DBCA Labs·Summit

Privacy Policy

Summit by DBCA Labs (DBCA Consulting Inc.) · Effective date: October 14, 2026

In short

Who we are

Summit is a number puzzle game for Android and iOS. It is published under the name DBCA Labs by DBCA Consulting Inc., a Canadian corporation (“DBCA Labs”, “we”, “us” or “our”).

DBCA Consulting Inc. is responsible for the personal information described in this policy. Under European data protection law, we are its “controller”.

Our privacy officer is accountable for how we handle personal information and can be reached at the same email address.

This policy covers the Summit app and these web pages. Google, Apple, Cloudflare and OVHcloud have their own privacy policies for their own services; we link to them below.

What we collect and why

Data we keep on our server

The “legal basis” column applies to players in the European Economic Area (EEA), the United Kingdom and Switzerland. Contract means we need the data to provide the game you asked for under our Terms of Service. Legitimate interests means we use it for a reasonable purpose of ours that doesn’t override your rights. Legal obligation means a law requires it.

What Where it comes from Why we use it Legal basis How long we keep it
Player ID: the user ID that Firebase Authentication gives your account, your Support ID (a number our server assigns, shown in Settings), and a public player ID (12 letters and digits) that other players’ apps receive with your display name Created automatically the first time you open Summit To recognize your account and connect your game data to it. The public player ID lets other players report or hide you without learning your Support ID Contract Until your account is deleted
Display name: an automatic name such as “Player4821”, or a nickname you choose You (the first-launch prompt or Settings); otherwise automatic To show you on the weekly leaderboard, in your league and in friend leagues you join, on invite pages you share, and to a player whose invite you accept or who accepts yours. Names must be unique Contract Until you change it or your account is deleted. Earlier names can stay in our server logs for a limited time (see How long we keep data)
Game results: score, level, clears, best combo, longest chain, game length, wildcards used, whether you continued, whether the game used a league boost, start and finish times, app version, and whether our anti-cheat checks accepted or flagged the game The app, when you start a game while online and when it sends the finished game (right away, or once you’re back online) To record your scores, rank you on leaderboards and in leagues, and detect cheating Contract; legitimate interests (fair play) Until your account is deleted. Games that are started but never finished are deleted within 2 days
Leaderboard and league data: your best score each week and when you reached it, your league tier, your group’s standings, your past weekly results, and any league boost you earned (when, the reward ID from Google, and the game that used it) Calculated by our server from your game results and ad rewards To run the weekly leaderboard, leagues, promotions, demotions and the league boost, and friend leagues’ weekly tables and trophies Contract Until your account is deleted
Friend leagues: the leagues you create or join: each league’s name (chosen by the player who created it, or later by its owner), its members and its owner, when each member joined, the weeks each member won a trophy and the winning score, and a record of each player the owner removed (who and when) You and the other members, when you create, join, rename or leave a league or remove a member. Our server works out the trophies from weekly best scores To run friend leagues: show each league’s weekly table and trophies, apply the limits (up to 50 members, up to 5 leagues each), pass a league to another member when its owner leaves, and stop a removed player from joining again with the same code Contract Your membership and your trophies in a league: until you leave it, its owner removes you, it is deleted, or your account is deleted. A league: until its last member leaves or its owner deletes it. Its name stays with it, even after the player who chose the name leaves or deletes their account. A removal record: until the owner gets a new invite code, the league is deleted, or the removed player’s account is deleted
Invite codes: a 6-character code for each friend league, and a personal invite code for you (made the first time you use friend leagues or invites), including old codes that were replaced by a new one Created by our server To make invite links, let friends join a league or accept your invite, show an “expired” page for old links, and make sure a code isn’t given out again while we keep it Contract A league’s codes: until the league is deleted. Your personal codes: until your account is deleted
Invites you accept or send: which player’s invite you accepted, or which players accepted yours; when; whether and when the new player’s first game after accepting counted; whether and when each player got the reward; and whether each player’s app has shown the reward notice You, when you follow a friend’s invite link, install Summit from it (Android) or enter their code; and our server, when the new player finishes a game To give both players their reward once, show the reward notices, count the friends who joined with your invite, and apply the rules: one invite per new player, within 7 days of creating the account, not your own and not each other’s, and at most 10 rewards for each player who invites Contract; legitimate interests (preventing abuse of the rewards) While either player’s account exists. When one of the two deletes their account, the record no longer names them. It is kept for the other player. If they joined with your invite, they can still get their reward, and they can’t accept another invite. If you joined with theirs, their invite count and reward limit stay right. It is deleted once it names neither player
