Playing without an account
SYVT needs no sign-in. Used that way, everything the game remembers — the players on the device, their nicknames, avatars, chosen world and language, best scores, rounds played, points, the days they played and settings — is written to the app's own storage on that device and nowhere else. We never see it, and uninstalling the app deletes it.
Three things can still reach the internet without an account: the spoken words and the date check, both described below, and a purchase, which Google Play handles.
What an account stores
An account exists so that the same players can be carried to another device, and a parent makes it in the app's settings for parents. It signs in with an email address and a password, or with a Google account. With a password, we receive the email address, and Google Firebase Authentication keeps the password only as a salted hash, never in readable form. With Google, Firebase Authentication receives the Google account's email address, together with the name and profile-picture link Google may include with a sign-in; the app uses only the email address. Either way, Firebase Authentication also keeps the dates the account was created and last used.
Once signed in, the game keeps one document per account on our server. For each player it holds the nickname (up to eight characters, freely chosen), the avatar (a short string of part numbers), the chosen world, the chosen language, the best score in each language, the number of rounds played, the points scored, when the player was made, whether words are read aloud, which country's German spelling counts as right, and the two paid settings — how much arithmetic is mixed in, and which level a round starts at. It holds the days on which the player earned a star (a day with a round of ten points or more, which is what the star chain is counted from) and how many stars a week a parent has asked of them, with the days that number was changed. It holds the player's sticker book too: which stickers have been found and how many of each, how many the day's play has given for each level and world, and where each sticker is stuck on the album pages. Alongside those it holds the identifiers of players deleted on another device, the time of the last change and a version number.
What we never collect
Apart from what a Google sign-in carries, no real names. No age or date of birth, no address or telephone number, no photographs or files from the device, no contacts, no location, and no advertising identifier. Nothing a child types is collected beyond the nickname, which need not be a real name. There is no chat and no messaging, and nothing a player does is visible to any other user.
Where it is kept, and how it is protected
Account data sits on Google's Firebase platform, in a project we run. The database (Cloud Firestore) is in Google's European multi-region, with the data held in Belgium and the Netherlands. The server functions the app calls — redeeming a friends-and-family code, and recording, moving or withdrawing a Google Play purchase — run in Zurich, Switzerland; one more function, which guards the project's spending and handles no user data, runs in Belgium. Data is encrypted in transit and at rest. The database rules let an account read and write its own document and read its own SYVT+ record, and nothing else; purchase and code records are written only by our server. Google acts as our processor here, on our instructions.
No advertising, no analytics, no tracking
SYVT carries no advertising, no analytics, no crash reporting and no third-party tracking or marketing software. It sets no cookies and reads no advertising identifier. Google Analytics is switched off in the Firebase project. How a child plays stays on the device, apart from the scores, days played and settings described above while an account is signed in, and the spoken words a device asks for, described below.
What the servers log
As with any app built on Firebase, Google records the IP address and the user agent of the requests the app makes — for sign-in security, and in the logs of our server functions, which also note the account identifier when a purchase cannot be confirmed with Google Play. Those logs are kept briefly and are not used to build a profile. The Firebase software in the app can give the installed app a random installation identifier, and a call to our functions can carry a Firebase messaging token. Google uses both to operate the service; they identify an installation rather than a person, and we neither read them nor send messages. This website is served by GitHub Pages, which, like any web server, logs the IP address of a visit.
The spoken words
The voice that reads the falling words is a set of fixed audio files on
Cloudflare R2, at audio.syvt.me — used
by the app and, on the two levels it reads them, by the game on this site.
Nothing is generated while you play: the word is turned into a file name on
your own device, and only that file name is asked for. No text, no account
and no device identifier is ever sent. Cloudflare, like any web server,
sees the IP address making the request and which files it asked for
— and because the word list is public, those names say which words
were practised. That is the honest limit of it. The app fetches a level's
words in a batch; the game on this site asks for each word as its tile
appears, so its requests follow the words a round actually shows. The
files are the same for everyone; nothing about them is personal to a
player. Switching the voice off stops every one of these requests.
