Tile Towers Privacy Policy

Effective date: August 24, 2026

This policy explains how FuzzyCastle handles information when you use Tile Towers on iPhone or the web, sign in to a FuzzyCastle account, or participate in Tile Towers leaderboards.

Information Tile Towers uses

Guest play. You can play Tile Towers without creating an account. Game preferences and temporary play information are stored locally in the browser or on the device so the game can operate and remember supported settings. Guest scores are not uploaded.

Account and authentication information. If you sign in, FuzzyCastle stores a stable internal account identifier, your generated or selected display name, the sign-in provider you chose, account status and security information, and account lifecycle dates. FuzzyCastle password accounts also store a username and a salted password hash; plaintext passwords are not stored. Apple sign-in does not request or retain your Apple email address or real name. Google may provide an email address and profile name. Those Google claims are not stored in the permanent account profile, but the current encrypted browser sign-in session may retain them for up to 30 days.

Leaderboard information. When you submit a signed-in score, FuzzyCastle stores your player identifier, display name, weekly personal-best score, and the Tile Towers game mode represented by the leaderboard game identifier. Rank is calculated from the active leaderboard. A weekly leaderboard becomes eligible for deletion 30 days after it ends.

Technical, security, and diagnostic information. FuzzyCastle and its service providers process information needed to deliver, protect, and improve the service. This can include request times, route and method, response status, latency and size, IP address, user-agent or browser information, correlation identifiers, and bounded authentication, security, lifecycle, and error outcomes. Some records can be linked to an account. This information is used for authentication, fraud and abuse prevention, troubleshooting, availability, performance, and service operation.

Traffic analytics and approximate region. Cloudflare provides aggregate traffic and Web Analytics used to understand audience size and service performance. Reports can include product interactions such as page or endpoint traffic and broad characteristics such as device type, browser, operating system, and country derived from network information. Tile Towers does not use this information for advertising or cross-app tracking.

iPhone credential storage

On iPhone, authentication uses a system authentication session and an authorization code protected with PKCE. The app keeps its short-lived access credential only in memory and stores a rotating refresh credential in the iOS Keychain. Native authorization codes expire after 120 seconds, access tokens expire after one hour, and refresh sessions expire after 30 days.

Service providers and sign-in providers

Google Cloud hosts FuzzyCastle authentication, leaderboard, database, logging, monitoring, backup, and related infrastructure. Cloudflare provides DNS, security, proxy, CDN/static hosting, and aggregate traffic analytics. If you choose Sign in with Apple or Google, that provider processes the authentication or revocation transaction under its own privacy terms.

FuzzyCastle does not sell player information. Tile Towers has no advertising network or data broker and does not use player information for targeted advertising or cross-app tracking.

Retention

Account identifiers, display names, credentials or provider associations, and account metadata remain while the account is active. Weekly leaderboard rows become eligible for deletion 30 days after the board ends. Google Cloud default operational logs are retained for 30 days; required administrative audit logs can remain for 400 days. Account security events are retained for up to 90 days. Cloudflare publishes up to seven days of Security Analytics history and retains Cloudflare account audit logs for 18 months.

FuzzyCastle keeps seven automated database backups and seven days of point-in-time recovery logs. A final backup created if a database instance is deleted can be retained for 30 days. Backups and audit records are restricted to recovery, security, compliance, and service administration and are not used for normal game operation.

Your choices and account deletion

You may play as a guest, sign out, remove local information using browser controls or by deleting the iPhone app, and change your FuzzyCastle display name subject to the displayed limits.

You can delete your FuzzyCastle account from Tile Towers by opening the signed-in account page, choosing Delete Account, and completing the confirmation. An accepted request immediately revokes existing browser and native credentials. Cleanup normally finishes in seconds or minutes and removes the FuzzyCastle profile and credentials, provider associations, display-name state, Tile Towers leaderboard records, and connected FuzzyCastle game data. Automatic retries and operator remediation support completion within 30 days. Sign in with Apple revocation is attempted when the required protected Apple token is available.

Limited backup, security, fraud-prevention, audit, deletion-confirmation, or legally required records may remain only for their stated retention period. They are access-restricted, excluded from normal product use, and account links are removed where the implementation supports it. De-identified or aggregate information that no longer identifies an account may be retained.

Contact

For privacy questions or help with account data, contact fuzzycastle@gmail.com.

Changes to this policy

FuzzyCastle may update this policy when Tile Towers or its supporting services change. The effective date above will be revised when a material update is published.