Privacy Policy
This policy explains what information TIMOZ ("we") collects when you play on timoz.app or in the TIMOZ mobile app, why we use it, who we share it with, and the choices you have.
Last updated: October 27, 2026
The short version
- You can play as a guest without giving us your name, phone number or email.
- If you sign in, we use your phone number or email to send you a login code and to keep your account. Other players never see them.
- Your display name, avatar, level, scores and country flag are visible to other players on leaderboards and in rooms.
- We show ads to keep TIMOZ free. Rewarded ads are always optional.
- We do not sell your personal data.
- You can delete your account at any time in the app (Profile, then Delete account) or by emailing [email protected]. See https://timoz.app/account-deletion.
Your account and sign-in
When you first open TIMOZ we create a guest account for you automatically, so you can start playing right away. A guest account has no name, phone number or email attached to it.
If you choose to sign in, you can use one of these:
- Your phone number: we send you a one-time code on WhatsApp.
- Your email address: we send you a one-time code by email.
- Your Google or Apple account: we receive the basic details that service shares for sign-in, such as your email address.
One-time login codes
Login codes are six digits and expire after 5 minutes. A code can be tried only a few times, and we limit how many codes can be requested in an hour.
We never store the code itself, only a scrambled (hashed) version of it. We keep a record of each request (the phone number or email it was sent to, the hashed code, the number of attempts and when it expires) so these limits work.
Your profile and what other players see
Your profile holds the display name you choose, a username if you set one, your avatar (one of ours, or a photo you upload), your language, the country you choose, your interests, and your level, points and coin balance. We also save your settings, such as sound, vibration, notification preferences, games you have muted and daily reminder time.
Some of this is visible to other players. On leaderboards, in rooms, in challenges and on friend lists, other players can see your display name, username, avatar, level, scores and country flag. Registered players can be found by their username. For guests, leaderboards may also show the model of the device you play on (for example "iPhone 15" or "Chrome on Windows"), never your device's personal name.
If you upload a profile photo, it is stored by our storage provider and can be opened by anyone who has its link, like any avatar. Please only upload a photo you are happy for other players to see.
Games and activity
To run the games and save your progress, we store what happens when you play: game sessions, answers and scores, levels and progress, daily streaks, badges, coins earned and spent, and leaderboard positions. We also store the rooms and challenges you create or join, your friends and friend requests, the players you block, and the notifications we show you inside TIMOZ.
Device and country
When the website or the app talks to our servers, we use your IP address at that moment to work out which country you are in, using a country header from our network provider or an offline IP database on our own servers. We save only the two-letter country code. We do not save your IP address to your account.
We also use the IP address of a request to protect TIMOZ from abuse, for example to limit how many login codes can be requested.
We save a short device label: the device model in the mobile app, or the browser and operating system on the website. The mobile app also sends a random install ID that identifies the app installation, which we use to keep guest progress on the right device and to prevent abuse. If you turn on notifications on the website, your browser keeps a random install ID too, used only to keep that browser's notifications going to the right account.
Notifications
We keep a list of your in-app notifications, such as friend requests, room invitations and game results.
If you allow push notifications in the mobile app or on the website, we store a push token from Firebase Cloud Messaging together with the device platform (Android, iOS or web) and app version, and in the app the operating system version, so we can deliver them. The website asks your browser for permission only when you turn on notifications in your profile, never by itself. If you are signed in on more than one device, every device that allowed notifications gets them. Signing out on the website removes that browser's push token. You can turn notifications off in the app, in your profile on the website, or in your device or browser settings at any time.
Analytics and error reports
We record app events on our own servers, such as opening a game, finishing a level or watching a rewarded ad, together with your account ID. This tells us which games people enjoy and where they get stuck.
On the website we use Google Analytics (through Google Firebase). It sets its own cookies and receives page views, the same app events, and error reports with sign-in tokens and phone numbers removed.
In the mobile app we use Firebase Analytics for usage statistics and Firebase Crashlytics for crash reports. The app may also use SmartLinks to measure app events and to open shared links on the right screen.
Advertising
TIMOZ is free to play because we show ads.
- On the website we show display ads from Adsterra, at the sides and bottom of the page and on some result screens. Each banner runs inside its own sandboxed frame.
- The website may also show ads from Google AdSense.
- Some browsing pages show In-Page Push and Vignette ads from Monetag. These formats are not loaded during gameplay or in rooms. Monetag privacy policy: https://monetag.com/privacy/
- In the mobile app we show ads from Google AdMob: rewarded ads, and full-screen ads when you leave the result screen of some solo games.
- Rewarded ads are always optional. You choose to watch one in return for in-game coins, for example to get a hint or to double the coins from a game.
How ad partners use information
Ad networks receive information from your browser or device, such as your IP address, device and browser type, the page you are on, and cookies or advertising IDs. They use it to show and measure ads and to prevent fraud, under their own privacy policies. We do not give ad networks your name, phone number or email.
Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to TIMOZ and/or other sites on the internet.
You can read how Google uses information from sites that use its services here: https://policies.google.com/technologies/partner-sites
Measuring our own ads
When we advertise TIMOZ on Facebook, Instagram or Google, we measure which ads bring new players. On the website these tags load only after you allow advertising cookies. In the European Economic Area, the UK and Switzerland (and when we cannot tell where you are) Meta Pixel is not used at all, and Google Ads loads only after you agree in Google's consent message. Elsewhere they are on by default, like our other ad partners, unless your browser sends a Global Privacy Control signal.
