Huebloom

Huebloom Privacy Policy

Last updated: October 30, 2026

This policy explains how Huebloom (the "App"), a mobile game published by Onur Bulut ("developer", "we"), handles information.

1. In short

  • No account is needed. We do not ask for or collect your name, email, phone number, photos or contacts.
  • Your game progress and settings are stored on your device. If you choose to sign in with Apple or Google, a copy of your progress is kept on our server so it comes back when you change phones; your email and name are not collected, and you can delete the account from within the App (Section 3.2).
  • If you join the optional leaderboard (off by default), the name you pick from a fixed list, your profile avatar and your scores are visible to other players; you can leave at any time and your entry is then deleted (Section 3.1).
  • An anonymous usage counter helps us improve the game (e.g. which level players get stuck on); it does not know who you are and can be turned off in Settings › Usage data (Section 3).
  • The App has no in-app purchases.
  • The App uses Google AdMob only for rewarded video ads that you choose to watch. The ad service processes limited device and usage information as described below.

2. Information stored on your device

Level progress, stars, best scores, statistics, booster counts, Workshop levels and settings (sound, music, theme, haptics, etc.) are kept in your device's local storage and are not transferred to us or to third parties. You can delete them by uninstalling the App or via Settings › "Reset all progress".

Workshop share codes are written to or read from your clipboard only when you tap "copy" or "paste".

The save code (HBS1-) made in Settings › "Move your progress" contains your progress, cards, profile name and settings; it is written to the clipboard only when you copy it and is never sent to any server. Your phone's own backup (iCloud device backup / Android Auto Backup) may back up this local data to your Apple or Google account.

3. Anonymous usage counter

To see which parts of the game feel hard and where players stop, the App sends short game events to our own server (huebloom.onurbulut.dev, hosted on Cloudflare): level start/win/loss (level number, attempt, duration, score, moves left), booster and undo use, responses to the rewarded-video offer, the name and new value of a changed setting, the name of the screen opened, and app errors (the start of the error message).

Each event carries a random install number generated on first launch, a random session number, the app version, operating system and major version, and language code. This number is not a device ID, advertising ID or account; it is never linked to any other identifier and does not tell us who you are. Your IP address is not stored; the server only records the country code derived from it. Names and share codes of levels you create in the Workshop are never sent.

Events are kept for at most 395 days and then deleted automatically; they are not shared, sold or used for advertising. Turning off Settings › Usage data stops sending and asks the server to delete every record of that install.

3.1 Optional leaderboard

The leaderboard is off by default; it is turned on only if you tap "Join the leaderboard". Once you join, the App sends the following to our own server (huebloom.onurbulut.dev), and it is visible to other players:

  • The name you pick from a fixed list (e.g. "Mor Lale 42"). Free text cannot be entered; the name typed in your profile is not sent.
  • Your profile avatar and frame (a herbarium card earned in the game; not a photo).
  • Scores and level: your best score in today's puzzle, the highest journey level you reached and your total stars.

These are stored with a random player number generated when you join. It is not a device ID, advertising ID or account; it is separate from the usage counter's install number and is never linked to it. Player numbers are not shown to other players. Your IP address is not stored. Daily scores are kept for 21 days, the leaderboard entry for at most 400 days after its last update.

You can leave at any time with "Leave the leaderboard" on the Profile screen: the server is asked to delete every leaderboard record of that player number (if you are offline, the request is sent when you are back online). If you join again, you start fresh with a new number.

