Privacy policy
Last updated 7 August 2026 · applies to Ultimate Tic-Tac-Toe
(com.heythemapps.TicTacToe) on Android and iOS.
The short version. The game is free and paid for by ads. The ads are served by Google AdMob, which uses your device's advertising ID and a rough idea of where you are, worked out from your IP address — that is the one part of this app that shares anything with anyone else. The game itself asks for no email, no name, no contacts and no location, and if you play online the only thing stored about you is a random identifier the app generates and the results of your games. Nothing is ever sold.
Who is responsible
bhytechnologies (Heythem Belhaj Youssef). Contact: heythemdev@gmail.com.
What is collected, and when
Playing offline — nothing, by the game itself
Games against the computer and two-player games on one device involve no connection to our server. Your win/loss records and settings are stored on the device only, and are deleted when you uninstall the app.
Ads are the exception, and they are not tied to the mode you play in — the ad SDK runs whenever the app does, offline games included. See Ads below.
Playing online
| What | Why | Kept for |
|---|---|---|
| A random guest identifier generated on your device | So a seat in a game belongs to somebody, and so your online record survives closing the app | Until you delete your account |
| Games you played: the moves, who won, when | Running the match, and showing your record | Until you delete your account, after which they keep only an identifier that no longer refers to anyone |
| A display name, only if you enter one | Showing it to your opponent | Until you delete your account |
| Your IP address, in server logs | Operating the service and preventing abuse | A short period, then discarded |
The guest identifier is created by the app. It is not your advertising ID, your device's serial number, or anything issued by Google or Apple, and it cannot be used to recognise you in any other app.
Ads
The game is free and supported by ads, shown between matches and on the Your record screen, plus an optional one you can choose to watch in exchange for a hint. There are no banner ads anywhere in the app.
Ads are served by Google AdMob (publisher
pub-3140333764215691), which may also fill them from other
advertising networks it works with. Serving an ad involves data we never
see and never store ourselves:
| What | Why | Who gets it |
|---|---|---|
| Your device's advertising ID | Choosing which ad to show, capping how often you see the same one, and detecting fake clicks | Google and the ad networks it fills from |
| Approximate location, worked out from your IP address | Showing ads that are legal and relevant in your country | Google and the ad networks it fills from |
| Whether an ad was shown, watched or tapped, and basic device information such as model and operating system | Measuring and paying for the ad | Google and the ad networks it fills from |
This is the only part of the app that shares anything with a third party. What Google does with it is covered by Google's privacy policy.
Your choices. If you are in the EEA, the UK or Switzerland, the app shows you Google's consent form the first time you open it, and no personalised ad is requested unless you agree. On iOS you are also asked separately, by the system, whether the app may track you; declining is respected. On any device you can reset or delete your advertising ID in the system settings — Android under Settings → Privacy → Ads, iOS under Settings → Privacy & Security → Tracking — and you will still see ads, just untargeted ones.
What is deliberately not collected
- No email address, password or account with any third party.
- No contacts, photos, files, microphone or camera.
- No location from your device's GPS or location permission — the app never asks for one. The only location involved is the rough, country-level guess advertisers make from an IP address.
- No analytics SDK and no crash-reporting SDK. Nothing tracks how you use the app beyond what the ad SDK needs to serve and count an ad.
- No purchases, and no payment details of any kind.
Who it is shared with
Your game data: nobody. Your guest identifier, your display name and your match history are never sold, rented or handed to advertisers, data brokers or analytics companies. They are stored on a server operated by bhytechnologies and hosted at OVH; Cloudflare sits in front of it and handles the encrypted connection.
Ad data: Google, and the advertising networks it fills from. That is the advertising ID, the IP-derived approximate location and the ad interaction data described under Ads — nothing from the game itself. The two sides are not joined up: your guest identifier is never sent to an advertiser, and no advertising ID is ever sent to our server.
Your opponent sees which side you play, whether you are still connected, and a display name if you set one. They are not sent your identifier.
Security
Every connection uses HTTPS or a secure WebSocket. Your guest key is held in the platform keystore — the iOS Keychain or Android's encrypted preferences — and is stored on the server only as a one-way hash, so a copy of the database cannot be used to sign in as you.
Children
This app is intended for people aged 13 and over, and that is the audience declared on Google Play. It is not designed for or directed at children, it is not part of Google Play's Designed for Families programme, and ads served in it are not marked as child-directed. There is no in-app purchase and no free-text chat between players.
We do not knowingly collect anything from a child under 13. If you believe a child has been using the app and want their online account removed, write to the address above and it will be deleted.
Your rights
You can delete your online account at any time, from inside the app under Your record → Delete online account, or by following the instructions on the account deletion page. Deletion removes your account and any games in progress.
If you are in the EU or UK, you also have the right to ask what is held about you, to have it corrected, and to complain to your data protection authority. Write to the address above and you will get an answer within 30 days.
Changes
If this policy changes in a way that affects what is collected, the app's store listing will be updated before that version ships, and the date at the top of this page will change.