Blanked

Privacy Policy

Last updated: 14 April 2026

We built Blanked because we love memory games and we respect the people who play them. This policy explains, in plain English, what we collect, why we collect it, who we share it with, and what rights you have. No dark patterns, no selling your data, no surprises.

If anything here is unclear, email us at hello@playblanked.com and we'll explain it.

Who we are

Blanked is operated from Gibraltar. When we say “Blanked”, “we”, “us”, or “our” in this policy, we mean the operators of the Blanked mobile app and this website. We are the data controller for the personal information described below.

What we collect

Here's everything we collect, and why.

Account information

  • Account ID — a random UUID generated by our auth system so we can tell one player from another
  • Email address — from Apple Sign In (which may be a real address or Apple's private relay address, your choice) or from email sign-up. Used solely for account recovery and important account-related emails. We don't send marketing unless you opt in.
  • Username — the name you pick; visible to your friends and on leaderboards
  • Profile photo — only if you upload one. Stored in Supabase Storage.

Gameplay data

  • Levels played, stars earned, world progression, memory-score averages
  • Power-up usage, gems earned and spent, in-app purchase records
  • Daily activity timestamps (for streak tracking)
  • Streak length, streak-shield count, last-play date (for streak recovery)
  • Tutorial-seen flag (so we don't show tutorials twice)
  • Cosmetic loadout (equipped frame, banner, avatar expression)
  • Subscription status (for Blanked+ entitlement)
  • Notification preferences

We use this data to save your progress, balance game difficulty, power our admin analytics dashboard (so we know which levels are too hard or too easy), and deliver the subscription features you've paid for.

Social data

  • Friend connections (who you've added / accepted)
  • Head-to-head challenge results with your friends

Device and technical data

  • Push notification token — an anonymous device identifier from Expo, so we can send streak reminders and friend-challenge alerts (only with your permission)
  • Advertising identifier (IDFA on iOS) — only if you grant App Tracking Transparency permission. If you say no (or don't answer), we serve non-personalised ads instead. You can change this any time in iOS Settings → Privacy → Tracking.
  • IP address — seen by ad networks and our hosting provider as a normal part of internet traffic. Not stored in our app database.

Purchase data

  • Transaction records for in-app purchases (processed by Apple — we never see your card or payment details)
  • RevenueCat subscription status (for Blanked+)

What we don't collect

  • Your real name, unless you choose to put it in your username or display name
  • Your location (no GPS, no geolocation APIs)
  • Your contacts or address book
  • Your camera roll or photos (other than the one profile photo you explicitly upload)
  • Your browsing history
  • Your microphone or camera in real-time

What other players can see

When you connect with friends in Blanked, they can see:

  • Your username
  • Your profile photo (if uploaded)
  • Your equipped cosmetics — frame, banner, avatar expression
  • Your total stars, highest world reached, memory-score average, and current streak length
  • Your head-to-head challenge results with them
  • Your online / recently active / offline status

Your email address, account ID, purchase history, streak-shield count, and daily activity timestamps are never shown to other players.

Third-party services

Blanked uses the following services. Each one gets the minimum data needed to do its job.

  • Supabase — our database and authentication provider. Stores your account, gameplay data, profile photo, and friend connections. Servers located in the EU (London, eu-west-2).
  • Apple Sign In — authentication. Apple hands us your account ID and either your real email or a private relay address (your choice).
  • RevenueCat — manages subscription entitlements (Blanked+). Sees your Apple purchase receipts but not your card details.
  • Expo — push notifications. Stores the anonymous push token we use to send your streak reminders and challenge alerts.
  • Google AdMob (via react-native-google-mobile-ads) — serves in-app advertising. AdMob may collect your device advertising identifier, IP address, and ad-interaction data. If you've granted App Tracking Transparency permission, ads may be personalised; otherwise, they're non-personalised. See Google's privacy policy for details.
  • Apple App Store — processes your in-app purchases. Governed by Apple's privacy policy.

In the future we may add Sentryfor crash reporting. We'll update this policy and notify users before that ships.

We do not sell your data. Not to advertisers, not to data brokers, not to anyone. Data is only shared with the services above, and only as far as necessary for them to function.

