Privacy policy
Sprig is a logic-puzzle game published by Luke Lancaster (“we”). Contact: sprig.game@gmail.com.
Playing without an account
You can play Sprig without signing in. Your progress, settings and puzzle history are stored only on your device. We do not receive them.
Signing in (optional)
If you sign in with Google, Firebase Authentication (Google) gives Sprig an account identifier, your name and your email address. If you sign in with Apple on iPhone, Apple gives Sprig an account identifier and, if you choose to share them, your name and email address; with Hide My Email, Apple gives a private relay address that forwards to you. We use this only to identify your account. Your email address is never shown to other players.
Cloud backup
When signed in, Sprig backs up your complete game save to our Firebase project, hosted in London (europe-west2). The save covers Journey progress, in-game coins and helpers, cosmetics, profile name and portrait, settings, puzzle history and saved boards. We keep the latest three backups so you can restore on a new device.
Live leagues
When signed in, puzzles you start online are sent to our server to verify your result: the moves you made and when on the puzzle’s clock you made each one, and when you started and finished. Your Sprig profile name, portrait, frame, score, puzzles solved and helper use are shown to other players in your league group. League groups also contain simulated players, labelled BOT.
To keep leagues fair, our server checks ranked results for signs of unfair play, such as finishes faster than a person could plausibly solve, finishes much faster than your own usual pace, or boards filled in the exact order or at the even pace of a machine. It keeps a running count of these checks with your account, a note of your recent solving pace and of any result it refused, and, when a check is triggered, a note of the finishes involved. A result faster than anyone could tap the board is not ranked; the other checks never change a score or rank on their own. Only we see them, and we decide whether to pause an account from live leagues or to rank a refused result.
Friends and private leagues
When signed in, you can get a friend code and add friends with theirs. We store your friend code, your friends, the requests you send and receive, and anyone you block, with your account. Friends see your Sprig profile name, portrait, frame and your league scores, puzzles solved and helper use. Requests end after 30 days. Blocking is private: the other player isn’t told.
You can also start or join a private league of up to 20 players. We store the league’s name, its code, who is in it and who runs it. Other players in the league see the same profile details and scores as friends do. Players never see each other’s email addresses or account identifiers, and there is no chat.
Support and moderation
To answer a support request or keep leagues fair, we can look up a signed-in account and what Sprig holds for it. We can give an account coins, helpers or a Sprig Club membership, reset a profile name, pause an account from live leagues, or delete an account at your request. We keep a short record of these actions without your email address. Gifts and pauses are deleted with your account.
You can report another player’s name or score from a league or friends table, or the name of a private league you are in. We receive your account identifier, the name and portrait that were shown, which table it came from and the reason. The reported player isn’t told who reported them. Reports are deleted a year after the last one, or sooner if either account is deleted.
App integrity
Sprig uses Firebase App Check (Google Play Integrity on Android, App Attest on iOS). It confirms requests come from a genuine copy of the app. It does not give us your personal information.
Notifications
Streak, league, daily-puzzle and Club reminders are planned on your phone and need nothing from us. If you allow notifications with News and messages from Sprig or Reminders to play on, your phone gets a Firebase Cloud Messaging (Google) token and joins a topic for its time zone offset (for example UTC+01:00), so our messages and a few reminders a day to play arrive between 08:00 and 21:00 your time. If you are signed in, we also store that token, a random identifier for this installation and the time zone offset with your account, so we can send a message to your phones. Signing out removes them from your account, and deleting your account deletes them. You can turn each kind of notification off in Settings → Notifications.
Crash reports
If Sprig hits an error, it sends a crash report to Firebase Crashlytics (Google): what went wrong and where in the app, the app version, your phone model and operating system version, and a random identifier for this installation. Reports never include your saved progress, profile name or email address, and they are not linked to your account. We use them only to find and fix faults. Crashlytics keeps them for 90 days. You can turn them off in Settings → Send crash reports.
Usage analytics
Sprig sends anonymous usage counts to Google Analytics for Firebase (Google): which screens are opened, when a puzzle starts and ends, its mode and difficulty, whether it was solved and how long it took, plus the app version, your phone model and operating system version, your approximate country from your IP address, and a random identifier for this installation. They never include your saved progress, profile name or email address, they are not linked to your account, Sprig does not collect your advertising ID with them, and they are not used to personalise adverts. We use them only to see which parts of Sprig are played and improve it. Google Analytics keeps event-level data for 2 months. You can turn analytics off in Settings → Share usage analytics.
