Skip to content
Twistly home

Legal

Privacy Policy

Last updated 21 October 2026

This policy explains what information the Twistly mobile game (“Twistly”, “the game”) and this website use, why, who receives it, and the choices you have. Twistly is made by Madarász Márk (“we”, “us”).

At a glance

  • Twistly needs no e-mail address, phone number or password. When you open it, it creates an anonymous game account with Unity Gaming Services.
  • Your buddy's name is your public player name. Other players can see it, your buddy's look and, if you race them, your rating — in friends lists, on the leaderboard and in 1v1 races.
  • The game shows ads through Unity LevelPlay and Unity Ads. Ads are personalised only if you give your consent; you can refuse it without losing any part of the game, and withdraw it at any time in the game's settings.
  • Purchases go through the App Store or Google Play. We never see your payment details.
  • Settings → RESET PROGRESS deletes your game data from inside the game, but in the current version it is not a complete deletion of your account and data. See Delete your data for exactly what it removes, and how to ask us to delete the rest.
  • This website sets no cookies and uses no analytics or trackers.

Who we are

The controller of your personal information is:

Madarász Márk
Individual developer
Hungary
support@twistlygame.com

For anything about privacy, write to that address.

What the game uses, and why

Your game account

Within a couple of seconds of starting, the game signs in to Unity Gaming Services anonymously. This creates a random player ID and the access tokens that keep you signed in. We use it to run the online parts of the game — friends, the leaderboard and 1v1 races — and to keep your online data together. Sign-in happens every time the game starts, whether or not you use the online features.

Your player name and your buddy

Your buddy's name becomes your public player name, shortened to letters and digits (at most 20) and followed by a number, for example Pip#4821. Until you name your buddy it has a random name. Names are checked by a word filter; a name that fails is not used, and other players' names that fail are shown as “Player”. Your buddy's look (colour, hat, face and extra) and name are shared with other players with your presence, in races and on the leaderboard.

Friends and online status

Friends, friend requests (sent by player name or player ID), blocks and 1v1 challenges run on Unity's Friends service. While the game is open on screen, it tells the service every 60 seconds that you are online, with your buddy's look and the time, and that you are offline when you leave. Your friends can see whether you are online or when you were last seen. A challenge carries a private table code, your name and your buddy's look.

1v1 races

To find you an opponent, the game sends Unity's matchmaker only the version of its game content. Once matched, you and your opponent share a session (Unity Lobby) that carries your player ID, your buddy card (name and look), your rating and the content version. During the race the two phones exchange, through Unity Relay, how far each side has got: moves, creatures fed, progress and finishing time. Each side's final standing is also written into the session, which carries the whole race if the Relay channel fails. Your opponent sees your player name, look and rating. If the connection drops, the game checks whether your phone is still online by contacting Unity's Lobby service. Races against the bot are played on your phone alone.

The leaderboard and your rating

Only races against people are rated. When such a race starts and when it ends, the game reports it to a rating script on Unity Cloud Code, with the match, your opponent's player ID, the outcome, your buddy card (name and look) and your country (a two-letter code). Your rating is then written to the game's leaderboard with your buddy card and country, by the script or, while the script is not available, by the game itself. Every player can see the leaderboard, with your player name, buddy, rank and rating, worldwide, among friends and for your country. A report that cannot be sent at once stays on your phone, with your player ID, the match and your opponent's player ID, for at most two days while the game tries again.

Your country

For the “your country” leaderboard the game works out your country without asking for your location: on Android from your SIM card, then your mobile network, then your phone's language and region settings; on iPhone from the Region setting. It is never your precise location. Your country is sent with your rating, and it is published as a public player record that other players can read once you have played a rated race against a person (or open the country leaderboard while you are on it).

Cloud save

The game contains a cloud save that can link your progress to an Apple or Google Play Games account. It is switched off in the current version, so your progress stays on your phone. We will update this policy before it is switched on.

Diagnostics

To help with problems, the game keeps a technical log of its own messages on your phone: signing in, friends and challenges, 1v1 matches and the leaderboard, including other players' names and ratings and session and table codes. It holds the latest 400 lines and writes them to a file in the game's storage, keeping the previous launch's file as well; the same messages appear in your phone's system log, which only developer tools can read. The game never sends the log anywhere: after a failed match it offers to copy it, so that you can send it to us if you want to. RESET PROGRESS does not clear it; uninstalling the game does.

