Fillbrook privacy policy

Effective date: 12 October 2026

Last updated: 12 October 2026

This policy explains what information the Fillbrook puzzle app (“Fillbrook”, “the app”) and this website use, why, who helps us, how long we keep it and the choices you have. We have tried to write it plainly. If anything is unclear, write to us at privacy@fillbrook.app.

1. Who we are

Fillbrook is made by Eriksen ENK, which publishes it on Google Play under the developer name “Fillbrook” (“we”, “us”). We decide how and why your information is used in the app, which makes us the “controller” under European and UK data protection law.

Privacy questions and requests: privacy@fillbrook.app. We reply within 30 days, usually much sooner.

2. The short version

• You don’t need an account. Fillbrook has no sign-up and no sign-in wall. Your puzzles, progress and settings live on your phone or tablet.
• We use a small number of service providers to run the app: Google Firebase (usage statistics, crash reports and settings), RevenueCat (purchases and coins), Google AdMob (ads), Google Play (payments) and Cloudflare (our website, puzzle downloads, the date check on our website and our email forwarding). They are listed in section 3 with what each one receives. If our website can’t be reached, the app checks the date with Cloudflare’s own website instead; Cloudflare handles that request on its own account, not for us (section 3.8).
• Our website keeps your puzzle progress and diary in your own browser. It counts visits and puzzles solved without cookies or identifiers.
• Automatic ads appear only between puzzles; short ads for coins play only when you tap one. Where the law requires it (for example in the European Economic Area and the UK), we ask for your consent before ads are personalised or usage statistics are collected. Where Google’s privacy options are available, you can change your mind any time in Settings → Privacy options.
• We don’t ask for your contacts, photos, files, microphone, camera or precise location.
• We don’t sell your information for money. Some US state laws count personalised advertising as “selling” or “sharing”; you can opt out of that (section 6).
• Fillbrook is for adults and is not directed at children (section 8).

3. What we collect, and why

3.1 On your device

Your puzzle progress, Today’s Paper, back issues, diary, stats, settings and letter-size choices are stored on your device. Copies or summaries leave it only in the ways described in this section:

• Android backup. If you have Android backup turned on, Android copies app data to your own Google Account so it survives a new phone. Google stores it under your account, not ours, and on Android 9 or later with a screen lock it is end-to-end encrypted (Android Developers: Auto Backup). We cannot read it.
• Coins and purchases (section 3.2).
• Usage statistics, such as puzzles started and finished and how long a grid took (section 3.3).
• Crash reports (section 3.4).
• Letters, if you choose to send one (section 3.7).
• Notes on how you found Fillbrook (section 3.12).

3.2 Coins and purchases

Fillbrook has an optional coin balance and optional purchases, such as coin packs, the Ad-free edition and, later, Bumper Books and a Home delivery subscription. Purchases go on sale when the app launches (see the note at the top of this policy). From then, we keep a record on a server so that your coins and purchases stay safe, you can restore purchases on a new device, and rewards can’t be abused. The record holds:

• a random app user ID that the app creates for your installation (it is not your name, email or phone number). It is also your support code (section 6);
• where usage statistics are on (section 3.3), the analytics app-instance ID for your installation, so that a request to delete your data can reach your usage statistics too;
• your coin balance and coin history (for example “+15, Thursday’s paper” or “−100, back issue”);
• your purchase history from Google Play: what you bought, when, the price and currency, and a purchase token that lets us check the purchase is genuine and notice refunds.

This record is kept by RevenueCat, Inc., which processes it for us as our service provider (RevenueCat Data Processing Addendum), and by our own app server. Before the app launches, we will update this section to say exactly what our app server keeps and who hosts it. So that the daily paper and coin rewards follow the real calendar, the app also checks the date and time with our website, or with Cloudflare’s if ours can’t be reached (section 3.8).

Restore purchases brings back what you bought to keep: the Ad-free edition and, once they are offered, Bumper Books and Home delivery. It does not bring back coins. If coins you bought didn’t arrive, write to us with your support code.

Payments are handled by Google Play. We never see or store your card or bank details. Google’s privacy policy applies to the payment itself.

