9Kukri — Nine Men's Morris | Last updated: September 22, 2026
This Privacy Policy explains how 9Kukri ("we", "our", or "us") collects, uses, and protects
information when you use our mobile game application available on iOS and Android ("App").
By using the App, you agree to the practices described in this policy.
1. Information We Collect
When you sign in with Google or Apple:
Display name
Email address
Profile photo URL
A unique user identifier (Firebase UID) assigned by the authentication provider
When you play as a Guest:
A randomly generated anonymous identifier stored locally on your device, and an anonymous Firebase account used to connect you to online games (neither is tied to your identity)
If you later choose to upgrade your guest session to a Google or Apple account, your existing game data is linked to your new account
Game data collected for all players:
Player name used in games
Game moves and board state of online games, together with the player names used in them
Win/loss statistics and win streak (for signed-in users only)
Game outcomes and match history
Daily Challenge results (win/loss and move count per day, for signed-in users only)
Technical data collected automatically:
Crash reports and error logs (via Firebase Crashlytics, on mobile devices)
Basic usage events such as game created, game joined, and sign-in method (via Firebase Analytics, on web only)
Advertising identifiers (IDFA on iOS, Google Advertising ID on Android) used by Google AdMob to serve ads and by the Meta (Facebook) SDK to measure app install campaign performance
App install and session events (via Meta Facebook SDK) used to attribute app installs to advertising campaigns and measure campaign performance — this data is sent to Meta/Facebook
Device push notification token (FCM token) used to deliver push notifications — stored in our database and linked to your player identifier
Device IP address (collected by Google Cloud infrastructure as a standard part of network communication)
2. How We Use Your Information
To create and manage your account and game profile
To track and display win/loss statistics on the leaderboard
To enable real-time multiplayer gameplay between two players
To send push notifications including daily re-engagement messages and Daily Challenge alerts
To display relevant advertisements through Google AdMob
To measure app install campaign performance and attribute installs to advertising campaigns via the Meta (Facebook) SDK
To detect and fix crashes and technical issues
To keep the App fair and safe: a small number of authorised team members can review accounts and games in an internal admin tool, rename offensive display names, end stuck games, and disable or delete accounts that break our Terms of Service. Every such action is logged
To automatically close online games that have had no activity for 24 hours, so abandoned games don't stay open
To notify our team about new sign-ups and account deletions, and to produce aggregate weekly statistics (see Slack in section 7)
To improve the App based on usage patterns
3. Leaderboard
Signed-in players appear on the public leaderboard with their display name, win count, and current win streak.
Guest players do not appear on the leaderboard and their game results are not tracked.
By signing in and playing online PvP games, you consent to your display name, win statistics, and win streak
being visible to other players in the Top 10 leaderboard. Your display name also appears on the daily
challenge leaderboard and to opponents in online games. We may change a display name that is offensive
or impersonates someone else.
4. Push Notifications
If you grant permission, the App sends push notifications to your device. These include:
Turn notifications for online multiplayer games — alerting you when it is your move
Daily Challenge alerts when a new challenge is available
Re-engagement reminders to invite you back to the game
To enable notifications, we store a device push token (FCM token) linked to your player identifier in our database.
You can disable push notifications at any time in your device's Settings → Notifications → 9Kukri.
Disabling notifications does not affect any other app functionality. When you sign out, we remove your
device's push token from that account, so you stop receiving its notifications on that device.
5. Advertising & Campaign Measurement
We use Google AdMob to display ads in the App. AdMob may collect and use your
device's advertising identifier and other data to show you relevant ads. This is governed by
Google's Privacy Policy.
We also use the Meta (Facebook) SDK to measure the performance of our app install
advertising campaigns. The Meta SDK collects your device's advertising identifier (IDFA on iOS,
Google Advertising ID on Android) and app event data such as app installs and session starts.
This data is sent to Meta Platforms, Inc. and used solely to attribute app installs to ad campaigns
and measure campaign effectiveness — it is not used to serve ads inside the App.
This is governed by Meta's Privacy Policy.
On iOS 14.5 and later, we request your permission via Apple's App Tracking Transparency prompt
before collecting your advertising identifier for personalised ads or campaign attribution.
If you decline, ads and attribution will still function but without personalisation.
You can opt out of personalised ads and campaign tracking at any time:
iOS: Settings → Privacy & Security → Tracking → disable "Allow Apps to Request to Track"
Android: Settings → Google → Ads → Opt out of Ads Personalisation
User profiles and stats — stored indefinitely until you delete your account
Online game records (moves, board, player names) — kept after the game ends; games with no activity for 24 hours are closed automatically
Daily Challenge results — stored indefinitely as part of your game history
Push notification tokens (FCM) — stored until you sign out, delete your account, or the token stops working (for example after you uninstall the app)
Admin action log — a record of each administrative action (who, what, when), kept for security and accountability
Crash reports — retained for 90 days (Firebase Crashlytics default)
Analytics events — retained for 2 months (Firebase Analytics default)
Our database is stored on Google Cloud servers in India (asia-south1, Mumbai), and our server code runs
on Google Cloud in the United States (us-central1). Crash reports and analytics are processed by Google
Firebase. All data is encrypted in transit using TLS and at rest by Google Cloud.
7. Data Sharing
We do not sell your personal data. We share data only with the following third-party services required to operate the App:
Google Firebase — authentication, database, crash reporting, analytics
Google AdMob — in-app advertising
Meta (Facebook) — app install campaign attribution and measurement; receives device advertising identifier and app event data (installs, sessions)
Apple — Sign In with Apple authentication
Slack — internal team notifications; when you create an account by signing in with Google or Apple, your display name, email address, sign-in provider and account ID are sent to our private team workspace. Guest play is never reported, and account deletion notices contain no personal details
Each of these services has their own privacy policy and data practices independent of ours.
8. Children's Privacy
9Kukri is rated for users aged 4 and above. We do not knowingly collect personal information
from children under 13. The App does not target children and does not include features
designed to collect data from minors. If you believe a child under 13 has provided us with
personal information, please contact us and we will delete it promptly.
9. Your Rights
You have the right to:
Access the personal data we hold about you
Delete your account and associated data at any time in the App (Profile → Delete Account), on our account deletion page, or by contacting us. Deletion removes your profile, statistics, Daily Challenge results, push tokens and sign-in account. Records of past online games may still show the player name you used in them
Withdraw your Google or Apple sign-in at any time via your device settings
Opt out of personalised advertising via your device's ad settings
Play anonymously as a guest without providing any personal information
If you are located in the European Economic Area (EEA), you also have rights under GDPR including
the right to data portability and the right to lodge a complaint with a supervisory authority.
10. Local Storage
The App stores the following data locally on your device:
An anonymous player identifier for guest sessions
The name you last entered as a guest, so it is filled in for your next game
Your current game session, so you can resume if the app is closed (kept for up to 24 hours)
A preference recording whether you have explicitly signed out of a guest session
Whether you have completed the first-launch walkthrough
A counter to determine when to show the App Store or Google Play review prompt
These local copies are not sent to us or shared with any third party.
11. Security
We take reasonable measures to protect your information. All communication between the App and
our servers is encrypted using HTTPS/TLS. Firebase security rules only let you change your own
records. Your public profile (display name, profile photo and game statistics) can be read by other
players so the leaderboard can show it. Our internal admin tool is limited to named team members,
checks their access on every request, requires them to sign in again before destructive actions,
and logs every action.
However, no method of transmission over the internet is 100% secure.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the
"Last updated" date at the top of this page. Continued use of the App after changes
constitutes acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or wish to request deletion of your data,
please contact us at: