you believe a child has used ONE MORE, contact us and we'll delete the account.
10. International transfers
AMCRAFTS and its providers (including Google) may process data in countries other than yours, including India, the European Union and the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, and on transfer mechanisms permitted under the DPDP Act.
11. Security
We protect data with HTTPS/TLS in transit, short-lived signed access tokens, hashed refresh tokens, recovery codes and device identifiers, hashed IP addresses, least-privilege database access, rate limiting, and access-controlled admin tools with audit logs. No system is perfectly secure. If a breach affects your data, we'll notify you and the authorities as the law requires.
12. Changes
If we change this policy, we'll update the effective date. For material changes, we'll notify you in the app before they take effect.
13. Contact
AMCRAFTS — Privacy
Email: contact@amcrafts.in
Address: Ace City, Noida, Uttar Pradesh, India