English · Português

Privacy Policy - Melbees: The Secret of Bees

Effective date: 2026-07-27 · Last updated: 2026-11-06

1. Who we are

Melbees (“the app”, “we”) is provided by Melbees Games, Brazil, which is the controller of the data described in this policy. For any privacy question or request, write to contact@melbees.games.

2. Scope

This policy explains what information Melbees handles, how, and what your choices are. It applies to the Melbees game distributed on Google Play (Android) and on the Microsoft Store (Windows), in every country where it is available. The Windows version handles less data than the Android one, and section 2.1 gathers every difference; where it says nothing, the rest of this policy applies. It also applies to the game's browser edition, closed and by invitation only, described in section 2.2, and to the Daily Challenge open to everyone in the browser, described in section 2.3, and to the iPhone version on the App Store, described in section 2.4. If the game is ever distributed through another store, this policy will be updated first.

Depending on where you live, besides Brazil's LGPD (Law 13.709/2018) the GDPR of the European Union and the United Kingdom, the United States' COPPA and other local laws may apply to you. Section 15 describes the rights each of them gives you and how to use them.

2.1 The Windows version (Microsoft Store)

The Windows version is the same game, and it handles less data. What changes in it:

2.2 The browser edition (by invitation only)

There is also an edition of the game that runs in the browser (Chrome or Edge). It is closed: only the people we invite can get in. What changes in it:

2.3 The Daily Challenge in the browser (open to everyone)

The Daily Challenge also opens in the browser (Chrome, Edge or Safari), from a public address, with nothing to install and no invitation. Alongside the day's Challenge, the Duel is available on our own addresses diario.melbees.games and daily.melbees.games. What changes in it:

2.4 The iPhone version (App Store)

The iPhone version is the same game, free to download, and it handles less data than the Android one. What changes in it:

3. The summary, in five lines

4. What stays only on your device

Melbees keeps the following on your device only, so the game can work; none of it is sent to us or to any server:

Deleting the game, or using Settings → Delete my data, removes all of it.

One exception: the hidden Studio device switch, off by default (section 10.2), is a device setting whose state, when on, goes as a test mark "1" along with the counts and the events of section 10. (The feedback you choose to send carries the interface language and the touch mode, as section 11 describes.)

If you signed in with Google or with Apple, the device also keeps your account session, as section 8 describes.

5. Children, teenagers and the age question

Melbees is a general-audience, family-friendly game, and we know that children and teenagers play it. That is why the version of the game everyone gets is already the version a minor is allowed to have: there is no chat, no messaging between players, no nickname you type on the leaderboard, no paid random reward, and no advertising profile built out of what you play. The game team's messages (section 12) are one-way: nobody answers them and no player writes one.

There is no age screen at the door and no parental gate. A date-of-birth form is trivially bypassed by a child, and a weak control gives parents a safety that does not exist. The strong control is the parents', at the platform: Google Family Link and Google Play's purchase approval. Section 12 says where they are. On Windows, the control is Microsoft Family Safety (section 2.1), and on the iPhone it is Apple's Screen Time and Family Sharing (section 2.4).

The one thing that needs an age is the ad, because the advertising rule is different for each band. So, the first time an ad is about to be shown, the game asks your age once:

On the web Daily, when ads are enabled after AdSense approval, the same band applies to both ads. The notice and choices are those of section 2.3: without an answer no ad is requested and the Duel continues; no ad is personalized, at any band. The browser does not use Firebase.

United States. We do not knowingly collect personal information from children under 13 for the purposes COPPA restricts. European Union and United Kingdom. Some countries set the age at which a teenager can consent alone anywhere between 13 and 16; where that limit is higher than ours, ad personalisation depends on the valid consent described in section 6.

If you are a parent or guardian and believe a child has sent us personal information - through the feedback screen, for instance - write to contact@melbees.games and we will delete it.

6. Ads

On Android and on the iPhone the game shows two kinds of ad. The rewarded ad is shown only after you tap to earn an extra Petal when you lose your last one: if you never tap, you will never see one. In the Duel, a player without Premium sees one full-screen ad, with no reward, right after tapping Ready: before each of the first three duels of a day and, after that, less and less often the more you play. It never appears when the app opens, never during a duel and never in the solo game, and you close it with the ad's own control. There is no banner. The Windows version has no ads at all (section 2.1), and Premium removes the Duel's ad: this section applies to Android and to the iPhone. The Duel's ad follows the same age and consent handling as the rewarded ad, described below. The Duel also exists on the web Daily. Its Ready ad uses AdSense H5 and stays off until approval, like the rewarded ad (section 2.3).