3.3 Usage statistics (Google Analytics for Firebase)

We use Google Analytics for Firebase to learn how the app is used, so we can fix confusing screens and keep puzzles fair. For example, the median time readers take on each grid is how we keep Monday easy and Saturday hard. It collects:

• app interactions (screens opened, puzzles started and finished, how long a grid took, coins earned and spent, settings changed);
• an app-instance ID and, where allowed, your device’s advertising ID;
• an approximate location (country or region), which Google works out from a masked IP address;
• in-app purchase events (product, price and currency).

Google’s description of this data is in Google Analytics: data collected for Google Play’s Data safety section. We keep event-level and user-level analytics data for 14 months, and then Google deletes it automatically (Google Analytics data retention). Summary reports that contain no identifiers may be kept longer.

Where the law requires consent for this (for example in the EEA and the UK), we ask first. Until you have answered Google’s consent form, the app sends no usage statistics at all. After that, your choices are passed to Google Analytics, which limits what it collects and keeps to what you agreed to. The form appears just before the first ad would be shown, so in those regions usage statistics may start some days after you install the app, or not at all. Elsewhere, they start when you first open the app.

3.4 Crash reports (Firebase Crashlytics)

If the app crashes, Firebase Crashlytics sends us a crash report: what the app was doing, the device model, Android version and a random Crashlytics installation ID. We use it only to find and fix problems. Google keeps crash reports for 90 days and then starts removing them from its systems (Firebase: privacy and security).

3.5 Remote settings and tests (Firebase Remote Config and A/B Testing)

We use Firebase Remote Config to change settings without an app update, for example to replace a faulty puzzle quickly or tune how many coins a grid pays. We sometimes try two versions of a setting with different groups of readers (A/B Testing). These services use a Firebase installation ID, your country, language, time zone and Android version (Firebase: Google Play data disclosure).

3.6 Ads (Google AdMob and the Google User Messaging Platform)

Fillbrook shows automatic ads only between puzzles, after you finish a grid and tap Next. Short ads for coins play only when you tap one. The Ad-free edition turns off the automatic ads. Ads are provided by Google AdMob. To show and measure ads and prevent ad fraud, Google’s ads software collects your IP address (which can indicate your general location), interactions with ads (such as views and taps), diagnostic information, and your device’s advertising ID and app set ID (Google Mobile Ads SDK: Google Play data disclosure). Google uses this information under Google’s Privacy Policy and explains how it uses information from apps that use its services at policies.google.com/technologies/partner-sites.

Your choices about ads:

• In the EEA, the UK and Switzerland, a consent form from Google’s User Messaging Platform appears before any ad loads, and ads are personalised only if you agree.
• In US states with privacy laws, you can opt out of the “sale” or “sharing” of your information for personalised ads.
• Where Google’s privacy options are available (for example the EEA, the UK, Switzerland and US states with privacy laws), you can change these choices at any time in Settings → Privacy options. Elsewhere there are no such choices to make, and that row says so.
• You can reset or delete your advertising ID in your phone’s settings (Settings → Privacy → Ads, or Settings → Google → Ads, depending on your phone).

We ask ad networks not to show ads about gambling, dating, politics or other sensitive categories.

3.7 Letters to the editor and emails

Write to the editor (in Settings) opens your own email app with your letter ready to send to hello@fillbrook.app. Nothing is sent until you send it from there, and nothing passes through Fillbrook on the way. Email us in Settings → About Fillbrook works the same way, and adds your support code and the app version, which you can delete before sending.

When you write to us, from the app or by email, we receive:

• your letter, and the email address you send it from;
• the place you enter in “Where you’re writing from”, if you enter one;
• your first name, only if you tick “You may print my first name” and write it;
• if you tick “Include details about my phone”, the app version, Android version and device model.

We use them to reply, fix problems and choose themes. We read every letter. If your idea becomes an Issue theme, we may credit “a reader in Kent”, using only the place you gave us; we print your first name only if you ticked the box, and never your full name. Mail to our fillbrook.app addresses is forwarded by Cloudflare Email Routing to the mailbox we read. We keep letters and emails for 24 months and delete older ones in a regular clean-up.

