Privacy policy
Last updated 7 August 2026 · applies to Ultimate Tic-Tac-Toe
(com.heythemapps.TicTacToe) on Android and iOS.
The short version. Play on your own or against the computer and the app never contacts a server — nothing leaves your phone. Play online and the only thing stored about you is a random identifier the app generates and the results of your games. No email, no name, no contacts, no location, no advertising identifier, and nothing is ever sold or shared.
Who is responsible
bhytechnologies (Heythem Belhaj Youssef). Contact: heythemdev@gmail.com.
What is collected, and when
Playing offline — nothing
Games against the computer and two-player games on one device involve no network connection. Your win/loss records and settings are stored on the device only, and are deleted when you uninstall the app.
Playing online
| What | Why | Kept for |
|---|---|---|
| A random guest identifier generated on your device | So a seat in a game belongs to somebody, and so your online record survives closing the app | Until you delete your account |
| Games you played: the moves, who won, when | Running the match, and showing your record | Until you delete your account, after which they keep only an identifier that no longer refers to anyone |
| A display name, only if you enter one | Showing it to your opponent | Until you delete your account |
| Your IP address, in server logs | Operating the service and preventing abuse | A short period, then discarded |
The guest identifier is created by the app. It is not your advertising ID, your device's serial number, or anything issued by Google or Apple, and it cannot be used to recognise you in any other app.
What is deliberately not collected
- No email address, password or account with any third party.
- No contacts, photos, files, microphone or camera.
- No location, of any precision.
- No advertising or analytics identifiers.
- No advertising SDK, no analytics SDK and no crash-reporting SDK.
Who it is shared with
Nobody. Your data is not sold, rented, or shared with advertisers, data brokers or analytics companies. It is stored on a server operated by bhytechnologies and hosted at OVH; Cloudflare sits in front of it and handles the encrypted connection.
Your opponent sees which side you play, whether you are still connected, and a display name if you set one. They are not sent your identifier.
Security
Every connection uses HTTPS or a secure WebSocket. Your guest key is held in the platform keystore — the iOS Keychain or Android's encrypted preferences — and is stored on the server only as a one-way hash, so a copy of the database cannot be used to sign in as you.
Children
The game is suitable for all ages and collects no personal information from anyone, children included. There is no advertising, no in-app purchase, and no free-text chat between players.
Your rights
You can delete your online account at any time, from inside the app under Your record → Delete online account, or by following the instructions on the account deletion page. Deletion removes your account and any games in progress.
If you are in the EU or UK, you also have the right to ask what is held about you, to have it corrected, and to complain to your data protection authority. Write to the address above and you will get an answer within 30 days.
Changes
If this policy changes in a way that affects what is collected, the app's store listing will be updated before that version ships, and the date at the top of this page will change.