Reports: a report you send about a display name or a league’s name (your player ID, the name as it was, the player or league it belongs to, the reason you chose, your note if you wrote one, and when), and what we did about it You, when you tap Report in the app; other players, when they report your display name or the name of a league you’re in To review names that may break our rules and act on them: we may dismiss a report, change a display name to an automatic one, or rename or delete a league. Each player can send a limited number of reports a day. When several players report the same display name, our server may change it to an automatic name at once. While we keep a report about a name we changed, that name can’t be used again Legitimate interests (keeping names on leaderboards and in leagues within our rules) Until we have dealt with the report, then 90 days. If you delete your account, reports you sent stay, no longer linked to you, until then; reports about your display name are deleted. Reports about a league’s name are deleted with the league
Wallet: your power-up balances (wildcards, reshuffles, extra time and kill rows), when your next free power-up is due, and a log of every change (the power-up, amount, reason such as sign-up gift, free refill, ad reward, purchase, invite reward, use or correction, and time) Calculated by our server To keep your balances correct, give you free power-ups on time, make sure nothing is granted or spent twice, and help you if something goes wrong Contract Until your account is deleted
Purchases and owned items: the store (Google Play or App Store), product, order or transaction number; for Google Play, a one-way hash of the purchase token; for the App Store, the original transaction ID and environment (production or sandbox); status (granted or refunded), dates, refund notices from Apple, a record of each time an item (such as Remove Ads or a theme) moved to another Summit account during a restore, and the items you own The app (after you buy or restore), Google Play and the App Store To deliver and restore what you bought, handle refunds and fraud, and keep accounting and tax records Contract; legal obligation (tax and accounting); legitimate interests (preventing fraud) Owned items: until your account is deleted. Purchase records: 6 years after the end of the tax year of the purchase, as Canadian tax law requires, including after your account is deleted. They are then no longer linked to your Summit account, unless the item is restored on a new Summit account (Summit does this by itself on a device signed in to the same Google Play or Apple account). The record is then linked to that account
Ad reward records: the reward ID from Google, what the reward was for (a power-up, progress towards a theme, or a league boost), whether it was granted, and when Google AdMob, which confirms to our server that you watched a rewarded ad To give you each reward you earned exactly once, count your progress towards a theme, and apply the daily limit Contract Until your account is deleted
Sign-in details, if you choose “Save your progress”: the email address and password, Google account or Apple ID you link; the email address that Google or Apple share when you link them (with Sign in with Apple, you can hide your real email address); for a Google account linked on Android, the name and profile photo that Google shares; and whether your email address is verified You, and Google or Apple when you link them To let you get your account back after reinstalling Summit or on a new device, verify your email address and reset your password Contract Until you delete your account. Firebase Authentication (Google) holds these details for us. Our game server stores only your player ID, never your email address or password
Technical data and server logs: IP address, date and time, the server address requested, app and operating-system information (or, for a web page, the browser’s) sent with each request, and our server’s record of events on your account (player ID, Support ID, display-name changes, account deletion, purchases, ad rewards, league boosts, flagged games, friend-league events such as creating, renaming, joining or leaving a league and removing a member, with the league’s name, invites accepted and rewarded, reports received, and names we changed after reports, with the old and new name). When a browser opens too many invite pages, our server also logs its IP address Automatically, with every request the app makes to our server, and when you visit these web pages or open an invite link To deliver the service, keep it secure, limit abuse and fix problems Legitimate interests (security and reliability) Server logs: for a limited time, then deleted automatically (see How long we keep data). Rate limiting uses your player ID and, when you look up an invite code or open an invite page, your IP address, only briefly, in memory
Messages to support: your email address, what you write, and any Support ID you give us You, when you email us To answer you, confirm that a request comes from the account’s owner, and keep a record of requests Legitimate interests; legal obligation (privacy requests) Up to 2 years after your request is closed

Each friend league has an invite code, and so does each player who uses friend leagues or invites. The app shares a code as a link to our server.

Data that stays on your device

Summit keeps the following on your phone or tablet. It isn’t sent to us, except as described in the table above:

Uninstalling Summit deletes this data from your device. Android’s automatic backup to your Google account, and iCloud or computer backups on iPhone and iPad, can keep a copy, which is how a guest account can come back after you reinstall Summit or move to a new device. Those backups are under your control. If you saved your progress, you can also get it back by signing in again.

