Version 2 · 11 October 2026

Privacy policy

Nilvo collects only what is needed to play, save your progress and compete with the people you choose. This policy explains which data we process, why, on which legal basis, who is involved, how long we keep it and how to exercise your rights. It describes what the app, the website and the server do today, not what they might do some day. The Spanish version is the reference text; this translation is provided for convenience.

1. Who is the controller

The data controller is Cristóbal Garrido Valero, a natural person, a self-employed professional who develops and publishes Nilvo as an independent developer.

Tax ID (NIF): 26049618W
Address: Calle Ciudad de París 8, 28840 Mejorada del Campo (Madrid), Spain
E-mail for anything about your data: cristobalgarrido@retroteca.es

There is no legal obligation to appoint a data protection officer (Article 37 GDPR; Article 34 of the Spanish LOPDGDD) and none has been appointed. For any question about this policy, write to the address above.

2. In two minutes

Without an account nothing of yours leaves the device: the game, records, favourites and settings are stored on your phone or in your browser.
With an account we store a technical identifier, your username, your avatar, your progress and your results. We store neither your e-mail address nor any password: the identity provider keeps the e-mail.
Your username, avatar, level and results are seen by the players of your groups, your friends and your challenge rivals. That is the only information about you anybody else sees.
No advertising, no third-party analytics, no tracking, no advertising identifiers. We do not sell data or share it for marketing.
The server and the account data are in the European Union (Microsoft Azure, North Europe region, Dublin). Technical logs are deleted after 30 days.
The account is deleted from within the app, without visiting the website or writing to us.

3. Playing without an account

Without an account you can play the tutorial, the included Training levels and Time Trial, with no registration. The saved game, records, favourites, the device streak, the settings and the full-game status are stored only in the app's or the browser's storage. We do not send them to any server.

The app does make a few requests to the server without an account: it downloads the store catalogue and the public configuration. Those requests carry no identifier of yours. Like any internet connection, they expose your device's IP address to the server, which records it masked in its technical logs (section 12).

The daily reminders ("today's challenge is waiting") are scheduled by the app on the device itself, with the system's notification permission; they never pass through our server and send nothing to anybody.

4. Creating an account and signing in

An account is only needed for the profile, groups and leagues, friends and challenges, the cosmetics store and progress sync. You can create it in three ways:

E-mail and one-time code. You type your e-mail and receive a code. The identity service is Microsoft Entra External ID, in a directory of Nilvo's own (tenant "capasjugadores") that Microsoft hosts and operates on the controller's behalf. That directory stores your e-mail address and the technical data of the sign-in (date, code, outcome). Our game server does not store your e-mail.
Google. You sign in with the device's Google account. Google hands us a signed token with an identifier of your account and your verified e-mail; we use the identifier and do not keep the e-mail.
Apple (iPhone and iPad only). You sign in with your Apple ID. Apple hands us a signed token with an identifier of your account; we keep neither the e-mail nor the name. The app also hands us Apple's one-time authorization code, which we exchange with Apple for a refresh token: we keep it with your account for one purpose only, revoking your Sign in with Apple when you delete the account, as Apple requires.

From the identifier the provider gives us we compute a digest (SHA-256) which becomes your account's technical identifier in Nilvo. The provider's original identifier is not stored in any table. Google and Apple process your Google or Apple account under their own privacy policies; we receive and check the sign-in token and, for Apple, keep the refresh token described above.

When you finish creating the account you choose a username (3 to 16 characters; letters, digits and underscore). It is visible to other players and cannot be changed. An automatic filter rejects offensive names; if you think it got it wrong, write to us.

The app keeps your session open with a token of its own, stored encrypted on the device, so it does not ask for your e-mail or account every time. The server keeps only a digest of that token with its creation, last-use and expiry dates.

5. What we store in your account

Profile: technical identifier, username, avatar (the combination of chosen pieces), level and experience, International League division, creation and last-update dates.
Progress uploaded from the device: completed and unlocked levels, records and best moves, claimed milestones, favourites, boosts, best Infinite run, tutorial done and app settings (sound, haptics, language, theme, colour-blind mode, reminders).
Economy: credits and boost balance, full-game status (and its origin: purchase, code or reward), cosmetics inventory, credit movements with their reason and date, and reward codes you have won or redeemed.
Streak and counters: consecutive days with a challenge played, last counted day, and the daily counters that enforce the game's limits (challenges sent, challenges that paid credits, boosts used, wrong codes).
Competition: the groups you belong to and your role in them, leagues and seasons, attempts and results of each daily challenge (score, time, moves, mistakes, submission time), accumulated standings, trophies, friends and requests, challenges between players (rival, levels, scores, outcome, dates), blocks and reports.
Notifications: if you accept them, the notification identifier of each device, its platform (iOS or Android) and the app language.
Purchases: platform, transaction identifier and product of each verified purchase.
Sign in with Apple: if you signed in with Apple, the refresh token Apple issues and the app that asked for it, to revoke it when the account is deleted.
Deletion request: the date on which you asked to delete the account, while the process carries it out.

