Light Tricks Privacy Policy
Last updated: 24 October 2026
Light Tricks (com.lighttricks.game) is a single-player puzzle game published by TurSal Studios. For privacy, support or deletion requests, contact DevSalehAlanazi@gmail.com.
This policy describes the Android game and its online services. There are no advertisements or social features. From version 1.14.0, a Google account is optional for cloud saves; playing as a guest remains available without providing a name or email. Earlier releases do not gain accounts remotely. Apple sign-in and an iOS release are not available yet.
1. Information on your device
The game saves progress, settings, coins and purchased solution routes in its private device storage. It also caches public configuration, remembers dismissed announcement revisions and stores your seasonal menu-theme choice. It keeps purchase tokens in local recovery records while purchases are retried; older recovery snapshots may remain until replaced or local app data is removed. Receipt hashes prevent duplicate delivery. Tokens are sent only to the purchase verifier, never to gameplay Analytics.
Progress and settings are saved locally for offline play. From version 1.14.0, a private anonymous Firebase identity also maintains a server-authoritative guest wallet, purchased routes and supported progress/settings. Verified guest balances and routes are combined once when linking or restoring an account. Without sign-in, losing that installation identity can prevent restoring its anonymous wallet. Your operating system's backup or transfer features may handle app data according to your device settings; do not uninstall or clear storage as a purchase-recovery method.
Older releases recorded grants but spent coins locally. Their historical unspent balance cannot be independently reconstructed. A new build provides a one-time compatibility import bounded by recorded verified purchase grants, recording the allocation between remaining coins and owned routes. Unverified legacy/bonus coins remain separate on the device; they are not minted into a cloud wallet.
From version 1.16.0, verified cached coins can unlock guides offline without preparation. Pending spending events and routes are saved locally and reconciled automatically when connected, using unique event identifiers and a random installation identifier tied to the Firebase identity. These are not hardware identifiers and are not sent to gameplay Analytics. Server records prevent duplicate charges, record synchronization-conflict forgiveness and help detect repeated abuse. Guide ownership is account-wide; the installation identifier is used for reconciliation and diagnostics. Conflicts do not create debt or deductions from later top-ups. Deleting app storage before synchronization can lose local-only events. Versions 1.15.0–1.15.1 used optional reserved coins; updating returns existing reservations automatically when connected.
Optional account and cloud saves (version 1.14.0 and later)
If you choose Continue with Google, Google's native sign-in screen authenticates you with Firebase Authentication. Firebase processes and may cache the provider identity, account identifier and profile information supplied by Google, which can include your name, email and profile picture. From version 1.14.2, Settings and the account controls display that name, email and picture so you can identify your signed-in account. The picture is downloaded directly from Google's HTTPS portrait service and held in memory; the game does not add this profile information to its own save files, photo cache, cloud-save requests, purchase reports or gameplay Analytics. Firebase Authentication's own profile/session storage is separate. TurSal uses the Firebase user identifier to maintain the cloud save and verify ownership. Passwords and Google sign-in tokens are not logged or stored in our game records.
Linked accounts save supported puzzle progress, settings, account coin balances and purchased solution routes on Firebase. New purchases before and after sign-in credit server-authoritative wallets. When restoring an existing account, both Firebase identities are authenticated and verified server-side, and a transaction combines the genuine remaining balances and unions purchased routes/progress. It records the source-to-destination association and makes the old guest wallet inert, preventing repeat credits or access to the destination through an old guest token. Anonymous source authentication remains on the device until transfer succeeds. Unverified legacy residue stays local. Synchronization requires a connection; from version 1.16.0, cached verified coins and downloaded routes can be used offline. Google and future Apple identities will not be merged merely because their emails look alike.
From version 1.14.4, downloaded progress, purchased routes, residual local coins and preferences are stored in separate local profiles for each Firebase identity. Signing out opens a separate guest profile; another account cannot inherit the previous account's downloaded data. Signing back into the same account restores its own cached profile. Genuine guest-to-account transfers still require server verification. A first offline installation uses a separate device guest until its first anonymous identity is available. When upgrading an older shared save, the game restores validated cached server data to its exact owner and preserves ambiguous extra local data in a private recovery archive rather than assigning it to a different account. This archive is not uploaded automatically and is removed when app storage is cleared.
