Last updated: May 24, 2026
App: Junction (com.junction.app)
Developer / Data controller: Junction (operated by the developer listed below)
Contact: toobajatoi44@gmail.com
This Privacy Policy explains how Junction ("Junction", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use the Junction mobile application and related services (collectively, the "Service").
Junction is a UX flow puzzle game. You design user journeys by connecting nodes, simulate flows, and may compete in timed and online modes. By using the Service, you acknowledge that you have read this Privacy Policy.
If you do not agree with this Privacy Policy, please do not use the Service.
1. Who this policy applies to
This policy applies to:
- Users who create an account (email, Google, or Apple Sign-In)
- Users who play as a guest without signing in
- Users who purchase subscriptions or in-app products
- Users who participate in Online Blitz or other multiplayer features
- Visitors who contact us for support
This policy does not apply to third-party websites, apps, or services that we link to (for example, YouTube videos in Learn lessons, Figma templates, or app store billing pages). Those services have their own privacy policies.
2. Information we collect
We collect information in the categories below. Some information is required to provide core features (for example, account credentials). Other information is optional or collected only when you use specific features.
2.1 Account and identity information
When you register or sign in, we may collect:
- Email address — if you sign up with email/password or if your OAuth provider shares it
- Authentication identifiers — Supabase user ID, OAuth subject IDs from Google or Apple
- Display name — the username you choose during onboarding (must be at least 2 characters)
- Profile metadata from OAuth — such as your name or profile picture URL if provided by Google or Apple (we primarily use the display name you set in Junction)
- Password — if you use email sign-up, your password is handled by Supabase Auth; we do not store plain-text passwords on our servers
We do not require a real name. Your display name is shown to other players in Online Blitz matchmaking and results.
2.2 Onboarding and preference information
During first-time setup, you may provide:
- Age range — selected from predefined brackets (used to tune difficulty; stored in local/cloud progress)
- Experience level — for example Beginner, Intermediate, or Advanced
- Interest tags — which game worlds you want to explore (e.g. ecommerce, fintech)
This information is stored as part of your game progress profile.
2.3 Gameplay and progress data
We store gameplay data so you can resume where you left off and, if signed in, sync across devices. This includes:
- Campaign progress — levels attempted, completed, best scores, stars, and unlock status
- World and level identifiers — which puzzles you have played
- Simulation results — scores across metrics such as simplicity, efficiency, conversion, recovery, trust, and accessibility
- Daily challenge — date, completion status, and best score
- Blitz mode stats — plays, clears, best score, best time, streaks, and coin balance
- Vs Computer stats — wins, losses, and draws
- Learn module progress — lesson quiz attempts, pass/fail status, best scores, and timestamps
- XP, streaks, and virtual coins — in-game progression and rewards
- Coin-unlocked levels — campaign levels unlocked early using in-game coins
- Onboarding completion flag — whether you finished the in-app tutorial
- Custom node labels — text you enter when adding custom nodes to a puzzle board (stored only as part of your local puzzle state unless shared via UX Audit export)
Most gameplay data for signed-in users is stored in Supabase (user_progress table as JSON). Guest progress is stored locally on your device until you sign in and link your guest session.
2.4 Online Blitz and multiplayer data
If you use Online Blitz, we collect and process:
- Matchmaking queue entry — your user ID and rating while waiting for an opponent
- Match records — match ID, level ID, your score, completion time, opponent user ID, opponent score, opponent time, and match outcome
- Online rating, wins, and losses — stored on your profile for skill-based matchmaking
- Live board activity — during an active match, we temporarily sync your puzzle nodes, edges, build status, and connection count so your opponent can see your board update in real time. This data is tied to the match and your user ID.
- Opponent display name and rating — shown to you during and after a match (we do not expose your email to opponents)
We may use bot opponents as a fallback when human matchmaking is unavailable. Bot matches still record scores and outcomes on your profile.
2.5 Purchase and entitlement data
When you buy a subscription or one-time in-app product:
- Apple App Store or Google Play processes payment. We do not receive your full card number, billing address, or bank details.
- RevenueCat receives purchase receipts and subscription status from the app store and tells Junction which entitlements you own (for example UX Flow Pro, world unlocks, Learn pack, UX Audit).
- We store entitlement flags locally and may sync purchase-derived unlock state with your account progress.
