Privacy policy

Last updated: 1 November 2026.

This policy covers all of Nordbeam's games. Our games share one server and the same data practices, so this is one text. It explains what the apps and the server collect, why, and how to delete it. We keep it short because there is little to collect: no ads, no tracking, no selling of data.

Who is responsible

Nordbeam AB is the data controller. Contact: hello@nordbeam.io.

What we collect

• A guest account. When you open one of our games it creates an account with a display name you choose (1 to 20 characters), a random account id and a random secret token. One account works in all our games. Only a hash of the token is stored on our server, so we cannot read it back. The token is stored on your device and, if you have iCloud Keychain turned on, in your iCloud Keychain, which Apple syncs between your devices; we have no access to it. There is no email, password, phone number or sign-in with another service.
• Your display name. The other players see it during a game and in their game list. Names are checked against a list of unacceptable words.
• Games. For online games we keep the match, who played, the moves made (in a question game, the questions asked and answered), the hidden pieces each player chose or was dealt, and the result. Rooms for friends use a four-character code that expires after 24 hours if nobody joins. Practice games against the built-in bot, in-person games and playing the Daily run on your device and only send the server what is described here. Game state in the live room is deleted 7 days after a game ends, and the match list entry 30 days after it ends. For your statistics we also keep one line per finished online game (won, lost or drawn, your placing, how many moves or questions you made, which mode, who the opponents were) with your account until you delete it.
• Daily results. The date, your score (such as the number of questions), whether you solved it, your result glyphs and the short text you can share, linked to your account, for your streak and the daily ranking. Kept for 13 months.
• Notification tokens. If you allow notifications, Apple gives the app a push token. We store it with your account, the language of your device and whether it is a test or production build, to tell you when it is your turn, when a friend invites you, or when a game ends. Live Activity tokens work the same way and are removed when the game ends. A token is deleted when Apple reports it invalid, or when it is not refreshed for 180 days.
• Purchases. Apple sells and bills the Tabletop Pass, a game's one-time unlock and Magnet Plus: we never see your card, your Apple Account or your billing address. When you buy one, the app sends our server the receipt Apple signed for that purchase, and Apple's server tells ours when a subscription renews, ends or is refunded. With your account we keep: which product it is, the transaction ids Apple assigned, when it was bought and when it ends, whether it is a free trial, whether it reached you through Family Sharing, and whether it was refunded. Each purchase also carries a random token derived from your account id, so that Apple's notices reach the right account. We keep this so that a pass bought in one of our apps works in the others, and so that Magnet Plus covers your partner's door too. It is kept as long as your account exists.
• Reports and blocks. If you report or block a player, we store who reported whom, the game, the reason you chose and the reported name at that time. Reports are kept for 12 months. A block is kept until you remove it or delete your account. If reports show that an account is abusive we can reset its name or stop it from playing online, and we note that on the account.
• Crash and performance reports. The app can send diagnostics collected by iOS (MetricKit): crash, hang and performance reports with the app version and iOS version. They are linked to your random account id when you have one, and deleted after 30 days.
• Technical logs. Cloudflare, which runs our server, processes your IP address to deliver requests, to limit abuse and to keep short-lived request logs. Our own log lines contain account and match ids, not your name or token.
• Anonymous counters. The app counts a few events (the app was opened, the tutorial was started or finished, a few screens were opened or shared, the purchase screen was shown, and a purchase was started, made or restored) and the server counts events such as "a game was created". A counter stores only the day, the event name, a short detail (such as which product, or what opened the purchase screen) and, for app events, the language and version of the app. It has no account id, no IP address and no device identifier, so it cannot be tied to you.

We do not collect your location, contacts, photos, payment details, advertising identifier or anything for advertising. There is no chat: players only send preset emotes.

Why we use it

To run the games you asked for (account, matches, notifications, Daily results) and to give you what you bought, and for our legitimate interests in keeping the game safe and working (blocks, reports, abuse limits, crash reports). Notifications are only sent if you allow them in iOS settings.

Who receives it

• Cloudflare, Inc. hosts the server and database as our processor.
• Apple delivers push notifications and Live Activity updates. Apple also sells and bills in-app purchases under its own terms and privacy policy, and tells our server about them.
• The other players in a game see your display name and your moves.

Some of this processing can take place outside the EU and EEA, under the safeguards these providers offer. We do not sell your data and we do not share it with advertisers or data brokers.

Delete everything

In any of our apps, open Settings, then Delete my data. This removes your account (which is shared by all our games) and display name, your game statistics, notification and Live Activity tokens, blocks, invites and the records of your purchases. Deleting your data does not cancel a subscription: cancel it in your Apple Account settings. Your purchases stay with your Apple Account, so Restore Purchases in the app brings them back to a new account. Games in progress are resigned so the other players are not left waiting, and past games show "Deleted player". Reports about you and Daily results are kept without any link to you. Backups kept by Cloudflare for disaster recovery can hold a copy for up to 30 days. The app also removes the token from your device and iCloud Keychain.

Accounts that have not been used for 18 months are deleted automatically.

If you cannot use the app, email hello@nordbeam.io from a device you used with one of our games and tell us your display name; we may ask you to prove it is yours.

Your rights

If you are in the EU or EEA you can ask us for access to your data, correction, deletion, a portable copy, or object to processing. Changing your name in Settings corrects it; deletion is in the app. For everything else, write to hello@nordbeam.io. You can also complain to your data protection authority (in Sweden, Integritetsskyddsmyndigheten, IMY).

Changes

If we change this policy in a way that matters, we will update the date above and tell you in the app.