This Privacy Policy explains what personal data CubersDen collects when you use the CubersDen apps for iPhone, Apple Watch and Android and the cubersden.com website, why we process it and on what legal basis, who we share it with, how long we keep it, and what rights you have.
CubersDen is a speedcubing service: a solve timer, statistics, algorithm trainers, lessons, head-to-head battles and an optional community. Some of these features are social and, by design, show certain information to other users. This policy says exactly which. The rules for using the community are in our Terms of Use.
1. Who we are
The controller of your personal data is Oumm Arvind Juneja, a sole trader registered in Poland, NIP 5321913971. For any privacy question, request or complaint, write to support@cubersden.com. You can write in Polish or English.
2. Accounts and how you use CubersDen
- Without an account. The timer, statistics, trainers and lessons work without an account. The apps may create a pseudonymous guest identifier so your data can sync and later be moved to a full account. No email is needed.
- With an account. You can create an account with an email address and password, or sign in with Google, or with Apple on iPhone. Sign-in is handled by Firebase Authentication (Google); we never see or store your password. If you use Google or Apple, we receive your email address and basic profile information from that provider. Sign in with Apple may give us a private relay address instead of your real one.
- One account, every platform. The same account works in the apps and on the website.
3. Information we collect
3.1 Information you give us
- Account data: your email address and the data Firebase needs to sign you in.
- Profile: username, display name, and optionally a bio, a main event and a profile photo from your sign-in provider.
- Cubing data: solve times, penalties, scrambles, puzzle types, timestamps, solve comments, session names, trainer progress and, when you time with a connected smart cube, the moves it recorded with their timing, the cube's model and your inspection time.
- Push notifications: if you allow notifications on your phone, a push token for that device (a random identifier issued by Apple or Google) is stored so we can notify you about replies, mentions and answers; it is deleted when you sign out and after 90 days without use.
- Community content: posts, comments, replies, likes, follows and scrambles you share.
- Reports and blocks: what you report, the reason you choose and any details you add, and the users you block.
- Notices sent through the form at /support/report: the address of the content, your explanation, your name and, if you give it, your email address.
- Age: we ask for your year of birth once and store only the resulting age group (13-15, 16-17 or 18 and over). We never store your birth date.
- Terms acceptance: the version of the Terms you accepted, when, and the language you use for our messages.
3.2 Information created when you use CubersDen
- User identifier: the Firebase user ID that owns your data.
- Battle data: results, opponents, format, and your rating and win/loss record.
- Moderation data: described in section 6.
- Crash reports (apps): crash and performance data from Firebase Crashlytics, tied to an app installation rather than to your identity.
- App analytics: the apps use Google Analytics for Firebase to learn which screens and features are used, so we know what to fix and what to build. It records the screens you open and events such as a solve saved, a smart cube connected, a lesson finished or a post created, with coarse details (the puzzle, the time, the cube brand) and a few coarse properties (your age group, main method, whether you use a smart cube or the community, and how you sign in). It is tied to a random identifier of the app installation, never to your account, name or email, and never to an advertising identifier: the apps do not collect one. It contains no post, comment or other text you write.
- Website analytics and cookies: cubersden.com uses Google Analytics to measure pseudonymous page views and the same kind of events. In the European Economic Area, the United Kingdom and Switzerland its cookies are set only after you press Accept on the cookie bar. Until then, or if you decline, no analytics cookie is stored and we send no events of our own; Google may still receive a signal that a page was loaded, without a cookie or an identifier. You can change your answer at any time with Cookies at the bottom of every page. We use no advertising cookies.
- Zen mode video: when you switch the timer to Zen mode, or press Video inside it, the website plays a rain video from YouTube (Google) through youtube-nocookie.com. Nothing is loaded from YouTube before you do that; YouTube then receives your IP address and browser details and its privacy policy applies to the video. Leaving Zen mode removes the player. Choose Animated for rain drawn on your own device, with no connection to YouTube.
3.3 The camera (cube scanner)
The apps can read your cube’s colours through the camera. This is optional: every screen that uses it also lets you enter the colours by hand. Camera frames are analysed on your device and discarded immediately. No photo or video is saved, and no image ever leaves your device. A finished scan produces only a description of which colour sits where on your cube.
3.4 What we do not do
- We do not track you across other companies’ apps or websites. There is no advertising SDK and no cross-app tracking.
- We do not sell or rent your personal data.
- We do not access your microphone, contacts, photo library or precise location.
4. Why we use your data, and the legal basis
- To provide the Service (timer, sync, accounts, battles, leaderboards, the community, and messages about your account): performance of our contract with you under the Terms of Use, Article 6(1)(b) GDPR.
- To moderate and keep users safe (the word filter, reports, blocks, posting limits, warnings, bans, detecting repeat abuse, and alerting moderators): our legitimate interest, and that of our users, in a service that is safe, especially for the children who use it, Article 6(1)(f) GDPR.
- To meet legal obligations (handling notices under the Digital Services Act, sending statements of reasons, informing authorities of threats to life or safety, answering lawful requests): Article 6(1)(c) GDPR.
- To fix bugs and understand how the apps and the website are used(crash reports and analytics): our legitimate interest in a working, useful service, Article 6(1)(f) GDPR. The analytics cookies on the website rely on your consent, Article 6(1)(a) GDPR, which you can withdraw at any time with Cookies at the bottom of every page.
- To establish or defend legal claims: our legitimate interest, Article 6(1)(f) GDPR.
Accounts of users aged 13 to 15 are provided on the basis of the contract, not of consent. You can object at any time to processing based on our legitimate interest (section 10), including the analytics in the apps, by writing to support@cubersden.com. On the website, Decline on the cookie bar is enough.
