Privacy Policy
The short version
- Jigglow has no accounts or logins and never asks for your name, e-mail address or phone number. Its own code has no analytics or crash reporting and uses no cookies, and the app asks for no iOS permissions such as camera, photos, location or contacts.
- Your puzzle progress, favourites, settings and caches stay on your device.
- Some pictures are downloaded from our content server. For paid pictures the server also checks your purchase using data that Apple has signed (section 3).
- Jigglow shows ads from Google AdMob between puzzles. Every ad request asks for non-personalised ads, but Google still receives technical data from your device to deliver, measure and secure ads (section 4). We do not claim that the app involves no data collection, or that nobody tracks you through it.
- Payments are handled by Apple. We never see your card or billing details.
1. Who we are
Jigglow (“the app”) is a jigsaw puzzle app for iPhone and iPad published by Suki Tai, trading as Megizi Studio (“we”, “us”). Megizi Studio is a trading name. You can reach us at support@megizi-studio.com.
For the personal data that we ourselves process (sections 3 and 6), the controller is Shuk-man Tai (known as Suki Tai), an individual based in Scotland, United Kingdom, who trades as Megizi Studio. The controller is responsible for that data under the UK GDPR and, where it applies, the EU GDPR. Google and Apple decide for themselves why and how they process data in their own services, and act as independent controllers for that processing. Megizi Studio is based in the United Kingdom (Scotland), so the UK GDPR and the Data Protection Act 2018 apply to the personal data we process. The UK supervisory authority is the Information Commissioner’s Office (ICO), and you can complain to it at ico.org.uk/make-a-complaint.
2. What stays on your device
The app has no accounts. So that you can carry on where you left off, it stores the following on your device only. We do not receive it.
- Your saved puzzles: a random identifier, the picture and piece count, how the pieces are placed, the zoom and position of the board, the time spent, and when you started, last played and finished.
- Your preferences, for example language, accessibility options and drawer settings.
- Your favourites.
- A cache of thumbnails, which iOS can clear at any time.
- Small counters that decide when an ad may be shown: puzzles completed, when the app was first opened, when an ad was last shown and how many were shown today.
- Pictures you have downloaded (section 3).
The app does not store your purchase status. It reads it from Apple’s StoreKit when it starts and when you return to it. Google’s advertising and consent software also keeps its own data on your device, such as your consent choice (section 4).
Uninstalling the app removes this data from your device. iOS may include app data in your iCloud or computer backups; we do not control that. Jigglow does not use iCloud to sync your puzzles.
3. Pictures from our content server
Some pictures are built into the app. Others are downloaded, when you choose to play them, from our content server (api.jigsaw.megizi-studio.com) over an encrypted HTTPS connection.
What the app sends
- Free pictures: the request names the picture by its file hash (a SHA-256 value). Like any internet request it also reaches the server with your IP address, the time and standard technical headers. The app adds no account number, device identifier, advertising identifier or cookie.
- Paid pictures (VIP and Premium Packs): before the download the app sends the server the transaction data that Apple has signed for your purchase, together with the hashes of the pictures it wants. That data can include the transaction ID and original transaction ID, the product ID, the app’s bundle ID, the environment (production or sandbox), dates, the storefront, and the price and currency. The server checks Apple’s signature and asks Apple’s App Store Server API about the status of your purchase, using the transaction ID. If the purchase is valid it returns an access token that is valid for about five minutes, and the app uses it to download the pictures.
- The token contains the product, the app’s bundle ID, the environment (production or sandbox), the hashes of the pictures requested, its issue and expiry times, and a pseudonymous code (a keyed hash of the original transaction ID, the same for every request of that purchase while the server’s key is unchanged). It exists for about five minutes, and the server does not store tokens or transaction data.
- We do not receive your name, e-mail address, card or billing details, or Apple Account details.
What the server keeps
- The server has no database and no accounts, and it does not write transaction data or tokens to disk.
- To limit abuse it counts requests by network address and by the pseudonymous purchase code. These counters are held only in the server’s memory for short periods and are lost when it restarts.
- Application logs record only technical fields: the type of request, the result, the environment (production or sandbox), the product identifier for paid requests, and counts. They contain no IP addresses, transaction data, tokens or picture identifiers. When unusual activity is detected, a short code that changes every day may be logged so that repeated events can be recognised within that day.
- Our web server is configured not to keep per-request access logs. Its operational error messages could include technical details of a request, such as an IP address.
