Plain English.
The short version. Hueful doesn't require an account, doesn't ask for your name or email, and doesn't sell your data. Your streak and palette live on your device. A few things do leave the app: limited ads (Google AdMob), anonymous usage events (PostHog), install and ad-campaign measurement (Google Analytics for Firebase), subscription status if you upgrade (RevenueCat), anonymous crash and performance data, and (if you opt in) leaderboards via Apple Game Center on iOS or Google Play Games on Android. We walk through each below.
What this covers. The Hueful iOS and Android apps and the website at hueful.app. All are made by J&B Creations LLC.
What stays on your device
The app keeps the following locally, in the operating system's standard app sandbox (iOS) or app-private storage (Android):
- Your streak and your daily results (target color, your guess, ΔE score)
- Your growing palette (the colors you've completed)
- App settings (notification time, sound on/off, haptics, theme preference)
- Hueful Plus entitlement (whether you've subscribed)
None of this is transmitted to us. If you delete the app, this data is removed by the operating system.
What leaves your device
Seven things, each with a specific purpose:
- Remote configuration. Hueful's daily puzzles are generated on your device. No puzzle data is sent to or fetched from a server. The app does periodically fetch a small configuration file (ad settings, feature flags) from our Cloudflare Worker at
hueful-worker.joel-a24.workers.dev. As with any web request, Cloudflare may process standard connection metadata (IP address, user-agent) and retains server logs for approximately 7 days for abuse prevention and then discards them. - Subscription status (only if you subscribe). If you purchase Hueful Plus, the App Store (iOS) or Google Play (Android) processes the transaction. We use RevenueCat to verify your purchase and unlock Plus features across reinstalls and devices. RevenueCat receives the App Store or Google Play receipt and an anonymous app-instance identifier. They do not receive your name, email, or payment method. See Subscriptions below.
- Anonymous usage events. The app sends gameplay and screen events (such as "completed today's puzzle," "viewed palette," app version, device class) to PostHog and to our own Cloudflare Worker so we can understand engagement and improve the app. Events are keyed to a randomly-generated app-instance identifier, not your name, email, Apple ID, or Google account. See Usage data below.
- Ad requests via Google AdMob. On the free tier, the AdMob SDK requests ads from Google's ad servers. This connection may include your advertising identifier (Apple's IDFA on iOS or the Android Advertising ID on Android) if you consented; if you declined, ads are non-personalized. See Advertising below.
- Install & campaign measurement. The app sends an install (first-open) signal and basic device and usage events to Google Analytics for Firebase so we can measure how many people install Hueful and which ad campaign brought them. Keyed to a Firebase app-instance identifier; your advertising identifier is included only if you consented. See Install & ad measurement below.
- Diagnostics. Anonymous crash reports and performance metrics may be sent so we can fix what's breaking. No personal information is included. See Diagnostics below.
- Leaderboards (optional). If you opt in, Apple Game Center (iOS) or Google Play Games (Android) sends our app a persistent player identifier so leaderboards can recognize you across sessions and devices. See Leaderboards below.
Cloud sync (future)
Future versions of Hueful may offer optional cloud sync so your streak and palette move with you across devices. If we ship this, it will be opt-in, the sync uses your platform's private cloud container (your private iCloud container on iOS; the equivalent on Android), we never see the contents, and this section will be updated before that feature is released.
Subscriptions & payments
Hueful Plus is a subscription processed by Apple via the App Store (iOS) or by Google via Google Play (Android). The store handles payment, billing, and refunds per its own policies. We use RevenueCat as our subscription management layer so your entitlement follows you across reinstalls and devices.
What RevenueCat receives: the App Store or Google Play receipt, your purchase status (active / lapsed / refunded), and a randomly-generated app-instance identifier. They do not receive your name, email, Apple ID, Google account, or payment method. RevenueCat's role is purely to validate the receipt with the store and tell our app whether to unlock Plus. Their privacy policy covers their practices.
Usage data
To understand engagement and improve the daily puzzle, the app sends gameplay and screen events to two destinations: PostHog and our own Cloudflare Worker at hueful-worker.joel-a24.workers.dev. Typical events: "completed today's puzzle," your ΔE bucket (close / very close / perfect), the app version, screen visits, and the device class (e.g. iPhone 15, Pixel 8). Each event is keyed to a randomly-generated app-instance identifier that lives on your device and is not linked to your name, email, Apple ID, or Google account.