What we don’t collect

Who we share data with

We don’t sell your personal information for money, although some US state laws treat Google’s personalized ads as “selling” or “sharing” (see California and other US states). We share it only as described here.

Our service providers (OVHcloud, Firebase Authentication and Cloudflare) process your information only on our behalf, under contracts that require them to protect it at least as well as this policy does. Google (for ads, Google Play and Sign in with Google) and Apple (for the App Store and Sign in with Apple) handle it under their own terms and privacy policies, and we share it with them only where they provide the same or equal protection of your data as described in this policy.

Other players

Your display name, scores and ranks are visible to other players on the weekly leaderboard and in your league (a group of up to 30 players). Friend leagues and invites show some of this to other people too (see below). Other players’ apps also receive your public player ID, so they can report or hide you. Other players never see your Support ID, your email address or any other account details. If you report a name, we don’t tell the player who reported it. If you hide a player, they aren’t told either: only your app shows them as “Hidden player”.

Friend leagues and invites

OVHcloud

OVHcloud hosts our game server and its database in Canada, as our service provider. Learn more: OVHcloud Privacy Policy.

Firebase Authentication (Google LLC)

Firebase Authentication creates and runs your Summit account. When the app signs in, Firebase receives your Firebase user ID, sign-in tokens, your IP address and basic information about your device and app. If you save your progress, Firebase also holds the email address and password (stored in a protected, hashed form), or the Google account or Apple ID you linked, with the details described in the table above. It sends the emails that verify your email address and reset your password. Google and Apple handle their own sign-in under their own privacy policies. Firebase acts as our service provider. Google says that Firebase Authentication keeps logged IP addresses for a few weeks, and keeps your other sign-in details until your account is deleted; it then removes them from its live and backup systems within 180 days. Learn more: Privacy and security in Firebase.

Google AdMob (Google LLC)

Google AdMob shows the ads in Summit: rewarded ads and full-screen (interstitial) ads. Google’s ad software in the app collects:

Whenever you watch a rewarded ad for a reward that our server gives you (a power-up, progress towards a theme, or a league boost), the app also passes your Support ID and the reward to Google, so that Google can confirm the reward to our server.

Google uses this data to show and measure ads, for analytics, to prevent fraud and, where you allow it, to personalize ads. Through AdMob, other advertisers and ad technology companies may bid to show ads in Summit and may receive some of this data (such as a shortened IP address and device identifiers) under Google’s rules; in the EEA, the UK and Switzerland, Google’s consent message lists them. For some of these uses, Google decides how the data is used itself, as an independent controller. Learn more: How Google uses information from sites or apps that use our services. Summit’s ads come only from Google AdMob; we don’t use other ad networks or ad mediation.

Google Play and the Apple App Store

Google Play and the App Store process your payments under their own terms and privacy policies. They tell us what was bought (product, order or transaction number, purchase token or signed transaction, which also shows the store country and price, and status) so that we can deliver it. If you install Summit from an invite link on Android, Google Play also passes the invite on to Summit (see Invite links). When you buy something on Google Play, the app also gives Google Play a coded (one-way hashed) form of your Firebase user ID, not your Support ID. Google can use it to detect fraud, and our server uses it to check that a power-up pack or bundle goes to the account that bought it. Our server checks Google Play purchases with Google, and receives refund information from both stores. We never receive your card number or billing details. Learn more: Google Privacy Policy and Apple Privacy Policy.

Cloudflare, Inc.

The app reaches our server, and your browser reaches these web pages and our invite pages, through Cloudflare’s network, which protects them and encrypts the connection. Cloudflare processes your IP address and the requests that the app and your browser send to us, as our service provider. Learn more: Cloudflare Privacy Policy.

When the law requires it, or to protect people

We may disclose information when the law requires it (for example, a valid court order), to protect the rights, safety or property of players, DBCA Labs or others, or to investigate fraud or cheating.

If the business changes hands

If DBCA Consulting Inc. or Summit is sold, merged or reorganized, player data may be transferred to the new owner, who must continue to protect it as this policy describes. We’ll tell you before your information becomes subject to a different privacy policy.

Ads and your choices

Summit is free because of ads.

Settings > Privacy choices only appears where the rules require it.

Legal basis (EEA, UK and Switzerland): we rely on your consent, given in Google’s consent message, for Google’s ad software to store and read information on your device and to personalize ads. If you don’t consent, Google may show non-personalized or limited ads based on our legitimate interest in funding a free game. Passing your Support ID to Google when you choose to watch an ad for a reward from our server is necessary to give you the reward you asked for (contract).