- Log files have a size limit and the oldest entries are discarded automatically. We have not set a fixed number of days.
- Our hosting provider, OVHcloud, may keep its own infrastructure logs under its own policies. The server is located in the Asia-Pacific (APAC) region.
- Backups of the server contain picture files and an index, and no personal data.
We use this information to deliver the pictures you choose, to check that paid pictures have been bought, and to prevent abuse.
4. Advertising and consent (Google)
Jigglow shows ads provided by Google AdMob and uses Google’s User Messaging Platform to ask for your consent where it is required.
- When: before you start a new puzzle and after you finish one. Never while you are solving a puzzle, dragging, zooming or panning, and not when you resume a saved puzzle.
- VIP and Remove Ads: if you have either, the app does not show the automatic ads between puzzles.
- Non-personalised requests: every ad request from the app asks for non-personalised ads and limits ad content to rating G. Non-personalised ads still involve Google processing data to deliver, measure and secure ads, which can include using identifiers to limit how often an ad is shown and to produce aggregated reports.
- Consent: where Google’s consent platform says consent is required, a consent form is shown the first time an ad would be requested, never when the app starts and never during a puzzle. The app does not request ads before the required consent has been obtained. You can review your choice in Settings → Legal → Privacy options when that row is shown. If you decline, you may still see ads; what Google serves and processes in that case is decided by Google’s consent framework and the law, not by the app.
- If you tap an ad, Google’s software may open a web page or the App Store. That is Google’s behaviour, not ours.
What Google may process
The table lists the data types that Google declares in the privacy manifests of the advertising and consent software shipped with this version of the app (Google Mobile Ads SDK 13.11.0 and User Messaging Platform 3.1.0). We have not measured the data that is actually sent, and Google may change it in later versions. Google explains more at How Google uses information from sites or apps that use our services.
| Data type | Linked to you (per Google) | Used for tracking (per Google) | Purposes (per Google) |
|---|---|---|---|
| Device ID | Yes | Yes | Third-party advertising, developer’s advertising, analytics |
| Advertising data | Yes | No | Third-party advertising, developer’s advertising, analytics |
| Coarse location (derived from your IP address) | Yes (ads software); no (consent software) | No | Advertising and analytics; app functionality (consent software) |
| Product interaction | Yes (ads software); no (consent software) | No | Advertising and analytics; app functionality (consent software) |
| Performance data | No | No | Advertising and analytics |
| Crash data | No | No | Analytics |
| Other diagnostic data | No | No | Advertising and analytics |
Tracking and the App Tracking Transparency prompt
The app does not show Apple’s App Tracking Transparency prompt and does not itself request the advertising identifier (IDFA). The app’s own privacy manifest sets tracking to false and lists no domains used for tracking. Google’s software, however, declares that its Device ID data type may be used for tracking, so we do not say that nobody tracks you through the app.
Where the law requires consent for ad-related storage or access on your device, we rely on your consent given through Google’s consent form.
5. Purchases and Apple
Purchases (VIP Monthly, VIP Yearly, Remove Ads and Premium Packs) are made through the Apple App Store. Apple processes your payment and your Apple Account details; the app and our server never receive your card or billing details or your Apple Account name or e-mail address. The app reads your purchase and subscription status from Apple’s StoreKit on your device to decide what to unlock. For paid pictures our content server also checks the Apple-signed transaction data (section 3).
Restore Purchases asks Apple to re-sync your purchases for the same Apple Account. If the app cannot work out your purchase status, it does not start new paid pictures until the status is known, and it never deletes your saved progress. Subscriptions and refunds are managed by Apple. Purchases cannot be shared with other people through Family Sharing.
6. This website and support e-mails
This website sets no cookies and loads no analytics, advertising, fonts, scripts or images from other companies. Like any website, the server that delivers it receives your IP address, the time of your request and the page you asked for, and may keep them in ordinary server logs for security and reliability. The site is hosted by Cloudflare, Inc. (Cloudflare Pages), which handles those logs under its own policies. Links to Apple, Google and the Information Commissioner’s Office lead to their sites, where their own policies apply.
If you e-mail support@megizi-studio.com, we receive your e-mail address and whatever you write. We use it only to reply and to deal with your request. Messages sent to that address are received by Cloudflare’s Email Routing service, which forwards them to the mailbox we use; the provider of that mailbox stores them on our behalf. We keep support e-mails only for as long as we need them to deal with your request and any follow-up.
