Privacy Policy

Who we are

Savanzo, operated by Iodine Studio, is a California business. Contact us about privacy at support@iodine.studio.

Information we collect

Depending on how you use Savanzo, we collect:

• your guest identifier and nickname;
• your registered username, optional email address, and password hash;
• your birth month and birth year from players who are 13 or older;
• session, MMR, win-loss, match, move, and rating-history records;
• operational request, device-class, diagnostic, abuse-prevention, and security metadata; and
• necessary browser storage described below; and
• daily aggregate game-start and game-completion counts when reporting is enabled.

Birth month and year are private account information. They are not included in public profiles or gameplay records and are not sent to advertising providers.

Our basic game report stores only a UTC calendar date, a game mode (live match, official Daily Quiz, or practice Daily Quiz), and counts of starts and completions. It also counts completions against the day a game started. A live match counts once, including a match against a bot; a Daily attempt counts once. Resuming or reconnecting is not a new game. These totals contain no account, player, session, match or attempt identifiers, birth dates, IP addresses, device fingerprints, URLs, referrers, campaign parameters or free-text properties.

Product account and play history remain separate from this report. Necessary operational logs can contain game and attempt identifiers, request diagnostics and abuse-prevention information. Aggregate reporting does not make those service records anonymous. We do not create a separate player-level analytics history, measure returning players or attribute individual games to advertisements.

How we use information

We use information to authenticate users, create and maintain sessions, operate matchmaking and games, provide ratings and records, prevent fraud and abuse, protect security, improve reliability, respond to support, comply with law, and understand overall game activity through daily totals.

We use birth month and year to enforce minimum-age requirements and to derive age-restricted advertising eligibility for features that remain disabled. This entry does not independently verify identity or legal location, provide marketing consent, or establish that any particular advertisement is otherwise legally eligible.

How we share information

We disclose information to infrastructure and service providers that help operate Savanzo; to advertising and consent-management providers such as AdSense when enabled; when reasonably necessary for legal, safety, or security purposes; and as part of a business reorganization, financing, sale, or succession. Ko-fi receives information only when you choose to navigate to its external service. Those providers have their own privacy practices.

Iodine Studio does not sell account passwords or gameplay records. If third-party advertising is enabled, the advertising provider may collect or receive identifiers and activity data as explained through its consent controls.

Cookies and browser storage

Savanzo uses a secure session cookie for authentication. Local browser storage may hold a profile snapshot and necessary game-interface state. Browser engagement and acquisition tracking are disabled: we do not set analytics cookies, a returning-visit marker or campaign attribution storage for the basic game report. Clearing browser storage does not delete your account or server-side play history.

Birth month, birth year, and the derived age-restricted-ad eligibility result are excluded from the local profile snapshot and other browser storage.

Advertising and online tracking

Publisher ads, browser engagement/acquisition tracking and their provider integrations are disabled for this release. The basic server-side report adds no tracking popup, third-party analytics, advertising pixels, conversion uploads, session replay or fingerprinting. A future change to advertising or broader analytics requires a separate review and updated disclosures and controls. Savanzo does not currently change its necessary service processing in response to browser “Do Not Track” signals. Contact us about privacy choices or objections.

When AdSense is enabled, Google and participating third parties may place and read first-party or third-party cookies, or use web beacons, IP addresses, or similar identifiers, as a consequence of serving and measuring ads. Applicable consent choices control personalized-ad processing. Learn more about how Google uses information from sites or apps that use its services.

When an ad request is otherwise eligible, Google may receive only an age-treatment value derived from the category: teen treatment for 13–17, or no specific age treatment for 18+. Advertising providers do not receive your birth month or birth year from Savanzo. The category is not proof of identity, legal location, consent, or complete legal eligibility for an advertisement.

Retention

Account information and play history are retained until you request deletion, with no automatic expiry for inactivity. Birth month and year are retained privately with your player account until updated or deleted. Sessions expire after 30 days by default or can be revoked earlier; expiry ends access but does not itself erase the stored session row. Private invites are usable for 10 minutes by default; their records remain until operational cleanup or account deletion.

Account deletion removes credentials, private age data, sessions and personal Daily records. Shared matches keep their results for opponents, with your account references replaced by a separate deleted-player reference in each match. Basic aggregate counts remain because they contain no account reference. Support must verify control of the account before deletion; a public nickname or an unverified email is insufficient.

Backup cleanup targets copies older than 14 days while protecting the two newest complete copies; incomplete copies need separate review. Deletion does not immediately erase backup copies. Restricted deletion records are kept separately to reapply deletion before a restored database is reopened. They are retained until affected backup copies have expired or been removed. Necessary security and diagnostic logs have separate retention: central monitoring is configured for 14 days, while local logs rotate by size and do not have a guaranteed time-based expiry. We review any additional retention needed for security, disputes or legal obligations.

Basic daily totals have no account-level deletion key and are retained for overall activity comparisons. They cannot show per-channel conversions, repeat players or the causal effect of a campaign.

Security

We use reasonable administrative and technical safeguards appropriate to the service, but no transmission or storage system can be guaranteed absolutely secure.

Your choices and requests

You may update your birth month and birth year from Profile. You may request access to, correction of, or deletion of information by emailing support@iodine.studio. We verify your control of the account and may retain information where permitted or required for security, integrity, legal, or operational reasons.

Children

Savanzo is not directed to children under 13. New birth-month and birth-year submissions indicating that a player is under 13 are rejected, and the submitted month and year are not retained. If you believe a child under 13 otherwise supplied personal information, contact us at support@iodine.studio.

California disclosures

The categories described above include identifiers, account and authentication information, internet or electronic activity, gameplay and profile records, and inferences such as ratings. Sources include you, your browser or device, service operation, and service providers. We use and disclose those categories for the purposes and to the third-party categories described above.

If applicable law gives you rights to know, access, delete, correct, restrict, opt out, or receive equal service when exercising a privacy right, submit a request to the privacy email above. We will process verified requests as required by applicable law.

Changes to this policy

We may update this Privacy Policy. We will update the effective date and provide notice of material changes. A Privacy-only update will not by itself block access to gameplay.