Ads are served by Google AdMob, which acts as an independent controller of the data it receives. The treatment of each request depends on the band from section 5:

For a personalised ad, AdMob receives your device's advertising identifier - an identifier you can reset or delete yourself in the Android settings, under Google → Ads. We do not receive it, we do not store it, and we do not use it anywhere else in the game, analytics included (section 10).

On the iPhone, the first time you open the game, the iPhone shows Apple's own question, App Tracking Transparency, before any ad is requested. Only if you choose Allow can AdMob receive the iPhone's advertising identifier (IDFA); with Ask App Not to Track iOS gives it to no one, and nothing is personalised. The bands above still apply: under 13 no identifier is sent whatever you choose, and from 13 to 17 the ad is never personalised. You can change the answer at any time in the iPhone's Settings → Privacy & Security → Tracking. The game shows the ad and grants the Petal the same way either way, and, as on Android, we never receive the identifier.

7. In-app purchases

The game offers three items, and none of them is required to play: two Petal packs (one-off purchases) and the monthly Premium subscription. There is no loot box: you always know exactly what you are buying, and nothing bought turns into a draw. On Windows the Microsoft Store does the charging, and there is also a 1-Petal pack (section 2.1); on the iPhone the App Store does the charging (section 2.4); the list below describes Google Play.

8. The account, and when it is asked for

The account is optional for the solo game: you need none to play or to buy. Only the Duel, the mode where you play a friend, needs an account, because your friend sees your nickname and your face. The game never asks you to sign in on launch. It offers the sign-in for three things, and signing in is always an action of yours: the online leaderboard, restoring a subscription on another device, the other platform included, and the Duel. A subscriber who has not signed in also sees that offer as a quiet line before a game, saying it will not reach the online leaderboard without the account, and as a button on the screen that celebrates the subscription. Neither stops you from playing. In the Daily's own browser pages, sign-in is offered for the Duel and the day's Daily Challenge ranking (section 2.3).

On Windows the account is the same, and signing in opens the browser; section 2.1 describes that sign-in and where Windows keeps the session.

The account is Google and, on the iPhone only, also Sign in with Apple (below): no e-mail-and-password sign-up, no anonymous login. The sign-in is run by Supabase, our authentication processor (section 13). When you sign in, Google confirms to Supabase that it is you, and Supabase keeps, on the sign-in server, with your account:

The game reads none of this except the identifier. Your name, e-mail and picture never appear on the leaderboard or to another player, never go into the game's analytics (section 10) or ads, and are not sold or shared. We see the e-mail and the name in our administration panel, which only we use, and the e-mail also in our internal report (below), and nowhere else. The panel lists the accounts that signed in to the game (the e-mail, the name, the dates of creation and last sign-in, the leaderboard nickname and whether the account has Premium) so that we can find an account when you ask by e-mail to delete it (Delete your account) or ask for a courtesy Premium, and when we give a courtesy Premium. All of it is deleted when you delete the account (section 15). Supabase also keeps a copy of the access record in its own technical logs, which it deletes by itself within a few days.

The accounts list in our internal report. Once a day, a copy of that list goes to an internal report of ours, in Google Cloud (BigQuery), which also only we see, so that we know how many accounts the game has, on which platform, and when they last signed in. The copy carries only the e-mail, the dates of creation and last sign-in, how you signed in (Google or Apple), the store of the subscription, if any, and whether the account is one of our own (the team's or the family's), so that we do not count those as players; it does not carry the name, the picture, the nickname or the access record. Each copy replaces the one before and deletes itself after 2 days, so a deleted account leaves the report within 2 days at most. The list and the copy do not go into the game's analytics, are not matched with them, and are not used for anything else.

Sign in with Apple, on the iPhone. On the iPhone you may also sign in with your Apple account. Then it is Apple that confirms to Supabase that it is you, and Supabase keeps, with the account, the identifier Apple gives you for this game and the e-mail address Apple sends: your Apple account's own, if you choose to share it, or, if you choose to hide it, an address Apple creates for this game only, which ends in privaterelay.appleid.com and forwards messages to your e-mail. From Apple the game keeps no name and no picture. So that it can cut the game's link to your Apple account when you delete the account, the game's server also keeps a credential Apple gives the game at sign-in (a refresh token), and uses it for that alone: when you delete the account, the server asks Apple to revoke the link and deletes the credential as soon as Apple confirms, within 30 days at most. The rest of this section applies the same: the access record, the administration panel, the internal report, and what is deleted with the account.

