Towerly

Privacy policy

Effective date: 10 October 2026. Applies to Towerly 5.0 for iPhone and Android, and to the challenge and Daily Tower link pages on towerly.web.app.

The short version

You play anonymously. Towerly never asks for your name, email, phone number or contacts.
There is no free text anywhere in the game. Player names are picked from a fixed word list.
The age check keeps only your age band (under 13, or 13 and over). Your birth month and year are not stored or sent.
Players under 13 get a child-safe mode: no analytics, no personalised ads, no tracking prompt.
Players 13 and over choose whether ads may be personalised, and can change that choice in Me → Ad choices.
We do not sell your data.

Who we are

Towerly is published by Bilal Sattar ("we", "us"). We decide how Towerly's data is used. Google's Firebase services process data for us on our instructions.

Bilal Sattar is the data controller for Towerly. We have not appointed a representative in the European Union or the United Kingdom; you can contact us directly using the details under Contact.

What we collect and why

Anonymous player ID

What: A random ID created by Firebase Anonymous Authentication the first time you use an online feature, after the age check. It is not linked to your name, email, phone number or store account.
Why: To run online features: challenges you send and receive, the Daily Tower ranking, and checking the time of day for the Daily Tower. It lets the game make sure each player enters a challenge or a day's ranking only once.

Age band

What: Whether you are under 13, or 13 and over. The age check asks for a birth month and year, works out the band on your phone and then discards them.
Why: To turn on child-safe mode for players under 13 and to choose the right ad settings.

Gameplay results and your player name

What: For a challenge you create: the level, the tower's random seed, your floors and score, and your player name. For a challenge you play: your floors, score and player name. For the Daily Tower: your floors and player name. Player names are picked from fixed word lists, so there is never free text. Your runs are checked on your phone; the taps you make are not sent.
Why: To run challenges between friends and the Daily Tower ranking.

Purchases

What: Which items you bought (Remove Ads, coin packs, the starter bundle) are recorded on your phone once the App Store or Google Play confirms the purchase; they are not stored on our servers. For players 13 and over, an analytics event records which item was bought and its price, without any player ID. Payments are handled entirely by the App Store or Google Play: we never see your card or payment details.
Why: To give you what you bought, restore it from your store account on a new phone, and understand which items players buy.

Crash reports

What: When the app crashes, Firebase Crashlytics sends a crash log: what went wrong in the code, the device model and the operating system version. No player ID, receipt or purchase token is attached.
Why: To find and fix crashes. This applies to every player, including child-safe mode.

Usage analytics (13 and over only)

What: Firebase Analytics events about how the game is used, such as screens opened, levels played and features used. No player ID is set in Analytics and the advertising ID is not collected for Analytics.
Why: To understand which parts of the game work and improve them. Nothing is sent before the age check, and nothing is sent in child-safe mode.

Advertising data

What: Google Mobile Ads (AdMob) receives ad views and taps and an approximate location worked out from your internet address. If you are 13 or over and agree to personalised ads (and, on iPhone, allow tracking), it also uses your device's advertising identifier.
Why: To show ads, limit how often you see the same ad, and prevent ad fraud. Ads keep Towerly free to play. See Ads and your choices.

App settings from our server and app integrity

What: Firebase Remote Config downloads switches that turn features on or off; it uses a Firebase installation ID, a random ID for this install of the app. Firebase App Check asks Apple (App Attest) or Google (Play Integrity) to confirm that requests come from the genuine app.
Why: To switch features off quickly if something goes wrong, and to protect the game and its players from cheating and abuse.

Kept only on your phone

What: Your progress, stars, coins, themes, purchases, season pass, settings, achievements and reminder times are saved on your phone. Reminders are local notifications: there is no push token and no messages from our servers. Share cards are drawn on your phone and leave it only when you choose where to share them.
Why: So the game works offline. Uninstalling the app deletes this data from your phone.

What we never collect

Your name, email address, phone number, postal address, contacts, photos or videos, precise location, health or financial details, browsing or search history, messages, audio, or any text typed by players. Towerly has no chat and no free-text fields.

