Shellburst: privacy

Shellburst privacy
Updated 8 November 2026

Moola operates Shellburst. Contact Moola through https://project-moola-401d0.web.app/support. This policy covers the app and its optional account services.

Play is processed on your device. The daily show and any show in progress are stored on your phone as a show seed and the moves you made, together with your preferences for sound, ambience, haptics and motion. You can play the daily show without an account. We do not ask for your photos, contacts, microphone, camera, location or advertising identifier. There is no advertising, chat, public profile, leaderboard, third-party analytics SDK or crash-reporting SDK.

If you create an account, Firebase Authentication processes your account identifier and the sign-in method you choose: Apple, Google or phone verification. Apple or Google may provide a name and real or relay email; phone verification processes the number and security information needed to confirm it, which on iPhone can include a reCAPTCHA check run by Google. We use identity for account access, recovery, purchase ownership and deletion. We do not use it for advertising.

With an account, Shellburst saves your results to Google Firestore in the Moola project, named database moola: the date, score, cues cleared and best salvo of each daily show, your best full-show scores and whether you have seen the tutorial. Results you played before signing in join the account when you first sign in. App records are isolated by app and account. Shows in progress stay on the phone. Other devices must connect to receive changes or deletion.

Apple or Google processes payment. We receive verified transaction references, product, platform, purchase environment and entitlement information to confirm, restore and reconcile the permanent unlock. We do not receive payment-card details. Store reporting provides aggregate product and purchase totals; we do not build a behavioural profile or send play events to an advertising service.

Firebase App Check, Firebase Authentication, Google Cloud and the stores process technical information needed for delivery and security, including app or installation identifiers, attestation results, IP addresses, request times and error information. These services may process data internationally under their published terms. Firestore application records are hosted in europe-west4; identity, store and infrastructure services can use other locations. The app does not intentionally log sign-in codes, tokens or results.

Sharing is optional and opens the system share sheet. A clip or show card shows one salvo of your show, the show number, your score and a link to the app. It does not include your account identity or other results. Clip and card files are kept in the app's temporary cache, which the system clears. The recipient and chosen destination control their copies. No contacts are uploaded and nothing is posted automatically.

Live account records remain until deletion. The app-specific deletion worker removes saved results, sync operations and account mappings. Save-operation records expire after 7 days. Completed deletion and membership markers expire after 30 days. Detached store references needed for payment reconciliation or disputes expire after 90 days. Expiry cleanup is asynchronous. Operational logs use the configured 30-day retention; support correspondence is retained for 12 months after closure unless an unresolved dispute or obligation requires longer.

Deletion completion confirms removal of live application records, not instant erasure of provider backups. Firebase describes removal of authentication data from live and backup systems within up to 180 days after its customer initiates deletion. Other infrastructure backups follow configured or provider periods. Recipient copies of shared clips and offline devices cannot be remotely erased. A shared Firebase identity can remain when it still belongs to another Moola app; deleting Shellburst does not delete another app's data.

Settings includes purchase recovery and account deletion without another purchase. To delete without the app, contact Moola support at https://project-moola-401d0.web.app/support using the email or phone linked to the account. We confirm ownership without asking for a password or sign-in code. Support aims to resolve verified requests within 30 days. You can use the same route for access, correction, removal or a privacy question; applicable statutory rights remain available.

Shellburst is designed for a general audience aged 13 and over and is not directed to children under 13. If you believe a child supplied personal information, contact support for removal.

Provider information: https://firebase.google.com/support/privacy, https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy. Material changes to collection or purpose will be reflected here before release.