6. What other players see

Nilvo is a social game only when you decide so. What others can see about you is always the same: your username, your avatar, your level and your results.

The members of a group see the daily challenge table and the league standings: rank, name, avatar, level, points, wins, challenges played, score, time, moves, mistakes and attempts.
In the International League, the players of your division see your rank and your weekly result.
Your friends see the head-to-head of challenges won and lost against you. Anybody who types your exact username can send you a friend request and see your public profile: name, avatar, level, trophies and the date you joined.
Your challenge rival sees your score when the challenge is settled, and the notification they receive contains your username.
If you share a friend invite, the link contains your username; if you share a league invite, the link contains the league code. Only you decide whom you send them to.

There is no chat, no free messaging and no way to publish text beyond the username. Nobody can see your e-mail, your solo progress or your purchases.

7. With an account, your progress goes to the server

While signed in, the app uploads your saved game so you can recover it on another device and so the campaign credits and experience can be granted. When you play the daily puzzle on the device, the app tells the server which day you played it so the streak counts in your account. The server only accepts today, yesterday and tomorrow (so a time zone counts without anybody filling in past days).

8. Daily challenges, leagues and challenges between players

Each group receives its own daily puzzle, derived on the server with a secret key. When you play a ranked challenge, the app sends your result (time, moves, mistakes) and the final placement of the board; the server checks that the board is solved, computes the score and stores one attempt per person and day. Challenges between players work the same way: the server generates the same boards for both players and computes both scores. These data form the tables described in section 6.

9. Notifications

Push notifications are optional. If you accept them, the app sends to your account the device's notification identifier, its platform and the app language. We only send notices that answer something another player did: a friend request or acceptance, a challenge to play or settled, and the end of a season. There are no marketing notices.

Delivery is done by Apple Push Notification service (iOS) and Firebase Cloud Messaging (Android). The text of the notice, which may include another player's username, passes through those services. If you refuse notifications or the registration fails, we keep a single diagnostic row with the platform and the reason ("denied", "unavailable" or "failed"), without any notification identifier, so that a silent failure does not go unnoticed. When you sign out, the app removes that device's identifier from your account; if Apple or Google tell us an identifier no longer exists, we delete it.

10. Purchases, credits and access codes

Credit packs are bought on the App Store or Google Play, which charge you and issue the receipt; the full game is paid with credits from the account. We never see your card or payment details. To credit what you bought, the app sends the server the proof of purchase the store provides (on iOS the signed StoreKit transaction, on Android the Google Play purchase token) and the server verifies it with Apple or Google. Of each verified purchase we keep the platform, the transaction identifier, the product and whether it was a real or a test purchase, so the same purchase is never credited twice. App Store and Google Play gift codes are redeemed by the store: we only receive the purchase they create, like any other.

The credits, cosmetics and boosts you earn or buy are recorded in a ledger of your account (movement, reason, date) and in your inventory.

Nilvo access codes, which were redeemed on the former web version until 30 October 2026 (for instance the ones that unlock the full game, or test codes), are checked on the server. The code table holds no personal data: it stores a SHA-256 digest of each code, what it grants, between which dates it is valid and how many times it has been used. Your redemption is recorded in your ledger. To prevent brute-force guessing we count the wrong codes an account tries each day (after ten, the server stops checking until the next day).

11. Reports and blocks

You can report another player for their name, their avatar, harassment, cheating or another reason, with an optional note of up to 280 characters, and you can block them. A report stores your identifier, the reported player's identifier, the reason, the note and the day; a person reads it later and decides. The reported player does not learn who reported them. A block stores both identifiers and the other person's username, undoes the friendship and cuts challenges, requests and profile in both directions.