- Meta Pixel (Meta Platforms), outside the EEA, the UK and Switzerland: tells Meta which pages you open, which game pages you view, when you tap an app store badge, when you create an account and when you finish your first game. Meta sets its own cookies and receives your IP address and browser details, under its own privacy policy: https://www.facebook.com/privacy/policy
- Google Ads: records the same sign-ups, first games and app store taps as conversions for our Google campaigns.
- timoz_attr (cookie): when a link from an ad or campaign brings you here, we remember its campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the ad click ID (fbclid, gclid, gbraid or wbraid), from your first and your latest such visit, for 90 days. It is deleted when you withdraw your consent. Without consent we keep the campaign labels only while the page is open and store nothing.
- We send the campaign labels, never the click ID, with the sign-up event to our own servers, and pass them to Google Play when you tap the Google Play badge, so an app install is credited to the same campaign. The Google click ID is passed to Google Play only with your consent.
- We do not give Meta or Google your name, phone number or email.
- You can change or withdraw your choice at any time: "Privacy choices" at the bottom of every page (where consent is required), the options under "Your ad choices", or by deleting cookies in your browser.
Your ad choices
- You can opt out of personalised advertising from Google in Ads Settings: https://www.google.com/settings/ads
- You can opt out of some third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices, and in Europe at https://www.youronlinechoices.eu
- If you are in the European Economic Area, the UK or Switzerland, we ask for your consent through Google's consent message before personalised ads or ad cookies are used. You can change your choice at any time.
- In the mobile app, the same consent message appears where it is required, and you can change your choice later from "Privacy choices" in the app settings.
- On iPhone, the app asks your permission before tracking (App Tracking Transparency). You can change this in your iPhone settings.
- You can also block or delete cookies in your browser and reset your advertising ID in your device settings. You will still see ads, but they will be less personalised.
How we use your information
If you are in the European Economic Area or the UK: we use your information to provide the service you asked for, for our legitimate interests in keeping TIMOZ secure and improving it, and with your consent where the law requires it (for example for personalised ads and ad cookies).
- To run TIMOZ: create your account, sign you in, save your progress, run rooms and challenges, and show leaderboards.
- To keep TIMOZ safe and fair: prevent cheating, spam and abuse, and enforce our terms.
- To improve TIMOZ: understand which games people play and fix bugs and crashes.
- To show ads that keep TIMOZ free, and to give you coins for rewarded ads you choose to watch.
- To send you notifications you have allowed, and to answer you when you contact us.
When the law requires it
We may also share information if the law requires it, or when it is necessary to protect players, the public or TIMOZ from fraud, abuse or harm.
International transfers
Our service providers may store or process information in countries other than yours. We use providers that offer appropriate protection for this information.
How long we keep information
- Account, profile and game data: for as long as your account exists, until it is deleted.
- Guest accounts are kept the same way. We do not currently remove inactive guest accounts automatically.
- Login codes stop working after 5 minutes. The request records described above are kept so request limits work.
- Analytics events: kept to understand how TIMOZ is used. When an account is deleted, its events are no longer linked to anyone.
- Information we must keep by law is kept for as long as the law requires.
Deleting your account
In the TIMOZ app, open your Profile, tap Delete account at the bottom, and confirm. Your account is deleted straight away and you are signed out. This also applies to guest accounts. Step-by-step help: https://timoz.app/account-deletion.
You can also email [email protected] from the email address on your account, or tell us the phone number or email you sign in with. We may ask you to confirm the request from that number or address, and we will delete your account within 30 days.
Deleting your account removes your name, username, photo, country, friends, notifications, devices and push tokens, and your sign-in identity (phone number and email). Your results in games you already played with others stay on their scoreboards as an unnamed "Player", and your username stays blocked so nobody else can take it and pretend to be you. We keep only analytics events that are no longer linked to you, and records we are required to keep by law.
If you play as a guest on the website, you can also clear your browser's cookies and site data for timoz.app. This signs you out of the guest account on that browser.
Children
TIMOZ is a general-audience service and is not directed to children under 13. We do not knowingly collect personal data from children under 13, or under the minimum age in their country.
If you are a parent and believe your child has given us personal data, email [email protected] and we will delete it.
Security
All connections to TIMOZ are encrypted (HTTPS). Login codes are stored only in hashed form, phone numbers and emails are never shown to other players, and access to our systems is limited. No system is perfectly secure, so please keep your phone, email and sign-in codes to yourself.
Your rights
You can change your display name, avatar and country from your profile at any time. You can also ask us to:
- Give you a copy of the personal data we hold about you.
- Correct information that is wrong.
- Delete your account and personal data.
- Stop or limit some uses of your data, or object to them.
- If you are in the European Economic Area or the UK: send your data to you in a portable format, withdraw consent you gave, and complain to your local data protection authority.
Making a request
Email [email protected]. We will answer as soon as we can, and within the time the law requires.
Changes to this policy
We may update this policy when TIMOZ changes. We will change the "last updated" date at the top, and if a change is important we will let you know in the app or on the website.
Contact us
Questions about privacy? Email us at [email protected].