Privacy Policy

Last updated 16 October 2026

GlyphLink is a tile-matching puzzle for iPhone and iPad, made by an independent developer (“we”). This page explains what the app and its App Clip keep on your device, what they send and to whom, and what they never collect. Questions go to hi@malikghani.com.

The short version

• You can play alone and use Learn mode without an account. Signing in is optional.
• There are no ads. We do not sell your data, and we do not track you across other apps or websites.
• The app sends crash reports and app usage events to Google's Firebase, so we can fix bugs and see which features are used.
• Multiplayer and the leaderboard need a display name and an anonymous device ID.
• Notifications are sent only if you allow them, and you can turn them off in iOS Settings at any time.
• You can delete your account, and the scores linked to it, from the app.

Stored only on your device

• Your settings, such as theme, tile style, fonts and sound.
• Your records: best scores, streaks and the last board you played.
• If you sign in, a session token that keeps you signed in. It is kept in your device's keychain.
• A random device ID, created the first time you open the app and kept in your device's keychain. It is not your Apple ID, not your advertising identifier and not linked to your contacts.

Sent to our server

The app talks to our server, glyph.mgkit.cloud, for these features:

• Multiplayer. When you create or join a room, the room code, your display name, your device ID and the moves you make (tile selections, matches and score) are sent so the match can run. Other players in the room see your display name and score.
• Leaderboard and stats. Finished multiplayer matches are stored with your display name and device ID (or your account, if you are signed in) so the app can show the leaderboard and your own stats. Ranked solo rounds (timed Game mode) send the score, glyph type, board size and time taken, with the same name and ID. The leaderboard shows display names and scores to other players.
• Your account, if you sign in. Signing in with Apple or Google is optional. When you do, the app sends the sign-in provider's ID token to our server, which keeps the account ID the provider gives us, your display name and the email address the provider shares. With Sign in with Apple you can choose to hide your email, in which case Apple gives us a private relay address instead. Signing in links your device ID to the account, so your scores follow you to other devices.
• Notifications, if you allow them. See Notifications below.
• Dictionary content and updates. The app downloads character data and example words, and checks whether a newer version of the app is required. These requests contain the character you looked up, or nothing at all, and nothing about you.

Like any web server, ours keeps standard request logs (IP address, time, requested address and app version) to keep the service secure and to fix problems.

Crash reports and analytics

The full app uses two Google Firebase services. Google processes this data for us, as our service provider, under Firebase's privacy and data processing terms.

Firebase Crashlytics

If the app crashes, it sends a crash report: where in the code the crash happened, the app version, the device model, the iOS version, free memory and storage, whether the app was in the background, and random identifiers for this install. We use it only to find and fix bugs. Google keeps crash reports for 90 days.

Firebase Analytics

The app sends app usage events, such as the app being opened, a round starting or ending, and which mode, character set and board size were played, together with the device model, iOS version, app version, language and random identifiers for this install. Google may estimate your country or region from your connection; it does not give us your precise location. We use this to understand which features are used and where players get stuck. Analytics does not receive your name or email address.

The app does not collect your advertising identifier (IDFA), does not ask for permission to track you, and does not use this data for advertising or share it with advertisers. Google keeps analytics events for the default retention period of Google Analytics, then deletes them; reports made from them do not identify you.

Notifications

GlyphLink can send notifications, for example about new features, events or a board to try. They are sent only if you allow notifications when iOS asks, and you can turn them off at any time in iOS Settings, under Notifications, then GlyphLink.

When you allow them, Apple gives the app a push token. The app sends it to our server together with your device ID, the app build, your language setting and whether it is a test or release build. We use the token only to send GlyphLink notifications through Apple's push notification service. We delete it when the app unregisters it, or when Apple reports that it is no longer valid, for example after the app is deleted. A notification can include a picture, which your device downloads from glyphlink.app, or a link that opens a board in the app.

Who else handles data

• Google: Firebase Crashlytics and Analytics, and Sign in with Google if you choose it.
• Apple: Sign in with Apple if you choose it, and delivery of notifications.
• Hostinger: the server our backend and this website run on.

We do not sell or rent data to anyone, and no one else receives it.

Never collected

• Precise location, contacts, photos, microphone or camera.
• Audio. Pronunciation uses Apple's on-device speech, so nothing is recorded or sent.
• Advertising identifiers, or anything for tracking you across apps and websites.

The App Clip

The GlyphLink App Clip is a quick, offline round of the game. It does not create a device ID, has no account, multiplayer or leaderboard, does not include Firebase, does not receive notifications and sends nothing about you to our server.

This website

glyphlink.app sets no cookies and runs no analytics. Our web server keeps the standard request logs described above.

Children

GlyphLink is made for a general audience and is not directed to children. We do not knowingly collect personal information from children.

Your choices and deleting your data

• Deleting the app removes everything stored on your device.
• If you have an account, Delete Account (in the app's Settings, under Account) removes the account, its scores and its leaderboard rows from our server.
• To remove leaderboard entries, stats or a push token linked only to your device ID, or to ask about any data we hold, email hi@malikghani.com.
• Crash reports are deleted automatically after 90 days, and analytics events after the retention period above.

Changes

If this policy changes, we will update this page and the date at the top. If the app starts collecting something new, the policy changes in the same release.

Contact

Email hi@malikghani.com with any privacy question or request.