Advertising and tracking

Blanked shows ads from Google AdMob to support the free-to-play experience. On iOS, Apple requires us to ask for your permission before tracking you across apps (App Tracking Transparency). When you first launch Blanked, you'll see Apple's standard prompt.

  • If you allow tracking, AdMob may use your device advertising identifier (IDFA) to show ads that are more relevant to you
  • If you don't allow tracking, AdMob serves non-personalised ads based only on coarse signals like the app category
  • You can change your choice any time in iOS Settings → Privacy & Security → Tracking, or switch off personalised ads entirely in Settings → Privacy & Security → Apple Advertising

Blanked+ subscribers don't see ads.

International data transfers

Our databases are hosted by Supabase in the EU (London, eu-west-2). Some of our other providers — Apple, Google (AdMob), and Expo — may process your data in the United States or other countries. Where personal data is transferred outside the UK / EEA / Gibraltar, we rely on Standard Contractual Clauses (SCCs) approved by the relevant authorities to ensure your data is protected to an equivalent standard.

Legal basis for processing

If you're in the UK, EEA, or Gibraltar, we rely on one of the following legal bases for each type of processing:

  • Contract — to provide the Blanked service you signed up for (account management, gameplay, purchases, subscription entitlement, friend features)
  • Legitimate interests — game-balance analytics, fraud prevention, product improvement. You can object to this processing any time — see “Your rights” below.
  • Consent — personalised advertising (where you granted App Tracking Transparency permission), push notifications, optional marketing emails. You can withdraw consent at any time.
  • Legal obligation — keeping purchase records for tax and consumer-rights compliance

Your rights

Under Gibraltar, UK, and EU data-protection law, you have the following rights. We'll respond to any request within 30 days.

  • Right of access — request a copy of the personal data we hold about you
  • Right to rectification — correct inaccurate or incomplete data
  • Right to erasure (“right to be forgotten”) — delete your account and all associated data. You can do this yourself at any time from Settings → Profile → Delete Account inside the app, or by emailing us.
  • Right to data portability — receive your data in a portable, machine-readable format
  • Right to restrict processing — ask us to pause certain uses of your data
  • Right to object — object to processing based on legitimate interests (e.g. analytics) or direct marketing
  • Right to withdraw consent — for anything you previously consented to (such as personalised ads or push notifications)
  • Right to lodge a complaint — with your local data-protection authority:
    • Gibraltar: Gibraltar Regulatory Authority — gra.gi
    • UK: Information Commissioner's Office — ico.org.uk
    • EU: your national supervisory authority (see edpb.europa.eu)

To exercise any of these rights, email hello@playblanked.com.

Data retention

  • Account data — kept while your account is active. When you delete your account (in-app or by request), we remove it from our live systems within 30 days.
  • Backups — Supabase retains encrypted backups for up to 7 days after deletion for disaster recovery. After that window your data is unrecoverable.
  • Analytics events (game-balance and economy data) — kept for up to 24 months, after which they're either anonymised or deleted
  • Purchase records — kept for as long as required by tax and consumer-protection law (typically 6 years in the UK / Gibraltar)

Data security

We implement appropriate technical and organisational measures to protect your personal data — encrypted connections (HTTPS/TLS everywhere), row-level security on our database, hashed authentication tokens, and principle-of-least-privilege access for our team. No internet transmission or storage system is ever 100% secure, but we take this seriously and treat any breach as the emergency it is.

Children's privacy

Blanked is rated 4+ on the App Store — it's a memory game with no violent or adult content. That said, we don't knowingly collect personal information from children under 13 (or the relevant age in your country — this can be as high as 16 in some EU member states) without verifiable parental consent.

If you're a parent or guardian and you believe your child signed up without your permission, email us at hello@playblanked.com and we'll delete the account promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes — like adding a new third-party service or changing how we use your data — we'll notify you in-app before they take effect. The “Last updated” date at the top of this page always reflects the current version.

Contact us

Questions about this policy? Want to exercise your data rights? Just reply to any of our emails, or contact us directly:

Email: hello@playblanked.com

Users in the UK, EEA, or Gibraltar can reach our data-protection contact at the same address.