The game engine, Unity, may also send crash and error reports to Unity, with technical information such as an installation ID and your device's model and operating system, so that faults can be found and fixed. Unity processes them on our behalf and keeps them for 90 days.

Support e-mails and player reports

If you e-mail us, we use your address and message to answer you. If you report another player's name in the game, the game blocks that player for you. If you also send us the report by e-mail, you see the e-mail before it goes, and it contains the reported name, the reported player's ID, where you saw the name, your own player ID and the game version.

Ads and your choice

The game shows ads through Unity LevelPlay (formerly ironSource), which can serve ads from Unity Ads. Rewarded videos are always your choice: you can watch one to double the coins from a level or a race against the bot, to get free coins in the shop, a booster you have run out of, or your buddy's energy back. A full-screen ad may play when you leave a finished campaign level — at most once every ten levels, never during the first five levels or in races, and never once you have bought anything with real money.

Ads are personalised only after you have given your consent. The game asks for it before it shows personalised ads; you can refuse without losing any part of the game, and withdraw or change your choice at any time in the game's settings. Your choice is passed to the ad network: as your consent, or refusal, for personalised ads, and as your choice about the “sale” or “sharing” of personal information under US state privacy laws. If you refuse, you may still see ads, but they are not personalised. We also tell the ad network that the game is not directed at children.

According to Unity's own disclosures, its ad services collect device and advertising identifiers, your IP address and the approximate location it suggests, information about your device, and how you interact with ads. They use it to show and measure ads, to prevent fraud and, if you agreed, to personalise ads. On iPhone, Twistly does not ask for permission to track you, so your device's advertising identifier (IDFA) is not available to ad partners. On Android, you can reset or delete your advertising ID in your phone's settings. Unity's handling of this data is described in the Unity Game Player and App User Privacy Policy (opens in a new tab).

Purchases

Coin packs are sold through the Apple App Store or Google Play, which handle the payment. We never receive your card or bank details. The game receives what it needs to deliver your coins — the product, a transaction ID and the store's receipt — and keeps a fingerprint of each transaction on your phone so a purchase is never paid twice. It also remembers that you have bought something, so that it stops showing full-screen ads.

The purchasing component the game uses (Unity IAP) sends Unity what it needs to deliver and check purchases: your game player ID, an installation ID and a session ID, your country, your device model, operating system and language, the app version and install time, on iPhone the vendor identifier (IDFV), and for each purchase the product, price, currency, transaction ID and receipt. It does not include advertising identifiers. Reports about your sessions that serve only sales and performance statistics are sent only with your consent. Unity processes this data on our behalf, and also uses transaction and billing data for its own purposes — payment reconciliation, financial reporting, legal compliance and fraud prevention — as an independent controller.

What stays on your phone

The game keeps on your phone: your progress (including a half-played level), coins, boosters, buddy, daily rewards and missions, today's reward videos, your friends, blocked players and the players you have raced (their player ID, name and rating), your rating, unsent race reports, purchase records, the codes you have redeemed, the country it last published for your player ID, your settings (sound, vibration and your privacy answer) and the diagnostics log. RESET PROGRESS clears your progress (see Delete your data for what stays); uninstalling the game removes the rest. On Android, if backup is turned on for your Google account, Android may keep a copy of the game's data in your backup and restore it when you reinstall.

This website

twistlygame.com is a static website. It sets no cookies, has no analytics, advertising or social media trackers, and loads no fonts or scripts from other companies. It is hosted by Cloudflare, which processes technical information such as your IP address, browser type and the pages you request in order to deliver the site and protect it from abuse (see the Cloudflare Privacy Policy (opens in a new tab)). The playable level on the home page runs entirely in your browser and sends nothing anywhere.

Where the EU General Data Protection Regulation (GDPR) applies, these are the legal bases we rely on, under its Art. 6(1):

  • Providing the game — your game account, player name and buddy, friends and online status, 1v1 races, the leaderboard with your country, delivering and restoring your purchases, and answering your support e-mails: performing our contract with you (Art. 6(1)(b)), for what providing the game you use needs.
  • Keeping the game fair, safe and working — checking race results, filtering player names, blocking and player reports, protecting the online services against fraud and abuse, and crash and error reports: our legitimate interests in fair races, secure services and a game that works (Art. 6(1)(f)). We use only the data this needs, and you can object to it (see Your choices and rights).
  • Personalised ads, and the purchasing component's session statistics: your consent (Art. 6(1)(a)). Where storing or reading information on your device for these needs consent, it happens only after you have given it. You can withdraw your consent at any time in the game's settings, without affecting what was done before.
  • Purchase records, and the purchase data the purchasing component sends to Unity, needed to deliver, restore and check your purchases: performing our contract (Art. 6(1)(b)); where a law requires us to keep such records, our legal obligation (Art. 6(1)(c)).
  • Answering requests about your data (access, deletion and the other rights below): our legal obligation under the GDPR (Art. 6(1)(c)).