One account, Google and Apple. On the iPhone one account may hold both sign-ins, Google and Apple: it is still a single account, with one nickname, one place on the leaderboard and one Premium, and either sign-in opens it. If your Apple account's e-mail is the same as your Google account's, Supabase joins the two sign-ins into the same account on its own; if it is not, or if you hid the e-mail, you join them in the game itself. In our panel we find the account by the e-mail of either one.

Courtesy Premium. To grant or renew a courtesy Premium, we find the account in our administration panel, by its e-mail, name or nickname; if you sent us the e-mail of your Google account, it is used only for that. The courtesy does not keep the e-mail: we keep only its start, end and reason, tied to the account's opaque identifier, and we delete them when you delete the account. The message in which you sent us the e-mail stays in our mailbox, like any message you send us.

So that you do not have to sign in again every time you open the game, the session is kept on this device: only the credential that renews it, never your name or your e-mail. On Android, it is encrypted, with a key Android creates and that never leaves the device, and it sits in a place Android keeps out of backups and out of transfers to another device, so your session never shows up on a device you did not sign in on. It is erased when you tap Sign out, Delete my data or Delete my account, or when you uninstall the game. On Windows, section 2.1 says where it is kept. On the iPhone, it is kept in the iPhone's Keychain, tied to this device: it does not go to iCloud Keychain and does not move to another iPhone through a backup. Uninstalling the game does not erase it at once, but it is no longer used, and the game erases it the first time it opens after being installed again. The session is used only when something needs it, such as the online leaderboard. Opening the game does not connect to the account, with one exception: when the device holds the answer about the account's Premium (below) and its date has passed, the game renews the session by itself, with no screen, to ask again.

Premium follows the account. With the account signed in, and when this device's store has no subscription, the game asks our server whether the account has Premium, bought on Google Play or on the Microsoft Store. The server answers which store it is from and until when it lasts. The device keeps that answer for that account, and it counts until that date, so you can play as Premium even offline. A newer answer from the server replaces it, and it is erased when you tap Sign out, Delete my data or Delete my account, or when another account signs in on this device.

A message from the team addressed to your account (section 12) is kept on our server, tied only to the account's opaque identifier, and is deleted with the account. The game asks for it only with your session open; when you sign out, it stops showing.

9. The online leaderboard

If - and only if - you enter the online leaderboard, this leaves your device:

What the public sees is only the best marks of each board: rank, nickname, number, portrait and time. No identification of who played appears there, neither to other players nor to anyone looking from outside.

The raw list of moves is deleted 60 days after submission; the time and the rank stay for as long as your account exists. Our game server does not store your IP address in any table: it uses it in memory, at the instant of the call, to rate-limit requests. Google Cloud, which hosts the server as our processor, records each request made to it (the IP address, the kind of device, the time and the address called) in a technical log that it deletes by itself after 30 days; we look at it only to investigate a failure or an attack. One exception: the simple count from Windows and the iPhone (section 10.1) is not in that log. The sign-in keeps the IP separately, in the account's access record (section 8).

9.1 The Duel, playing a friend

The Duel needs an account (section 8), because your friend sees your nickname and your face. Both come from the game's closed lists, as in the leaderboard: you never type a letter, so no nickname can hold personal data, and the Duel has no chat, free text, photo or voice. Nothing a player types reaches another.

During a duel your device sends to the room service (rooms.melbees.games, on Cloudflare, our processor): the nickname in pieces, the card number, the face, your plays, the cards you chose and the signal of your connection. The room only relays these messages to your friend, without reading them, and deletes everything when the room ends, in about 30 minutes at most. The service uses your IP address in memory only, to limit abuse, and never stores or logs it.

If you create a public room, any player who opens the Join screen sees, while the room is open: your nickname, the card number, your face, the category, the mode, the level, the language and your connection in milliseconds. A room with a code only is not in the list.

A duel's result stays on the two devices: it does not go to the leaderboard. The Share button builds an image with no Secret word and no other player's nickname, and it leaves the device only if you send it.

On the web Daily, the same service receives the messages and deletes them within the same periods above. To create a room or publish it in the public room list, the page loads Cloudflare Turnstile to distinguish a person from a program. Cloudflare processes browser and connection signals such as IP address, TLS connection characteristics, browser used, and the site key with its origin. It verifies the attempt for us as a processor and also processes signals as an independent controller to improve bot detection, under the Turnstile privacy notice. That notice governs retention of these signals; we do not promise the room's 30-minute period for them. The page receives a verification token, sends it to the service for that attempt and discards it afterwards. Publishing the room requires another verification with a fresh single-use token; the creation token is not reused. It does not keep it in site storage or use it for advertising.

