Oh My Sum!Privacy Policy
Last updated: 3 October 2026
The short version: Oh My Sum! has no ads, and you can play without an account. If you choose to sign in with Google Play Games, we keep your progress and coins on our server under your Play Games player ID, display name and profile picture, so they follow you to a new phone. You can delete that account in the game at any time. The first time you play, the game asks whether you want to share gameplay stats. Only if you say yes does it send us gameplay stats tagged with a random ID. The ID isn't your name or your Google account, and we never link the stats to your account. We never ask for your email or location, and we don't sell or share your data with anyone.
Who we are
Oh My Sum! is made by Leonardo Seccia, a sole trader trading as AlrightMyLover, based in the United Kingdom ("we", "us"). We are the data controller for the data described here.
Questions about privacy, or requests about your data: dpo@ohmysum.games.
What we collect
1. Gameplay stats (only if you say yes)
The first time you play, the game asks "Share gameplay stats?" with two buttons, Share stats and No thanks. Stats are off until you tap Share stats: before that, nothing is sent and no ID is made. You can change your answer any time with the "Share gameplay stats" switch in the game's Settings.
If you say yes, to see which levels are too hard or too easy, the game sends us:
- A random ID. The game makes this up when you say yes. It isn't tied to your device's hardware IDs, your advertising ID, your Google account or your name. Turning stats off deletes it, and turning them on again makes a new one. Reinstalling the game also starts afresh.
- Game events, for example: a level started, won, lost or left part-way, the digits of each hit and the paths that missed the target, the score and stars, moves or time used, running out of lives, coins earned and spent, coin packs bought, power-ups and hints used, stickers collected, settings changed and how long a session lasted. If something goes wrong in the game, also an error report: the error message, the script file and line in the game's code where it happened, and the app version. Like everything in this list, error reports are only sent if you said yes to stats.
- Basic app details: the app version, the platform (for example Android) and the version of the game's rules.
- Your country, worked out from your connection by our hosting provider when the stats arrive. We never store your IP address.
We use this only to improve the game (balancing levels, finding bugs, understanding which features people use). It isn't used for advertising and isn't combined with data from anywhere else.
How to turn it off: tap No thanks when the game asks, or later open Settings in the game and switch off "Share gameplay stats". The game stops collecting stats straight away, throws away any it hasn't sent yet, and deletes the random ID from your phone.
Your IP address
When the game connects to our servers, they see your IP address, as any internet service does. We use it only for a moment, to work out your country for stats and to stop too many requests from one place. We don't store it.
2. Your account (only if you sign in)
Signing in is optional. The game plays fully as a guest. If you sign in with Google Play Games, we keep:
- Your Play Games player ID, display name and profile picture link, which Google gives us when you sign in. We use them to find your account and to show your name in the game.
- Your saved game: levels cleared, stars and scores, coins, lives, power-ups, stickers and daily missions, plus when it was last saved. Your settings stay on your phone.
- Your coin history: each time you earn or spend coins, the amount, what it was for (for example "level" or "hint") and when. This keeps your balance right across phones and stops cheating.
- A sign-in key for each phone you're signed in on. We only store a scrambled (hashed) copy of it, which can't be turned back into the key.
Your account uses its own player ID. It is never sent with the gameplay stats, so those stats can't be linked to your name.
How to stop: in the game, open Settings → Manage. Sign out stops syncing on that phone. Delete my account deletes everything listed above from our server, and the records of your purchases (section 3). The one thing we keep is a scrambled (one-way hashed) copy of your Play Games player ID, which can't be turned back into the ID, only so the one-off 50-coin sign-in bonus isn't paid again if you sign in later. Your phone keeps its progress and carries on as a guest.
Google's handling of your Play Games profile is covered by the Google Privacy Policy.
3. Purchases
If you buy coins, the payment is handled entirely by Google Play. We never see your card or bank details, your name or your email address. To make sure a purchase is genuine before we give you the coins, the game sends our server the purchase token Google gives it and a random purchase-check ID, and our server checks the token with Google. This ID is made on your phone the first time a purchase is checked. It is not the stats ID and is never sent with stats, so it's used even if you said no to stats; it's used to stop abuse (rate limiting) and is kept with the purchase record below. For each genuine purchase our server keeps a record: a scrambled (hashed) copy of the token, the purchase-check ID, which pack it was and when, and, if you're signed in, which account got the coins. That stops one purchase being counted twice or on several accounts, and lets us take the coins back from an account if Google refunds the purchase. If you're signed in, we also add the coins to your account's coin history.
Google's own handling of your purchase is covered by the Google Privacy Policy.
4. Data that stays on your device
Your progress, coins, lives, stickers and settings are saved on your phone. If you play as a guest, we can't see them. If you sign in, a copy of your progress (not your settings) is also kept in your account, as described above. If your phone backs up app data to your Google account, that backup is handled by Google.