7. Why we use information, and who receives it
We share personal data with other organisations only where this is needed to run Jigglow: to deliver the pictures you choose, to check purchases, to show ads, to host this website and to handle support e-mails. We do not sell personal data: we do not give or rent it to anyone in return for money. Google pays us for the ads shown in the app, and its software collects the data described in section 4 directly from your device to deliver them.
| Recipient | What it receives | Its role and the terms that apply |
|---|---|---|
| Apple | Your purchases and Apple Account details, which Apple handles itself through the App Store; from our content server, the transaction ID of a purchase when we check it with Apple (sections 3 and 5) | Decides for itself how it uses this data (an independent controller), under Apple’s Privacy Policy. We use Apple’s services under the Apple Developer Program License Agreement. |
| Google (AdMob and User Messaging Platform) | The data its advertising and consent software collects from your device (section 4) | An independent controller. Google’s published data protection terms for AdMob, the Google Ads Controller-Controller Data Protection Terms, say that Google and the app’s publisher each act as an independent controller and must each comply with data protection law. Google’s privacy policy applies to Google’s own use. |
| OVHcloud | Everything our content server receives (section 3) passes through OVHcloud’s infrastructure, and OVHcloud may keep its own infrastructure logs | Hosts the server on our behalf (a processor). OVHcloud’s customer terms include a data processing agreement under which it processes personal data only to provide its service, applies security measures and keeps its staff under confidentiality obligations. |
| Cloudflare, Inc. (Cloudflare Pages) | For this website, your IP address, the time and the page you asked for (section 6); for support e-mails, the messages that its Email Routing service receives and forwards to our mailbox | Acts on our behalf (a processor) for this data. Cloudflare’s customer agreement incorporates its Data Processing Addendum, which requires security measures and confidentiality and sets out how personal data may be transferred out of the UK. |
| The provider of our mailbox | Support e-mails forwarded to our mailbox, which it stores (section 6) | Stores e-mail on our behalf under its own terms. |
Where a provider processes personal data on our behalf, the terms above limit it to providing its service. Apple and Google decide for themselves how they use the data they receive and are responsible for that use under data protection law.
| Purpose | Information | Legal basis (UK GDPR) |
|---|---|---|
| Delivering the pictures you choose and checking paid pictures | Picture hash, IP address, Apple-signed transaction data | Performance of our contract with you (providing the app and what you bought) |
| Security and preventing abuse of the content server | IP address and pseudonymous codes held in memory; technical log fields | Our legitimate interests in keeping the service secure and available |
| Showing ads | Data that Google processes for ads and consent (section 4) | Your consent, where the law requires it, given through Google’s consent form; Google is an independent controller |
| Answering your e-mails | Your e-mail address and message | Our legitimate interests in helping you, and performance of our contract with you |
8. How long information is kept
- On your device: until you delete a puzzle or uninstall the app.
- Our content server: request counters for short periods in memory only; application logs in size-limited rolling files; no per-request access log; no stored transaction data or tokens (section 3).
- Our hosting provider: under its own policies.
- Support e-mails: as long as needed to deal with your request.
- Google and Apple: under their own policies and periods, not ours.
9. Your rights
Under the UK GDPR, and under the EU GDPR where it applies, you may have the right to be informed, to access, correct, erase, restrict and object to the processing of your personal data, to data portability, and to withdraw consent at any time. Because Jigglow has no accounts there is normally no personal profile for us to look up: write to support@megizi-studio.com and we will explain what, if anything, we hold and what we can do. To withdraw consent for ads use Settings → Legal → Privacy options where it is shown. Rights over data held by Google or Apple are exercised with them.
You may complain to the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint) or, in the European Economic Area, to your local data protection authority.
10. Children
Jigglow is made for a general audience. It is not directed to children and is not in Apple’s Kids Category, and its ad requests are limited to content rated G. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.
11. International transfers
Google and Apple may process data in countries outside the UK and the European Economic Area under their own transfer mechanisms. Our content server is located in the Asia-Pacific (APAC) region, which may be outside the UK and the European Economic Area; the data it receives is limited to what section 3 describes. Cloudflare’s Data Processing Addendum uses the UK Addendum to the EU standard contractual clauses for transfers of personal data out of the UK.
12. Changes to this policy
If a feature changes how information is handled, for example if analytics or a tracking prompt were added, we will update this policy and its effective date before the change takes effect.
13. Contact
Suki Tai, trading as Megizi Studio · support@megizi-studio.com
See also the Terms of Use and Subscription information.