5. What other users can see
- Battles: your opponent sees your display name, profile photo if any, your times in that match and your rating.
- Solves are public: every solve you sync (time, scramble, date, platform and, when recorded, the smart-cube moves and the phases we derive from them) can be opened by anyone at its own page, with your display name. If your profile is private, the solve page shows your name without a link and is not indexed.
- Leaderboards are public: display name, rating, win/loss record, best times and solve counts.
- Community: posts, comments, replies, likes, follows and shared scrambles are visible to other users and, where public, to visitors without an account.
- Public profile: if your profile is public, anyone can see your display name, bio, main event, stats and shared activity. Profiles of users aged 13 to 15 start private.
You decide whether to use the community, what to post, and whom to follow or block. Blocking hides a user from you but does not hide your public content from them (see clause 5.8 of the Terms).
6. Moderation data
To enforce the Terms we keep the following moderation records:
- Reports: who reported what, when, the reason code and any details.
- Blocks: the fact that a user was blocked, and how many users blocked them; blocks are flagged to moderators.
- Filter holds: content the word filter held back, and which part of the list it matched.
- Held content (moderation hold): a copy of content that was held, hidden or removed, kept so that a moderator can review it and restore it if the decision was wrong.
- Moderation actions: what was decided (remove, restore, dismiss, warn, ban, automatic hide), about which item and which user, by whom, the Terms clause applied, whether it was automated, and a moderator’s internal note.
- Statements of reasons sent to you, and bans and warnings on your account.
- Notices from the form at /support/report, including the notifier’s name and email address.
Only our moderators (Arvind Juneja and a named backup moderator) can read these records. We never tell a reported user who reported them. Moderators are alerted by email, and that alert carries only an item ID, its type and its priority: never content, names, user IDs or email addresses.
Retention. Moderation records are kept in identifiable form for 6 months from the report or action. After that, user IDs, reporter IDs and other identifiers are replaced with one-way hashes (SHA-256) and content excerpts are deleted; the hashed record is kept so that repeat abuse can be recognised. Reports on content that was left up are deleted after 6 months. Held content is deleted 6 months after the decision, unless the law or an authority requires us to keep it longer, for example material we have reported to the police. A ban record is kept while the ban is in force.
Appeals. Every decision that restricts your content or account comes with a statement of reasons and an action ID. To appeal, reply to that message or write to support@cubersden.com quoting the action ID (section 7 of the Terms).
7. Children
- No accounts under 13. Nobody under 13 can create an account. Children under 13 can use everything that works without an account; their data stays on their device, apart from the crash reports and the pseudonymous app analytics described in section 3.2, which are never linked to a person.
- Accounts created before this rule. Accounts that were recorded as under 13 before this rule have no community, a private profile and invite-only battles. We will ask their holders to convert to use without an account, or to have a parent confirm by email.
- 13 to 15. Profiles start private and personal bests are not posted to the feed automatically.
- Birth year only. We ask for a year of birth, never a date, and store only the age group.
If you are a parent or guardian and believe a child under 13 has given us personal data, write to support@cubersden.com and we will delete it.
8. Service providers and other recipients
We use these providers (processors) to run CubersDen, only for the purposes above:
- Google Firebase (Google Ireland Limited and Google LLC): Authentication, Cloud Firestore, Cloud Functions, hosting and Crashlytics. Your account, cubing, community and moderation data are stored there.
- Google Analytics and Google Analytics for Firebase (Google Ireland Limited and Google LLC): pseudonymous usage measurement in the apps and on the website, never for advertising.
- Resend: sends our transactional email, such as statements of reasons, notice receipts and decisions, and moderator alerts. It receives the recipient’s email address and the message.
- Cloudflare Turnstile (Cloudflare, Inc.): checks that the notice form at /support/report is used by a person and not a bot. It runs on that form only and processes technical data such as your IP address and browser characteristics.
- Apple and Google as sign-in providers and app stores. Apple Watch data is exchanged locally between your paired devices.
We disclose data to authorities when the law requires it, for example to the Police in case of a threat to someone’s life or safety, or to Dyżurnet.pl (NASK) when we report suspected child sexual abuse material.
9. How long we keep data
- Account data: for as long as your account exists.
- Guest data: on your device and in the guest account until you sign up, sign out or delete it.
- After you delete your account: as described in section 10.
- Moderation records and notices: 6 months in identifiable form, then hashed, as described in section 6.
- Analytics (apps and website): 14 months, after which Google Analytics deletes the event data automatically.
- Crash reports: according to the default retention period of Crashlytics.
- Emails with our support team: for as long as needed to handle your matter, and then for the limitation period of any related claims.
10. Your rights, and deleting your data
- Access and correction: you can view your data and edit your profile in the apps and on the website.
- Export: the apps can export your solves as a CSV file from the Statistics screen.
- Deleting your account: in the apps under You → Settings → Delete Account, or as described at cubersden.com/account/delete. Deletion is permanent. Your solves, sessions, posts, comments, follows, shared scrambles, block list, trainer progress and profile are deleted; your identity in battle records is anonymised so your opponents’ history stays intact. Moderation records follow the retention in section 6.
Under the GDPR you have the right to access your data, to rectify it, to have it erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. Write to support@cubersden.com to use any of these rights. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa) or with the supervisory authority where you live.
11. Security
We protect your data with encryption in transit (TLS) and with server-side security rules that limit each user’s data to that user. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
12. Transfers outside the European Economic Area
Some of our providers (Google, Cloudflare, Resend) may process data outside the European Economic Area. Where they do, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission’s standard contractual clauses.
13. Changes to this policy
We will publish any change at cubersden.com/privacy and update the date at the top. If a change is significant, we will also tell you in the app.