EN

Privacy and data

Privacy Policy

This page explains what data is processed when you use 26. The app and this website are covered in their own sections, followed by information that applies to both.

1. Data controller

26 is developed and operated by the person below, who is responsible for the processing described on this page.

Legal name
Jérôme Marquis
Country
Suisse
Contact email
contact@twenty-six.app

2. In short

What 26 does — and does not do — with your data:

  • your data is never sold, and nothing is shared with third parties beyond what is described on this page;
  • an account with your email address is required to play, so your progress is saved and synchronized;
  • the app sends anonymous technical statistics and diagnostic data through JMHub to measure use, diagnose failures, and improve the app; they are not linked to your account, email address, or nickname and are not used for advertising or cross-app tracking;
  • the iOS app only shows limited ads without cross-app tracking; on Android, personalized ads are shown only with your consent;
  • this website uses a developer-operated Matomo instance to measure visits; the selected language is part of the page address.

3. The 26 app

This part describes the data processed when you use the mobile app.

3.1 Your account

Playing 26 requires an account. When you register and play, the server stores:

  • your email address (used to sign in, confirm your account, and reset your password) and your password, which is stored only in hashed form;
  • if you continue with Apple or Google, the provider name, its account-specific identifier, and verified email address; 26 never receives your Apple or Google password;
  • your profile: nickname, date of birth, chosen canton, language, time zone, avatar, and your notification and leaderboard preferences;
  • your progress: completed levels, scores, edelweiss, achievements, streaks, and daily challenge results;
  • your social activity: friend requests, friendships, blocks, and user reports. A report stores the reporting account, reported account, nickname captured at the time, reason, optional comment, date, and review status.

Your nickname, avatar, and results are visible to your friends and on the leaderboards. You can hide yourself from the global leaderboard at any time in your profile.

3.2 Diagnostic data

To produce aggregate technical statistics, diagnose crashes and errors, and improve the app’s stability, performance, and user experience, 26 sends the following anonymous technical data to the developer-operated JMHub service. They are associated only with a random installation identifier generated by the app, not with an advertising identifier or a 26 account:

  • the random anonymous installation identifier, installation and update events, app version, and build number;
  • platform, device model, operating-system version, device language and region, and time zone;
  • UTC timestamps, generated session identifiers, and app lifecycle events (started, foregrounded, backgrounded, or closed), which make it possible to measure session duration;
  • exception type and message, stack trace, and occurrence time, together with the technical app and device data above.

JMHub does not receive your 26 account identifier, email address, or nickname for these statistics. 26 does not use them for advertising, does not share them with AdMob, and does not use JMHub to track you across apps or websites.

Feedback is processed separately from anonymous technical statistics. If you voluntarily send feedback, JMHub receives the type, title, and message you enter, together with app and device technical data. A contact email address is included only if you choose to provide one and is used only to reply; the feedback is not associated with your 26 account or nickname.

3.3 Advertising

On iOS, the app only requests limited ads from Google AdMob (Google LLC). This mode disables ad personalization and features that require a local identifier; the iOS app does not display an advertising-consent form and does not track you across other companies' apps or websites. On Android, the app refreshes privacy information through Google UMP before any AdMob request and shows the form when Google requires it.

On Android, adult users can review or change their advertising privacy choices in the app settings. Refusing personalization does not remove ads: Google may serve non-personalized or limited ads. Minor users always receive limited ads. More information: policies.google.com/privacy.

If you buy the ad-free option, payment is handled by the App Store or Google Play. 26 never receives your payment-card details. The server stores the product, store transaction identifiers, sandbox or production environment, purchase and verification dates, revocation state, and protected verification material needed to validate and restore the purchase.

3.4 Push notifications

Notifications are optional. If you enable them, a device token is registered through Firebase Cloud Messaging (Google) so the server can send you the categories you selected. You can disable notifications at any time in the app or in your device settings.

4. This website

This website uses Matomo, an analytics service operated by the developer, to measure visits and improve the site. Matomo receives the visited page, referrer, technical browser and device information, and the visitor’s IP address through an encrypted connection.

The selected language is part of the address of the page you visit. Matomo uses first-party analytics cookies; the site sets no advertising cookies.

5. Hosting and third parties

Google provides Google sign-in, Firebase Cloud Messaging, AdMob, and Google Play. Apple provides Sign in with Apple and the App Store. Anonymous technical statistics and optional feedback are sent to JMHub, which is operated directly by the developer on privately managed infrastructure in Switzerland. No third-party hosting, logging, or backup provider processes JMHub data. The provider and region shown below concern the website and API, not JMHub.

Infrastructure provider
Infomaniak Network SA
Main processing country or region
Suisse

International transfers

26's own infrastructure and current transactional-email relay are operated in Switzerland by Infomaniak. Depending on the features you use, data is also sent to Google services and Apple services. For users in Switzerland, Google identifies Google Ireland Limited in Ireland as controller for its consumer services. Google operates worldwide infrastructure, and Firebase Cloud Messaging may process data wherever Google or its subprocessors maintain facilities. Apple identifies Apple Distribution International Limited in Ireland as controller for people in Switzerland and states that data may be processed by Apple Inc. in the United States and other affiliates worldwide.

Ireland is recognized by Switzerland as providing adequate data protection. For transfers to the United States or another country without an adequate level of protection, the providers state that they rely, as applicable, on the Swiss-U.S. Data Privacy Framework and/or Standard Contractual Clauses adapted to Swiss law. The providers' current documentation is available below.

6. Retention and deletion

Account data is kept while the account exists and is deleted through the in-app deletion flow. The API removes synchronization events and completed notifications after 90 days, completed email jobs after 30 days, inactive push installations after 180 days, expired authentication history after 90 days, and hourly activity aggregates after 400 days. Technical diagnostics, crash reports, usage sessions, and feedback stored in JMHub are kept for no more than 12 months and are then deleted. Security and operational logs are kept only for as long as needed to investigate incidents and protect the service.

7. Your rights

Under the Swiss Federal Act on Data Protection (and the GDPR where it applies), you can request access to, correction of, or deletion of your data, receive a copy of it, and object to certain processing. Write to the address below; you may also contact the Federal Data Protection and Information Commissioner (FDPIC).

8. Children

An account can be created from age 13. Users under 18 always receive limited ads and cannot enable personalized advertising.

9. Security

All communication between the app, this website, and the server is encrypted (TLS). Passwords are stored only as hashes, access to the servers is restricted, and 26 deliberately keeps only the minimum data it needs.

10. Changes and contact

This policy may be updated when the app or legal requirements change. The date above identifies the current version. Questions and privacy requests can be sent to:

Privacy and legal contact

contact@twenty-six.app