We may receive: product identifier, purchase date, renewal status, expiration date (for subscriptions), and anonymous app store transaction IDs through RevenueCat.
2.6 Device, app, and technical data
Depending on your platform and settings, we may collect:
- Guest device identifier — a random ID stored locally (AsyncStorage) to associate guest display-name claims and guest progress before you sign in
- Device type and OS version — indirectly through Expo/React Native for compatibility
- Push notification permission status — if you grant permission, we schedule local reminders on your device (daily streak nudge, weekly challenge). We do not operate a server-side push notification marketing platform at this time.
- App logs and error reports — our backend providers (Supabase, Expo) may log IP addresses, request timestamps, and error diagnostics for security and reliability. We do not currently integrate a separate third-party crash analytics SDK (such as Sentry or Firebase Analytics) in the app.
We do not collect precise GPS location. We do not access your contacts, photos, microphone, or camera for core gameplay.
2.7 Support and communications
If you email us at toobajatoi44@gmail.com, we receive:
- Your email address
- The content of your message and any attachments you choose to send
- Metadata necessary to respond (timestamps, thread history)
We use this information only to provide support and improve the Service.
2.8 UX Flow Audit and exports
The UX Flow Audit feature generates a structured report from your puzzle solution (metrics, findings, suggested nodes). If you choose Share PDF, the report is rendered on-device and shared through your device's native share sheet (email, messaging apps, cloud storage, etc.). We do not upload audit PDFs to our servers unless you separately send them to us for support.
3. How we collect information
We collect information through:
- Information you provide directly — account registration, display name, onboarding choices, custom node labels, support emails
- Automatic collection during gameplay — scores, progress, match results, and sync data when you use signed-in features
- Third-party authentication — Google Sign-In and Apple Sign-In provide account tokens and limited profile fields
- App stores and RevenueCat — purchase and subscription status
- Local device storage — guest progress, notification preferences, cached entitlements
4. How we use your information
We use personal and gameplay information for the following purposes:
| Purpose | Examples |
|---|---|
| Provide the Service | Create accounts, save progress, run simulations, unlock purchased content |
| Multiplayer | Match you with opponents, record match results, update ratings |
| Personalization | Adjust difficulty based on experience level, remember interests and streaks |
| Purchases | Verify subscriptions, restore purchases, gate premium worlds and features |
| Security & fraud prevention | Enforce display-name uniqueness, detect abuse in online modes, protect accounts |
| Support | Respond to your requests and troubleshoot issues |
| Improve the Service | Understand feature usage patterns in aggregate, fix bugs, balance gameplay |
| Legal compliance | Respond to lawful requests, enforce our Terms of Service |
Legal bases (EEA, UK, and similar jurisdictions)
If you are in the European Economic Area, United Kingdom, or another region that requires a legal basis for processing, we rely on:
- Contract — processing necessary to provide the Service you requested
- Legitimate interests — securing the Service, preventing abuse, improving features (balanced against your rights)
- Consent — where required, for example push notification permissions or optional OAuth scopes
- Legal obligation — where we must retain or disclose data under applicable law
You may withdraw consent where applicable without affecting the lawfulness of processing before withdrawal.
5. How we share information
We do not sell your personal information. We do not share your email address with other players.
We may share information in these limited circumstances:
5.1 Service providers (processors)
We use trusted vendors who process data on our behalf under contractual obligations:
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Auth, database, realtime, edge functions | Account IDs, email, display name, progress JSON, match data |
| RevenueCat | In-app purchase management | App user ID, store receipts, entitlement status |
| Sign-In, Play Billing (Android) | OAuth tokens, purchase data via Play | |
| Apple | Sign-In, In-App Purchase (iOS) | OAuth tokens, purchase data via App Store |
| Expo / EAS | App builds and updates | May process device/build metadata |
Each provider's privacy policy governs their handling of data:
5.2 Other players (limited)
In Online Blitz, other players may see your display name, online rating, match score, and board activity during an active match. They cannot see your email, age, or full progress history.
5.3 Legal and safety
We may disclose information if we believe in good faith that disclosure is necessary to:
- Comply with law, regulation, legal process, or government request
- Enforce our Terms of Service
- Protect the rights, property, or safety of Junction, our users, or the public
- Detect or prevent fraud, security issues, or abuse
5.4 Business transfers
If Junction is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via the app or email if ownership or use of your personal information changes materially.