PostHog is hosted in the United States. PostHog's role is bounded to analytics; it is not used to track you across other companies' apps or websites, and it does not power ad personalization. Their privacy policy covers their practices. The Cloudflare Worker keeps its own event logs for approximately 7 days (the same standard retention as the rest of Cloudflare's request logs) and discards them after.
You can turn analytics off entirely in the app under Settings → Privacy → Analytics. See Your choices below.
Advertising
On the free tier Hueful shows limited ads (one interstitial per day and an optional rewarded video you choose to watch). Ads are provided by Google AdMob, a third-party advertising network. To show ads, AdMob may access your device's advertising identifier (Apple's IDFA on iOS, the Android Advertising ID on Android) and limited usage data. Their ads privacy notice covers their practices.
On iOS, when you first open the app Apple's App Tracking Transparency prompt asks whether Hueful may track you across other companies' apps and websites. On Android, where required (for example in the EEA and UK), a Google-provided consent form asks the equivalent. If you decline, you'll still see ads, but they will be non-personalized: AdMob will not use your advertising identifier to tailor them. You can change this anytime in iOS Settings → Privacy & Security → Tracking, or on Android in Settings → Privacy → Ads (where you can also delete or reset your advertising ID). Hueful Plus removes ads entirely.
Install & ad measurement
To measure how many people install Hueful and which marketing campaign brought them — so we can run our advertising efficiently — the app uses Google Analytics for Firebase. It records a Firebase-generated app-instance identifier, the first-open (install) event, basic device and usage information, and approximate location derived from your IP address. This information is processed by Google. If you allow tracking — Apple's App Tracking Transparency prompt on iOS, or where required a Google consent form on Android — your device's advertising identifier may also be used to attribute your install to one of our Google Ads campaigns. Hueful plays exactly the same whether you allow tracking or not. We use the Firebase Analytics SDK only (no Crashlytics or other Firebase products). See Google's Privacy Policy and how Firebase uses data.
Diagnostics
To find and fix crashes and slow paths, the app may send anonymous crash reports and performance metrics. These contain stack traces, app version, OS version, and device class. They do not include your name, email, Apple ID, Google account, location, contacts, or any content from your device.
Your choices
- Ad personalization. Decline Apple's App Tracking Transparency prompt (iOS) or Google's consent form (Android) and ads become non-personalized. Change at any time in iOS Settings → Privacy & Security → Tracking, or Android Settings → Privacy → Ads.
- Analytics. Turn off product analytics in the app under Settings → Privacy → Analytics. No usage events leave the device while this is off.
- Ads. Subscribe to Hueful Plus and ads are removed entirely. The AdMob SDK still ships in the binary but is not invoked.
- Diagnostics. Anonymous by design; you can also disable Apple's system-wide "Share with App Developers" in iOS Settings → Privacy & Security → Analytics & Improvements, or Android's "Usage & diagnostics" in Settings → Google → Usage & diagnostics.
Leaderboards
Hueful supports optional leaderboards and friend comparisons through Apple Game Center on iOS and Google Play Games on Android. When you opt in (by signing in on your device, or by tapping a leaderboard prompt inside Hueful), the platform sends our app a persistent player identifier scoped to this developer. We use it to associate your scores with your account so leaderboards can show your nickname where you've placed.
What the platform shares with us:
- Your player identifier (a persistent ID, scoped to J&B Creations LLC, not your Apple ID or Google account)
- Your gamer nickname (whatever you've set in Game Center or Play Games; this is the name that appears on leaderboards)
- The scores you submit to leaderboards
What the platform does not share with us: your real name, your Apple ID / Google account email, your payment information, your contacts, or your gaming activity in other apps.
Leaderboards are optional. If you decline the sign-in or turn it off (iOS Settings → Game Center, or in the Google Play Games app), everything else in Hueful still works. You just won't appear on leaderboards. The platforms' own practices are governed by Apple's Privacy Policy and Google's Privacy Policy.
What we don't do
We don't sell your data. We don't ask for your name, email, or contacts. The Hueful iOS and Android apps use the third-party SDKs disclosed above (AdMob, PostHog, RevenueCat, Google Analytics for Firebase) and nothing else: no Facebook SDK, no Firebase Crashlytics, no Amplitude, no Mixpanel, no behavioral retargeting beyond AdMob's ad personalization (which you control via the ATT prompt on iOS or the consent form on Android).
