Privacy policy
Last updated:
This policy explains the data used by Fruit Merge Game at fruitmerge.com. You can play solo or a friendly duel without creating a saved account.
Who is responsible?
Matthieu SAUVET is the publisher and data controller. For privacy questions or requests, write to fruitmerge@gmail.com. Hosting information is available in the legal notice.
Data and purposes
Solo play and rankings
Your browser keeps a random player identifier, your personal best, sound, theme and language preferences, and available country and region information. Online solo rounds send the identifier and a gameplay history to validate the score; the server records submitted scores, their display name, country and region. New solo scores use the same public display name as duels when it is available at submission. Scores and display names can appear in the world, country and regional rankings. The random identifier and login username are not displayed in the solo ranking.
Duels and saved profiles
Opening Duel creates or restores a guest profile and a session cookie. A guest profile contains a random identifier, a public player name and rating statistics. Saving a profile adds your chosen username, a password hash and a recovery-code hash. No email address or real name is required to play.
When available, Continue with Google is optional. Google supplies a signed identity token, which our server verifies. We store the stable Google identifier linked to your game profile, not your Google password, email address, real name or photo. Your chosen nickname remains public. You can link Google to an existing profile after signing in; accounts are never merged by email. Deleting your game profile removes the Google link. We also record the platform used (web, Android or itch.io) and the sign-in method for operation and diagnostics; older records without this information remain unspecified. The Google identity token may contain an email address and basic profile information. The token is verified in memory for the sign-in request and is not stored; only the stable Google identifier is used to identify the account.
Your opponent receives your public player name, game state and a live view of your jar. Saved profiles that complete ten ranked matches appear in the public duel ranking with their player name, Elo and match statistics. Choose a nickname rather than private information.
Duel results, gameplay action logs and final jar checkpoints support ratings, result checks and technical diagnostics. These records are not public. Passwords and recovery codes are stored as hashes, not plain text. Live visual updates are relayed to the opponent without being saved to the database.
Achievement progress and counters are saved locally and synchronized with your game profile when connected. They are deleted from the server when you delete that profile. Offline solo progress is self-reported; duel achievements use server-confirmed results.
Approximate location
For regional solo rankings, our backend estimates your country and region from your connection IP using a locally stored MaxMind GeoLite2 City database. Your IP is not sent to MaxMind or another geolocation provider for these lookups and is not stored in score or profile records. Only the approximate country and region are returned to the game; we do not request your device’s precise location. World rankings and gameplay remain available if the lookup fails.
Connections and support
Connection metadata, including your IP address, is processed to deliver the site, limit abusive requests and secure sessions. IP addresses are not stored in solo score or duel profile documents. Hosting and application diagnostics can involve technical logs. If you email us, we receive your email address and the information you include, to answer your request.
Google Analytics
When enabled, Google Analytics measures page visits, sessions, device and browser information and approximate location to help improve the game. Gameplay events also measure readiness and startup failures, solo or duel starts and finishes, fruit milestones, scores, elapsed play segments, matchmaking waits and account actions. Requests to Google also involve connection metadata. The site does not send game identifiers, player names, passwords, recovery codes or private invitation parameters as Analytics event fields. Query strings and fragments are removed from the page and referrer URLs supplied by the site.
Advertising personalization and Google signals are disabled. Collection depends on the site settings: with the consent interface enabled, Analytics is loaded only after acceptance and can be rejected through Privacy choices. With that interface disabled, enabled Analytics starts automatically unless a valid previous rejection is saved. This mode does not establish that consent is unnecessary.
Collection depends on the current site configuration.
Legal bases
- Providing gameplay, sessions, saved profiles and the rankings you use: performance of the service you request, under Article 6(1)(b) GDPR.
- Protecting the service, validating results and diagnosing failures: legitimate interests in security and fair play, under Article 6(1)(f) GDPR.
- Providing approximate regional rankings and answering support requests: legitimate interests in providing these features and responding to users, under Article 6(1)(f) GDPR.