If you allow notifications, the game's reminders (your daily gift, full hearts, a nudge after a few days away) are scheduled on your phone itself. No server sends them. If you share gameplay stats, they include whether you allowed notifications and which reminder you tapped, and nothing else about them. Switch reminders off any time in the game's Settings or in your phone's settings.
Report a problem. The "Report a problem" button in the game's Settings opens an email to us in your own email app, with the app version, your phone model, its Android version, the level on screen and the game's recent error messages already filled in. Nothing is sent unless you send that email, and you can edit it first.
What we don't collect
No email, phone number, contacts, photos, precise location, advertising ID or device hardware IDs. We only have your name if you sign in, and then only the display name you chose for Google Play Games. We don't read your Play Games friends list. The game has no ads and no third-party advertising or tracking SDKs.
Legal basis
Under UK GDPR, we collect gameplay stats only with your consent: the game asks first, and nothing is collected unless you say yes. You can withdraw it any time by switching stats off in Settings. We check coin grants, limit how often the game can call our servers, keep hashed sign-in keys, purchase records and the hashed IDs that stop the sign-in bonus being paid twice because we have a legitimate interest in stopping cheating and abuse. We answer your emails because we have a legitimate interest in helping you. We process purchase checks, and your account data if you sign in, because they are needed to provide what you asked for (performance of a contract): delivering what you bought, and keeping your progress and coins in your account.
Who handles the data
| Who | What for |
|---|---|
| Cloudflare, Inc. | Hosts the servers that receive gameplay stats, check purchases and keep accounts, and stores the stats and account data on our behalf (as our processor). |
| Google (Google Play) | Takes payments and confirms purchases are genuine. Google acts under its own privacy policy. |
| Google (Google Play Games) | Signs you in, if you choose to, and tells us your Play Games player ID, display name and profile picture. Google acts under its own privacy policy. |
Cloudflare may process data outside the UK, including in the United States. Where that happens it is covered by appropriate safeguards such as the UK International Data Transfer Addendum and Cloudflare's certification under the UK Extension to the EU-US Data Privacy Framework.
We don't sell your data, and we don't share it with anyone else unless the law requires us to. We don't make automated decisions that significantly affect you.
Keeping it safe
The game talks to our servers only over encrypted connections (HTTPS). Sign-in keys and purchase tokens are stored only as one-way hashes. Only we can access the data, through our hosting provider's access-controlled tools.
How long we keep it
- Gameplay stats are deleted automatically after about 3 months. We may keep totals and averages (for example "how many players finished level 20") for longer; those can't be linked to any install.
- Purchase records (the hashed token, purchase-check ID, pack and time) are deleted after 30 days for a purchase made without signing in, and after about 13 months (400 days) for one credited to an account, because refunds can come months later. Deleting your account deletes them straight away.
- Account data (your Play Games details, saved game and coin history) is kept until you delete your account. An account, its cloud save and coin history are also deleted after 12 months without being used. Either way, it is deleted from our server straight away, and from our hosting provider's backups within 30 days. Only the hashed Play Games player ID that stops the sign-in bonus being paid twice is kept.
- A sign-in on a phone expires after 180 days without being used, and its hashed sign-in key is deleted.
- Emails you send us (including ones from Report a problem) are kept for as long as we need them to help you, and then deleted.
Your rights
Under UK data protection law you have the right to access, correct or delete your data, to object to or restrict how we use it, and to data portability. If you have an account, you can delete it yourself in the game (Settings → Manage → Delete my account). The gameplay stats hold only a random ID and not your name, so we may not be able to tell which of those records are yours; see Delete your data for how requests work.
To use any of these rights, email dpo@ohmysum.games.
If you're unhappy with how we've handled your data, email dpo@ohmysum.games with the subject "Privacy complaint". We'll confirm we've received it within 30 days and tell you what we've done about it as soon as we can. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Children
Oh My Sum! is made for players aged 13 and over and isn't directed at children under 13. We don't knowingly collect personal information from children. If you think a child under 13 has sent us personal information (for example in an email), contact us and we'll delete it.
This website
This website uses Google Analytics to count visits and see how people find and use the site, but only if you say yes. When you first visit, we ask. If you tap Accept, Google Analytics sets cookies (names starting with _ga, kept for up to 2 years) and sends Google details such as the pages you visit, roughly where you are (country or city), your device and browser type, and the site that sent you here. We use it only to understand visits to this site, never for advertising, and we have turned off Google's ad features and data sharing. If you tap No thanks, no analytics runs and no cookies are set. Your choice is remembered in your browser. Change it any time with Cookie settings, also at the bottom of every page.
Our legal basis for website analytics is your consent. Google may process this data outside the UK, including in the United States, under the UK Extension to the EU-US Data Privacy Framework; see the Google Privacy Policy and how Google uses data from sites that use its services. Google Analytics keeps this data for 14 months.
The website also loads its font from Google Fonts, so your browser connects to Google to fetch it.
Changes
If we change this policy we'll update the date at the top of this page. If the change is significant, for example if we start collecting something new, we'll also tell you in the game.