The short version: PunchCraft has no accounts and never asks for your name, email, or phone number. Your collection and progress live on your device. When you combine two words nobody has combined before, the app asks our server to write the result — that request carries the two words, an anonymous device code, and nothing about you.
The app stores the following locally, and we cannot read it:
This data is deleted when you delete the app.
PunchCraft builds one shared library of results: the first time anyone combines a given pair, the result is written once and then reused for every player. To make that work, combining two words sends a request to our server containing:
We do not receive your name, email, contacts, location, photos, or Advertising Identifier. Nothing we receive identifies you personally.
Merge records are kept for up to 30 days and then deleted automatically. The generated words themselves become part of the shared library and stay.
New combinations are written by Google's Gemini models, called from our server. Only the two element names are sent to Google — never your device code, IP address, or any other information about you. Google processes the request as our service provider and does not use it to build a profile of you.
Results are automatically filtered before you see them, and every generated element has a Report button. Reporting sends us the element name and your anonymous device code so we can review it and remove it for everyone.
Earlier versions of PunchCraft generated words using Apple's on-device Foundation Models. That feature has been removed and is no longer used.
The optional PunchCraft Pro subscription is processed entirely by Apple. We never see or store your name, payment details, or billing address.
To unlock Pro features, the app sends Apple's transaction identifier to our server, which asks Apple to confirm the subscription is valid. We store that identifier along with the plan and its expiry date. It identifies a subscription, not a person.
We use Firebase Crashlytics (Google) to find out when the app crashes. If it does, Crashlytics sends Google a crash report containing the type of crash, where in the code it happened, your device model and OS version, and an anonymous installation identifier generated by Firebase. It does not contain your name, email, or anything you typed.
We use crash reports only to fix bugs. They are not used for advertising or profiling.
We use Google Analytics for Firebase to understand how the game is played, so we can tune things like the energy limit. It records in-app events such as opening a screen, completing a merge, hitting the energy limit, or starting a subscription — together with your device model, operating system version, language, and an approximate location derived from your IP address (country or region level, never a precise position).
Firebase assigns your installation a random identifier. It is not your Advertising Identifier, it resets if you delete and reinstall the app, and we never link it to your name or email — we have neither.
We do not use this data for advertising, we do not sell or share it with data brokers, and we do not combine it with data from other apps or websites. Ad personalisation is switched off.
PunchCraft contains no advertising and no cross-app tracking. Apart from the crash reporting and analytics described above, we run no other third-party SDK. If a future version adds ads, this policy will be updated first and the app will ask for any consent the law requires.
If you enable the daily seed reminder, the notification is scheduled locally on your device. We do not send push notifications from a server.
PunchCraft is not directed at children under 13 and we do not knowingly collect information from them. We collect no personal information from any user, children included.
Deleting the app removes everything stored on your device and resets the Firebase installation identifier described above. Because we hold no account and nothing that identifies you, there is no profile for us to delete — but if you want the records tied to your device code removed early, email us and we will erase them.
If this policy changes, the new version will be posted here with a new effective date. Questions? Email support@basity.net.