TUSSLE Privacy and Data Deletion

Effective Date: July 21, 2026 · TUSSLE Build 7

The short version: TUSSLE asks before using online play. It has no social login and does not ask for your legal name, email address, or phone number. Online competition uses a pseudonymous TUSSLE identity and hosted gameplay service. Raw competitive transcripts expire within 30 days. You can delete your hosted identity and linked records from inside the App. TUSSLE has no advertising or third-party analytics SDK and does not track you across other companies’ apps or websites.

Your Choice: Online or Offline

On first launch, TUSSLE asks you to choose before it accesses or sends online-play data. Allow Online Play enables Live Battle, Recorded Rivals, weekly standings, Daily Tussle, direct challenges, and limited private iCloud settings sync. Play Offline keeps Practice Bot and Nearby Party available without contacting the TUSSLE gameplay service or private iCloud settings sync.

You can switch off online play later from Privacy & Online Play. This cancels matchmaking, stops future online gameplay reads and writes, and removes downloaded foreign Recorded Rivals from the device. Previously stored hosted data remains until it expires or you use the deletion control described below.

Hosted Information

TUSSLE does not request your legal name, email address, phone number, contacts, photos, precise location, Apple ID, Google account, Samsung account, or advertising identifier. If you allow online play, the hosted service processes:

Pseudonymous identity: a random installation identifier and independent random bearer credential are created by the App. The server stores one-way HMAC/SHA-256 digests rather than those raw values, plus a random server player ID and noneditable tag such as PLAYER8K2M4Q7Z.
Game role: Team Men or Team Women and the current weekly team lock. This is an unverified honor-system game role. TUSSLE does not ask for, infer, or verify gender identity.
Competitive gameplay: match/run IDs, week and set coordinates, team, question identifiers and order, selected option or timeout, server timing, correctness, score, outcome, opponent pseudonymous player ID, and server timestamps.
Daily and challenge gameplay: one-attempt Daily claims/results, opaque challenge IDs, sender and challenger transcripts, results, and expiry timestamps.
Short-lived security state: a hashed reconnect proof while needed for a live match, idempotency records for safe retries, and bounded rate-limit state keyed by one-way token digests.

This information is used only for authentication, strict Men-versus-Women matchmaking, authoritative scoring, Recorded Rival playback, standings, retries, abuse prevention, support, and data deletion. Other players can see the noneditable tag, team, score, rank, and recorded performance when the selected feature requires them. TUSSLE does not sell this data or use it for advertising.

Network information

Internet providers and Render necessarily process source, destination, and other network metadata, including an IP address, to deliver requests and secure the service. Render processes this provider-level metadata under its Data Processing Addendum. TUSSLE does not use it to infer a player’s location.

Under the current Render Hobby workspace plan, developer-visible application and deploy logs are available for up to seven days. Routine HTTP and WebSocket connection logging is disabled by the Build 7 release configuration. Earlier production testing occurred before that logging fix, so those earlier connection-log entries may contain a source IP address and port; they age out within the same seven-day window.

TUSSLE uses bounded runtime warning and error events only for App Functionality and security. These events must omit request bodies, trivia answers, public player tags, bearer credentials, reconnect secrets, and, after the logging fix, routine client IP addresses.

Live Battle, Recorded Rivals, and Challenge Links

Live Battle means two opposite-team players are connected to the hosted service at the same time. Only accepted, server-finalized simultaneous Live Battle results affect the weekly Team Men/Team Women totals. Daily Tussle has separate standings; Direct Challenge, Nearby Party, Recorded Rival, and Practice Bot results do not affect weekly totals. A Recorded Rival — Not Live is a validated prior performance that can be downloaded and cached for offline replay. A Practice Bot is computer-controlled. TUSSLE does not relabel a replay or bot as live.

A public challenge URL contains only a random opaque challenge ID. Anyone who receives the link can try to open the corresponding challenge until it expires. The GitHub Pages handoff receives that opaque ID in the requested URL and converts it locally into a `tussle://` App link; it has no analytics script. GitHub and any app used to share the link process the request under their own privacy terms.

Public CloudKit and Private iCloud

Build 7 makes no reads from or writes to Apple’s public CloudKit database for gameplay. Hosted online competition uses the TUSSLE service instead. Legacy public CloudKit records created by prerelease or TestFlight builds are separate; request their removal through Email Support.

If you allow online play, private iCloud key-value storage may sync a small set of your own settings, such as team choice and weekly score, between devices signed into your Apple ID. This is separate from hosted competitive gameplay. The developer does not receive your Apple ID. Apple controls propagation and backup behavior. An authenticated in-App deletion requests removal of gameplay/settings keys.

