Privacy Policy

Plumvia, the game studio of Celerora LLC (a Texas limited liability company), respects your privacy. This Privacy Policy describes how we handle personal information across our website at plumvia.com and our games (together, the "Services"). Our current releases show no third-party ads and do not use an advertising identifier.

For the purposes of data protection law, Celerora LLC, operating as Plumvia, is the controller of personal information processed through the Services. You can reach us at privacy@plumvia.com.

Information you give us

• Contact form: when you message us, we collect your name, email address, and the contents of your message.
• User content: if a game lets you create or share content with others — such as a display name, profile details, or messages — we collect what you submit.
• Reports: if you report another player's display name, we store the report — your account identifier, theirs, the name as it appeared, and when. We use it only to review the name. The person reported is not told who reported them. We keep a report for 24 months after it is made.
• Notification tokens: kept while notifications are on for that device. From Zigora 1.0.7, turning notifications off removes the token the next time you open the game. We also remove a token when Apple or Google report it is no longer valid, and tokens are deleted with your account.
• Launch waitlist: if you ask to be notified when a game launches, you choose which games, and we first email a link to confirm the address is yours. Nothing is added to any list until you follow it. Once you do, we store your email address on a separate list for each game you chose and use it only to confirm you're on it and to send those launch announcements. You can remove yourself from every list at once using the unsubscribe link in any email we send, or by emailing privacy@plumvia.com.

Information collected automatically

• Device & usage data: such as IP address, browser or device type, pages or screens viewed, and timestamps.
• Security signals: data needed to prevent spam and abuse, including rate-limiting and CAPTCHA checks on our website, and a device-integrity check when a game contacts our servers (see Google Firebase below).
• Crash reports: when a game crashes, we receive an automatic report containing the technical details of the failure — a stack trace plus your device model, operating system version, and the app version. These reports carry no name, email address, or account identifier. Stackabloom does not send crash reports.
• Installation ID: the Firebase services in our apps create a Firebase installation ID — a random identifier for that install of the app. It contains no name, email address, or phone number, and it changes if you delete and reinstall the app or clear its data. It's used only to run those services: signing in, saving progress, keeping requests to our servers secure, delivering crash reports, and, in Zigora, notifications. It isn't used for advertising or to track you across other apps.

Game data

• Gameplay: progress, scores, streaks, and settings needed to run a game on your device or account.
• Sharing a result: some games let you share how you did. In Zigora and Stackabloom you can share your result for the day as text — your stars or score, the day's puzzle number, date or name, and your streak, never the answer — and in Zigora you can also share a word from your Collection as a picture card. You choose whether and where to send it: on a phone your phone's own share sheet opens, in the app or the browser, and on a computer you can copy the text or pick a site to post it on yourself. We don't receive what you send or learn who it goes to, and nothing is ever posted for you; shared links carry no tracking codes. Zigora's app analytics notes that Share was tapped (and, for a word card, which word and its rarity tier), along with the other gameplay events described under GameAnalytics.
• Purchases: if you buy something, the relevant app store processes your payment. We receive confirmation of the transaction but not your full payment details.

Your Plumvia account

When you first open one of our games on your phone we create an account for you through Google Firebase Authentication. In games with friend features (today, Zigora), the account also gets a friend code. By default the account is anonymous — a random identifier, with no email, password, or real name — and it exists so your progress has somewhere to live. Google processes this data as our infrastructure provider, over encrypted connections (HTTPS/TLS).

Playing in a browser. Our browser versions do not create an account and do not sync anything. Your progress is kept in that browser's own storage, where clearing the site's data removes it, and our web server logs the request the same way it logs any visit to this site.

One account, all our games. Your Plumvia account is shared across every game we make. If you played one of our games and then open another, it is the same account — the same anonymous identifier, the same linked email address if you added one, and, in games with friend features, the same friend code. Each game's progress is stored separately, but the account itself is one thing.

