ColorBlast LLC provides Three Tigers: Aadu Puli Attam. This policy describes information handled by the Android app and its connected game services. Contact us about privacy at amitg@colorblast.in. For help using the app, visit Android Support.
Playing locally
Versus AI, Pass and play and the tutorial work without signing in. Local saved games, replay history, local AI statistics, tutorial progress and comfort preferences are stored on your device. We do not upload ordinary offline game histories as online matches.
A configured app may still contact online services to check available sign-in providers and load public catalog information while signed out. Those connections expose technical information such as your network address to the service providers. Being able to play offline does not mean that a connected device never makes service requests.
Android backup and device-transfer rules exclude the app's saved data. Uninstalling or clearing app storage can remove local games and device credentials. It does not delete an online account or request a purchase refund.
Accounts and profiles
If you choose Google sign-in on Android, our authentication provider receives the account identifier and basic information supplied through that sign-in, which may include a name and email address. We also store your chosen display name, preset avatar, player code, equipped appearances and account activity needed for game features. Android offers Google sign-in only. We do not receive your Google password.
Google sign-in may also provide a profile-picture reference retained by our authentication service. The app uses preset avatars and does not access your photo library.
The Android release uses a separate account service from Three Tigers on iOS and earlier Testing/TestFlight builds. Signing in with the same Google email does not import an iOS or test account, coins, hints, cosmetics, friends, ratings or match history. Your Android inventory belongs to your Android account. Existing iOS and test accounts are preserved; this release does not merge or delete them. Ordinary local saves and preferences remain on the same device when updating without clearing app data.
A guest purchase or another supported commerce action can create a persistent guest identifier without Google sign-in. This guest identifier connects purchases, inventory and recovery information to the correct account. It is not anonymous usage data. Connecting Google can preserve access across Android devices using this same account service. The supported guest-to-Google connection or guest-transfer flow requires server confirmation; separate registered accounts are not automatically combined. It is not a migration from iOS or Testing.
Sign-in sessions are stored using Android Keystore-backed encryption. Account linking or guest transfer may retain encrypted recovery information until the server confirms the operation. Signing out is different from deleting an account.
Online play, friends and player safety
For Online games we process participants, room and queue information, moves, results, clocks, ratings and related statistics. These records let us validate moves, restore games, settle virtual coins and investigate disputes or abuse.
Social features use player codes, friend requests and relationships, invitations and blocks. We do not upload your device address book. Reports can include the selected reason, optional text, relevant players and match, and moderation decisions. Please avoid unnecessary personal information in report text.
Other players can see information needed for matches and social features, including your display name, preset avatar/frame, shared player code, participation, results and qualifying leaderboard entries. Email addresses, purchase history and private reports are not public profile posts.
Purchases, virtual items, rewards and hints
Google Play processes Android purchases. We receive purchase information needed to verify and deliver items, such as the product, purchase token or its hash, order reference, account binding, purchase state and refund status. We do not receive payment-card details. We store server-owned coins, hints, appearance ownership and relevant grants, spending, rewards and reversals to prevent duplicate delivery and maintain inventory.
An unfinished purchase can remain encrypted on the device until verified delivery and finalization are acknowledged. These recovery records are not silently discarded on sign-out or account changes. Account deletion is not a refund request and does not make already delivered consumable packs eligible for another grant.
For a new AI hint, the app sends account-linked game/request identifiers and a code derived from the board position. For an Online hint, it sends the match identifier, expected move number and request identifier; the server already holds that match's moves. These requests confirm the permitted inventory use. The hint is calculated on the device. Local hint/reward recovery records allow interrupted requests to be retried without an extra grant or charge. Claiming an available tutorial or AI reward sends that claim to the service; it does not upload every offline game.
Optional voice and microphone
Voice is optional during an active match between two authenticated human players. When you deliberately join voice and allow Android microphone access, LiveKit transports your live microphone audio to your opponent. Voice credentials use an internal account identifier and a match-specific room identifier. You can mute yourself, mute your opponent or leave; the game can continue without voice.
The app stops voice when backgrounded, when you leave or finish the match, or when account access changes. Blocks and moderation can revoke voice access. Three Tigers does not provide recording, transcription, voice cloning or an AI voice-agent feature. The app rejects rooms marked as recording. This is not a guarantee that an opponent cannot independently capture audio using another device.
Live audio transmission and operational records are different: LiveKit and our backend also process connection, participant, room and cleanup information. Those technical records may be retained for service operation and access revocation; the app's voice-room records do not contain conversation recordings. Do not assume application-layer end-to-end encryption: the app does not configure it. Avoid sharing sensitive information with an opponent.
You can revoke microphone permission in Android Settings. The app does not request device contacts, camera, photos or location-service access.
