Privacy policy

CubeDojo for iPhone, iPad and Android, and the website cubedojo.app. Last updated: 19 October 2026.

Who is responsible

CubeDojo is made by Javier Rubio Roca, an individual developer in Spain, who is the controller of the personal data described here. Write to support@cubedojo.app for anything about your data.

Your account

On iPhone, iPad and Android you sign in before you start; on the website you can use CubeDojo without an account and sign in whenever you want to keep what you did. You can sign in with Apple, with Google, or with your email address and a password.

With Apple or Google we never see a password: Apple or Google confirm who you are and tell us only:

• your email address (with Apple you can hide it, and we then receive a private relay address from Apple),
• your name, if the provider gives it and you let it,
• the identifier Apple or Google uses for you in CubeDojo.

With your email and a password you give us your address, the password and, if you like, a name. Then:

• Your address is confirmed first. We email you a 6-digit code, and the account exists only once you enter it. We also email you a code to reset or add a password, and to confirm that you want to delete your account if you do not remember the password. A code works for 15 minutes and only once; we keep only a one-way fingerprint of it (a hash), and delete it about a day later, together with any registration you did not finish.
• Your password is never kept in clear. We store it only as an Argon2id hash, a fingerprint designed so that the password cannot be worked out from it, and it is never written to any log.
• Leaked passwords are refused. So that you do not choose a password that has already leaked from another site, our server checks it against Have I Been Pwned’s Pwned Passwords list without revealing it: it sends only the first 5 characters of the password’s SHA-1 fingerprint, and makes the comparison itself. Neither your password, nor its whole fingerprint, nor your email address leaves our server.

If you later sign in another way and both confirm the same email address, they join the same account. To keep you signed in we issue our own sign-in tokens; we store them only as a one-way fingerprint (a hash). Changing or resetting your password signs you out on your other devices. With Apple we also keep a token Apple gives us, encrypted, only so that deleting your account can tell Apple to remove CubeDojo from your Apple ID.

What your account holds

To keep your devices in step, the app stores everything on the device first and then syncs it with the account, even after it has been offline:

• your solves (times, scrambles, penalties and comments) and your sessions,
• your progress on each algorithm case and its review schedule, and your trainer attempts,
• your XP, achievements, goals and lesson progress,
• your preferences (for example language, theme, colour scheme and left-handed mode) and the event selected in the timer.

Some things never leave your device: the year of birth you give for ads, the state of the ads, and the rest of the device’s settings. Signing out removes the account’s data from that device; it stays in your account.

Where it is stored

Your account lives on CubeDojo’s own server, api.cubedojo.app, which the developer runs himself in Spain. Cloudflare sits in front of it (and of the website) to deliver the traffic and protect it. Everything travels encrypted. The database is backed up every day, encrypted, to Cloudflare R2 storage held in the European Union, and each backup is kept for 30 days. Like any server, ours writes technical logs with your IP address, the time and the account’s identifier (never your email or the content of your data); they are kept for up to 14 days.

Emails we send

Apart from replying when you write to us, we email you only about your account: the 6-digit codes described above and, sometimes, a notice that the address you tried to register already has an account. No newsletters, no advertising, and no tracking pixels or tracked links. The emails come from cuenta@cubedojo.app, and a reply reaches support@cubedojo.app.

• How they are sent. Our server writes each email and hands it to the developer’s own email service, which runs beside it on his server in Spain and sends it through Resend (Plus Five Five, Inc., United States), which works for us. Resend sends cubedojo.app’s emails from Ireland, but keeps its records of them, the message included, in the United States, for up to 30 days.
• What the log keeps. The developer’s email service keeps a log of each email: the address, when it was sent, which kind of email it was, its subject line (in a code email, with the code masked: the code itself is never kept) and whether it was delivered; never the body. A code email is sent at once and its body is never stored. When you delete your account, your address and the reference to you are erased from that log, and from its backups within 30 days; what is left does not identify you.
• Addresses we stop writing to. If an email to your address bounces for good or is reported as spam, the address goes on a list we no longer send to, until you ask us to take it off.

Suggestions and problem reports

Signed in, you can send ideas and report problems from the app (Settings) or from the account menu on the website, in a chat with an AI assistant: it asks what it needs, tells you when CubeDojo already does what you want, and writes a summary for you to send. Its replies are written by an AI model and can be wrong.