12. Security and diagnostics

The service runs on Microsoft Azure, North Europe region (Dublin, Ireland): Azure Functions (the API), Table Storage (the data), Key Vault (the keys) and Application Insights with Log Analytics (errors and technical metrics). The technical logs record which request failed, when and with which code; they may include an account's technical identifier when the error carries it. IP addresses are masked on arrival. These logs are kept for 30 days and then deleted automatically.

All communications are encrypted (HTTPS). The server accesses the data with managed identities, without passwords or shared keys. Session tokens and provider identifiers are stored as cryptographic digests. We keep no backups of our own outside Azure.

13. The website (nilvo.app): cookies and local storage

The website uses no cookies and stores nothing in your browser: there is no game on it, only the guide and links to the stores. To know how many people visit it and which pages are read we use Cloudflare Web Analytics, by Cloudflare, Inc.: it counts visits in aggregate (page, country, browser, referring site) without cookies, without local storage and without identifying anyone, and does not combine that data with anything else. It is the only external resource the website loads; the content security policy prevents any other.

Until 30 October 2026 nilvo.app also served a web version of the game, which saved the game in the browser's local storage (keys capas-prototype-save-v1 and capas-wallet-v1). It no longer exists; if you used it, that data stays only in your browser, we cannot read it and you can clear it from its settings. Your account and your cloud progress remain intact in the app.

The portal pages are served by Azure Static Web Apps, a Microsoft service that records requests (IP address, page, date, browser) in its technical logs, with the guarantees of section 15.

14. Why we use the data and on which legal basis

Purpose	Data	Legal basis
Providing the game with an account: identifying you, keeping your profile and progress and restoring what you bought	Technical identifier, username, avatar, progress, verified purchases, session	Performance of the contract (Art. 6(1)(b) GDPR)
Groups, leagues, standings, friends, challenges and public profile	Username, avatar, level, results, times, trophies	Performance of the contract (Art. 6(1)(b))
Sending you notices about challenges, friendships and leagues	Notification identifier, platform, language	The consent you give by allowing notifications on your device (Art. 6(1)(a)); you can withdraw it in the system settings or by signing out
Purchases, credits and codes: granting what you bought once and preventing fraud	Proof of purchase, transaction identifier, credit movements, redemptions, wrong codes	Performance of the contract (Art. 6(1)(b)) and legitimate interest in preventing fraud and duplicates (Art. 6(1)(f))
Moderation: name filter, reports and blocks	Username, reason, note, identifiers	Legitimate interest in protecting the other players and meeting the stores' rules (Art. 6(1)(f))
Security, diagnostics and abuse prevention	Technical logs, sessions, attempt counters, verification of results	Legitimate interest in the security of the service (Art. 6(1)(f) and Recital 49 GDPR)
Answering your questions and your rights requests	Your e-mail and the content of your message	Legitimate interest in assisting you (Art. 6(1)(f)) and legal obligation to answer your rights requests (Art. 6(1)(c))

We take no automated decisions with legal effects on you and build no profiles. Two automatic checks exist and you should know about them: the filter that rejects offensive usernames and the verification that a board sent to a ranking is really solved (a submission that does not close it is rejected). In both cases you can write to us if you believe the system got it wrong.

15. Who processes data with us

Nilvo does not sell data, shows no advertising and builds no advertising profiles. These providers take part because the service does not work without them:

Provider	What it does	Where	Role and safeguards
Microsoft (Azure)	Hosts the API, the account data, the keys, the technical logs and the web portal	North Europe region (Dublin, Ireland); the portal is distributed from Azure's global network	Processor, under the Microsoft Products and Services Data Protection Addendum (DPA)
Microsoft Entra External ID	Sign-in with e-mail and code; keeps your e-mail in Nilvo's own directory	European Union	Processor (same Microsoft DPA)
Google	Sign in with Google; Firebase Cloud Messaging for Android notices (Nilvo's own project); Google Play for purchases	Google LLC (United States), Google Ireland Ltd and Google Commerce Ltd (Ireland)	For sign-in, Google is an independent controller of your Google account. For notices, processor (Google Cloud Data Processing Addendum). For purchases, seller of the store
Apple	Sign in with Apple; Apple Push Notification service for iOS notices; App Store for purchases	Apple Inc. (United States) and Apple Distribution International Ltd (Cork, Ireland)	Apple is the controller of your Apple ID and of the store; notices are delivered under Apple's developer terms and its privacy policy

Other players also see what section 6 describes. We disclose data to nobody else, unless a law or an authority obliges us.

