LEGAL

Privacy Policy

ELBA Solutions is a one-person indie studio. This page explains, in plain language, what happens to your information when you visit this website, use the contact form, or play one of the studio's games. It is also the official privacy policy for every ELBA Solutions app, on Google Play and on the Apple App Store.

Last updated: 25 September 2026

Permanent address of this policy: https://elba-solutions.com/privacy-policy

The short version

This website has no ad pixels and shows no ads. It does use Google Analytics to count visits and see which pages people read, which sets analytics cookies on your device. The studio's mobile apps are free and supported by ads: they display ads through Google AdMob, which uses your device's advertising ID. No account is required, the apps never ask for your email, contacts, or precise location, and no data is ever sold. Game data stays on your device, with two exceptions: Quizinho has a public ranking list that shows the nickname you choose, your country, and your score — and you can switch it off — and Mills passes the name you type and your moves through a relay server while an online match is running. The apps also send automatic crash reports to Sentry in the EU: technical details about the failure, never anything you typed.

Who is responsible

ELBA Solutions (Elbin Hasic, one-person studio, Bosnia and Herzegovina) is the data controller for this website and for the apps published under the ELBA Solutions developer account on Google Play and the Apple App Store. Contact: elba.solutions.dev@gmail.com.

What this website collects

Browsing the site does not require an account and places no advertising cookies on your device. Two kinds of cookie can be set: a language preference cookie, only after you switch languages yourself, and the Google Analytics cookies described in the next section. The web host keeps short-lived server logs (IP address, browser user-agent, requested URL, timestamp) for security and abuse prevention. These logs are not used to build profiles and are rotated on the host's standard schedule.

Website analytics

This website uses Google Analytics 4 (the gtag.js tag) so the studio can see how many people visit and which pages are useful. The tag sets first-party cookies (_ga and _ga_<id>) that hold a randomly generated identifier for your browser, and sends Google the pages you view, referrer, approximate location derived from your IP address, and basic device and browser information. IP addresses are anonymised by Google Analytics 4 and are not stored. The studio sees only aggregated reports and never uses this data to identify an individual visitor.

You can opt out at any time by blocking cookies for this site in your browser, using its "Do Not Track" or tracking-protection setting, or installing the Google Analytics Opt-out Browser Add-on.

The contact form

If you send a message through the contact form, the name, email address, optional subject, and message you provide are transmitted by email to the studio inbox. That information is used only to read and reply to your message. It isn't added to a mailing list, shared with third parties, or used for marketing. Messages are kept as long as needed to handle the conversation, then deleted.

Mobile games & apps

The games and apps published under ELBA Solutions on Google Play and the Apple App Store are free, ad-supported, and work without an account. In short:

  • No sign-up, no account. The apps never ask for your real name, email address, phone number, contacts, microphone, camera, or precise location. Quizinho lets you pick a nickname and, if you like, a profile picture through the system photo picker, which hands the app only the one picture you select. That picture never leaves your device.
  • Game data stays on your device. Progress, high scores, and settings are stored locally on your phone (some apps also allow them into your own Android or iCloud backup, others deliberately keep their data out of system backups). The studio operates no server that receives them — except for Quizinho's ranking list and question updates, and Mills' online matches, both described in the sections below.
  • Ads are the exception. To keep the apps free, they display ads served by Google AdMob, and that advertising SDK does collect data. The "Advertising and the advertising ID" section describes exactly what.
  • Crash reports are the other exception. When an app crashes or hits an unexpected error, it sends a technical report so the failure can be found and fixed. It carries no game content and nothing you typed — see "Crash reports" below.

Quizinho: question updates and the ranking list

Quizinho talks to a server run by the studio (Mills does too, for online matches — see the next section). It does so for two reasons: to download new and corrected quiz questions, and to show a public ranking list of players worldwide and by country. For that, the app sends the studio's server:

  • An installation identifier — a random ID the app creates on first launch, together with the platform (Android, iOS, Windows, or macOS) and the app version. It lets the server issue and revoke access tokens and limit how often a single installation can call it. It is not the advertising ID and is never linked to it.
  • Your ranking profile — the nickname you choose, the country you select, and the app's language, plus a random player identifier created on your device. The nickname starts out as a random code; replacing it is up to you, and it does not have to be your real name.
  • Your scores — total points, best single-quiz score, and number of quizzes played, sent after each quiz so your rank stays current.
  • IP address — visible to the server with every request, as with any internet connection. It is used only in memory, to limit abuse, and is not stored with your profile.

