Numelo
Privacy Policy
Effective 27 September 2026 · Version 2.0
Version française · Terms of Use
The short version, in five sentences.
Numelo never sells your data, to anyone, ever. A nickname is all you need to play: no real name, no address, no phone number. The children's area, "Numelo Kids", contains no advertising at all, and what it measures (play time, correct calculations) is computed on the device and never leaves it. No image of your face is ever sent anywhere: the selfie filter's face detection runs offline, on the phone. And you can erase everything from this page, without installing anything.
1 · Who is responsible
Numelo (the "App") is published by Hatem Maati, an
independent developer, who is the data controller under the EU General Data
Protection Regulation (GDPR).
Contact for any question or request:
hatemmaati@gmail.com.
2 · What is collected, and why
Each row states the purpose, the GDPR legal basis and how long it is kept. Nothing else is collected.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account identifier (anonymous, or via Apple/Google) |
Restore your progress across your devices | Performance of contract | Until the account is deleted |
| Nickname and avatar | Identify you in duels, leaderboards and friend lists | Performance of contract | Until the account is deleted |
| Gameplay data Numelo rating, XP, badges, streaks, games played, records, last seen |
Run the ranking, duels and progression | Performance of contract | Until the account is deleted |
| Numelo Kids progress city built, animals, mysteries solved |
Back-up, so nothing is lost when changing phone | Performance of contract | Until the account is deleted |
| Push token (FCM) | Send duel invitations and the reminders you opted into | Consent (system permission) | Until notifications are declined or the App is removed |
| Analytics usage events and an app-instance identifier, via Firebase Analytics |
Learn which screens people actually reach, so we can fix what blocks them | Legitimate interest (product improvement) | 14 months |
| Diagnostics crash reports, device model, OS version, via Crashlytics |
Fix crashes | Legitimate interest (stability) | 90 days |
| Advertising identifier (IDFA on iOS, AAID on Android) |
Show and measure advertising | Consent (see §5) | Managed by Google; resettable in your phone settings |
| Purchases confirmation of a Premium subscription |
Unlock Premium and restore it on your devices | Performance of contract | Until the account is deleted |
What is NOT collected — the list is short because it is complete: no location data, no address-book contacts, no microphone, no photos from your library, no health data, no browsing history, and no payment details (Apple and Google process all payments; the App never sees a card number).
Signing in with Apple or Google
If you choose "Sign in with Apple" or "Sign in with Google", the provider passes us an e-mail address and, where applicable, a name. These are used only to attach your account and are held by the Firebase authentication service. They are never written into the gameplay data and are never shown to other players, who only ever see your nickname. With Apple's "Hide My Email", we only receive the relay address Apple generates.
3 · The children's area: Numelo Kids
Numelo Kids is the part of the App intended for children (Numelocity, the mini-games, the mysteries). It follows stricter rules than the rest of the App — and these are verifiable facts, not intentions:
- No advertising is ever displayed there, in any form.
- No purchase is ever offered there.
- The parent report (play time, correct calculations by operation family) is computed on the device and sent nowhere: not to us, not to a third party.
- No comparison between children, no leaderboard, no "come back and play" notification.
- The only thing that leaves the device is the progress back-up (city built, animals earned, mysteries solved), so that changing phone does not erase it.
- Child profiles created by a parent only ask for a first name or a nickname. Please do not enter a child's surname — it is not needed for anything.
If you are a parent or guardian and wish to review or delete the data attached to your child's profile, write to hatemmaati@gmail.com: requests are handled within 30 days, with no justification required.
4 · The camera, and your face
The App requests camera access for two features, and for nothing else: showing your animal in augmented reality around you, and trying it on as a selfie filter.
- The camera only runs on those two screens, never in the background.
- Face detection uses a model bundled inside the App (Google ML Kit) that runs entirely offline.
- No image, no video and no facial measurement ever leaves your device. Nothing is uploaded to a server, nothing is stored by the App.
- No biometric template is created, stored or used to recognise you: the model reads the position of a smile or a blink to animate the mask, then forgets it on the next frame.
- If you save or share a photo, that is your decision, and it goes wherever you send it — not to us.
You can withdraw camera permission at any time in your phone settings; only those two features will stop working.
5 · Advertising and tracking
Outside Numelo Kids, the App shows advertising served by Google AdMob to users who have not bought Premium. Those who have see none.
The Numelo Kids area shows no advertising at all, in every version. None, ever, whether you have Premium or not. This covers Numelocity, the mini-games, Numelo Mysteries and the parents' area: while you are there, no ad is requested or loaded.
Elsewhere in the App, ads are personalised only if three conditions are met: you have declared that you are an adult, you have accepted the consent form, and — on iOS — you have allowed tracking. If any one of those is missing, ads are still shown but are not targeted: no advertising identifier is passed on and no profile is built.
- The age question is asked once, at the moment an ad is about to appear, and never inside the kids area nor on a child profile. We keep neither your age nor your date of birth — only the fact that someone declared being an adult on this device. That stays on the phone.
- You can change that choice at any time in Settings › Ads & privacy.
- Ads are limited to general-audience content (no alcohol, gambling or adult advertising) — for everyone, adults included.
- In the European Union, a Google consent form is shown before any personalised advertising, as required by the GDPR.
- On iOS, the "Allow tracking?" prompt is shown only to a player who has declared being an adult, and never at app launch. Saying no takes nothing away: ads are still shown, simply not targeted.
- On Android, you can delete the advertising identifier in Settings › Security & privacy › Privacy › Ads.
- We pass the ad network neither your nickname, nor your scores, nor any gameplay data.
6 · Who the data is shared with
Numelo uses no processors other than these, and no data is ever sold, rented or traded.
| Provider | Role | Their policy |
|---|---|---|
| Google Firebase Auth, Realtime Database, Firestore, Cloud Messaging |
Account, back-up, live duels, notifications | firebase.google.com |
| Firebase Analytics & Crashlytics | Audience measurement and crash reports | policies.google.com |
| Google AdMob | Advertising (never in Numelo Kids, never for Premium) | policies.google.com |
| Apple & Google | Processing purchases and subscriptions | apple.com · google.com |
Gameplay data is hosted in the European Union (Europe-West region). Some of these providers may process data in the United States; such transfers rely on the European Commission's Standard Contractual Clauses and, for participating companies, on the EU-US Data Privacy Framework.
7 · Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw consent at any time.
- Delete your account and your data: playnumelo.com/delete-account.html — the procedure works without installing the App.
- Any other request: hatemmaati@gmail.com. Answered within 30 days at the latest.
- If an answer does not satisfy you, you may lodge a complaint with your national supervisory authority — in France, the CNIL.
8 · Security
Traffic to our servers is encrypted (HTTPS/TLS). Database access is governed by server-side rules that only let an account read and write its own data: your back-up, your messages and your recovery codes are not accessible to any other player. Other players only ever see your public profile — nickname, avatar, rating and gameplay statistics.
9 · Minimum age
Numelo is built for family use and part of the App is explicitly aimed at children. If you are under 16 (or the age set by the law of your country), use of the App must be authorised by a parent or guardian, who may exercise the rights described in §7 at any time.
10 · Changes
Any change to this policy will be published on this page with a new effective date. A change that would broaden collection will be announced inside the App before it takes effect.
11 · Contact
Hatem Maati — hatemmaati@gmail.com