Privacy Policy
This policy explains what the Lotus Letters app for Android (“the app”) collects, why, who can see it, and how to have it deleted. Lotus Letters is published by DRS Auto Group, Inc. (“we”, “us”). Questions? Email support@lotusletters.app.
What changed on October 27, 2026
- You can now block a player or report a display name. We store the players you block and the names you report, and reports made about you (sections 2, 3 and 7).
- Our server checks display names against a list of offensive words before saving them (section 2), and names must follow our community rules.
- You can delete your server data yourself in the app: Home > Settings > Delete my challenge data (sections 7 and 8).
- The app doesn't send push notifications for now, and doesn't ask to (section 4).
The short version
- There's no account to make: no email address, phone number or password.
- Solo play happens entirely on your phone. Your levels, coins and settings never leave it.
- If you play friends (challenges or live matches), we store a random player ID, the display name you pick, your match results and, if you use them, the players you block and the names you report, so the game can match you up, show who won and keep names friendly.
- If you allow notifications, we store a notification token so a friend's live match invite can reach you.
- The app shows no ads.
- The app has no purchases.
- No analytics or tracking, and the app doesn't use your advertising ID. It never asks for your location, contacts or microphone.
- We don't sell your information. You can delete it yourself in the app (Home > Settings > Delete my challenge data), or ask us any time and we'll delete it: see Delete your data.
1. What stays on your phone
The app keeps these only in its own storage on your device. They are never sent to us:
- Your solo level progress and whether you've finished the tutorial
- Your coin balance, hints you've used, and challenge rewards you've collected
- Sound settings (music, volume, sound effects, sound style)
- Your chosen avatar, including a custom picture if you pick one (see Photos)
- A copy of your display name and whether you're “Open to challenges”
Because these never leave your phone, we can't see them, back them up or restore them. Uninstalling the app or clearing its storage erases them for good, and they don't carry over to a new phone.
2. What we store when you play friends
Playing solo needs no connection to us. The first time you open the Challenge Arena or use a challenge code, the app signs in to our game server anonymously. From then on, when you play friends we store:
- A random player ID
- Created by the anonymous sign-in. It isn't linked to your name, email, phone number or Google account. It lets the server know which challenges are yours.
- Your display name
- The name you type (2 to 16 characters) when you first send or accept a challenge, or a friendly generated one if you skip. It's saved with each challenge and live match you play. Before a name is saved, our server checks it against a list of offensive words, and it won't store a name that fails. When we add words to the list, stored names that now fail are cleared. The check itself stores nothing and isn't sent with your player ID. Names must follow our community rules.
- Challenges and live matches
- Which puzzle was played, who played it, when it was created, started and finished, its six-character challenge code, and its status (for example invited, active, completed or expired).
- Your results
- The words you found, how many hint letters you used, your time and score, and coins you earned during the match. In a live match, your progress during the round is also stored, so the game can show each of you how the other is doing.
- Your record
- Wins, losses and streaks against each person you've played.
- Live match status
- Whether you've turned on “Open to challenges” (it switches itself off after 15 minutes away from the app), when you last had the app open while it was on, and connection check-ins during a live match (used to start the round together and to settle a match if someone drops out).
- Players you block
- If you block a player, we store that you blocked them and when. We use it to stop live match invites between the two of you and to take you out of each other's friends list.
- Names you report
- If you report a player's name, we store your player ID, theirs, the name, the match it was on, and when. We use it only to review names and act on them, for example by removing a name. If someone reports your name, the same record is stored about you (your player ID and your name), and it's covered by access and deletion requests like the rest of your information.
- Notification token
- Only if you allow notifications. See Notifications.
We use this information only to run challenges and live matches: matching players, deciding the winner, showing results and records, sending live match invites, and keeping display names friendly. We don't use it for advertising and we don't sell it.
3. What other players can see
- The other player in a challenge or live match can see your display name and your results, including the words you found. You can see theirs too.
- Anyone you give a challenge code to can use it to accept that challenge, until someone accepts it or it expires.
- People you've finished a challenge with appear in each other's friends list in the Arena, with your display name, your record against each other, and whether you're available, away or in a match.
- Nobody else can look up your challenges, results or record. The server only lets the two players in a challenge read it.
- If you block or report a player, they aren't told. After a block, you simply stop appearing in each other's friends list. Blocks and reports are never shown to other players.
Challenge codes and links you share are sent through your own messaging apps. We don't see who you send them to.
4. Notifications
The app doesn't send push notifications for now. It doesn't ask for permission to, and it doesn't collect a notification token. A friend's live match invite shows up while you have the app open. If we add push notifications later, the app will ask before sending any, and we'll update this policy first.
If notifications are allowed for Lotus Letters in your phone's settings, the app can show a reminder during a live match. It's created on your phone and never goes through our server.
After your first completed challenge, or the first time you turn on “Open to challenges”, the app asks whether it may send notifications. If you say yes, it saves your device's notification token (an address for this copy of the app) with your player ID. We use it only to tell you when a friend invites you to a live match, or accepts your invite. To deliver them, our server sends the message and token to Expo's push service, which passes it to Google's Firebase Cloud Messaging. The message includes your friend's display name.