Linking an email (optional). You can choose to link an email address so your account and progress come back if you reinstall or switch phones. If you do, we store your email address and send you a short sign-in code — we never ask for a password. The address is used only to sign you back in and to recover your account. Players who never link an email stay fully anonymous to us.

Deleting your account deletes it everywhere. Deleting your account from inside any of our games removes your data from all of them, along with your friend connections, your linked email address, and the account itself. It cannot be undone, and the in-game deletion is all or nothing — it does not offer a way to remove one game's data and keep another's. It does not touch the progress saved on your own device. If you need something narrower, email us at privacy@plumvia.com.

Daily Challenge results, friends & Duels (Zigora)

When you finish a Zigora Daily Challenge in the app, we store the result against the account above in Google Cloud Firestore: the day, whether you solved it, and your score. This happens for every app player, whether or not you use the friend features — it is what lets a friend you add later see your results. If you have chosen a display name, it is stored with the result.

The optional private friend leaderboard and Duels (head-to-head games on a hidden word you and a friend share) also store:

• a display name you choose (please don't use your real name); and
• the friend connections you make — you add friends by code, or by sharing an invite link. The link carries an invitation code and your friend code; anyone who opens it in the game within 7 days becomes your friend, and you're notified when they do. The link stops working after 7 days and is then deleted. We never access your contacts.

Your display name and results are visible only to you and to players you're connected with as friends; nobody else can see them. You can remove friends at any time, delete your account from inside the game, or ask us to delete this data at privacy@plumvia.com. We do not use it for advertising, and we do not sell it.

In-app support messages

If you contact us from inside one of our games, we store your message with what we need to answer it: your account identifier and friend code, whether your account is anonymous or linked, your email address if you linked one, the game and app version, and your device model and operating system, and when you sent it. We use it only to help you. It is deleted 24 months after you send it, or sooner along with your account.

Push notifications

If you turn on notifications, we store a notification token issued by Apple or Google for that device, together with the platform name. That token is what lets Apple or Google deliver a message to your device. It is linked to your game account, and we store one for each device you use — older ones drop off as you add new devices.

One exception: Zigora for Android before version 1.0.7 stored this token when you first opened the app, whether or not you had allowed notifications. From 1.0.7 it waits for your permission, as it always has on iOS, and it removes a token stored that way the first time you open the updated game.

We use it only to send the notifications you asked for: a friend request, someone accepting yours or claiming your invitation, when it is your turn in a game, and when a game you played has finished. A friend can send you at most three turn reminders a day. We never use it for advertising or tracking. Apple and Google deliver these messages on our behalf.

You can turn notifications off at any time in your device settings; from Zigora 1.0.7, that also removes your token the next time you open the game. We remove a token once Apple or Google tell us it has stopped working, and it is deleted with the rest of your data if you delete your account.

On-device reminders

Some games, such as Stackabloom, offer an optional daily reminder instead. Your phone schedules it for itself once you turn it on in the game's settings. No notification token is created, and nothing about the reminder is sent to us or to Apple or Google.

• to provide, maintain, and improve the Services;
• to respond to your messages and support requests;
• to send you notifications you have turned on, such as friend requests and game turns;
• to protect against spam, fraud, and abuse;
• to understand how the Services are used; and
• to comply with legal obligations.

Where required, our legal bases are your consent, performance of a contract, our legitimate interests in operating and securing the Services, and compliance with law.

We and our providers use cookies and similar technologies to keep the Services secure and working properly. For example, our anti-abuse provider (Cloudflare Turnstile) may set cookies to verify that requests come from real people. You can control cookies through your browser settings; disabling some may affect functionality.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose it only to service providers that process data on our behalf, and only as needed to run the Services:

• Vercel — website hosting and content delivery.
• Resend — delivering contact-form emails to us, waitlist confirmations, and sign-in codes to players.
• Cloudflare — bot/spam protection (Turnstile) and network services.
• Neon — the database behind our support tools. It holds contact-form submissions, the support messages you send from inside a game, and name reports, so our team can answer and review them.
• Upstash — rate limiting, waitlist signups, and a backup store for contact submissions if the main database is unavailable.
• Google Firebase — authentication, database, crash reporting, and app verification (Firebase Authentication, Cloud Firestore, Firebase Crashlytics, and Firebase App Check). Authentication and the database hold your Plumvia account, Daily Challenge results, friend connections and Duels; Crashlytics receives automatic crash reports so we can fix what breaks. App Check confirms a request comes from a genuine, unmodified copy of our app on a real device — using Google Play Integrity on Android and Apple's App Attest on iOS, which means those services receive device-integrity signals when the game contacts us. It carries no name, email address, or account identifier. These services also create the installation ID described above. Google processes this data as our infrastructure provider, over encrypted connections. See the Friend leaderboard details above.
• GameAnalytics — analytics for our games. This involves app-usage and gameplay events, device and app information, and a device identifier (Android app-set ID or Apple's IDFV), used to understand how our games are played and to improve them. It is not used for cross-app tracking and does not use advertising identifiers such as IDFA. Handled under GameAnalytics' privacy policy. Stackabloom does not use GameAnalytics or any other analytics.
• Apple Push Notification service & Firebase Cloud Messaging (Google) — delivering the notifications you have turned on. They receive the notification token for your device and the message being sent, so it can reach you. They do not receive your game progress or your friend list.
• Apple App Store & Google Play — distribution and payment processing for our games, under their own privacy policies.

We may also disclose information to comply with the law, enforce our Terms, or protect the rights and safety of our users and Celerora LLC, and in connection with a merger, acquisition, or sale of assets.

Our Services are not directed to children under 13 (or the minimum age required by your local law), and we do not knowingly collect personal information from them. Where a specific game is intended for children, we will handle data in accordance with applicable laws such as COPPA and the GDPR. If you believe a child has provided us personal information, contact us at privacy@plumvia.com and we will delete it.

We keep personal information only as long as needed for the purposes described here, then delete or anonymize it. In general:

• Contact messages: kept while we handle your inquiry, and deleted 24 months after we close it. Messages you send from inside a game are deleted 24 months after you send them, or right away if you delete your account. A message sent through this website's contact form isn't linked to a game account, so to have one deleted sooner, email us.
• Security & rate-limit logs (including IP): kept short-term to detect and prevent abuse.
• Game progress & purchase records: kept while you use the game and as needed for support, accounting, and legal obligations.
• Analytics & crash data: analytics data is kept by GameAnalytics for 12 months on a rolling basis and then anonymized or deleted; crash reports are kept by Firebase Crashlytics for 90 days.
• Account and game data: your display name, friend connections, and Daily Challenge results are kept until you delete your account or ask us to delete them.
• Launch waitlist: a request you haven't confirmed is deleted after 48 hours. Once confirmed, your email address and the date you confirmed are kept on each game's list until that game's launch announcement has been sent, or until you unsubscribe or ask us to remove them.
• Support and moderation records: when someone on our team looks at your information to answer a message or review a report, we record who did it and when. We keep those records for 24 months so we can account for how your information was handled.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA), among others, have specific rights, including the right not to receive discriminatory treatment for exercising them. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

To make a request, email privacy@plumvia.com. We may need to verify your identity before responding.

You can turn notifications off at any time in your device settings, or in the game where it offers the choice.

Some browsers and devices let you send a Global Privacy Control (GPC) signal. Where required by law, we treat a GPC signal as a request to opt out of any "sale" or "sharing" of personal information. As described above, we do not sell personal information or share it for cross-context behavioral advertising.

We operate from Texas, USA and our providers may process data in other countries. Where we transfer personal information across borders, we rely on the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism where one applies.

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Services may link to third-party sites and platforms (such as app stores). Their privacy practices are governed by their own policies, and we are not responsible for them.

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above and, for material changes, provide additional notice where appropriate.

Questions or requests about your privacy? Email privacy@plumvia.com or use our contact page.