A saved profile is optional; its username and credentials are required only if you choose to create one. Blocking the duel cookie prevents online duels, while solo remains available. Optional Analytics cookies require consent where applicable; accepting them is not a condition for playing. The game does not load advertising scripts.
Sharing results and invitations
Sharing is optional and starts only when you choose a share button. Your result message includes the score, and the biggest fruit for solo play, with a link to the game. An invitation link includes its code so a friend can join. The game uses your device’s sharing options or clipboard; you choose where to send it. No social network widget is loaded. Analytics, when enabled, receives the sharing method, game mode and whether you shared a result or invitation, not the message or invitation link.
Who receives the data?
The publisher operates the game and its databases on an OVHcloud VPS in Strasbourg, France. OVH SAS provides the hosting infrastructure. Other players receive only the public ranking information and opponent information described above, never your login credentials or recovery code.
The current regional lookup runs on our VPS in France using MaxMind GeoLite2 City data. Database updates download public geographic data without sending player IP addresses. Email sent to our Gmail contact address is processed by the email provider; avoid sending passwords or recovery codes.
When Analytics runs, Google receives measurement data and may process it outside the European Economic Area. Its privacy policy and data-processing terms describe its processing and transfer arrangements. Retention of Analytics event data follows the settings of the publisher’s Google Analytics property; browser Analytics cookies and saved consent choices have a configured lifetime of up to 180 days.
How long is data kept?
- Browser preferences and personal best: until you clear site data or your browser removes it. Cached assets can be replaced as the game is updated.
- Unfinished solo rounds: expire after 24 hours and are removed by periodic maintenance. A successfully submitted round is removed after validation.
- Solo scores: kept to maintain the all-time ranking; there is currently no automatic expiry. You can request deletion by email.
- Duel sessions: expire after 30 days, unless renewed when you return. Signing out revokes the current session; deleting the profile revokes all its sessions.
- Duel results, logs and checkpoints: expire 14 days after the match ends. Database expiry and hourly maintenance remove expired records, also checked at startup.
- Guest profiles: removed once their sessions and retained matches have expired. Saved profiles remain until deleted.
- Support correspondence and diagnostics: kept as needed to resolve the request or incident, or meet an applicable legal obligation. Hosting providers apply their own operational retention policies.
Account and data deletion
Deleting your Fruit Merge profile removes its login credentials, public profile name, achievement progress and links to Google and Play Games from our server. It revokes all account sessions and removes the profile from the public duel ranking. Retained duel records keep a pseudonymous identifier until their normal expiry, 14 days after the match ends; the profile is removed once no retained match references it. Existing solo scores are stored separately: you can request their deletion by email. This does not delete your Google account or Google Play Games achievements, which you manage with Google. Clearing browser or app storage alone does not delete the server profile.
You can request deletion of solo scores or other data without deleting your account. Email fruitmerge@gmail.com, identify the relevant profile or player identifier and specify which data you want deleted. We may request information needed to verify ownership. Never send passwords or recovery codes. Retention limits and any data that must be kept are described above; Google manages its own account and Play Games data separately.
Your choices and rights
You can change your public duel name, sign out, replace a recovery code or delete your duel profile from Your profile. The cookie policy explains how to remove local storage and offline caches.
Under applicable data-protection law, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests. Contact fruitmerge@gmail.com and identify the relevant profile or player identifier so we can locate the records. Do not send your password or recovery code. We may ask for enough information to verify that the records belong to you.
Requests are normally answered within one month. If a request is complex or we receive several requests, GDPR permits an extension of up to two additional months; we will explain the delay within the first month. You can also complain to the CNIL or your local data-protection authority.
Elo and rankings are calculated automatically from game results. They do not make decisions with legal or similarly significant effects on you.
Changes
Changes to this policy will appear here with an updated date. Any new use of data or non-essential trackers will require the corresponding information and, where applicable, prior consent before activation.