Your nickname, country, total points, and best quiz score are visible to every Quizinho player on the ranking list. Nothing else is shown — not your profile picture and not your identifiers — so choose a nickname you are comfortable showing publicly. Your profile picture, quiz history, answers, and settings stay on your device, and downloading questions carries no personal data.

Leaving the ranking list: in Profile → Settings, turn off Show me on the leaderboard. The app deletes your entry from the ranking list on the server and stops sending your nickname and scores. If you are offline at that moment, the deletion is sent the next time the app connects.

Deleting everything: leaving the ranking list removes your public entry, but the server keeps the nickname, country, and language you last sent, along with the installation record, so that switching back on restores your place. To have all of it deleted, email elba.solutions.dev@gmail.com with the nickname and country shown on the ranking list, and it will be removed within 30 days. Uninstalling the app alone does not remove this server data.

Mills: online matches

Mills has an online 1v1 mode. There is no account and no sign-up: one player creates a room and gets a short game code, the other types it in. The two devices exchange their moves through a relay server run by the studio, which forwards messages and knows nothing about the game itself — the rules and the board stay on the two devices. While a match is in progress, the relay sees:

  • The name you enter — passed to your opponent so each side knows who it is playing. It does not have to be your real name, it is tied to no account, and it is not stored once the match ends.
  • The moves in that match — forwarded between the two devices while the game runs and not kept afterwards. The server stores no game state and no match history.
  • IP address — visible to the server with every request, as with any internet connection. It is used briefly to protect the server from abuse (for example, too many wrong game codes), and the hosting provider may keep it in standard technical server logs for a limited time. It is linked to no profile.

The other game modes need no server at all: playing against the computer and two players on one device are entirely offline, and a Bluetooth match goes directly between the two phones without touching the internet.

Advertising and the advertising ID

ELBA Solutions apps contain ads. Ads are delivered by Google AdMob (the Google Mobile Ads SDK), a Google service. The SDK runs inside the app, requests an ad from Google's ad servers, and displays it. The studio receives only aggregated, anonymous reports (impressions, clicks, revenue) — never data that identifies an individual player.

To serve and measure those ads, the Google Mobile Ads SDK collects the following and sends it to Google, which acts as an independent controller for advertising purposes:

  • Advertising ID — on Android the Google Advertising ID (AAID), on iPhone and iPad the Identifier for Advertisers (IDFA). Either way it is a resettable identifier the operating system provides specifically for advertising, used to cap repeated ads, to measure ad performance, and, where permitted, to select ads relevant to you. On iOS the app receives the IDFA only if you allow tracking in Apple's prompt described below.
  • Device and app information — device model, operating system version, language, screen size, app package name and version, and IP address.
  • Approximate location — derived from the IP address, roughly at country or region level. The apps never request location permissions on either platform and never collect GPS or precise location.
  • Ad interaction data — whether an ad was requested, shown, viewed, or tapped, plus basic diagnostic and crash data from the ads SDK itself.

This data is used for advertising (showing ads and, where you consent, personalising them), fraud prevention, and measurement. The studio does not use it to build a profile of you, does not combine it with anything you send through the contact form, and does not sell it. Google's handling of this data is governed by the Google Privacy Policy and the Google Advertising Services notice.

If you are in the EU, the UK, or Switzerland, the apps show a consent dialog (Google's User Messaging Platform, aligned with the IAB Transparency & Consent Framework) before any personalised ads or non-essential data use. You can accept, refuse, or change your choice later from the app's privacy option. If you refuse, the app still works and still shows ads — they are simply non-personalised. Where consent is not legally required, personalised advertising relies on legitimate interest and you can opt out with the device settings listed below.