You can turn notifications off at any time in your phone's settings. The app also shows some reminders during a live match that are created on your phone and never go through our server.
5. Photos and your avatar
You can pick a picture from your photos as your avatar. The app only opens your photos when you choose to do this. It crops and shrinks the picture and keeps that copy on your phone. The picture is not uploaded to us, and other players don't see it.
Ads (Google AdMob)
The free version of the app shows ads provided by Google AdMob, owned by Google LLC. Ads never appear while you're playing a puzzle, and there are no full-screen ads that pop up on their own:
- A small banner can appear on some screens outside of play.
- You can choose to watch a short video ad to earn coins. Videos only play when you tap to watch one.
To show and measure ads, the Google Mobile Ads SDK collects information from your device, such as your device's advertising ID, your IP address (from which an approximate location can be worked out), your device type and settings, and how you interact with ads. Google uses this as described in How Google uses information from sites or apps that use our services. Where the law requires it, the app asks for your consent before ads can be personalized.
You can reset your advertising ID or delete it in your phone's settings (Settings > Google > Ads, or Settings > Privacy > Ads, depending on your phone). We don't receive your advertising ID or the information the AdMob SDK collects, beyond overall reports that don't identify you.
Purchases (Google Play)
You can buy coin packs or remove ads in the app's shop. Purchases are handled by Google Play Billing: Google takes your payment under the Google Privacy Policy, and we never see your card or payment details.
When you buy something, the app receives a confirmation from Google Play (which item, and a purchase token) and uses it to add the coins or remove the ads on your phone. Your Google Play account keeps a record of your purchases, which you can see in the Play Store app.
6. Services we use
We don't share your information with anyone except these service providers, who handle it on our behalf to run the app:
- Supabase hosts our game server and database (the information in section 2). Like any internet service, it receives your phone's IP address when the app connects and keeps short-term technical logs. Its servers may be in the United States or other countries.
- Expo (650 Industries) and Google Firebase Cloud Messaging deliver notifications, if you've allowed them.
- Google AdMob provides ads (see Ads).
- Google Play Billing processes purchases (see Purchases).
We may also disclose information if the law requires it, or to protect the safety of our players or the public.
7. How long we keep it
- On your phone: until you uninstall the app or clear its storage.
- On our server: your player ID, display name, challenges, results and record are kept until you delete them in the app or ask us to, so your match history and friends stay available. A challenge code stops working 7 days after the challenge was created, but the finished match stays in both players' history.
- Blocks and reports: also kept until you delete your data. Deleting it removes every block and report that involves you, whether you made it or it's about you. A block or report between two players also goes if the other player deletes their data.
- Notification token: until it's replaced by a new one or you delete your data.
Uninstalling the app doesn't delete what's on our server, but it does delete your player ID from your phone, and there's no way to sign back in to it. So if you'd like your server data removed, delete it in the app before you uninstall: Home > Settings > Delete my challenge data. If you've already uninstalled, or played on another phone, email us. See Delete your data.
8. Your choices and rights
- Play solo only, and nothing is sent to us.
- Say no to notifications, or turn them off later in your phone's settings.
- Turn off “Open to challenges” so friends can't send you live invites.
- Block or report a player: from the results screen after a match, or from the ⋯ next to their name in the Challenge Arena's friends list.
- Delete your server data yourself: Home > Settings > Delete my challenge data removes it at once. Your levels, coins and settings on your phone stay.
- Ask us for a copy of your information, to correct your display name, or to delete everything: email support@lotusletters.app.
Depending on where you live (for example the European Union, the United Kingdom or California), you may have legal rights to access, correct, delete or move your personal information, to object to or limit how it's used, and to complain to your local data protection authority. We honour these requests for everyone, wherever you live, and we won't treat you differently for making one. Because the app has no accounts, we may ask for details such as your display name or a recent challenge code to find your information.
Where laws like the GDPR apply, we process the information in section 2 because it's needed to provide the multiplayer features you choose to use, and reports about a player's name for our legitimate interest in keeping names friendly and players safe. We process notification tokens on the basis of your consent, which you can withdraw at any time.
9. Children
Lotus Letters is meant for people aged 13 and older. It is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child under 13 has used the multiplayer features, email support@lotusletters.app and we'll delete their information.
10. This website
lotusletters.app uses no cookies, analytics or trackers, and loads nothing from other companies. Our web host, Netlify, receives your IP address and basic request details when you visit, so it can deliver the pages and keep the site secure. A challenge page (lotusletters.app/c/…) reads the code from the link in your browser and doesn't send it anywhere.
11. Security
The app talks to our server over encrypted connections, and the database only lets each player read their own challenges and records. No system is perfectly secure, but we work to protect your information and keep only what the game needs.
12. Changes and contact
If we change this policy, we'll update it here and change the effective date above. If a change is significant, such as collecting a new kind of information, we'll also say so in the app or on this site before it takes effect. The latest change is summarized at the top of this page, under What changed.
DRS Auto Group, Inc.
Email: support@lotusletters.app