_______ _ _ |__ __| | | | | | |_ _ _ __ ___ | |__ | | ___ | | | | | '_ ` _ \ | '_ \| |/ _ \ | | |_| | | | | | | | |_) | | __/ |_|\__,_|_| |_| |_| |_.__/|_|\___|

Privacy Policy

Last updated: May 10, 2026

What We Collect

Account information — email address and display name when you sign up.
Authentication identifiers — a Cognito user ID; if you sign in with Google or Apple, the provider’s identity token.
Camera and microphone — photos and videos you capture during gameplay (your “proofs”).
Game data — game history, who you played with, in-game comments.
Device tokens — push-notification tokens (if you allow notifications).
Logs — request metadata and error traces for debugging.
Donations — if you choose to donate in-app, we receive the donation amount, currency, and a transaction reference from the payment processor. We do not receive or store your card number, expiry, or CVC — those are handled directly by Stripe (Android) or Apple In-App Purchase (iOS) under their own privacy terms.

How We Use Your Data

Solely to provide the Tumble game experience: compiling recap videos, managing your account, sending game-related notifications, and operating the moderation systems described below. We do not sell your personal information.

Photos and Videos

Proofs you capture are uploaded to our servers in Sydney, Australia. They are visible only to other players in the same game session and are stitched into a recap video once the game ends.

Content Moderation

To keep Tumble safe, every uploaded proof is automatically scanned for inappropriate content (nudity, violence, gore, weapons, hate symbols) before it appears in any recap. Scanning is performed by Sightengine (a third-party automated moderation service); only the image data and the moderation result are exchanged. No personally identifying account data is sent to Sightengine.

Text fields you submit (display name, game name, comments) are screened locally for profanity before being saved.

You can also report content or block other players from inside the app. Reports and moderation actions are stored in our audit log so we can demonstrate compliance with platform policies.

Data Storage and Retention

Data is stored on Amazon Web Services in the ap-southeast-2 (Sydney) region. Account data is retained until you delete your account in-app or request deletion. Game data and proofs are retained while the relevant game exists. Content flagged by automated moderation or by user reports remains in storage but is excluded from recap videos and hidden from other players; audit log entries documenting moderation actions are retained for 12 months for compliance.

Third-Party Services

Amazon Web Services — hosting, storage, authentication.
Google Sign-In and Apple Sign-In — optional authentication.
Sightengine — automated content moderation (see above).
Expo Push Notifications — delivering push notifications.
Stripe — processes Android donation payments. Card data is collected by Stripe directly; we never see it. See Stripe’s privacy policy.
Apple In-App Purchase — processes iOS donations under Apple’s privacy terms; we receive only a transaction identifier and product tier from Apple.

Your Rights

You can delete your account and all personally identifying data from inside the Tumble app (Account → Delete Account). Once deleted, your account information, blocks, and game-participation records are removed; old proof attribution becomes anonymous. Some data may be retained where we are legally required to do so.

You may also request a copy of your data by emailing the address below.

Children

Tumble is rated 12+ and is not directed to children under 13. We do not knowingly collect data from children under 13.

Contact

For privacy questions or to exercise your rights, contact support@cucocode.com.