Privacy Policy

last updated August 27, 2026

Privacy Policy for Duelo

Last Updated: August 27, 2026 Effective Date: August 27, 2026

Introduction

Welcome to Duelo ("we," "our," or "us"). We are committed to protecting your privacy and providing a safe, enjoyable gaming experience. This Privacy Policy explains how we collect, use, and protect your information when you use our multiplayer head-to-head games platform.

Duelo currently includes the following games:

Crossword Chaos — real-time crossword duels
Word Chaser — themed word-search races
Cluster Clash — group-the-words puzzles
Cipher Storm — head-to-head five-letter word cracking
Path Pursuit — territory-claiming word grid
Connect Four — drop and line up four
Sudoku — solve a grid together or race it
Bomb Pass — pass the bomb before it goes off
Trapdoor Panic — cross a hidden minefield
Queens — one per row, column and colour

We may add or modify games over time; this Policy applies to all games and features in the Duelo app.

A note about our brand: Duelo was previously released as "Crossword Chaos," and then as "WordKO." If you installed either of those, it is the same app and the same account — your friends, statistics and progress have carried over. Our site now lives at play-duelo.com. The older crossword-chaos.web.app address still serves the same policies and invite links, so links from earlier app builds keep working.

Information We Collect

Information You Provide

Username: A unique display name you choose. Usernames are reserved on our servers so two players cannot pick the same one.
Avatar Emoji: A single emoji you select to represent yourself.
Sign-In Information: Depending on the sign-in method you choose:
- Anonymous (Guest): Only a randomly generated user ID. No email or name is collected.
- Google Sign-In: Your email address and basic Google profile data, as authorized by you.
- Apple Sign-In: An Apple-issued identifier and (only if you choose to share it) your name and email. If you select "Hide My Email," Apple provides a private relay address.
Game Activity: Your scores, win/loss records, completed puzzles, words found, paths traced, guesses, group selections, and other in-game actions across each game.
Skill Rating: A numeric rating per game, calculated from your results, used to match you with opponents of similar ability. Co-operative games are unrated, because a shared solve has no losing side.
Friend Connections: When you complete a private match with another player, we record a friendship link between your accounts so you can find and challenge them later.
Messages and Reactions: Emoji and sticker messages you send to friends, and emoji reactions you send during live matches. These are visible to the recipient.
App Preferences: Sound, music, vibration, theme, and notification toggles you set in Settings.

Information Collected Automatically

Device Identifiers: Anonymous device IDs and (with your consent in regulated regions) the device advertising identifier (IDFA on iOS, AAID on Android).
Time Zone: The time zone your device reports (for example, Europe/London) and its current offset from UTC. We use this for one purpose: sending a reminder at a reasonable hour where you actually are, rather than a reasonable hour where our servers are. It is a region-level signal, not a location — it does not tell us your city, your address, or your coordinates, and we never collect GPS or precise location. It updates when your device's zone changes, such as when you travel.
Match and Session Data: Room codes, session IDs, presence/heartbeat timestamps, and the state of any multiplayer match you join.
Push Notification Token: Firebase Cloud Messaging (FCM) registration token, used to deliver friend requests, challenge invites, rematch alerts, and update notices.
Analytics Data: Game performance metrics, feature usage, and aggregated event logs.
Diagnostics and Crash Reports: Stack traces, breadcrumbs, device type, operating system, and app version when an error occurs.
Purchase Data: Whether you own the Duelo Pro entitlement, the tier and store product you bought, the store transaction identifier, and the purchase and expiry timestamps. We never receive or store your payment card details.

Information from Third-Party Services

We use the following third-party services that may collect or process information:

Firebase (Google) — Authentication, Firestore database, Cloud Functions, Analytics, Crashlytics, and Cloud Messaging. Firebase processes data in accordance with Google's Privacy Policy and Firebase's privacy documentation.
Google Sign-In — OAuth authentication for users who sign in with Google.
Sign in with Apple (iOS) — OAuth authentication for users who sign in with Apple, including optional private email relay.
Google AdMob — Non-personalized advertisement delivery and ad performance measurement. See AdMob's privacy information.
Google User Messaging Platform (UMP) — Used to collect and record your advertising consent in regulated regions (EEA, UK, Switzerland).
Apple App Tracking Transparency (ATT) (iOS 14+) — System-level prompt asking whether the app may use your device advertising identifier.
RevenueCat — Purchase validation and entitlement management for the optional Duelo Pro purchase. RevenueCat receives an app user ID linked to your account, your store receipt or purchase token, and basic device and country information. It does not receive your payment card details, which stay with Apple or Google. See RevenueCat's privacy policy.