Providers, technical information and support
We use Supabase for authentication, game data and server functions; LiveKit for optional voice; and Google for Google sign-in, Play billing, distribution and review services. These services receive information necessary for the features you use. The separate iOS service uses Apple sign-in and Apple payment services; Android does not start Apple authentication or import those identities. Support messages and any attachments you choose to send are handled through our support email service.
Online services receive network and operational information, including IP addresses, request/session times, connection errors and performance information. Provider logs may also contain approximate location derived from the connection, such as city, region and country. This does not use your device's location-service permission. Some technical data can remain linked to an account or session. This Android release has no third-party advertising feature.
Google and LiveKit software in the app sends technical information such as app or session identifiers, device and operating-system information, and diagnostics. These providers may use operational telemetry to operate, improve and secure their own services under their applicable policies.
The Android game backend is hosted in the United States. Providers may process information elsewhere under their service arrangements. Provider account and payment services also have their own terms and privacy information: Google, Apple, Supabase and LiveKit.
These website pages are hosted by Vercel. The website code does not use advertising, analytics, cookies or local-storage integrations; hosting still processes connection information.
People authorized to handle support, service security and moderation may access the information needed for that work. Contact us if you have questions about information you supplied, account access, corrections or deletion. Do not send passwords, verification codes, session tokens or payment-card details in a support message.
Account deletion and retained records
For a guest or Google-only account, use Profile → Delete account → Delete permanently on Android. The confirmation explains that remaining coins, hints, cosmetics and social connections are removed, purchases are not refunded and offline games remain on the device. In the isolated Android release this removes your Android account; it does not request deletion of a separate iOS or earlier Testing account, even if the email is the same.
The backend deletion process closes commerce access, cancels waiting matchmaking, ends active games as resignations and removes the online Auth account and associated profile, wallet, inventory, purchase rows, coin/hint activity and social relationships within that service. Linked transferred guest identities in that same service are included. Android clears acknowledged account data after the server confirms; interrupted operations may need to be retried.
To recover a deletion interrupted by a lost connection or reply, the app saves a random recovery receipt in encrypted device storage. The service stores its hash together with the request, account and service identifiers and creation time; it does not store the original receipt secret or a sign-in or purchase token in this record. These identifiers are still linked to the account. After deletion is confirmed and local cleanup is acknowledged, the app requests removal of that receipt. Interrupted cleanup can leave the device receipt and corresponding server record until recovery succeeds. Requests from another device have independent receipts.
If you are using an earlier Testing build with an Apple-linked account, Android preserves the Apple verification requirement and directs you to Three Tigers on iOS. Android does not start an Apple sign-in flow or bypass identity proof. If you cannot access the relevant app or account, use the email request route below and identify whether the request concerns Android, iOS or Testing. Existing Apple-linked accounts are not imported into the new Android service.
Deletion does not erase every historical or technical record:
- Match moves/results can remain for the other participant, with the deleted profile references removed.
- Reports and moderation records can remain with profile references removed. Free text can still identify someone.
- Voice-room and cleanup records can retain internal participant IDs so access can be revoked or cleanup retried.
- Closed commerce/receipt-account mappings and guest-transfer records, receipt/account hashes, order references and refund/revocation records can remain to prevent replay, duplicate delivery or transfer of old purchases to another account.
- Deletion-recovery receipt hashes and their associated identifiers do not have automatic expiry, so an interrupted deletion can still be confirmed later. Abandoned or unrecovered receipts may remain after account deletion. Successfully acknowledged cleanup removes the particular receipt used for that recovery; it does not claim to remove every independently created receipt.
- Provider logs/backups, payment-provider records and support correspondence have separate handling. Some retained identifiers are still linkable; hashing or removing a profile link does not necessarily anonymize them.
The service does not implement automatic expiry for every retained category. No universal deletion deadline is promised here. Contact us for the current handling of a particular record. Unrelated offline games and settings are device-local; deleting the online account does not claim to erase every local file or all information held by Google, Apple or another player.
If you cannot access the app, email amitg@colorblast.in with the subject Three Tigers Android account deletion. Include the account email or player code if available, say whether you used a guest account, and identify Android, iOS or an earlier Testing build. We may need information to verify ownership and the correct account service before acting. A matching email alone does not authorize deletion of accounts in other services. Do not send a password, verification code, purchase token or access token. See Delete your Android account for what is removed and what can remain.
Eligibility and updates
The Android app is intended for players aged 13 and older. The app does not claim to verify a user's age. If you believe a child below that age supplied personal information through an account or support request, contact us. The Android terms apply to this app; existing iOS service terms remain separate.
We may revise this policy as features and data practices change. The effective date identifies the current version. Contact amitg@colorblast.in with privacy questions.