• What is sent. Your messages, and the context you choose to attach to a problem report: the app version, the device and operating system (or the browser), the screen you were on and an accessibility setting in use (for example a screen reader). Never your solves, your email or your name.
• Who processes it. Our server sends the conversation to the AI model through Vercel’s AI Gateway (Vercel Inc.) to Anthropic (Anthropic, PBC), which writes the replies; both work for us, neither uses it to train models, and the model provider may keep it for up to 30 days to prevent abuse. What you send is then passed, under a random identifier and without your name or email, to the developer’s own system for handling suggestions, which sorts it with another AI model (Google’s, through the same gateway), checks it against other reports, files it in the developer’s issue tracker (GitLab) and notifies him (Telegram); AI coding tools that work for the developer may read it to analyse and fix the problem.
• How long it is kept. A conversation you never send is discarded after 7 days without activity and deleted 30 days later. One you send is kept while it is being handled; 30 days after it is closed (done, discarded or withdrawn), the conversation and what was attached are deleted, and your own words are removed from the issue in the issue tracker, except for the copies described in the next point. Its title, its summary and its status stay in your list in the app until you delete your account. You can withdraw an item while it is being analysed.
• Copies in the developer’s tools. The issue tracker is GitLab.com, run by GitLab Inc., whose servers are in the United States; the issue sits in a private project that only the developer can see. The notifications reach him through Telegram, which keeps messages on its own servers; according to Telegram, those of accounts registered in the European Union, like the developer’s, are stored in data centres in the Netherlands. Removing your words from the issue does not remove two internal copies: the issue’s edit history in GitLab and the notifications already sent to the developer on Telegram. They are kept until the case is closed and then deleted where the tool allows it; where it does not, they last as long as that tool keeps them. You can ask at any time for them to be deleted by writing to support@cubedojo.app.
• Please do not write personal or sensitive information about yourself or others in the chat: it is not needed to report a problem.

Achievements in Game Center and Google Play Games

If you are signed in to Game Center on iPhone and iPad, or to Google Play Games on Android, the app tells it which CubeDojo achievements you unlock, so they appear there too. Apple and Google keep them under their own terms and privacy policies (Apple: apple.com/legal/privacy; Google: policies.google.com/privacy), and you manage or delete them in their settings. CubeDojo does not send your Game Center or Play Games profile to our server.

Advertising

The free version shows ads: in the app from Google AdMob, small banners on a few screens (never while you time, drill or follow a lesson) and at most one full-screen ad a day; on the website, banners from Google AdSense. To show and measure ads, cap how often you see them and prevent fraud, Google’s software collects the device’s advertising identifier (on iPhone only if you allow tracking), your IP address (from which an approximate location is derived), information about the device and the app, and how you interact with the ads. It never receives your CubeDojo account, your email or your solves.

• Your choice. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent with Google’s consent message before any ad is requested; if you say no, Google shows non-personalised or limited ads. On iPhone and iPad the app also asks whether it may track you (App Tracking Transparency); if you say no, the advertising identifier is not used. You can change your choice at any time in the app under Settings → Ad privacy, and on the website from the “Privacy and cookie settings” link.
• Age. The year of birth you enter never leaves your device. If you are under the age at which your country lets you consent on your own (for example 13 in the United Kingdom, 14 in Spain and Italy, 15 in France, 16 in Germany), ad requests are marked accordingly and ads are never personalised; under 13, they are marked as directed at children.
• “No ads”. Once you own it, the app no longer requests ads, so the data above is no longer collected for advertising.
• Google uses this data as an independent controller for its own purposes too: see how Google uses information from sites or apps that use its services and Google’s privacy policy.

Purchases

“No ads” is bought through the App Store or Google Play, which handle the payment under their own terms; we never see your payment details. RevenueCat, Inc., which works for us, receives the store’s receipt and a random identifier the app creates, so the app knows you own “No ads” and can restore it on another device. That identifier is not your CubeDojo account, and nothing else about you is sent. See RevenueCat’s privacy policy.

Crash reports

When the app or the website hits an error, it sends a report to Sentry (Functional Software, Inc., which works for us and stores the reports in the European Union): what went wrong, the app version, the device model and operating system, and what the app was doing. A report never carries your account, your email, your name or your IP address; anything else that could identify you is removed before it leaves your device. Reports are kept for up to 90 days.

The website

cubedojo.app is served by Cloudflare, which processes your IP address and the request to deliver the pages and protect the site, and keeps that briefly. The website uses no analytics. If you sign in there, our server sets one cookie of its own, needed to keep you signed in: it cannot be read by the page’s scripts, it is only sent to api.cubedojo.app, and signing out or deleting the account removes it. Beside it, the site keeps a marker in your browser’s local storage, cubedojo.session with the value “1”, that only says you are signed in, for browsers that cannot keep the app’s database (such as Safari’s private browsing): it is strictly necessary, never holds a token, and is removed when you sign out. Signing in with Google loads Google’s sign-in button, and signing in with Apple takes you to Apple’s page, each under its own privacy policy. The ads described above may set cookies of their own, as your consent allows.

When it starts, the app (and the website) asks the developer’s server which features are switched on, for example whether ads are shown. The request carries nothing about you or your device. Like any web server, it sees your IP address, behind Cloudflare, and keeps it only in its technical logs, for a short time. Whether a feature that is switched on for only some devices reaches yours is decided on your device, from a random number that never leaves it.