How We Use Your Information

We use collected information to:

Provide and maintain Duelo and all its games
Match you with friends or other players in live and asynchronous games
Track game state, deliver moves and reactions to your opponent in real time, and resolve match outcomes
Maintain friendships, head-to-head records, and friend chat threads
Display global, weekly, and friend leaderboards
Send push notifications for friend requests, challenge invites, rematch requests, and important updates
Deliver non-personalized advertisements
Measure ad performance and prevent ad fraud
Improve game performance, fix bugs, and develop new features
Prevent cheating, abuse, and ensure fair play
Comply with legal obligations

Information Visible to Other Players

Some information is visible to other Duelo players by design:

Your username and avatar emoji appear on global and weekly leaderboards (top 50), in matches you join, and in any friend list that includes you.
Your game statistics (wins, losses, current streak, head-to-head record, recent match outcomes) are visible to friends and to opponents you've played with.
Your online presence (whether you're currently active in Duelo) is visible to your friends.
Your in-game actions during a live match (selected clues, guesses, found words, reactions, claimed cells, etc.) stream to your opponent in real time.
Messages and emoji you send to a friend are visible to that friend.
Your username and avatar emoji are shown to strangers you are matched with, from the first match, in the same way they are shown to friends. Duelo does not put you behind a pseudonym or a masked identity when you play someone you don't know. Choose a username you are comfortable showing to people outside your friend list.

You can change your username and avatar emoji at any time in Settings.

Multiplayer and Friend System

Duelo has four ways to play, and each stores a slightly different record.

Live Matches (Versus and Turns)

When you start or accept a live match — whether you are both racing the same board at once, or alternating turns on a shared one — we create a shared "room" record containing both players' user IDs, usernames, avatar emojis, and the live state of the match. Both players' devices read from and write to this record while the match is in progress. The record is retained after the match for rematch coordination, statistics, and dispute resolution. While a match is live, both devices also write short "still here" timestamps so the app can tell when someone has genuinely disconnected.

Co-op Matches

In a co-operative game, both players work the same board on the same side. The record is the same shape as a live match, except there is no winner and no rating change.

Battle Anytime (Asynchronous Challenges)

When you challenge someone without both of you being online at once, we store a challenge record containing both players' IDs, the game type, the puzzle, scores once each side plays, and timestamps. The recipient receives a push notification and can play the same puzzle on their own schedule.

Playing Strangers

Some ways of starting a game — Quick Battle, and Battle Anytime when you don't pick a specific friend — match you with a player you have no existing connection to. When that happens:

Your username, avatar emoji, and result are shown to that player, and theirs to you.
We store a running head-to-head record for that pairing — how many times you've played, the wins, losses and draws per game, and the details of the most recent result — the same way we do for a friend you play often.
Your skill rating for that game is updated.
Being matched with someone does not create a friendship. Friendships are only created by completing a private 1-on-1 match with someone you invited.

Friend Connections

When two players complete a private 1-on-1 match, we automatically create a friendship link between their accounts. Friends can see each other's username, avatar emoji, online presence, and head-to-head statistics, and can send each other messages and challenges.

Data Storage and Security

Your data is stored using Firebase's cloud infrastructure (operated by Google), primarily in the United States.
We implement industry-standard security measures, including encryption in transit and access controls on our backend.
Some data is also stored locally on your device (preferences, cached game data, etc.).

Important: If you uninstall the app or clear app data without first deleting your account, your server-side account data (username, friends, stats, message history) remains on our servers and can be recovered by signing back in with the same credentials. Anonymous (guest) accounts are tied to your device and may not be recoverable after uninstall — link to a Google or Apple account to preserve guest progress.

Advertising and Your Choices

We display non-personalized advertisements through Google AdMob to keep Duelo free. Non-personalized ads are based on context (such as the content you're viewing) rather than your personal interests or browsing history.

Ad Formats

Banner ads appear on certain screens.
Interstitial ads appear at natural breakpoints (e.g., after a game completes or is abandoned), subject to a frequency cap.
Rewarded ads may be offered in the future in exchange for in-game bonuses; if so, viewing them will always be your choice.
No ads at all if you buy Duelo Pro. That removes advertising, and with it the advertising identifier sharing described below.

How Advertising Works

Device Identifiers: With your consent (in regulated regions) or by default elsewhere, we share an anonymous device advertising identifier with Google AdMob to serve ads and measure performance.
Consent Requirement (EEA / UK / Switzerland): We use Google's User Messaging Platform (UMP) to ask for your consent before sharing device identifiers. The consent prompt appears on first launch and can be re-opened from Settings.
App Tracking Transparency (iOS): On iOS 14 and later, the system displays a prompt asking whether Duelo may track you across apps and websites. You can change this answer at any time in iOS Settings → Privacy & Security → Tracking.
Your Choices:
- Accept: We can use device identifiers for non-personalized ads (a more relevant ad experience).
- Decline: We serve "Limited Ads" that don't use device identifiers (fewer ads, lower-quality matching).
Other Regions: If you are outside the EEA/UK/Switzerland, device identifiers are used by default for non-personalized ads. You can opt out through your device's privacy settings.

We do not:

Track your interests or browsing history
Create advertising profiles about you
Serve personalized or targeted ads
Sell your personal information to advertisers

Push Notifications

If you allow notifications, we send two kinds of push.