To resume an invitation after Google sign-in, the browser may store the short code and time. Resuming is valid for up to ten minutes; the code is erased on resuming, cancelling or checking that its time has passed. No room token is in this record. Clearing site data also erases it.

Public rooms are also available on the web, when the listing service is available to browsers. Creating a private or public room uses the day's Daily category in the page's language. Joining may list rooms of every category and language, including rooms created in the apps. The public data is the same as above; the list entry is deleted when the room is removed and expires within 90 seconds after its last renewal. A private room is accessible only to someone with its code or invitation.

Hiding the tab counts as leaving the Duel, including switching tabs or minimizing the browser. The room connection is interrupted; if you stay away for 15 seconds during play while the other player remains connected, they win by walkover. Returning before the deadline lets you resume the same seat. Neither player wins if both are absent.

10. Analytics and crash reports

This section applies to Android only: the Windows and iPhone versions do not use Firebase (section 2.1, section 2.4); what they send is in section 10.1, and the studio switch is in section 10.2.

We use Google Analytics for Firebase and Firebase Crashlytics to know whether the game works and where it breaks. They are configured as internal operations, and that configuration is the reason we can use them with every player:

What is recorded are game events, such as a run started or finished, the Premium screen being seen, a purchase completed, a Petal obtained by ad, by purchase or for free, and a subscription starting or lapsing. The events are the same for every player. Alongside them go those services' standard technical data: the device model, the system version, the country and the language.

What changes with age, and only this. Before the first ad, the game asks your age (section 6) and keeps only the band.

Crash reports are the same for everyone. Whatever your age, and whether or not you answered, when the game fails Crashlytics sends a crash report: the error's stack trace, the state of the game at that moment and the device's technical data above. The only identifier it carries is an installation identifier, made of a random number Crashlytics generates itself and Firebase's installation number; it identifies this installation of the game, not you. It carries no name, no e-mail, no text you wrote and not your age band.

Your age band decides what analytics keeps on your device and is not sent. Settings → Delete my data also reaches Firebase: it stops sending the game's errors to Crashlytics at once, erases Firebase's installation number (on the device and on Firebase's servers), denies every storage again and erases from the device the analytics data, before erasing the rest. Crashlytics stays off until you close the game. The next time the game opens, it first erases any crash report still waiting on the device, unsent; then Crashlytics works again as for everyone, with a new installation identifier. If a report had to be erased, Crashlytics stays off in that opening, and each later opening checks again; it works again from the first one that finds nothing waiting. Erasing the installation number needs an internet connection: without one, the game tells you the deletion was not complete, and you can try again. After it, the game treats you as someone who has not answered.

What this does not erase. What had already been sent stays with Google, tied to identifiers that no longer exist on your device, and is erased by the retention period: 2 months for analytics data and 90 days for crash reports.

10.1 Windows and iPhone: simple counts, with no identifier

The Windows and iPhone versions do not use Firebase. They only count, on our server, a few steps at the start of the game, as numbers, so that we know whether the game is being opened and played in those stores. They are counts of events, not of people.

Android does not send this count to our server: it stays as described above, with Firebase.

10.2 The studio device

In Settings → About there is a hidden switch, Studio device, so that the devices of our team and our family do not count as players in our numbers. It is off by default.

10.3 The iPhone: which Apple Ads campaign brought the install

If you installed the game from an Apple Ads ad (the App Store's search ads), the iPhone version asks Apple which campaign it was, so that we know which of our ads are worth what they cost. This uses AdServices, Apple's own feature for it: it does not ask the tracking question (App Tracking Transparency), does not read the advertising identifier and does not depend on your answer to it. None of this shows in the game.

11. Feedback and support

The game has a Send feedback screen (Settings ▸ About), a per-word report on the results screen and, after a rewarded ad, a Report this ad link. They exist so you can tell us about a problem, a wrong word, an idea, a compliment or an inappropriate ad. There is no automatic sending: nothing leaves the device until you tap “Send”.

What is sent, and nothing beyond it: the category you chose (one of five fixed labels), your message as free text, and a technical block the app assembles and shows you on screen before you send - the app version and build type, the platform and the operating-system version string cut at 40 characters (on Android this is usually a kernel line, not the device model), the interface language, the tap mode, the screen you were on, and a list of up to 20 recent actions as internal game codes. Errors appear as a label from a closed list, never the error message and never the stack. A per-word report also carries the category, subcategory, secret count, phase and the word's internal identifier. An ad report also carries the ad unit, the time the ad was shown and the identifier the ad network gave that one ad response, so we can find the ad and block its advertiser; it is not a device or advertising identifier.