Who receives it

  • Unity Technologies, in two roles, under its data processing addendum (opens in a new tab):
    • on our behalf, as our processor, for the game's online services (Authentication with player names, Friends, Leaderboards, Cloud Save, Cloud Code, Matchmaker, Lobby, Relay, and the QoS and Wire services these build on), the engine's crash and error reports, and the purchasing component;
    • for its own purposes, as an independent controller, for its ad services (Unity Ads and LevelPlay) and for the transaction and billing data it uses itself, as its Game Player and App User Privacy Policy (opens in a new tab) describes.
  • Apple and Google, for downloads, purchases and the services on your phone, under their own privacy policies (Apple (opens in a new tab), Google (opens in a new tab)).
  • Cloudflare, which hosts this website: it processes visitors' technical data on our behalf to deliver the site, and for its own purposes, such as security and running its network, as an independent controller (privacy policy (opens in a new tab)).
  • Other players, who see your public player name, buddy, online status, rating and country as described above.
  • Authorities, only where the law requires it.

We do not sell your personal information for money. Under some US state laws, letting ad partners use data to personalise ads counts as “selling” or “sharing” it; refusing personalised ads in the game, or withdrawing your consent in its settings, opts you out.

These companies may process data outside the European Economic Area, including in the United States. Where they do, they may rely on the lawful transfer mechanisms set out in their data protection terms, such as an adequacy decision of the European Commission or Standard Contractual Clauses, where applicable. See Unity's privacy policy (opens in a new tab) and data processing addendum (opens in a new tab), Cloudflare's privacy policy (opens in a new tab) and data processing addendum (opens in a new tab), and the privacy policies of Apple (opens in a new tab) and Google (opens in a new tab).

How long it is kept

  • Your game account and the online data linked to it: as long as your account is active or the data is needed to provide the game, or until you ask us to delete it. RESET PROGRESS deletes your Cloud Save data and your game account; in the current version your leaderboard entry, friends, online status, public country and player name records stay until you ask us to delete them (see Delete your data).
  • Data on your phone: your progress until you reset the game; the settings and records the reset leaves (listed on Delete your data) until you uninstall it.
  • Unsent race reports on your phone: at most two days.
  • Support e-mails: up to 12 months after your request is closed, unless we need to keep one longer for security or legal reasons, or because of a dispute.
  • Crash and error reports, and the purchasing component's service logs, at Unity: 90 days, according to Unity's documentation (diagnostics (opens in a new tab), purchasing (opens in a new tab)).
  • Anything else Unity, Apple, Google and Cloudflare keep, Unity's other service logs included: as their privacy policies and data processing terms describe.

Your choices and rights

  • Give, refuse or withdraw your consent to personalised ads: in the game's settings.
  • Delete your data: Settings → RESET PROGRESS (not yet a complete deletion), or ask us — see Delete your data.
  • Block or report other players from their player card.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, to withdraw consent at any time, and to complain to a data protection authority: where you live or work, or in Hungary, where we are based, the National Authority for Data Protection and Freedom of Information (NAIH) (opens in a new tab). US residents may have the right to know, delete and correct their information and to opt out of its “sale” or “sharing”. To use any of these rights, write to support@twistlygame.com. Because accounts are anonymous, please include your player name (the Friends screen shows it as “Your handle is …”) so we can find your data. We reply without undue delay and within one month, as the GDPR requires; for complex requests it allows two more months, and we would tell you why.

Children

The game is not specifically directed at children. We do not knowingly collect personal information from children without the consent their country requires. If you believe a child has given us personal information that way, for example in a support e-mail or through the game's online features, contact us and we will delete it.

Security

The game talks to Unity's online services over encrypted connections (HTTPS). It does not write access tokens, player IDs or your country to its logs, and other players' names are filtered before they are shown. No system is perfectly secure, but we work to protect your information.

Changes and contact

If we change this policy, we will update the “Last updated” date at the top and, for important changes, tell you in the game or on this website. Questions or requests: support@twistlygame.com.