Privacy Policy

Plumvia, the game studio of Celerora LLC (a Texas limited liability company), respects your privacy. This Privacy Policy describes how we handle personal information across our website at plumvia.com and our games (together, the "Services"). Our current releases show no third-party ads and do not use an advertising identifier.

For the purposes of data protection law, Celerora LLC, operating as Plumvia, is the controller of personal information processed through the Services. You can reach us at privacy@plumvia.com.

Information you give us

• Contact form: when you message us, we collect your name, email address, and the contents of your message.
• User content: if a game lets you create or share content with others — such as a display name, profile details, or messages — we collect what you submit.
• Reports: if you report another player's display name, we store the report — your account identifier, theirs, the name as it appeared, and when. We use it only to review the name. The person reported is not told who reported them.
• Notification tokens: kept while notifications are on for that device. We remove a token when Apple or Google report it is no longer valid, and tokens are deleted with your account.
• Launch waitlist: if you ask to be notified when a game launches, we store your email address and use it only to send that announcement. You can remove yourself at any time using the unsubscribe link in any email we send, or by emailing privacy@plumvia.com.

Information collected automatically

• Device & usage data: such as IP address, browser or device type, pages or screens viewed, and timestamps.
• Security signals: data needed to prevent spam and abuse, including rate-limiting and CAPTCHA checks on our website, and a device-integrity check when a game contacts our servers (see Google Firebase below).
• Crash reports: when a game crashes, we receive an automatic report containing the technical details of the failure — a stack trace plus your device model, operating system version, and the app version. These reports carry no name, email address, or account identifier.

Game data

• Gameplay: progress, scores, streaks, and settings needed to run a game on your device or account.
• Purchases: if you buy something, the relevant app store processes your payment. We receive confirmation of the transaction but not your full payment details.

Friend leaderboard & Firebase (Google)

When you first open Zigora we create an account for you through Google Firebase Authentication and give it a friend code. By default the account is anonymous — a random identifier, with no email, password, or real name — and it exists so your progress has somewhere to live and so the optional private friend leaderboard and Mystery Duels (head-to-head on the daily hidden word) work if you choose to use them. If you use those features, we also store the following in Google Cloud Firestore:

• a display name you choose (please don't use your real name);
• the friend connections you make — you add friends by code, and we never access your contacts; and
• your Daily Challenge scores, so you and the friends you connect with can see each other's results.

Linking an email (optional). You can choose to link an email address so your account and progress come back if you reinstall or switch phones. If you do, we store your email address and send you a short sign-in code — we never ask for a password. The address is used only to sign you back in and to recover your account. You can delete your account, and the linked address with it, from inside the game at any time. Players who never link an email stay fully anonymous to us.

Google processes this data as our infrastructure provider, over encrypted connections (HTTPS/TLS). Your display name and scores are visible only to friends you connect with. The feature is optional; you can remove friends at any time, delete your account from inside the game, or ask us to delete your leaderboard data at privacy@plumvia.com. We do not use this data for advertising, and we do not sell it.

Push notifications

If you turn on notifications, we store a notification token issued by Apple or Google for that device, together with the platform name. That token is what lets Apple or Google deliver a message to your device. It is linked to your game account, and we store one for each device you use — older ones drop off as you add new devices.

We use it only to send the notifications you asked for: a friend request, someone accepting yours or claiming your invitation, and when it is your turn in a game. We never use it for advertising or tracking. Apple and Google deliver these messages on our behalf.

You can turn notifications off at any time in your device settings. We remove a token once Apple or Google tell us it has stopped working, and it is deleted with the rest of your data if you delete your account.

• to provide, maintain, and improve the Services;
• to respond to your messages and support requests;
• to send you notifications you have turned on, such as friend requests and game turns;
• to protect against spam, fraud, and abuse;
• to understand how the Services are used; and
• to comply with legal obligations.

Where required, our legal bases are your consent, performance of a contract, our legitimate interests in operating and securing the Services, and compliance with law.