3.2 Optional sign-in and cloud save

Signing in is optional and off by default. If you tap "Sign in with Apple" or "Sign in with Google" on Profile › My save (or in the one-time invitation shown after a few levels):

  • Apple or Google gives the App a signed identity token. The App requests no scopes (no email, no name). Our server verifies the token's signature and uses only the user number the provider assigns to you ("sub"); it does not store that number either, only a one-way hash (SHA-256) derived from it as the account number. Your email address, name and IP address are not stored.
  • The server gives the App a random session key; the key stays on your phone, the server keeps only its hash.
  • Your game save (the content of the HBS1 save code in Section 2: progress, stars, best scores, statistics, boosters, cards, profile name and avatar, settings, Workshop levels) is uploaded to our server (huebloom.onurbulut.dev, hosted on Cloudflare) a few seconds after it changes. Its only purpose is to let you continue where you left off after reinstalling the App or changing phones, by signing in with the same account. It is not shared, sold or used for advertising or analytics, and it is not linked to the usage counter or the leaderboard.
  • Sign out ends the session on this phone; your cloud save stays. Delete my account (after confirmation) permanently deletes your account, your save and all your sessions from the server; if you are offline, the request is sent when you are back online. The progress on your phone stays as it is. You can also request deletion without opening the App: see the steps on the Delete your account page.
  • Accounts that are never used (no sign-in or backup for 2 years) are deleted automatically together with their save.
  • Apple (for Sign in with Apple) and Google (for Sign in with Google) handle the sign-in itself under their own privacy policies.

3.3 Duel rooms

Duels only work if you create a room or join one with a room code. A room is private: only people who know its 4-character code can enter. The following is sent to our server (huebloom.onurbulut.dev) and is visible only to the players in the same room:

  • The name you type for the room (at most 14 characters) and the dare written by the room's creator (e.g. "Buy dinner", at most 40 characters). Both pass a profanity filter.
  • Your score and moves left in the current round (live during play).

They are stored with a random player number generated anew for every room; it is separate from the usage counter, leaderboard and cloud save numbers and is never linked to them. Your IP address is not stored. A room and everything in it is deleted from the server after 3 hours at the latest; leaving a room in its lobby deletes your entry right away.

4. Advertising (Google AdMob)

There are no banner ads. Google AdMob shows ads in two cases: when you choose to watch a short video to earn a booster (entirely optional), and, after the first 5 levels, a short interstitial between levels every few levels. No ads are shown during play. Ads are requested as non-personalized; no interest-based profile is requested.

To serve and measure ads and prevent fraud, Google's ad SDK may automatically process:

  • IP address (only to estimate approximate location),
  • device and advertising identifiers (Android advertising ID, App Set ID; on iOS the identifier for vendor — the iOS advertising identifier (IDFA) cannot be read without your permission),
  • ad interaction data (impressions, taps, video views),
  • diagnostics and performance data (launch time, crash information, etc.).

This data is sent over an encrypted (TLS) connection directly to Google; we do not access it or use it to identify you. How Google uses data: https://policies.google.com/technologies/partner-sites · Google Privacy Policy: https://policies.google.com/privacy

On Android you can reset or delete your advertising ID under Settings › Google › Ads. On iOS the App does not request tracking permission.

5. Consent and privacy options

Users in the European Economic Area, the United Kingdom and Switzerland (and other regions where required) are shown a consent message through Google's consent management tool before any ad is loaded. You can change your choice at any time in Settings › Privacy options. Declining ads does not lock any part of the game; only the rewarded video option may be unavailable.

6. Children

The App is intended for a general audience and is not specifically directed at children under 13. We do not knowingly collect personal data from children.

7. Legal basis (GDPR / KVKK)

The usage counter processes non-identifying (anonymous) events based on our legitimate interest in improving the game; you can turn it off at any time in Settings. Leaderboard, cloud save and duel data are processed because you turned those features on, and only to provide them to you (your consent / performance of the service you asked for). Processing by the ad SDK relies on your consent where required, and otherwise on legitimate interests in providing the service and preventing fraud. To exercise your rights (access, deletion, objection, etc.) you can contact us; requests about ad data can also be sent to Google.

8. Changes

When we update this policy, we change the "Last updated" date on this page.

9. Contact

Onur Bulut · help@onurbulut.dev · https://onurbulut.dev