Noma Privacy Policy

01Data controller and contact

The publisher of Noma, identified in the app’s legal notice, is responsible for the processing described below. It determines why and how data is used.

For any question or to exercise your rights, you can write to noma@timotei.co.

02Data we process

Noma does not ask you to create an account and does not directly collect your name, postal address, precise GPS location, contacts, photos, camera, or microphone.

Depending on your use of the app and your choices, the following categories of data may be processed:

• Data saved locally: language, vibration and notification preferences, progress, completed levels and tutorials, streaks and daily puzzles, games in progress, moves played, rewards, hints and wands available.
• Amplitude technical data: pseudonymous identifier assigned to the device or browser, IP address and the approximate location that can be inferred from it, device model and manufacturer, operating system, browser, app version, language, platform, carrier when available, and date and time of events.
• Amplitude usage data: screens and journeys viewed, time spent, game, puzzle, difficulty, grid size, puzzle and attempt identifiers, generation seed, number of moves, actions and hints used, abandonments and successes, progress, inventory, daily streak, tutorials and enabled preferences.
• Web autocapture: pages, URL, title and referrer of the visit, clicks or element changes, display dimensions, performance, and technical information about network requests.
• AdMob advertising data: device advertising identifier (IDFA on iOS, or an equivalent identifier), IP address and the approximate location that can be inferred from it, technical device data, ads shown, clicked or dismissed, and information used to measure advertising campaign performance.
• Session Replay: visual reconstruction of the session and interactions, such as clicks, taps, scrolling and screen changes. The “medium” masking level hides form fields and inputs, but other text shown on screen may remain visible.
• Contact requests: email address, name or pseudonym if provided, message content, attachments, and information necessary to respond to your request.

03Purposes and legal bases

• Providing the game, remembering your settings, and restoring your progress: performance of the service you request. This data stays on your device, except the usage indicators sent to Amplitude with your consent.
• Measuring audience, understanding journeys and difficulties, and improving puzzles, usability, stability and performance through Amplitude, autocapture and Session Replay: your prior consent. You may decline or withdraw this consent without losing access to the game.
• Showing ads within the app and measuring their performance through Google AdMob: your prior consent for personalized ads and the related advertising tracking, where required. Absent consent, non-personalized ads may still be shown on the basis of Noma’s legitimate interest in funding the app for free.
• Responding to messages and requests to exercise your rights: Noma’s legitimate interest in providing support and honoring your requests, or performance of steps taken at your request, depending on context.
• Preventing abuse, securing the service, and defending Noma’s rights: Noma’s legitimate interest in protecting the app and its users.

Noma does not make any decision producing a legal effect on you based solely on automated processing. Data collected by Amplitude is not used to send you targeted advertising; only the data described in the “Advertising and Google AdMob” section is used for that purpose.

04Source of the data

Data comes from your use of Noma, your device or browser, the Amplitude SDK integrated into the app, and information you voluntarily provide when contacting Noma.

05Recipients and processors

Data is accessible only to individuals authorized by Noma’s publisher who need it, as well as to Amplitude, Inc., which provides analytics and Session Replay services as a processor, and its own technical sub-processors.

Google LLC and Google Ireland Limited provide the Google AdMob advertising service. For processing related to advertising, Google acts as an independent data controller, under the terms described in its own privacy policy.

Data may also be disclosed to authorities or professional advisors where required by law or necessary to establish, exercise, or defend legal rights.

Noma does not sell or rent your personal data.

06Hosting and international transfers

Data processed by Amplitude for Noma is sent to the European data zone and hosted in Amplitude’s European data center located in Frankfurt, Germany.

Amplitude may use technical sub-processors located inside or outside the European Economic Area. Where processing involves an international transfer, Amplitude provides appropriate safeguards, including an applicable adequacy decision, the EU-U.S. Data Privacy Framework for eligible organizations, or the European Commission’s standard contractual clauses.

You can request more information about these safeguards by contacting Noma.

Data processed by Google for advertising purposes may be transferred to and hosted in various countries, including outside the European Economic Area. Google frames these transfers with the safeguards provided by its privacy policy, including the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

07Retention periods

• Local data: until deleted from the app or browser, the app’s data is cleared, or it is uninstalled. An app update does not necessarily delete it.
• Amplitude events and properties: up to 14 months from collection.
• Session Replay recordings: 30 days from collection.
• Support exchanges and rights-related requests: the time needed to process the request, then up to 3 years to keep evidence of how it was handled and to defend Noma’s rights.

Some data may be kept longer where a legal obligation requires it or for as long as necessary to establish, exercise, or defend legal rights. It is then isolated and access to it is restricted.

08Identifiers and similar technologies

Noma uses the local storage essential to saving the game. Amplitude may also store or read a pseudonymous identifier and session information in device or browser storage. These analytics and Session Replay technologies are only enabled after your consent where required.

Declining or withdrawing consent stops future Amplitude collection without preventing the essential functioning of the game. Withdrawal does not affect processing carried out lawfully before it.

On iOS, accessing your device’s advertising identifier requires your prior authorization through Apple’s App Tracking Transparency framework. You can change this choice at any time in Settings > Privacy & Security > Tracking.

09Advertising and Google AdMob

Noma shows ads within the app through Google AdMob, a service provided by Google. These ads allow the app to be funded for free.

Where required by law, notably in the European Economic Area and the United Kingdom, a consent message shown before ads lets you accept or decline personalized ads and the related tracking. Absent consent, non-personalized ads may still be shown and measured.

You can manage certain advertising settings at adssettings.google.com and review Google’s privacy policy at policies.google.com/privacy.

10Your rights

Depending on the situation and the applicable legal basis, you can request access to your data, its rectification, erasure, restriction of processing, or portability. You can withdraw your consent at any time and object to processing based on legitimate interest.

If you are in France, you can also set directives regarding the fate of your data after your death.

Send your request to noma@timotei.co, specifying the right concerned and, if possible, your device’s Amplitude identifier. Noma may ask for the information strictly necessary to verify your identity.

You will receive a response within one month, except where an extension is permitted due to the complexity or number of requests.

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority) or the supervisory authority competent for your place of residence.

Withdrawing your consent to personalized ads does not prevent non-personalized ads from being shown, as they are necessary to fund the app.

11Minors

Noma does not ask for its users’ age and does not knowingly seek to collect personal data concerning children without the required authorization.

Where parental authorization is required to consent to audience-measurement tools, it must be given by the holder of parental authority.

A parent or legal guardian can request the erasure of a minor’s data by contacting Noma.

12Security

Noma implements technical and organizational measures proportionate to the risks, including limiting access, securing exchanges in transit, and minimizing the data sent.

As no system is entirely invulnerable, absolute security cannot, however, be guaranteed.

13Changes to this policy

This policy may be changed to reflect developments in Noma, its providers, or the applicable regulation. The date shown at the top of the page will then be updated.

If a significant change affects your rights or the purposes of processing, you will be shown suitable notice within the app.