On iPhone and iPad there is a second prompt. After the consent dialog above, iOS itself asks, through App Tracking Transparency, whether the app may track you across other companies' apps and websites. If you say no, the app receives no advertising identifier and the ads it shows are non-personalised. Saying no never removes a feature and never leaves the app broken — it keeps working and still shows ads. You can change the answer at any time in the iOS settings listed below.

Crash reports

When an app crashes or hits an unexpected error, it sends an automatic report so the studio can find and fix the failure instead of waiting for someone to describe it in an email. This happens in the Android and iOS apps; the Windows and macOS builds contain no crash-reporting component at all. A report contains:

  • What is sent: the error and its stack trace (the technical path through the code), the app version and build, your device model and operating-system version, and basic context about the state the app was in — the app's language and theme, which screen or game mode you were on, and a short trail of the app's own technical log messages leading up to the failure.
  • What is never sent: your name or nickname, your game history or scores, the contents of anything you created (wheel names and entry texts in Lucky Wheel Spinner, game codes in Mills), and no advertising identifier. Where such text could end up inside an error message, the apps replace it with a placeholder before the report leaves the device, and storage of IP addresses is switched off on the receiving side.
  • Who processes it: Sentry, a crash-reporting service, in its EU region — the reports are stored in Frankfurt, Germany. Only the studio can see them, and they are never used for advertising, analytics about you, or profiling.
  • How long it is kept: up to 30 days, then deleted automatically.

Crash reporting is on by default and has no separate switch in the apps: it collects no personal data, and an app that crashes silently for everyone is a defect the studio has no other way of learning about. If you would rather not send these reports, you can block the app's network access in your system settings, or stop using the app. On both platforms the store itself also collects its own crash reports separately — those are governed by Google's and Apple's policies, and on iOS by whether you agreed to share diagnostics with developers.

Store privacy declarations

This section mirrors the Data safety declaration on the studio's Google Play listings and the App Privacy declaration on its App Store listings:

  • Data collected: device or other IDs (the advertising ID), app activity limited to ad interactions, device and app diagnostics, and approximate location derived from the IP address.
  • Quizinho only, in addition: personal info limited to the nickname you choose, your selected country, and the app language; app activity limited to quiz scores; and device or other IDs (a random installation identifier and player identifier). This data is collected for app functionality — the ranking list and question updates — is not shared with third parties, is encrypted in transit, and can be deleted on request. Appearing on the ranking list is optional.
  • Crash logs and diagnostics: collected, not shared with anyone else, not optional, for app functionality — plus analytics in the narrow sense of how often the apps crash. Google Play groups these under App info and performance; on the App Store the same thing is declared as Crash Data for App Functionality, not linked to your identity and not used for tracking.
  • App Store specifics: the App Privacy declaration lists Device ID and Advertising Data for the ads SDK, marked as linked to you and used for tracking, which is why iOS shows the App Tracking Transparency prompt; and Crash Data, marked neither linked nor tracking. Mills' online mode declares nothing of its own: the name you type is not tied to an account and is not kept after the match.
  • Data shared: the advertising data above is shared with Google AdMob for advertising and measurement. Nothing else is shared with any third party for its own purposes. Crash reports go to Sentry, and Mills' online messages pass through the relay server, as processors acting only on the studio's instructions — which is why both stores' forms record them as collected but not shared.
  • Purposes: app functionality, advertising or marketing, analytics limited to ad performance and crash rates, and fraud prevention and security.
  • Required or optional: ad delivery is required for these free, ad-supported apps to function. Personalisation of those ads is optional and consent-based wherever the law requires consent.
  • Security: everything the apps send — ad requests, crash reports, Quizinho's ranking data and Mills' online messages — travels over encrypted HTTPS connections. This website is served over HTTPS as well.
  • Deletion: the studio holds no user accounts. Crash reports delete themselves after 30 days, and nothing from an online match is kept once it ends. For Quizinho, leaving the ranking list removes your public entry, and an email to the studio removes everything described in the Quizinho section. You can reset or delete the advertising ID at any time in your device settings, and you can email the studio to have any correspondence you sent deleted.