We and our providers use cookies and similar technologies to keep the Services secure and working properly. For example, our anti-abuse provider (Cloudflare Turnstile) may set cookies to verify that requests come from real people. You can control cookies through your browser settings; disabling some may affect functionality.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose it only to service providers that process data on our behalf, and only as needed to run the Services:

• Vercel — website hosting and content delivery.
• Resend — delivering contact-form emails to us and sign-in codes to players.
• Cloudflare — bot/spam protection (Turnstile) and network services.
• Upstash — rate limiting and storage for our forms (waitlist signups and contact submissions).
• Google Firebase — authentication, database, crash reporting, and app verification (Firebase Authentication, Cloud Firestore, Firebase Crashlytics, and Firebase App Check). Authentication and the database power Zigora's optional friend leaderboard and Mystery Duels; Crashlytics receives automatic crash reports so we can fix what breaks. App Check confirms a request comes from a genuine, unmodified copy of our app on a real device — using Google Play Integrity on Android and Apple's App Attest on iOS, which means those services receive device-integrity signals when the game contacts us. It carries no name, email address, or account identifier. Google processes this data as our infrastructure provider, over encrypted connections. See the Friend leaderboard details above.
• GameAnalytics — analytics for our games. This involves app-usage and gameplay events, device and app information, and a device identifier (Android app-set ID or Apple's IDFV), used to understand how our games are played and to improve them. It is not used for cross-app tracking and does not use advertising identifiers such as IDFA. Handled under GameAnalytics' privacy policy.
• Apple Push Notification service & Firebase Cloud Messaging (Google) — delivering the notifications you have turned on. They receive the notification token for your device and the message being sent, so it can reach you. They do not receive your game progress or your friend list.
• Apple App Store & Google Play — distribution and payment processing for our games, under their own privacy policies.

We may also disclose information to comply with the law, enforce our Terms, or protect the rights and safety of our users and Celerora LLC, and in connection with a merger, acquisition, or sale of assets.

Our Services are not directed to children under 13 (or the minimum age required by your local law), and we do not knowingly collect personal information from them. Where a specific game is intended for children, we will handle data in accordance with applicable laws such as COPPA and the GDPR. If you believe a child has provided us personal information, contact us at privacy@plumvia.com and we will delete it.

We keep personal information only as long as needed for the purposes described here, then delete or anonymize it. In general:

• Contact messages: kept while we handle your inquiry and for a reasonable follow-up period.
• Security & rate-limit logs (including IP): kept short-term to detect and prevent abuse.
• Game progress & purchase records: kept while you use the game and as needed for support, accounting, and legal obligations.
• Analytics & crash data: analytics data is kept by GameAnalytics for 12 months on a rolling basis and then anonymized or deleted; crash reports are kept by Firebase Crashlytics for 90 days.
• Friend leaderboard data: your display name, friend connections, and scores are kept until you delete them or ask us to delete them; inactive anonymous accounts may be cleared periodically.
• Launch waitlist: your email address and the date you signed up are kept until you unsubscribe or ask us to remove them, or until the launch announcement has been sent.
• Support and moderation records: when someone on our team looks at your information to answer a message or review a report, we record who did it and when. We keep those records for 24 months so we can account for how your information was handled.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA), among others, have specific rights, including the right not to receive discriminatory treatment for exercising them. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

To make a request, email privacy@plumvia.com. We may need to verify your identity before responding.

You can turn notifications off at any time in your device settings, or in the game where it offers the choice.

Some browsers and devices let you send a Global Privacy Control (GPC) signal. Where required by law, we treat a GPC signal as a request to opt out of any "sale" or "sharing" of personal information. As described above, we do not sell personal information or share it for cross-context behavioral advertising.

We operate from Texas, USA and our providers may process data in other countries. Where we transfer personal information across borders, we rely on the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism where one applies.

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Services may link to third-party sites and platforms (such as app stores). Their privacy practices are governed by their own policies, and we are not responsible for them.

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above and, for material changes, provide additional notice where appropriate.

Questions or requests about your privacy? Email privacy@plumvia.com or use our contact page.