Nearby Party and On-Device Data

Nearby Party uses Apple’s local peer-to-peer networking and asks for local-network access only when you enter that mode. It uses a generated noneditable PLAYER ### alias rather than your device name or contacts. Nearby devices exchange aliases, Team Men/Team Women choices, questions, answers, and scores for that session. Party data is not uploaded to the hosted TUSSLE gameplay service.

The App stores settings, privacy choice, team, recent personal runs, statistics, Daily/challenge retry state, sound preference, and the raw hosted bearer locally. The bearer is kept in Keychain or corresponding protected storage. Downloaded Recorded Rivals are bounded and expire no later than 30 days. Deleting the App removes local data subject to operating-system backups, but does not by itself authenticate a request to delete hosted data.

Retention

Queue, ready, presence, and heartbeat state is short-lived and cleared when a match closes or a stale session is removed.
Raw live, Recorded Rival, Daily, and challenge transcripts stop being available by 30 days and are deleted by the hourly retention job. Direct challenge links stop working no later than 30 days after creation.
Idempotency response records expire within 48 hours. The reconnect-proof hash is cleared at a terminal match transition.
Developer-visible Render application and deploy logs remain available for up to seven days under the current Hobby workspace plan. Earlier production test connection logs that may contain a source IP address and port age out within that window.
Player-linked standings are available only for the current competition and bounded dispute/replay window. Their underlying raw runs expire by 30 days and are deleted by the hourly retention job. TUSSLE may retain irreversible Men/Women team totals after removing player identifiers, and only when the minimum cohort rule is met.
The pseudonymous player identity, credential digest, and current team history remain until authenticated deletion or 24 months of inactivity.
Render continually backs up the paid PostgreSQL database for point-in-time recovery. Under the current Render Hobby workspace plan, the recovery window covers the past three days. A record deleted from the live database can therefore remain recoverable within that window. Point-in-time recovery is used only for disaster recovery, and the recovery data ages out as the rolling window advances.
If you voluntarily email support, the email address and message stay outside the gameplay database and are normally deleted within 30 days after the request closes unless law requires longer.

Delete Your TUSSLE Data

With the App: Open Privacy & Online Play and choose Delete My Hosted TUSSLE Data. TUSSLE authenticates the current guest credential, cancels active online presence, deletes the hosted pseudonymous identity and player-linked weekly, Daily, and challenge records, and deletes or unlinks player-linked Live records as applicable. It then clears local gameplay data after the server confirms deletion. The App also requests removal of private iCloud gameplay/settings keys. Apple controls when that private change reaches other devices.

For 48 hours, the service retains a retry tombstone containing only a one-way bearer digest, request UUID, fixed deletion outcome, and created and expiry timestamps. It contains no player ID, exists only so a lost deletion response can be retried safely, and then expires. Irreversible team aggregates that no longer identify a player can remain.

Without the App or original device: Email joedeangelis533@gmail.com. Include any noneditable PLAYER tag, challenge link, approximate play date, platform, and team you still know. A public tag or link alone does not prove ownership, so we may need additional non-governmental proof or may be unable to safely identify the record. We will explain the limitation rather than risk deleting another player’s data.

Legacy public CloudKit: Build 7 does not access it, but prerelease/TestFlight records require the separate Email Support request above because the hosted deletion credential does not control Apple’s legacy public records.

Advertising, Analytics, Purchases, and Tracking

TUSSLE has no third-party advertising or analytics SDK, does not request the advertising identifier, and does not track you across other companies’ apps or websites. If an App Store or Play purchase is offered in a future version, the store provider processes payment details; the developer does not receive your payment-card or financial-account number.

Service Providers, Security, and Children

Render hosts the TUSSLE API, paid PostgreSQL database, TLS/WebSocket transport, developer-visible application/deploy logs, and the current Hobby plan’s three-day point-in-time recovery data. GitHub hosts the public support, policy, and challenge-handoff pages. Apple may provide private iCloud key-value sync. These providers process data under their own terms, including Render’s Data Processing Addendum, and the developer’s configuration. No service can guarantee absolute security.

TUSSLE is a general-audience trivia game and is not directed to children under 13. We do not knowingly request a child’s legal identity or collect personal information from children for advertising.

Changes and Contact

We will update this policy before materially changing the data, purpose, retention, providers, advertising, analytics, or tracking behavior. The effective date identifies the current version.

Questions, privacy requests, and deletion requests: joedeangelis533@gmail.com