Important: the message field is free text and reaches us exactly as you wrote it. Do not write your name, e-mail, phone number, address or any other personal information there - yours or a child's. We do not need it to fix the game, and the app says so under the field.

Where it goes. The report is sent over HTTPS to a Google Apps Script service operated by Melbees Games, which appends it as a row in a Google Sheets spreadsheet of ours, with access restricted to us. Google acts only as a hosting provider, under its own terms. Nothing is sold, shared with third parties, used for advertising or used to build profiles.

The row carries no identifier tied to you. There is no account, no device id, and we do not keep your IP address - in practice we cannot link a report to a person, or join two reports from the same person, except by what is written in them.

If sending fails, the app says so (it never says “sent” when it did not) and offers two ways out, both started by you: opening your e-mail app with a pre-filled message - if you send it, we come to know your address, because it is ordinary e-mail - or copying everything to the clipboard.

How long we keep it, and how to delete it. We keep the row while it is useful for fixing what it describes and, in any case, for at most 24 months. You can ask for it to be deleted sooner by writing to contact@melbees.games. Because the rows carry no identifier, we need your help to find yours: tell us the date you sent it and an excerpt of what you wrote. We delete the matching rows and confirm by e-mail. Without those two details we cannot locate your report - not out of refusal, but because the spreadsheet stores nothing that ties a row to a person.

12. For parents and guardians

Inside the game, under Settings, there is a For parents and guardians page. It asks for no age, sits behind no purchase, and shows:

On Windows, the matching controls are Microsoft's, in Microsoft Family Safety: screen-time limits and approval before a purchase on the Microsoft Store.

On the iPhone, the matching controls are Apple's: Screen Time limits screen time, and Family Sharing's Ask to Buy asks a guardian's approval before a purchase on the App Store.

The game measures and shows time of use and never interrupts a run. It also sends no notifications, gives no reward for time spent connected, and has no daily streak that is lost by missing a day.

Messages from the game team, only inside the app, with no notification and no conversation. The team writes short messages, signed by the Melbees, kept in Hug's Mail inside the game and read when the player chooses. Nobody answers them and no other player ever writes one; they never appear during a match and are never chosen by age or by how the player plays. Those about the Premium subscription are marked as such and go to everyone, never to one player alone. To fetch the messages for everyone, the game sends our server a request that carries no identifier at all and is the same for every player; what was read stays on the device (section 8 covers a message to one account). A row in Settings > General > Hug brings new messages turns off Hug's arrival with the message; the messages stay in the Mail.

13. Who the data is shared with

We do not sell your data and we do not give it to data brokers. The services below are the only ones that receive anything, each for one purpose:

We may also disclose data where the law requires it, to comply with an order from a competent authority, or to investigate fraud and abuse of the leaderboard.

14. International transfers and retention

The services above run servers outside Brazil, so the data described here may be processed in other countries, under those providers' contractual safeguards - including the standard contractual clauses that apply to transfers out of the European Union and the United Kingdom.

15. Your rights, and how to use them

The LGPD gives you, among others, the rights of confirmation, access, correction, anonymisation, portability, erasure, information about sharing, and withdrawal of consent. Where the GDPR applies, you also have the rights to object, to restrict processing and to portability, and the right to complain to your country's data-protection authority - in Brazil, the ANPD.

In practice:

The legal bases. We perform the contract of using the game in order to make the game work, deliver what you bought, and keep your account and the leaderboard (LGPD art. 7 V; GDPR art. 6(1)(b)). We rely on legitimate interests to fix defects, to measure whether the game works and how many accounts it has, and to defend the leaderboard against cheating (LGPD art. 7 IX; GDPR art. 6(1)(f)). We rely on your consent for personalised advertising where it is required (LGPD art. 7 I; GDPR art. 6(1)(a)), and you may withdraw it at any time. We also comply with legal obligations, such as those of Brazil's Law 15.211/2025, the Digital Statute of the Child and Adolescent (LGPD art. 7 II; GDPR art. 6(1)(c)).

16. Security

Everything that leaves the device travels over HTTPS. Access to the leaderboard database and to the feedback spreadsheet is restricted to us. No system is perfect and we cannot promise absolute security. We hold no password of yours and no payment data, and the game server keeps no IP address, which sharply limits what an incident could expose. What the sign-in keeps about your account is in section 8.

17. Changes to this policy

We may update this policy; the “Last updated” date will change and, for material changes, we will say so inside the app. A new feature that sends data is only switched on after this page has been updated, never before.

18. Contact

Melbees Games, Brazil
contact@melbees.games