The website at hueful.app uses Cloudflare's standard request logging (server side, retained ~7 days) for security and performance, plus PostHog for product analytics: anonymous pageviews and click events that help us understand which pages people read before downloading. PostHog is first-party, US-hosted, and sets a cookie that lasts up to one year. No Meta Pixel, no Google Analytics, no behavioral ad retargeting. Most ad blockers and Do Not Track / Global Privacy Control signals already block it.
Share tiles
When you tap Share at the end of a daily session, the app generates a 1080×1080 image on your device using only your local result data and hands it to the operating system's native share sheet. We don't see what you shared or who you shared it with.
Sub-processors
These are the services we rely on. We share only what's strictly needed for each one to do its job.
| Provider | Purpose | What they see |
|---|---|---|
| Cloudflare | Remote-config Worker (hueful-worker.joel-a24.workers.dev), anonymous gameplay events, website hosting (Pages) |
Standard HTTP request metadata (IP, user-agent); anonymous app-instance identifier + play events; 7-day log retention |
| Google AdMob | Serving in-app advertisements on the free tier | Advertising identifier (IDFA on iOS / Android Advertising ID, only if you consented), usage data, ad-request metadata |
| PostHog | Product analytics (in-app usage events and hueful.app pageviews) | Randomly-generated app-instance identifier, gameplay/screen events, app + device class; US-hosted |
| Google Analytics for Firebase | Install & ad-campaign conversion measurement | Firebase app-instance identifier, first-open/install + in-app events, device class, app usage, coarse location (from IP); advertising identifier only if you consented (ATT on iOS / consent form on Android); processed by Google |
| RevenueCat | Subscription management for Hueful Plus (receipt validation, entitlement sync across devices) | App Store or Google Play receipt, purchase status, anonymous app-instance identifier. No name, email, or payment method |
| Apple (iOS) | App distribution, subscription billing, push notifications, cloud sync (future), Game Center (optional leaderboards) | Apple's standard App Store / iCloud data, never shared with us in identifiable form. Game Center: persistent player identifier + nickname when you opt in |
| Google (Android) | App distribution (Google Play), subscription billing (Google Play Billing), Play Games (optional leaderboards) | Google's standard Google Play data, never shared with us in identifiable form. Play Games: persistent player identifier + nickname when you opt in |
Notifications
If you opt in to daily reminder notifications, your device (iOS or Android) handles delivery locally. Notification scheduling happens on-device. We don't send push notifications from our servers.
Data retention & deletion
We don't store personally identifiable information on our servers: no name, no email, no account. The anonymous app-instance identifier used for analytics and subscription validation isn't tied to your Apple ID, your Google account, your name, or anything else that points back at you, so there is no per-user record to delete from our side. To reset that identifier, delete and reinstall the app, which generates a fresh one. To remove the local copy of your streak and palette, delete the Hueful app from your device; the operating system will clear the sandbox along with it.
Retention windows. Cloudflare's standard request logs (config-fetch traffic) expire within 7 days. PostHog retains event data for up to 7 years by default; if you want your analytics data purged sooner, email us at support@hueful.app with your app-instance identifier (you can find it in Settings → Privacy → Diagnostics) and we'll forward the deletion request. RevenueCat retains subscription records for the life of your account plus an audit window; same email-us-to-purge flow.
Leaderboard scores and entries live on Apple's (Game Center) or Google's (Play Games) servers, not ours. To remove an entry, use the platform's own controls: iOS Settings → Game Center, or the Google Play Games app, where you can reset or sign out. We can't delete that data on the platform's behalf. That's between you and Apple or Google.
Children's privacy
Hueful is rated 4+ on the App Store and Everyone on Google Play, and contains no content unsuitable for children. We do not knowingly collect personally identifiable information from anyone, regardless of age. The anonymous identifier and gameplay events described above are not tied to a name, email, Apple ID, Google account, or any other identifier that would let us figure out who's playing.
If a child uses leaderboards, the platform's child-account protections govern what information flows to Hueful: on iOS, Apple's Family Sharing, Ask to Buy, Screen Time, and Game Center age handling; on Android, Google's Family Link and Play Games age handling. Parents who want to limit leaderboard exposure can disable Game Center for a child's account in iOS Settings → Screen Time → Content & Privacy Restrictions, or manage Play Games access through Family Link on Android.
Changes to this policy
If we change what data the app handles (for example, when cloud sync ships), we'll update this page and bump the effective date at the top. Material changes will also be flagged in the app's release notes.
Contact
Real questions: support@hueful.app. We reply.