Privacy Policy

What we keep, why, and for how long. Plain words, no tricks, no ads.

Effective: October 10, 2026

This policy explains what Time Crush collects when you play, why, how long we keep it, and what you can do about it. We keep it short and in plain words.

1. Who we are

Time Crush (https://timecrush.net) is made and run by Insoola Information Technology Solutions ("we", "us"), a company in the Philippines. We decide how your personal data is used, so we are its "controller" under data protection laws such as the Philippine Data Privacy Act, the EU GDPR and the UK GDPR. Questions or requests: ben@insoola.org.

2. What we collect and why

2.1 Your save

When you first play, our server creates a save with a funny player name we pick for you (you can change it) and your progress: levels, stars, coins, gems, lives, boosters, Helpers, the landmarks you built and the styles you picked. To keep levels fair, the server also gets each level's starting number and your moves, and plays them back. We need all this to run the game for you (legal basis: our contract with you).

Your player name, the number of levels you won and your country's flag appear on the public ranks, so please pick a name that does not reveal who you are.

2.2 The key in your browser

Your browser stores a random key (a long code) that opens your save. Our server keeps only a scrambled (hashed) copy of it. If you clear your browser data without saving with Google, we cannot find your save again, because we don't know who you are.

2.3 IP address and device data

Every time your browser talks to our server, it sends your IP address and basic device data, like the browser type. We use the IP address to limit how fast new saves can be made (to stop spam and abuse) and to find your country, which we use for the ranks, to show prices in your money and to pick your language. We don't store your IP address with your save or in our database. Our host, Cloudflare, processes this data to deliver and protect the site (legal basis: our legitimate interest in running a secure, working game).

To count visits to our pages, we make a daily visitor code from a scrambled mix of your IP address, your browser and a secret that changes. It can't be turned back into your IP address. With it we keep the page you visited, the site or link that sent you, your device type, browser, system, language and country. We keep these visit counts for up to 400 days.

2.4 How the game is played

The game tells our server when a session starts, how long it lasted, which buttons were tapped and any errors that happened (the error message and where in our code it happened). We add up the time you play, per day and in total, next to your save. We use this only to understand and improve the game: which levels are too hard, which screens confuse people, and what breaks. The single events are deleted after 14 days, error reports after 90 days; only daily totals are kept (legal basis: our legitimate interest in improving the game).

2.5 Saving with Google (optional)

Saving with Google is optional. It keeps your save safe when you change or lose your phone. This is exactly what happens with your Google user data:

• What we get: when you tap the Google button, Google sends our server a signed sign-in token. It holds your Google account ID and, because the sign-in uses Google's basic scopes, your email address, your name and your profile picture. We never see your Google password.
• How we use it: we check the token with Google's public keys. We use the account ID to link your save to your Google account and to give you the same save back on another device. We keep your verified email address so we can find your save when you write to us for help, and to know which players saved with Google.
• What we store: a scrambled (hashed) copy of the account ID, and your verified email address, next to your save. We don't store your name or picture: the rest of the token is gone as soon as it is checked.
• Who sees it: only our own small team, inside our admin tools, for support and to keep the game running. We never show it to other players. We don't share, sell, rent or transfer Google user data, we don't use it for ads, and we don't use it to train AI or machine learning models. We will not send you marketing emails.
• Deleting it: write to us and we delete the link and your email, or your whole save (see section 7). You can also remove our access in your Google Account at myaccount.google.com/connections.

Time Crush's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Legal basis: our contract with you. Google's own privacy policy applies to your Google account.

2.6 Purchases

Coins, gems and other paid items are sold through Xsolla, which acts as the merchant of record: Xsolla takes the payment, handles your card or other payment details, and deals with taxes and refunds. We never see or store your payment details.

To open the checkout, we send Xsolla your player ID (a random code), your player name, your country and your language, so it can show the right currency, taxes and payment methods. Xsolla tells us the order number, the item, the price, and whether it was paid or refunded, so we can deliver or take back the item. Xsolla's privacy policy applies to the payment itself. We keep order records as long as tax and accounting laws require (legal basis: our contract with you and our legal obligations).

2.7 What we keep in your browser

The game keeps your key, a copy of your save, moves you made offline that are waiting to be sent, and your settings (sound, music, language) in your browser's storage. A small cookie remembers the language you picked on our pages for one year. The game also stores its own files on your device so it can open and play offline. None of this is used to track you, and we use no advertising or analytics cookies. You can clear all of it in your browser settings.

3. Who we share it with

We share personal data only with the companies that help us run the game, and only what they need:

• Cloudflare hosts the game, its database and our pages, and protects them from attacks.
• Xsolla handles payments (see 2.6).
• Google handles the optional sign-in (see 2.5).

We may also share data when the law requires it, or to protect our players, our game or our rights. We never sell personal data, and we don't use it for advertising.

4. Where your data goes

Our servers run on Cloudflare's global network, so your data may be processed outside your country, including in the United States. When we move personal data out of the EU, the UK or Switzerland, we rely on the safeguards the law provides, such as the European Commission's standard contractual clauses used by our providers.

5. How long we keep it

• Your save and its playtime totals: as long as the game runs, or until you ask us to delete them.
• Single play events: 14 days. Error reports: 90 days. Daily totals: as long as the game runs, with no name attached.
• Visit counts: up to 400 days.
• Your Google link and email: until you ask us to delete them, or your save is deleted.
• Order records: as long as tax and accounting laws require.

6. Children

Time Crush is for players aged 13 and over (16 and over where the law asks for it). We don't knowingly collect personal data from younger children. If you believe a child under 13 is playing, write to us and we will delete their save.

7. Your rights

Depending on where you live, you can ask us to show you the data we have about you, correct it, delete it, give you a copy, or stop or limit using it. You can also object to how we use it. To do any of this, write to ben@insoola.org with your player name, and the email you saved with Google if you used it. We answer within 30 days. We may ask you to prove the save is yours, for example by writing from that email or by showing your game.

If you are not happy with our answer, you can complain to your data protection authority. In the Philippines, that is the National Privacy Commission.

8. Keeping it safe

We protect your data with encrypted connections (HTTPS), scrambled keys, strict limits on who can reach our admin tools, and checks on everything the game sends to our server. No system is perfect, but if something goes wrong that puts your data at risk, we will tell you and the authorities as the law requires.

9. Changes to this policy

If we change this policy, we will post the new version here with a new date, and tell you in the game about important changes.

10. Contact

Insoola Information Technology Solutions, Philippines. Email: ben@insoola.org.