Match activity — these follow something another player did:

Friend requests and new friendships
Challenge invites (live, turn-based, co-op and asynchronous)
Someone taking the open seat in a game you created
Rematch requests after a finished match
Your turn arriving in a turn-based game

Reminders — these are sent by us, not triggered by another player:

A reminder that a game is waiting for you, sent at most once in an evening, timed to your own time zone rather than ours (this is what the time-zone field described above is for)
Notices about changes to these Terms or this Policy
Occasional product news

We do not send reminders during the night in your local time.

You can turn reminders off on their own, and keep match activity, from Settings inside the app. You can turn off all notifications from Settings or from your device's system settings. Turning them off in your device settings stops delivery immediately; the in-app toggle stops us sending them.

Data Sharing

We do not sell your personal information. We share limited data only in the following circumstances:

With Other Players: As described in "Information Visible to Other Players" and "Multiplayer and Friend System" above.
Advertising Partners: Anonymous device advertising identifiers with Google AdMob (subject to your consent in regulated regions).
Service Providers: With Firebase, Google, Apple, RevenueCat, and other infrastructure providers necessary to operate the service (authentication, database, analytics, crash reporting, push notification delivery, purchase validation).
Legal Requirements: When required by law, court order, or to protect our rights, your safety, or the safety of others.
Aggregated/Anonymized Data: We may share anonymized, aggregated statistics publicly (e.g., total games played).
Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to this Policy.
With Your Consent: When you explicitly agree to other sharing.

Children's Privacy

Duelo is intended for users aged 13 and above. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will delete it.

Your Rights and Choices

You have the right to:

Access Your Data: Request a copy of the data we hold about you. Contact us at the email below.
Delete Your Account: From Settings → Delete Account, you can permanently remove your username, statistics, friend connections, skill ratings, and username reservation. Account deletion is irreversible. Full details, including how to request deletion by email if you cannot open the app, are at play-duelo.com/data-deletion.
Change Username and Avatar: At any time from Settings.
Manage Privacy Preferences: EU/UK/Swiss users can re-open the consent dialog from Settings; all users can opt out of personalized advertising through their device settings.
Opt Out of Reminders, But Keep Match Activity: A separate toggle in Settings turns off our reminder pushes without silencing notifications that another player triggered.
Opt Out of Push Notifications Entirely: Toggle in Settings or in your device's notification settings.
Opt Out of Friend Discovery: By not playing private matches with new opponents (no friendship is created without a completed private match).
Withdraw Consent: Where we process data based on your consent, you can withdraw it at any time.

To exercise these rights, use the in-app controls or contact us at the email below.

Data Retention

Active Accounts: We retain your data as long as your account is active.
Deleted Accounts: When you request deletion via Settings, we remove your personal data within 30 days, except where retention is required for legal, security, fraud-prevention, or legitimate business purposes.
Inactive Accounts: We may delete or anonymize accounts that have been inactive for extended periods.
Backups: Deleted data may persist in encrypted backups for a limited additional period before being purged on our normal backup rotation.
Aggregated Data: Anonymized, aggregated statistics may be retained indefinitely.

International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable law.

Third-Party Links

The app may contain links to third-party websites or services (including those embedded in advertisements). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of changes by:

Updating the "Last Updated" date at the top of this Policy
For material changes, presenting an in-app re-acceptance dialog the next time you open Duelo

Your continued use of Duelo after a material change constitutes acceptance of the updated Policy.

United States Privacy Rights

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

Right to know what personal information is collected
Right to opt out of the sale or sharing of personal information
Right to delete personal information
Right to correct inaccurate personal information
Right to non-discrimination for exercising privacy rights

Data Sharing for Advertising: We share device identifiers with Google AdMob for advertising purposes. Under California law, this may be considered "sharing" for cross-context behavioral advertising. You can opt out by declining consent when prompted, using the in-app privacy preferences, or using your device's privacy settings.

We do not sell personal information in the traditional sense (for monetary value).

Other US States

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights. Contact us to exercise these rights.

European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and related privacy laws, including:

Right to consent before device identifiers are used for advertising
Right to withdraw consent at any time by re-opening the consent dialog from Settings
Right to access and to receive a copy of your data
Right to data portability
Right to rectification of inaccurate data
Right to erasure (delete your account in-app or contact us)
Right to restriction of processing
Right to object to processing based on legitimate interests
Right to lodge a complaint with your local data protection authority

Legal Basis for Processing:

Consent: For device identifier sharing with advertising partners, push notifications, and any optional features
Contractual Necessity: For providing matchmaking, friend features, leaderboards, and other game services you request
Legitimate Interest: For ad performance measurement, fraud prevention, security, and service improvement
Legal Obligation: For complying with law enforcement and regulatory requirements

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@keedastudios.com Website: https://play-duelo.com

For data protection inquiries: support@keedastudios.com

Consent

By using Duelo, you consent to our Privacy Policy and agree to its terms.