Maze67 Privacy Policy

Effective and last updated: August 31, 2026

This policy describes the Android game Maze67 (package com.gravestory.maze67), its leaderboard service, and the developer-only Maze67 YouTube publishing utility. You can play the complete local game without creating a leaderboard identity.

Data we process

• Leaderboard identity: a public username and random public player ID after you choose to claim a username.
• Authentication: random account tokens and Recovery codes. Tokens are stored in Android secure storage; the service stores only cryptographic hashes.
• Scores: level, completion time, random run ID, app version, texture mode, and submission time. The public leaderboard shows username, player ID, level, time, and rank.
• Moderation: reports you submit, including the reported player, reason, optional details, status, reviewer decision, and an audit record.
• Security: short-lived keyed network identifiers and request counters used for rate limiting. The application database does not store raw IP addresses, advertising IDs, or device IDs.
• On-device data: campaign progress, blocked-player IDs, cached leaderboards, and pending score submissions. Account credentials and the Recovery code use Android secure storage.
• Age handling: Google Play Age Signals may provide an age range or parental-approval status. Maze67 uses that information only for age-appropriate access and parental approval; it is not used for advertising, marketing, profiling, or analytics. Separately, a birth date is checked on this device and immediately discarded. Android secure storage keeps only the derived teen or adult age band and verification time. To configure age-appropriate consent and ad requests, Maze67 sends Google Mobile Ads and UMP only a derived teen-or-adult advertising treatment signal. Maze67 does not send the birth date, exact age, or Play Age Signals response to Google. The Maze67 service and leaderboard database receive no age data.
• Ranked Score integrity: Google Play Integrity processes app recognition, licensing, and device integrity for Ranked Score verification. Maze67 retains only the bound request hash, provider timestamp, coarse accepted verdict class, and bounded decision code. Maze67 does not retain raw integrity tokens, full Google responses, Google identity, advertising IDs, raw IP addresses, or stable device identifiers.

YouTube API Services

The developer-only Maze67 Windows Publisher uses YouTube API Services solely to publish approved, original Maze67 gameplay videos to the developer-owned Maze67 YouTube channel. The publisher is not distributed to other users and cannot authorise or manage third-party channels.

• OAuth and scopes: the publisher uses youtube.upload to upload videos and youtube.readonly to confirm the authorised channel and the resulting public video.
• YouTube data processed: the authorised channel ID; video IDs; titles, descriptions, tags, categories, privacy status, and other upload metadata; and API responses needed to confirm each upload.
• Storage and retention: the OAuth client credential and refresh token are encrypted with Windows Data Protection API for the authorised Windows account. Access tokens are used for API requests and are not written to long-term storage. Local publishing receipts may retain video IDs, public URLs, upload metadata, and API status for operational and compliance records. No YouTube user data is sent to the public leaderboard service.

Use of YouTube data is subject to the YouTube API Services Terms of Service, the YouTube API Services Developer Policies, and the Google Privacy Policy. The authorised account owner can review or revoke access in Google Account connections; revocation stops further API access. The operator can remove the local OAuth credential and can manage or delete published videos in YouTube Studio. YouTube data is not sold or shared with third parties.

Ads and consent

The Android app uses Google Mobile Ads and Google's User Messaging Platform. Players ages 13–17 receive limited, non-personalized ads. Adults may receive personalized ads only where regional rules and their consent allow it. Google receives the derived teen-or-adult advertising treatment signal for advertising and legal compliance. The Google Mobile Ads SDK automatically collects and shares IP-derived approximate location, app interactions, diagnostic information, and device and account identifiers for advertising, analytics, and fraud prevention; consent and limited-ads settings may restrict identifier use. Ads are not tied to Maze67 leaderboard accounts, and the Maze67 service does not receive or store advertising IDs.

Why we process data

We use this data to provide the leaderboard, keep the best score for each player and level, sync pending submissions, prevent duplicate or abusive requests, enforce username rules, process reports, and protect the service.

Sharing and service providers

Public leaderboard fields are visible to other players. Cloudflare provides the Worker and D1 database infrastructure. Google provides Play Integrity, advertising, and consent services. We do not sell leaderboard account data.

Retention and deletion

Scores and active account data are retained while the account exists. Issued Ranked authorizations expire after 48 hours; terminal authorization records and credential-recovery receipts expire after 30 days. Rate-limit records expire automatically. Reports and moderation audit records are retained as needed for safety and service integrity. Account deletion removes public username, credentials, scores, and reports involving the account. A non-public player tombstone and keyed username fingerprint may remain to prevent identity reuse, preserve moderation integrity, and defend against abuse.

Use the saved Recovery code to restore the same username on a replacement device or to permanently delete the identity through the app's account controls or web deletion tool. Recovery does not transfer campaign progress. Local Scores are not transferred. Without the code, Maze67 and support cannot restore the identity.

Your choices

You may play offline without a public username, decline or limit ad consent where the consent form offers those choices, use Ad privacy choices when required, update locally stored age information, block leaderboard players locally, report usernames, or delete the leaderboard account.

Children

Maze67 is intended for players age 13 and older. A reported under-13 player cannot activate gameplay, leaderboard accounts, purchases, UMP, or Mobile Ads. The app does not ask for a real name, email address, precise location, contacts, microphone, camera, or phone data.

Contact

Maze67 is published by Gravestory Labs. For privacy or support questions, email j3k420@gmail.com.

Policy changes

Material changes will be published on this page with a new effective date before the related app behavior is released.