16. International transfers

Your account data are stored and processed in the European Union. The US providers (Google LLC and Apple Inc.) may process data outside the European Economic Area when providing their identity and notification services; Microsoft Corporation may do so to a limited extent as part of operating Azure. Those transfers rely on the EU–US Data Privacy Framework (Google LLC and Microsoft Corporation are certified) and on the standard contractual clauses approved by the European Commission, which Apple uses and which Microsoft and Google include in their terms. You can ask us for more detail at the contact address.

17. How long we keep the data

Data	Period
Account data (profile, progress, inventory, credits, trophies, results, friends, reports and blocks)	While the account exists. When you request deletion, a scheduled process that runs every ten minutes removes them: normally within an hour and never later than 30 days.
App session	180 days from last use, renewed while you use it. Deleted when you sign out and, if expired, on the first attempt to use it. The access token lasts one hour.
Notification identifier	Until you sign out on that device, delete the account, or Apple or Google tell us it no longer exists.
League results and standings	They live with the league and the group: they disappear when you delete your account or when the administrator deletes the group.
Removal from a league	If the administrator removes you, the league keeps for 30 days that you cannot rejoin with its code. It is deleted earlier if the administrator lifts it, if you delete your account or if the group is deleted.
Challenges between players	While either player keeps them in their list. When you delete your account, your side is replaced by a "deleted player" identifier and only the result remains.
Purchase records (platform, transaction, product)	While the account exists. Deleting it removes everything that links the purchase to you; of the store's transaction identifier only a mark that it was already credited remains, with no data about your account, so the same purchase cannot be credited again. Apple and Google keep their own sales records under their policies.
Reward codes	The code keeps existing (it may already have been handed out), but when the account is deleted it no longer says who won or used it.
Apple refresh token	While the account exists. When it is deleted we hand it back to Apple to revoke your sign-in, and it is erased.
E-mail in the sign-in directory (Microsoft Entra External ID)	Until you ask us to delete it. Deleting the account in the app erases the game data but not the entry in that directory: to delete your e-mail as well, write to us from that address and we remove it within one month.
Technical logs (Application Insights and Log Analytics)	30 days.
Support and rights-request e-mails	Until the query is resolved and at most twelve months afterwards.

18. Deleting your account

It is done from the app: tap the person icon ("Your account") on the home screen, scroll to the end of your profile and tap Delete account; you must confirm a second time. The session closes by itself and the app first removes that device's notification identifier.

Deletion is carried out by a scheduled process every ten minutes. It removes your profile and the reservation of your name, your progress, your credits, inventory, trophies and movements, your purchase records, your sessions and devices, your membership of groups (the groups you administer are deleted whole, with their leagues and standings), your results and standings in every season, your friendships, blocks and reports in both directions. If you signed in with Apple, we revoke your Sign in with Apple before erasing the data. A challenge already played still exists in the other person's list, without your name or avatar: only a "deleted player" identifier and the result. Technical logs expire after 30 days.

Progress stored only on the device is not touched by this process: it is removed by uninstalling Nilvo or clearing the app's or the browser's data. If you cannot access the app, ask by e-mail from the address you created the account with; we will check that you are the holder before deleting it. More detail on the account deletion page (in Spanish).

19. Minors

To create an account you must be at least 16 years old. Nilvo does not ask for a date of birth, so we do not verify age: we rely on the statement you make when creating the account.

Without an account the whole game can be enjoyed and nothing leaves the device, so a minor can play without registering. If you are a parent or guardian and know that somebody under that age has created an account, write to us and we will delete it.

20. Your rights

You can ask us for access to your data, their rectification or erasure, the restriction of their processing, their portability, and you can object to processing based on legitimate interest. You can also withdraw the notification consent at any time, without affecting what came before.

Full erasure is available in the app (section 18), and most of your data is visible in your own profile, your progress and your lists.
For everything else, write to cristobalgarrido@retroteca.es from your account's e-mail (if you signed in with Google or Apple, tell us your username). We will answer within one month, extendable by two further months in complex cases, as Article 12 GDPR provides. If we cannot identify you, we will ask for what is needed to do so.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid; www.aepd.es, with an electronic office for complaints) or with the data protection authority of the EU country where you live.

21. Changes to this policy

When what Nilvo does with data changes, we will update this page, change the date above and, if the change matters to you, announce it inside the app before it applies. The version in force is always the one published at nilvo.app/legal/privacidad.html (Spanish) and this English translation.

22. Contact

cristobalgarrido@retroteca.es

Other pages: Legal notice · Terms of use and purchase · Delete your account · Support