Privacy policy

FOLD · last updated 2026-08-21

1. Data controller

Mathieu Vigne, publisher of FOLD, reachable at [email protected] for any question or request to exercise your rights.

2. Principle

FOLD asks for no name, no address, no password. The game is fully playable offline. The data below is only processed when the player uses the online services: leaderboards, daily challenge, progress saving.

3. Data processed

• Game Center identifier — provided and signed by Apple. It serves as the account identity: it is what makes it possible to attribute a score to someone, and to ban a cheater.
• Game Center nickname — shown on the leaderboards.
• Games played — run code, mode, cut, seed, score, number of folds and shapes, date. The run code makes it possible to replay the game and therefore to verify the score without trusting the device.
• Activity log — sessions opened, games accepted or refused, saves, moderation decisions, with their dates.
• Truncated IP address — only the network is kept (for example 203.0.113.0/24), never the full address. It serves to spot abuse, not to identify a person.
• Progress save — local best scores, levels cleared, preferences. Its content is opaque to the server, which only guarantees who it belongs to.

No location data, no contacts, no photos, no health data and no payment data is collected.

4. Legal bases

• Performance of the contract — account creation, leaderboards, saving.
• Legitimate interest — game verification, cheat detection, abuse prevention, activity log.
• Legitimate interest — showing non-personalised ads, the game's only source of funding.

5. Advertising

The game shows ads served by Google AdMob, and requests them non-personalised: they depend on context, never on what the player does elsewhere.

• The game never asks for iOS tracking permission (App Tracking Transparency), and therefore does not use the device advertising identifier.
• Google still receives the technical data needed to serve an ad — device type, language, IP address — as an independent controller.
• None of it is used to follow you from one app to another, nor passed to data brokers.
• The “Ad-free” purchase removes all advertising, and therefore all advertising-related processing.
• Google’s policy: policies.google.com/technologies/ads.

6. In-app purchases

Purchases go through the App Store. Apple handles the payment; the publisher receives no payment details, only the fact that the purchase exists for the account concerned.

7. Recipients

• Apple — Game Center and the App Store, as the provider of the identity and payment services.
• Google (AdMob) — ad serving.
• The API host — storage of the data described above, within the European Union.

No data is sold, rented, or passed to data brokers. The publisher makes no transfer outside the European Union; Apple and Google apply their own transfer safeguards.

8. Retention periods

• Account and best scores: for as long as the game is used, then 24 months after the last session.
• Run codes and activity log: 12 months, the time needed to investigate a disputed score.
• Progress save: until the player deletes it or deletes the account.
• Banned accounts: kept for as long as the ban remains useful, reason included.
• Fingerprint of a banned identifier after account deletion: kept to prevent evading the sanction, without making it possible to recover the identifier.

9. Your rights

The player has the right of access, rectification, erasure, restriction, objection and portability. A request sent to [email protected] receives an answer within one month. To find an account without a password, the request must be made from the game or mention the Game Center nickname concerned.

Erasure in fact needs no procedure at all: the game settings include delete my account, which immediately erases the account, the games, the leaderboard entries and the save. A ban, however, survives deletion as a fingerprint of the identifier — otherwise deleting an account would be enough to erase a sanction.

A complaint can be filed with the CNIL: www.cnil.fr.

10. Security

Exchanges with the API are encrypted (HTTPS). Identity rests on Apple’s signature, never on a mere claim from the device. Session tokens are signed and expire. No password is stored, since none exists.

11. Children

FOLD is not intended for children under 13 and no data is knowingly collected from them.

12. Changes

This policy may change. The date of the last update appears at the top of the page; a substantial change is announced in the game.