From version 1.17.1, the device also retains a separate copy of its guest puzzle progress and preferences before sign-in. Signing out resumes that guest game when available. This copy excludes transferred coins, account identity information, purchase records and authoritative wallet ownership. From version 1.17.2, it can retain a separate local list of solution routes already unlocked by that proven original guest, for free replay after sign-out on this device. This replay list cannot create coins, import purchased ownership into another wallet or include routes added only while signed in. Transferred coins and account-owned routes remain with that account. Account-only progress is not copied into the guest checkpoint. Exact guest history from older versions cannot always be reconstructed; missing or ambiguous provenance is not treated as proof of a guest's routes.
From the account controls in Settings you can sign out or request cloud-account deletion after recent sign-in verification. Deletion removes cloud progress/settings, the account wallet, identity-associated purchase reports and the Firebase Auth user. From version 1.14.4 it also retires that account's ordinary downloaded profile; unrelated local profiles remain separate. Limited de-identified receipt and deletion records remain to prevent duplicate grants and complete deletion safely. Older backup or ambiguous recovery data can remain locally until replaced or app storage is removed. You can also request deletion by email using section 6; do not send passwords or tokens.
From version 1.17.1, deletion asks whether to keep the game on the current device first, or erase the account's game data. If you choose to keep it, an authenticated server transaction transfers verified remaining coins, purchased guides, progress and settings into a new anonymous Firebase identity, then removes the old account and its provider link. Limited transfer, receipt and deletion records prevent duplicate credits and support interrupted-operation recovery. The phone retains random operation and identity identifiers while this transfer completes; sign-in credentials remain inside Firebase's native session storage. Other changes and new purchases are paused during the transfer. Unverified local purchase residue must recover before transfer can start. The resulting guest save has no Google sign-in recovery until you explicitly link an account again; uninstalling or clearing app storage can make it inaccessible. Choosing erase does not make this transfer.
2. Essential online services and purchases
The game downloads public settings, update rules, announcements, optional seasonal menu colours, localized links and free puzzle packs over HTTPS from TurSal's Google Cloud/Firebase services. The public configuration request identifies the game and carries ordinary connection information, which can include an IP address and technical request details in operational service logs. It does not send your purchase token, purchase identity or puzzle progress. These settings are available independently of gameplay statistics; cached settings and bundled content support offline play. Missing translations fall back to English. Versions up to 1.11.0 use GitHub for update information and puzzle files; those older links remain available during migration. A randomly assigned legacy rollout choice stays on your device.
From version 1.17.2, an accepted required-update rule is also saved in a separate device record containing the game/platform store identity, minimum build, policy revision and public message. It is independent of your account, wallet and puzzle progress. A known requirement remains active offline, after failed requests, clock changes, sign-out and restart; cloud-account deletion does not reset this device rule. Installing a build that meets the minimum, or receiving a newer accepted rule that lowers or removes the requirement, permits play. First-ever offline startup does not invent a required update. Optional update offers still require fresh online information. This local policy record is not sent to gameplay Analytics as an account identifier.
Purchase services can initialize when the app starts, independently of gameplay statistics. Firebase Authentication creates a persistent anonymous installation identity for guests. Firebase App Check and Google Play Integrity process installation, app/device-integrity and network information to protect the service. This background identity does not require registration. Choosing optional Google sign-in links or restores a Firebase account as described above; it is never started automatically. If you contact support with an order number, we may associate that correspondence with the relevant purchase record.
If you buy Tollman coins, Google Play handles payment. TurSal does not receive card or bank details. The game supplies Google Play with a hash derived from the anonymous purchase identity to bind purchases to the correct installation identity; this is separate from Analytics. Our Firebase verifier receives the anonymous identity, product and purchase token, checks them with Google Play, and retains the token hash, order ID when supplied, quantity, delivery/consumption status and transaction timestamps. Related security, quota and error records help prevent duplicate delivery, abuse and purchase loss. Raw purchase tokens are not written to our application logs.
In version 1.14.0 and later, guest-wallet services synchronize supported progress/settings and purchased routes under the anonymous Firebase identity, independently of Analytics. Sign-in enables account restoration and authenticated guest-wallet merging as described above. Older guest purchase verification did not upload progress/settings. Existing unverified local coins and purchased routes remain usable offline once initial wallet migration is complete. New purchases require Google Play and working verification services.