6. International data transfers
Our service providers may process data in the United States, European Union, and other countries where they operate data centers.
If you use the Service from outside those regions (including Pakistan), your information may be transferred internationally. Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms offered by our providers.
7. Data retention
We retain information for as long as necessary to provide the Service and fulfill the purposes described in this policy:
| Data type | Retention period |
|---|---|
| Account & profile | Until you delete your account or request deletion, plus a short backup window |
| Gameplay progress | While your account is active; guest data until cleared from device or linked to an account |
| Match history | Retained for matchmaking integrity and rating calculation; may be aggregated or anonymized over time |
| Live match activity | For the duration of an active match; updated in real time and not intended as permanent archive |
| Purchase records | As long as required for tax, accounting, and app store reconciliation (often several years per store rules) |
| Support emails | As long as needed to resolve your inquiry and maintain reasonable support records |
When you request account deletion, we will delete or anonymize personal data within a reasonable period (typically 30 days), except where retention is required by law or legitimate business needs (for example fraud prevention or unresolved disputes).
To request deletion, email toobajatoi44@gmail.com from the address associated with your account.
8. Security
We implement administrative, technical, and organizational measures designed to protect your information, including:
- Encryption in transit (HTTPS/TLS) for network communication with Supabase and store APIs
- Row Level Security (RLS) on Supabase tables so users can only access their own progress where applicable
- Authentication tokens managed by Supabase Auth
- Least-privilege access to production systems by the developer
No method of transmission or storage is 100% secure. You are responsible for keeping your device and account credentials safe.
9. Your privacy rights
Depending on where you live, you may have rights to:
- Access — request a copy of personal data we hold about you
- Correction — update inaccurate display names or profile data (many fields editable in-app)
- Deletion — request erasure of your account and associated data
- Portability — receive a machine-readable copy of progress data where feasible
- Object or restrict — certain processing based on legitimate interests
- Withdraw consent — for optional features such as notifications
How to exercise your rights
Email toobajatoi44@gmail.com with the subject line "Privacy Request". We may verify your identity before fulfilling requests. We will respond within the timeframe required by applicable law (often 30 days).
Subscriptions and store purchases
To cancel a subscription, use your Apple App Store or Google Play subscription settings. Refunds are handled by Apple or Google under their policies, not directly by Junction.
California residents (CCPA/CPRA)
We do not sell personal information. California residents may request access to or deletion of personal information as described above. We will not discriminate against you for exercising privacy rights.
EEA / UK residents
You may lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concern.
10. Children's privacy
Junction is not directed to children under 13 (or the minimum digital consent age in your country, which may be higher in some regions, such as 16 in parts of the EU).
We do not knowingly collect personal information from children under the applicable minimum age. If you believe a child has provided us personal information, contact toobajatoi44@gmail.com and we will take steps to delete it.
The Service includes age-range selection during onboarding for difficulty tuning; this is not intended as verified age authentication.
11. Push notifications
If you allow notifications on iOS or Android, Junction schedules local notifications on your device (for example daily streak reminders). These are generated on-device; we do not use them to collect location or behavioral advertising profiles.
You can disable notifications anytime in your device Settings.
12. Guest play and account linking
You may play without signing in. Guest data (progress, display name claim, device ID) is stored locally on your device.
When you later sign in with Google, Apple, or email, we may merge guest progress into your account if you choose to link sessions. Merged data is governed by this policy as account data.
If you uninstall the app without signing in, guest progress may be lost.
13. Third-party content and links
The Learn section may link to external resources (YouTube, Figma community files, articles). Opening those links leaves the Junction app and is subject to the third party's terms and privacy practices.
Level scenarios may reference well-known products and brands for educational purposes. Junction is not affiliated with or endorsed by those companies unless explicitly stated.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top. Material changes may be communicated through the app, email, or store listing notes.
Continued use of the Service after changes become effective constitutes acceptance of the updated policy, unless applicable law requires otherwise.
15. Contact us
For privacy questions, requests, or complaints:
Email: toobajatoi44@gmail.com
App: Junction (com.junction.app)
We aim to respond to privacy inquiries within 30 days.