Players under 13

Towerly is a general-audience game that children also play. When the age check gives the under-13 band, child-safe mode is on:

no analytics events are sent;
ads are child-directed and rated G, never personalised, and the advertising identifier is not used;
the iPhone tracking prompt and the ad consent screen are never shown;
there is no profile and no free text, and other players see only the word-list name and scores;
there are no random matches with strangers, and online features can be switched off for child-safe mode only;
purchases need a grown-up check first, and are handled by the App Store or Google Play.

The anonymous player ID, gameplay results and crash reports are still used, only to run the game's online features, keep them secure and keep the app working.

A parent or guardian can ask us to review or delete their child's data; see Your choices and deleting your data.

For players under 13, the anonymous player ID and crash reports are used only to support the game's internal operations: to run challenges and the Daily Tower, keep them secure and fix crashes. They are never used for advertising, to build a profile or to contact a child, and we do not knowingly collect any other personal information from children. Child-safe mode starts with the most private settings, and a grown-up check stands in front of purchases.

Ads and your choices

13 and over: after the age check Towerly asks whether ads may be personalised. If you say yes, Google's consent message is shown where the law requires it, and on iPhone the system asks whether apps may track you. If you say no, ads are not personalised.
Change your mind any time in Me → Ad choices. The change applies from the next ad.
Under 13: ads are always child-safe and never personalised; there is nothing to choose.
Remove Ads is a one-time purchase that turns off banner ads and ads between games. Rewarded ads still play, but only when you choose to watch one.

You can also reset or limit your advertising ID in your phone's settings. Google explains how it uses data in ads at policies.google.com/technologies/ads.

What other players see

Your word-list player name and the floors or scores of your challenges and Daily Towers. The Daily Tower ranking shows the top 100 players by name and floors. A challenge link carries only a challenge code and the numbers needed to rebuild the tower; the link page shows the challenger's word-list name, floors and level name, and nothing else.

Google Firebase (Authentication, Cloud Firestore, Hosting, Remote Config, App Check, Crashlytics, Analytics) processes data on our behalf to run the game. Firebase privacy information.
Google Mobile Ads (AdMob) receives advertising data as described above and uses it for advertising, including, for players 13 and over who agree, personalised ads.
Apple and Google handle payments, confirm purchases to the app, and confirm app integrity.
We may disclose data if the law requires it.

We do not sell personal data, and we do not share it with data brokers.

Where data is kept and how it is protected

Online data is stored on Google's servers in the us-central1 region (Iowa, United States), which may be outside your country.

When data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States, Google protects it under the Firebase data processing terms, which include the European Commission's Standard Contractual Clauses and the matching UK and Swiss terms.

Data travels encrypted (TLS). Our security rules let each player add only their own results, once each, with fixed fields, and nobody can change or delete a result afterwards. Receipts, purchase tokens and sign-in tokens are never written to logs or crash reports.

How long we keep data

Challenges can be played for 30 days. A challenge, with everyone's results on it, is deleted 90 days after it ends.
Daily Tower entries and rankings are deleted 90 days after the day they belong to.
The server-time check the app uses for the Daily Tower is deleted 90 days after it was last used.
Crash reports are kept by Firebase Crashlytics for 90 days.
Analytics data is kept for 2 months, then deleted by Google Analytics.
Your coins, purchases and progress stay on your phone, not on our servers. Your purchases can always be restored from your App Store or Google Play account.
Your online entries (challenges, challenge results and Daily Tower rankings, held under your anonymous ID) are deleted on the schedule above. We remove expired entries at least once a month, so one may stay up to a month longer.

Your choices and deleting your data

Depending on where you live, you may have the right to access, correct, delete or move your data, and to object to or restrict how it is used. You can also complain to your local data protection authority.

To ask us to delete the data held on our servers, or to make any other privacy request, email bilal.sattar99@gmail.com. Because Towerly never collects your name or email, we cannot look you up by them: tell us your player name and the challenge codes you sent or played, or the dates of the Daily Towers you played, and we will delete the matching entries. A parent or guardian can ask on behalf of a child. We will reply within 30 days. Deleting removes those challenges, results and Daily Tower entries from our servers. Your progress, coins and purchases are kept on your phone, not on our servers, and purchases can always be restored from the App Store or Google Play.

Data kept only on your phone is deleted when you uninstall Towerly.

Changes to this policy

If we change what we collect, we update this page and the effective date above before the change reaches the app. Important changes are also announced in the app.

Contact

Email: bilal.sattar99@gmail.com

Home · Support · towerly.web.app/privacy