Versions before 1.13.11 included studio solution-guide access codes. That feature is removed and both server programs are disabled. Historical grant/attempt records may remain for security; cached old-version grants follow their original expiry. They are not coins or purchases.
The purchase-report service records the owned-floor/product snapshot, app version and platform under a random installation hash bound to its Firebase identity. Reporting identities change when the authenticated identity changes. These records help investigate delivery independently of Analytics and never grant coins or routes.
3. Gameplay statistics
From version 1.13.0, gameplay statistics are collected automatically using Google Analytics for Firebase. There is no statistics switch in Settings. This replaces the optional switch in versions 1.10–1.12, including for existing installations; the old saved preference is retired. Earlier versions retain their original setting and behavior. The current game sends:
• Current floor and chapter, attempts, moves, active play time, completion, restarts, hints and navigation.
• Solution-demonstration use, replays, skips and completion. These are game demonstrations, not recordings of your screen.
• Purchase-flow results, product, coin quantity, recovery category and the floor where buying began when known; coin delivery and spending.
• Chosen look, language, soundtrack, rounded music/effects volumes, graphics and accessibility/play settings.
Firebase also creates an Analytics app-instance identifier and processes app, device, session and network information. It can derive approximate location from network information. We do not request precise location. The SDK may report Play purchase information when its purchase reporting is available.
We send no explicit Analytics user ID and do not join its identifier to the separate purchase-verification identity in this version. Custom events contain no purchase tokens, receipt hashes, names, emails or payment-card information. Advertising-ID collection and advertising consent categories are disabled. Statistics help improve puzzles and check game, guide and shop flows; we do not use them for targeted advertising.
Statistics collection begins when the supported Android game starts. Offline events may be queued by the SDK and sent when connected. The game does not record screenshots, audio, video, keystrokes outside the game or files on your device. Contact us using the details below for privacy or deletion requests. Platform restrictions and service availability can limit collection.
4. Providers and disclosures
Google Play processes purchases. Google/Firebase provides public configuration, content and legal-page hosting, authentication, app integrity checks, verification-record hosting and Analytics. GitHub hosts legacy update and puzzle files for older versions. These services process information needed for their functions under their applicable terms and privacy notices:
• Firebase privacy information
• Google Analytics privacy information
We do not sell personal information or build advertising profiles. Information may also be disclosed where necessary to comply with law, protect people and the service, or resolve a purchase dispute. When you contact us, your email provider and ours process the support correspondence you send.
5. Security, locations and retention
App-service traffic uses HTTPS/TLS. Server permissions and Firebase rules restrict access to verification records. No system can promise absolute security. Verification records are hosted in Google Cloud's US region us-central1; Google and GitHub may process service data in other countries.
Local data remains until removed or replaced on the device. Purchase/security records are retained as needed to verify transactions, prevent fraud and duplicate delivery, handle disputes and meet legal obligations. Analytics records follow the service's configured retention controls; aggregated reporting may remain longer. We assess deletion requests against these purposes. Uninstalling does not delete all server records. On older versions, turning statistics off does not erase records already received.
6. Your choices and deletion requests
You can change sound, vibration and other play settings in the game. Versions 1.10–1.12 also have a statistics switch; version 1.13.0 and later collect statistics automatically as explained above. Android's app-storage controls remove local data, subject to your backup settings and the loss of local purchases explained above.
To request access, correction or deletion of information held by TurSal, email DevSalehAlanazi@gmail.com with the subject “Light Tricks privacy request”. Describe the request and include the app version. For a purchase issue, the order number from Google Play can help locate the record. Do not send passwords, payment-card details or purchase tokens. You do not need to reinstall the game to contact us.
We may need enough information to locate and verify the relevant record. An email alone does not identify anonymous gameplay statistics. We will explain what can be located or deleted and any records retained for security, fraud prevention or legal reasons. Applicable rights depend on where you live. You can also use Google's own privacy and purchase controls.
7. Audience, permissions and updates
Light Tricks is intended for teens and adults aged 13 and above. Its content rating is shown separately on Google Play. It is not directed to children under 13. Contact us if you believe a child has supplied personal information.
The game uses internet access for the services above and optional vibration. It does not request precise-location, contacts, photos, camera or microphone access. There is no screen recording, advertising SDK or crash reporter.
We update this policy when practices change and show the revision date here. Material changes that require a new choice will be presented appropriately.