Your choices and how to opt out

You stay in control of the advertising identifier on your own device:

  • Android — reset the advertising ID: Settings → Google → All services → Ads → Reset advertising ID. Earlier ad data can no longer be linked to the new identifier.
  • Android — delete the advertising ID: the same screen offers Delete advertising ID, which stops apps from receiving an identifier at all. Ads then become non-personalised.
  • iPhone and iPad — turn tracking off: Settings → Privacy & Security → Tracking lets you withdraw permission for a single app, or switch off Allow Apps to Request to Track for all of them at once. Settings → Privacy & Security → Apple Advertising separately controls Apple's own personalised ads.
  • Withdraw consent: where the consent dialog applies, reopen it from the app's privacy option and change your answer at any time.
  • Leave the Quizinho ranking list: Profile → Settings → Show me on the leaderboard. See the Quizinho section above.
  • Uninstall: removing an app deletes its local data from your device and ends all collection by that app. For Quizinho, leave the ranking list first, or email the studio, if you also want your server data gone.

Children

The studio's apps are not directed at children. They are not part of the Google Play Families programme, and their target audience on both stores is 13 years and older. The studio does not knowingly collect personal data from children under 13 (or the equivalent minimum age where you live). If you believe a child has provided personal data, email the studio and it will be deleted.

Retention and security

The studio runs no user database apart from Quizinho's. Crash reports are kept by Sentry for up to 30 days and then deleted. Mills' relay server keeps nothing after a match ends, beyond whatever the hosting provider holds in its standard technical logs for a limited time. For Quizinho, the server keeps the installation record and the ranking profile described above until you ask for them to be deleted; access credentials are stored only as a one-way hash. Contact-form emails stay in the studio inbox only as long as the conversation needs, then are deleted. Server logs are rotated by the web host on its standard schedule. Advertising data and Google Analytics data are retained by Google according to Google's own retention periods, not the studio's. All traffic to this website, to the Quizinho server, to the Mills relay, to Sentry, and from the ads SDK uses encrypted HTTPS connections.

Third-party services

These are the only third parties involved, and each has its own privacy policy:

  • Google AdMob — ad serving and measurement inside the apps. See how Google uses data from apps that use its services.
  • Sentry — crash and error reporting inside the Android and iOS apps, processing the reports described above in its EU region (Frankfurt, Germany). See the Sentry privacy policy.
  • Google Play — app distribution, updates, and the crash reporting the Play Store itself collects, all governed by Google's policies. Apart from the Google Mobile Ads SDK and Sentry, the apps embed no other third-party component — no Firebase, no analytics SDK, no social or tracking library.
  • Apple App Store — app distribution and updates on iPhone and iPad, plus the crash and usage diagnostics Apple itself collects and passes to developers only if you agreed to share them, all governed by Apple's policies. The iOS apps check the App Store for a newer version by version number; that check sends no data about you.
  • Google Analytics — audience measurement on this website only (it is not embedded in the apps). See how Google uses data from sites that use its services.
  • Outbound links (LinkedIn, store pages, and similar) lead to services with their own privacy policies. Apart from Google Analytics, this website embeds no third-party trackers, social widgets, or ad pixels.

Your rights

Under the GDPR and similar laws, you can ask what personal data the studio holds about you, request a copy, a correction, or deletion, object to processing, withdraw consent for any future contact, or lodge a complaint with your local data protection authority. If you are a California resident: the studio does not sell personal information and does not share it for cross-context behavioural advertising in the CCPA/CPRA sense. Email elba.solutions.dev@gmail.com and you'll get a reply from a real person, normally within 30 days.

Changes to this policy

If anything material changes — new tools, new data flows, a new ad partner — this page will be updated before the change goes live, and the date at the top will reflect it. The address of this page stays the same, so the link filed with Google Play and the App Store always points at the current version.

Contact

Questions, concerns, or data requests? Reach out at elba.solutions.dev@gmail.com.