If you write to us

We use your email address and what you send only to answer you, and keep the conversation for up to two years after it ends; then we delete it. Mail to support@cubedojo.app goes this way:

• How it arrives. Cloudflare Email Routing receives it for cubedojo.app and passes it to a small program of the developer’s that runs at Cloudflare and keeps nothing. That program files the message in the developer’s own support console, on his server in Spain, the only place it is kept; the developer gets a notice on Telegram with your name, your address and the subject.
• What is kept. The console keeps the message as you sent it, with your address and your name, and its attachments, in private Cloudflare R2 storage in the European Union.
• Our replies. They are written in that console (or as an answer to the Telegram notice) and sent from support@cubedojo.app through Resend, like our other emails; the console keeps their text with the conversation.

How long we keep it

• Your account and what it holds: until you delete it. Then it is deleted at once from our server, and it disappears from the backups within 30 days.
• Sign-in on a device: 180 days after you last used CubeDojo there; then you sign in again.
• Technical logs: up to 14 days.
• Suggestions and problem reports: as explained above.
• Email codes and unfinished registrations: deleted about a day after they were sent. The log of the emails we sent you: while your account exists, as explained above; Resend’s own records, up to 30 days.
• Crash reports: up to 90 days. Emails: up to two years after the conversation ends.

Why we may use it (legal bases)

• Contract: your account, syncing it and keeping it safe, including the emails with codes and the check against leaked passwords; the suggestions chat and handling what you send; sending your achievements to Game Center or Google Play Games; giving you, and restoring, what you bought.
• Consent: personalised ads, and storing or reading identifiers on your device for ads where the law requires consent; tracking on iPhone and iPad.
• Legitimate interests: non-personalised ads, which keep the app free; preventing ad fraud and abuse, including abuse of the suggestions chat; technical logs and backups, to keep the service secure and recoverable; crash reports, to keep the app working; answering your messages.
• Legal obligation: keeping what the law requires and answering lawful requests from authorities.

Who works with your data

We do not sell your data, and we share it only with those who help us run CubeDojo and are bound to protect it, or as described above: Apple and Google (sign-in, purchases, Game Center and Google Play Games), Cloudflare (delivery, protection, backups and receiving the mail sent to support@cubedojo.app), Resend (sending our emails), Have I Been Pwned (checking that a new password has not leaked, without receiving it or anything about you), Vercel, Anthropic and Google (the suggestions assistant and the sorting of what you send), GitLab and Telegram (the developer’s issue tracker, and the notices he gets about suggestions and support mail), Sentry (crash reports), Google AdMob and AdSense (ads) and RevenueCat (purchases). We would disclose data to authorities only when the law requires it.

Outside the European Union

Your account is stored in Spain and its backups in the European Union. Google, Apple, RevenueCat, Cloudflare, Resend, Vercel, Anthropic and GitLab may process data in the United States and other countries. They do so under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission’s standard contractual clauses. The password check sends Have I Been Pwned nothing that identifies you, and the notifications about suggestions that the developer receives through Telegram carry neither your name nor your email.

Children

CubeDojo is for a general audience and is not directed at children under 13. Accounts are for people aged 13 or over; if you are under the age of majority where you live, use CubeDojo with your parent or guardian’s permission. If we learn that an account belongs to a child under 13, we delete it. The ad settings for younger people are described above.

Your rights

These rights are for everyone, wherever you live. You can ask for access to your data, a copy in a portable format, its correction or deletion, to restrict or object to its use, and you can withdraw your consent at any time without affecting what was done before. You can delete your account and everything in it yourself (see Delete your account); for anything else, write to support@cubedojo.app from the email address of your account and we will answer within a month. You can reset your advertising identifier in your device’s settings. You can also complain to the Spanish data protection authority (aepd.es) or the one where you live.

• United Kingdom: the UK GDPR gives you the same rights; you can complain to the ICO (ico.org.uk).
• United States: under the privacy laws of California and other states, you can know what we collect, get a copy, correct it, delete it and opt out of the “sale”, “sharing” or targeted advertising of your data. We do not sell data for money, and we do not use sensitive data to infer anything about you. Personalised ads may count as “sharing” or “targeted advertising”: opt out in Settings → Ad privacy, or on the website from the “Privacy and cookie settings” link. Write to us to use any right, or to appeal a decision; we will not treat you differently for using them.
• Brazil: the LGPD gives you the rights in its article 18, including confirming that we process your data and knowing with whom we share it; you can complain to the ANPD.
• Elsewhere: you have whatever rights your local law gives you, and we honour the ones above wherever you live.

Changes

When this policy changes we update this page and its date, and the app tells you about any change that matters.