Feedback
If you send feedback from Settings → Send feedback, we receive your message, the email address you give for a reply (if any), the Sprig version, your phone model and operating system version, and a random identifier for this installation that limits how often feedback can be sent. If you are signed in, it also carries your account identifier so we can look into your account. We use it only to answer you and improve Sprig. It is deleted after a year, or sooner with your account.
App updates
Sprig checks with Firebase Remote Config (Google) whether your version is still supported, so we can ask you to update an old version. This uses a random Firebase installation identifier and your app version, and nothing from your game.
Advertising
Sprig shows adverts through Google AdMob between puzzles, and optional adverts you can watch for extra hearts, helpers or coins. When you first open Sprig in the UK, EEA or Switzerland, Google’s consent message asks how your data may be used for adverts. You can change your choice at any time in Settings → Privacy choices.
AdMob may collect your device’s advertising ID, approximate location from your IP address, and how you interact with adverts. On iPhone, Sprig does not ask for permission to track you, so AdMob does not receive your Apple advertising identifier. Google uses this to show, measure and protect adverts under Google’s privacy policy. Adverts are limited to content suitable for general audiences. Remove ads stops the adverts between puzzles; Sprig Club removes all adverts. Development builds and registered test devices use Google’s test adverts. Closed-beta builds may use live adverts.
Purchases
Google Play (on Android) or the App Store (on iPhone) handles payment; we never see your card details. Our purchase provider, RevenueCat, receives a record of what you bought and your Sprig account identifier. It uses these to unlock your purchases on your devices. Deleting your account also deletes this record. Subscriptions renew until you cancel them in Google Play or in your App Store subscriptions.
Retention and deletion
Your data is kept while your account exists. You can delete your account in the app: Settings → Account and progress → Delete account. You can also ask us to delete it without the app; see https://sprig-game.web.app/delete-account.
Deletion removes your sign-in account (and, for Sign in with Apple, revokes Sprig’s access to your Apple ID), cloud backups, profile, league results and prize records, your row in league tables, your friend code, friends, requests and blocks, your place in private leagues, reports you sent or that were made about you, and the fairness checks on your results. If you run a private league, the longest-standing player takes it over. Cleanup normally finishes within 15 minutes to 24 hours. If a provider is temporarily unavailable, the request stays pending and retries; contact us if it has not finished within 24 hours. A minimal record of the request remains, identified only by a one-way hash. It stops old devices re-uploading deleted data and lets you check the deletion finished. Backup files you exported yourself are not affected.
Children
Sprig is not directed at children under 13.
Feedback and the closed test
Our feedback form collects the information you submit, such as the affected feature, device model, app version, a description of the issue and whether you would keep playing. An email for a reply is optional. Do not submit passwords, payment details or information about other people.
These responses are stored privately in Google Forms under the publisher's account. Form response summaries and respondent lists are not published. Google's service processes the form under Google's privacy policy. These form responses are separate from your Sprig game save.
Before its Google Play release, Sprig ran an Android closed test for adults aged 18 or over. Testers joined the Sprig Android Beta Testers Google Group and opted in on Google Play, both with their Google account. As the group’s owner, Luke Lancaster can see the email address of that account, and used it only to run the test and send test instructions. Joining did not subscribe anyone to general marketing. Google runs the group and the opt-in under Google’s privacy policy. You can leave the tester group at any time in Google Groups.
You can ask for form responses to be deleted by emailing sprig.game@gmail.com. Optional feedback email addresses are removed within 90 days of your report, or for the closed test within 90 days after it ended, unless you ask us to keep in touch. Feedback with identifying details removed may be kept to track product improvements. Deleting your in-app account does not automatically delete a separately submitted form response; please mention these responses when making a deletion request.
Security
Data travels over HTTPS. Only Sprig’s server can read or write the database; no player can read another player’s records directly.
Your rights
You can ask for a copy of your data, or for it to be corrected or deleted, by emailing sprig.game@gmail.com. If you are in the UK or EEA you can also complain to your data protection authority; in the UK that is the Information Commissioner’s Office.
Changes
We will update this page when Sprig’s data use changes, and change the date at the top.