The date check
Stickers are found by playing well, and each level gives a few a day.
So that winding a tablet's clock forward does not refill them, the app
asks the same server, audio.syvt.me, what day it is: one
request for the name of a single file, made when the app starts and when
it comes back from the background, whether or not the voice is on. It
sends no account, player or device identifier and nothing typed or
played; the only thing read from the reply is the date the server stamps
on it. Cloudflare sees the IP address of that request as it does of any
other. Offline, the tablet's own clock is used.
The daily reminder
SYVT can remind the children on a device to come and play, with one notification a day at most. It is off until somebody says yes: the game asks once, after the first round that earns a star, and a parent can change the time or switch it off in the settings for parents. The reminder is worked out and scheduled on the device itself, from what the device already holds — which children have not played yet that day, and the line SYVT says to them. Nothing is sent anywhere to make it or to show it, and no push-notification service is involved. Its settings — whether it is on, its time, and the reminders it has handed to the device — stay on that device and are never backed up to an account. On Android 13 and later the system asks for permission to show notifications when the reminder is switched on, and not before.
SYVT+ and purchases
SYVT+ is sold as a monthly subscription or as a single payment, and the payment is handled entirely by Google Play. We never see or receive payment details. The app remembers on the device whether SYVT+ is active, so a paid game still works offline.
While an account is signed in, the app also tells our server about a SYVT+ purchase, so that SYVT+ follows the account to its other devices. It sends the purchase's Google Play token and which product it is. The server checks both with Google Play and then records, against the account, the product, the token, the date it recorded them, when a subscription expires, and when Google Play last confirmed it. It also records which account holds the purchase, so that one purchase serves one account: if another SYVT account already holds it, the app shows that account's email address cut down to its first letter and its domain, and moves the purchase only if you ask it to. When Google Play reports that a purchase has ended or been refunded, the app asks our server to take SYVT+ off the account. A purchase the server already knows about is reported again at most once a day.
Friends-and-family codes
Redeeming a code needs an account. It sends the code, your account identifier and whether a Google Play subscription is active to our server, which records the code, the account and the moment it was used, so that a code cannot be spent twice, and stores the entitlement it grants — where it came from, the code, the date, and any expiry date — against the account. So that codes cannot be guessed, the server also counts the codes an account tries, and refuses more than ten in an hour.
Data sharing
We do not sell data, and we share none of it with third parties for their own purposes. The companies involved are Google — as the operator of Firebase, where account data is stored, of Google Play, which processes purchases, and of Google sign-in when you choose it — GitHub, which serves this website, and Cloudflare, which serves the spoken words. Firebase, GitHub and Cloudflare act as our processors under contract; Google Play and Google sign-in work under your own agreement with Google.
How long we keep it
Account data is kept for as long as the account exists, and the app can end that itself: Settings (for parents) → Danger zone → Delete account removes the sign-in and everything backed up under it, straight away. The same danger zone wipes every player's games, points, best scores and the days their star chains are counted from, and deleting a player removes them from the device and from the account on every device signed in to it. Data held only on a device goes when the app is uninstalled. The Data Deletion Policy sets all of this out step by step.
Children
SYVT is built to be safe to hand to a child of about eight and up, and so that a child gives nothing away in order to play. No account is needed. The only thing a child enters is a nickname of up to eight characters. There is no advertising, and nothing a child does is shown to anyone else. The only notification is the daily reminder, which stays off until somebody agrees to it and which a parent can switch off. Everything that costs money or leaves the app sits behind a parents' gate, a number written out in words to be typed back in digits; the one link out of the app, to Google Play's subscription settings, is behind it too. If you believe a child has given us more than the above, write to us and we will delete it.
Your rights
You may ask for a copy of the data held under your account, ask us to correct it, or ask us to delete it — see the Data Deletion Policy. You may also simply play without an account, in which case there is nothing on our servers to ask about. Write to hi@SYVT.me for any of these.
Changes to this policy
If we change what SYVT collects, we will update this page and the date at the top of it.
Contact
SYVT is made by A51. For questions or requests, email hi@SYVT.me.