Privacy policy
This policy explains what Tilkly does with your information when you play Seven Worlds: Myths, History & Puzzles. It is written to be read, not to be survived. If anything here is unclear, write to privacy@tilkly.com and we will explain it.
On this page
1. Who we are
Seven Worlds: Myths, History & Puzzles is made and operated by Jyoti Singh, trading as Tilkly, Appt 4113, 169 Avenue de Grande Bretagne, 31300 Toulouse, France. We are the data controller for the processing described here.
Privacy contact: privacy@tilkly.com. General support: support@tilkly.com.
We do not sell personal data, and we do not share it with data brokers.
2. Playing without an account
You can play the whole first Chronicle without signing in. As a guest, your progress is stored on your device and is not sent to us. Uninstalling the game deletes it.
Some things still happen without an account: the game contacts our servers for downloadable story content and configuration, it requests ads if you are not a member, and it sends a crash report if it crashes. Those are described below.
3. What we process and why
The legal bases below are those of the EU General Data Protection Regulation. "Contract" means the processing is necessary to give you the game you asked for; "legitimate interests" means we have weighed our interest against your rights and explain the balance.
| What | Why | Legal basis |
|---|---|---|
| Google account identifier, email address and display name, when you sign in | To create and recognise your account, sync progress across devices, and show you on social surfaces you choose to appear on | Contract |
| Game progress: missions completed, scores, stars, XP, rank, streaks, achievements, daily drill results, artifact collection, cosmetics owned | To save your game and restore it on any device you sign in on | Contract |
| Profile, avatar, visibility settings, follows, friendships, blocks, reactions and reports | To run the social features you use | Contract |
| Purchase records: product bought, Google Play order and purchase token, coin balances and movements | To deliver what you paid for, prevent a purchase being redeemed twice, and settle refunds and chargebacks | Contract, and legal obligation for the accounting record |
| Support messages, the address you give for a reply, and the technical details you choose to attach | To answer you | Contract, and legitimate interests where you write to us as a guest |
| Device and app information: app version, platform and OS version, time zone, language, a pseudonymous installation identifier, and Google Play Integrity evidence | To keep the game working on your device, to keep purchases and progress honest, and to detect tampering and abuse | Legitimate interests in a working, non-cheatable game |
| Crash reports and diagnostics | To find and fix crashes | Legitimate interests in a stable game |
| Advertising identifier and ad request data, if you are not a member | To show banner ads on puzzle boards | Your consent, where consent is required (see below) |
| Server security and rate-limiting logs, including IP address | To defend the service against attack and abuse | Legitimate interests in security |
What we deliberately do not collect. We do not ask for your location, contacts, photos, camera or microphone, and the app requests none of those permissions. Puzzle answers, the text you type into a board, and anything you write in the game are not sent to our crash reporting. The optional Breathing Reset measures nothing about your body; it is a timer with a picture, it makes no health claim, and it never affects rewards, streaks or leaderboards.
4. Advertising
Seven Worlds shows banner ads on puzzle boards, supplied by Google AdMob. Ads appear nowhere else in the game, and an Inner Circle member sees none at all — a member's device does not request an ad in the first place.
To show an ad, Google receives your device's advertising identifier, IP address, and technical information about the device and the ad request, and may use it to select and measure ads and to detect fraud. Google's own description of that processing is at business.safety.google/privacy.
If you are in the European Economic Area, the United Kingdom or Switzerland, the game asks for your choice before any personalised advertising, using Google's consent form. If you decline, you will still see ads, but they are non-personalised — selected from the context rather than from a profile about you. You can change your choice at any time in Settings → Legal → Ad Choices, and you can reset or delete the advertising identifier in your Android settings.
5. Purchases and membership
Coins and the Inner Circle membership are sold through Google Play. Google is the seller and the payment processor: we never receive your card number, bank details or billing address. We receive the product you bought, the order and purchase token, and the state of that purchase, so we can verify it with Google and grant what you paid for.
The Inner Circle membership is a subscription billed by Google. Cancel it in the Play Store, under Payments & subscriptions. Cancelling stops future billing; benefits run to the end of the period you have already paid for.
6. Crash reports
The game uses Firebase Crashlytics to report crashes and freezes. A report contains the stack trace, the device model, the operating system version, the app version, the state of the app at the moment it failed, and a Crashlytics installation identifier. It does not contain your account id, your email address, your puzzle answers, or anything you typed.
7. Who else sees your data
We use a small number of service providers, each acting on our instructions:
- Google — sign-in, Play billing and Play Integrity, Firebase Crashlytics, and AdMob.
- Our hosting and infrastructure providers — the servers and databases that store your account and progress.
- Our email provider — to send support replies and account deletion confirmation links.
Other players see only what your visibility settings allow: your display name, avatar, rank and the progress you choose to publish. Your email address is never shown to another player.
We may disclose data where the law requires it, or to establish or defend a legal claim.
8. Where it is processed
Some providers, including Google, process data outside the European Economic Area. Where that happens, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision, together with the additional measures those providers publish. You can ask us for details.
9. How long we keep it
| What | Kept for |
|---|---|
| Account, profile and game progress | Until you delete the account |
| Purchase and payment records | 10 years, as French accounting law requires |
| Coin ledger entries | 10 years; the ledger is append-only and entries cannot be altered |
| Abuse reports, moderation and restriction records | Up to 24 months |
| Support correspondence | Up to 24 months, or until you delete your account, whichever comes first |
| Crash reports | Up to 90 days, set by Crashlytics |
| Server security and rate-limiting logs | Up to 12 months |
10. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to another service in a portable form. You can object to processing we base on legitimate interests, and you can withdraw consent — for advertising, at any time — without affecting what was done before you withdrew it.
Write to privacy@tilkly.com. We answer within one month. We will ask you to confirm you control the account, because handing your data to somebody else would be the worse failure.
If you think we have got this wrong, you can complain to your national data protection authority. Ours is the Commission Nationale de l'Informatique et des Libertés (CNIL).
11. Deleting your account
You can delete your account yourself, from Settings → Data → Delete Account in the game, or from https://sevenworlds.tilkly.com/delete-account if you have already uninstalled it. Deletion is immediate and cannot be undone.
Deletion severs your sign-in identity and destroys your profile, progress, collection and social data. Purchase and payment records, the coin ledger, and abuse and moderation records are kept for the periods above, without your name, email address or Google identity attached. The deletion page lists both sides in full.
12. Children
Seven Worlds is not directed to children. It is rated for players aged 13 and over, and we do not knowingly collect personal data from children under 13, or under the higher age of consent in some EU countries. See the children and age page. If you believe a child has given us personal data, write to privacy@tilkly.com and we will delete it.
13. Security
Traffic between the game and our servers uses HTTPS. Access to production data is limited to the people who need it, is authenticated, and is logged — the record of staff access to player data is itself kept and auditable. Purchase tokens are encrypted at rest and are never written to logs. The coin ledger is append-only, so an entry can be added but never quietly rewritten.
No system is perfect. If you find a security problem, write to support@tilkly.com and we will take it seriously.
14. Changes
If this policy changes in a way that affects you, we will update the date at the top and, for a significant change, tell you in the game before it takes effect.
15. Contact
Jyoti Singh, trading as Tilkly
Appt 4113, 169 Avenue de Grande Bretagne, 31300 Toulouse, France
privacy@tilkly.com