Last updated: May 2026
This is the privacy policy for Challenge World. We have tried to write it in plain language so you can actually understand what it says. Questions? Email us at blueskiiye@gmail.com.
Challenge World is a mobile game made by an independent developer based in Belgium. For the purposes of data protection law, we are the data controller for the personal information described in this policy.
When you create an account, we collect your email address and a password. Your password is hashed before it is stored and we cannot read it in any form. We use the part of your email before the @ symbol as your default display name, which you can change at any time.
As you play, we store your game progress: which levels you have completed, your scores, your accuracy, and the time you took per level. This lets you pick up where you left off across devices.
Your display name and your highest completed level appear on the global leaderboard. Everything else about your account stays private.
When a crash occurs, Firebase Crashlytics sends us a report containing your device model, OS version, and a technical stack trace. No name, email, or gameplay data is included.
We use Firebase Analytics to understand how the game is played in aggregate. This data is anonymous: level completion rates, session frequency, and similar patterns. No personally identifying information is included.
If you make a purchase, RevenueCat processes it on our behalf. RevenueCat receives a device identifier and your purchase history so your unlocked content is restored if you reinstall or switch devices. We never see your payment card or billing information. All payments are handled by Apple or Google.
We do not collect your location. We do not access your contacts.
Three challenge types in the game use your device microphone: the breath challenge (which measures breath intensity to detect when you blow), the hearing challenge (which measures ambient sound levels), and the voice recall challenge (which uses speech recognition to check your spoken answer). In all three cases, audio is processed entirely on your device in real time. No audio recordings are stored, transmitted to our servers, or shared with any third party.
We process your account and progress data to perform the contract you entered into when you created an account. Without this data the game cannot work.
We process crash reports and anonymous analytics under our legitimate interest in keeping the app stable and improving it. This data is either fully anonymous or contains only technical device information.
We process purchase data to fulfil our obligation to deliver the content you paid for.
We share data only with service providers we need to run the game:
• Google Firebase: account authentication, cloud database, crash reporting, and analytics
• RevenueCat: purchase verification and content restoration
• Apple App Store / Google Play: payment processing
These providers act as data processors under our instructions. We do not sell your data. We do not share it with advertisers or any other third parties.
Google's servers are in the United States. Transfers from the EU to Google are covered by Standard Contractual Clauses approved by the European Commission.
We keep your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Anonymised, aggregated statistics that cannot be linked to any individual may be kept indefinitely.
If you are in the EU, the UK, or another region with similar data protection laws, you have the right to access, correct, delete, restrict, or port your data, and to object to processing based on our legitimate interest.
To exercise any of these rights, email us at blueskiiye@gmail.com. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority. In Belgium, that is the APD/GBA at gegevensbeschermingsautoriteit.be.
Challenge World is rated for users aged 12 and over. We do not knowingly collect personal data from children under 13. If you believe your child has created an account, contact us at blueskiiye@gmail.com and we will delete it promptly.
All data is transmitted over HTTPS. Passwords are hashed using industry-standard algorithms. Firestore security rules ensure each user can only read and write their own data.
We may update this policy from time to time. If we make significant changes, we will let you know through the app. The date at the top of this page always shows when it was last revised.