Where your data is stored

Our game server and its database are hosted by OVHcloud in Canada. Google (Firebase Authentication, AdMob, Google Play and Sign in with Google), Apple and Cloudflare are based in the United States and may process data in the United States and other countries. Data held in another country is subject to that country’s laws, and its courts or authorities may be able to access it.

For players in the EEA, the UK and Switzerland: Canada is recognized as providing adequate protection for organizations subject to Canada’s federal privacy law (PIPEDA). Transfers to our providers in other countries rely on safeguards such as the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or standard contractual clauses.

How long we keep data

How we protect your data

No system is perfectly secure. If a security breach creates a real risk of significant harm to you, we’ll notify you (for example, in an app update or on this page) and the authorities, as the law requires.

Your rights

Everyone

Wherever you live, you can:

To make a request, email support@dbcaconsultinginc.ca and include your Support ID (in the app: Settings > Support ID, tap it to copy it). The Support ID is how we find your account. If you saved your progress, you can instead give us the email address you used: the one you typed, or the one of your Google account or Apple ID. If you used Sign in with Apple and chose Hide My Email, give us the relay address: on your iPhone, open Settings, tap your name, then Sign-In & Security > Sign in with Apple > Summit. To protect your account, we may ask for more details to confirm that the request comes from its owner. We answer within 30 days, free of charge. If we need more time and the law allows it, we’ll tell you why.

Canada

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy laws, you can access and correct your personal information and withdraw your consent, subject to legal and contractual limits. If you withdraw consent to something Summit needs in order to work, we may no longer be able to provide it. If you aren’t satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy commissioner.

EEA, UK and Switzerland

Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, you have the right to:

Our anti-cheat checks automatically flag results that aren’t plausible and leave them off leaderboards and leagues. This has no legal or similarly significant effect on you, and you can ask us to review a flagged result.

California and other US states

This section applies to California residents, and to residents of other US states with consumer privacy laws, to the extent those laws apply to us.

What is collected. These categories of personal information are collected through Summit, by us, by Firebase Authentication for us, or by Google’s ad software, from the sources and for the purposes described in What we collect and why and Who we share data with:

We don’t use or disclose sensitive personal information for any purpose that would give you a right to limit its use. We keep each category for the periods in How long we keep data.

Selling and sharing. No one pays us for your personal information. However, Google AdMob’s software in Summit collects identifiers (such as your advertising ID and IP address), approximate location and data about how you interact with ads and the app, and Google uses them to show personalized ads. Under California law, this may count as “sharing” personal information for cross-context behavioral advertising, and possibly as “selling”. You can opt out with Settings > Privacy choices where it is offered in your state, by choosing “Ask App Not to Track” on iPhone and iPad, or by deleting your advertising ID or opting out of ad personalization in your Android settings. Summit doesn’t ask for players’ ages, and we don’t knowingly sell or share the personal information of consumers under 16. Our web pages don’t sell or share personal information, so there is nothing for a Global Privacy Control signal to opt out of there.

Your rights. You can ask to know what personal information we have collected about you and to get a copy of it, to delete it, and to correct it. You can also opt out of its sale or sharing. We won’t treat you differently for using these rights. An authorized agent can make a request for you with your written permission; we may ask you to confirm your identity directly. Make requests as described under Everyone.

Other US states. If you live in another state with a consumer privacy law (for example, Colorado, Connecticut, Texas or Virginia), you may have similar rights, including opting out of targeted advertising. If we decline your request, you can appeal by replying to our answer; if we deny your appeal, you can contact your state’s attorney general.

Children

Summit is for players aged 13 and over, and it is not directed to children under 13. We don’t knowingly collect personal information from children under 13, or from children below the minimum age in their country for using online services without a parent’s consent.

If you believe a child has used Summit and given us personal information, email support@dbcaconsultinginc.ca, ideally with the Support ID from the child’s app (Settings > Support ID). We’ll delete the account and its data.

Deleting your account

Uninstalling Summit does not delete your data from our server. The Delete your account page explains both options, what we delete, what we keep and for how long.

Changes to this policy

When we change this policy, we’ll update the effective date at the top. If a change is significant, we’ll tell you in the app (for example, in an app update) or on this page before it takes effect. Earlier versions are available on request.

Contact us

DBCA Labs (DBCA Consulting Inc.)

Please include your Support ID (in the app: Settings > Support ID) when you write about your account.