3.8 Downloading new puzzles and checking the date

About six months of papers come inside the app. Newer papers download as files from our website, fillbrook.app, which is hosted by Cloudflare, Inc. (Cloudflare Pages). The app also asks the same website for the current date and time, so the daily paper and coin rewards follow the real calendar even if your phone’s clock is off. That is a plain request for a small file, fillbrook.app/clock.txt, then, if that fails, for the website’s front page. It carries nothing about you, not even your phone’s own time. The answer can also say whether the install-source notes in section 3.12 are switched on. If our website can’t be reached, the app asks Cloudflare’s own website (www.cloudflare.com) for the date in the same way instead. Cloudflare then sees your IP address and the basic technical details every web request carries (described below), and handles that request on its own account under its own privacy policy, not as our service provider. The app sends nothing else with either date check and keeps no cookies from either website. None of these requests sends anything about you beyond what every web request carries: the files contain puzzles only, and nothing about you is uploaded. If no date check succeeds (for example, when you are offline), you can still play; coins and your run for those puzzles are added the next time a check succeeds, if your phone’s date was right.

Like any web host, Cloudflare receives your IP address and basic technical details of each request (such as the type of device or browser) to deliver it and protect against abuse, and it works out which country a request came from. We don’t export or store these request logs. Cloudflare’s dashboard shows us summary traffic figures and security events (a security event can include the IP address of a request Cloudflare blocked or challenged). Cloudflare handles the logs under its own policy (Cloudflare Privacy Policy).

3.9 Sharing a clipping

When you tap Share on a finished puzzle, Fillbrook makes the clipping image on your device and hands it to Android’s share sheet. You choose where it goes. The link in the message goes to fillbrook.app/paper/ and the date of the paper you shared, where the person you sent it to can play that paper’s Quick and Standard. It carries nothing about who shared it. For puzzles without a date (Archive, Endless, Jumbos), the link goes to Google Play with a tag that tells us, through Google Play and Firebase, that an install came from a shared clipping, but not who shared it.

3.10 Notifications

If you turn on the morning paper note, the reminder is scheduled on your device. Turning it off in the app or in Android settings stops it.

3.11 This website

fillbrook.app runs two scripts of its own: the puzzle player, and a smaller one that fills in today’s paper and your diary on the front page. It runs no third-party scripts, shows no ads and sets no cookies.

In your browser. Your puzzle progress, diary, run, the reveals you’ve used and your settings are kept in your browser’s storage on your device. They are never sent to us. You can clear them with “Clear this browser’s diary” in the player’s settings, or with your browser’s own settings. Some browsers clear them by themselves after a week without a visit.

What we count. We count, without cookies or identifiers:

• pages served;
• links to the app followed;
• and, outside the UK, Ireland and the European Economic Area, puzzles started and solved, solve-time ranges, panels about the app shown, and taps on Share, Print and “Open in the app”.

Each count carries only these details, none of which identifies you:

• the page, and which version of it you saw when we are comparing two;
• the paper’s date, its weekday and how old the paper was;
• the kind of link that brought you (search, a share, social media, email, print, another website, another of our pages, or none);
• your country, if it is one of the six we launch in (the United States, the United Kingdom, Canada, Australia, Ireland and New Zealand), and otherwise only that it was elsewhere;
• your device type (Android, iPhone or iPad, or computer);
• whether the page was allowed to send puzzle and panel counts;
• and the website’s version.

A count of a link or panel about the app also records which one it was, and a followed link records where it led. A puzzle count also records the grid, the solve-time range and whether you used help, and a tap on Share records how you shared. Visits from search engines and other automated programs are counted separately, by kind of program. Nothing is read from your browser’s storage to make these counts, and your IP address and browser details are not kept with them. The counts are kept by Cloudflare Workers Analytics Engine for three months; we keep monthly totals.

Cloudflare, which hosts the website, also receives the standard details of each visit (your IP address, the page asked for and your browser type) to deliver the page and protect against abuse, as described in section 3.8. Cloudflare’s dashboard shows us summary traffic figures and security events; we don’t export or store request logs. If you email us, section 3.7 applies.

3.12 How you found Fillbrook

Where the law doesn’t require consent for it, or after you agree to usage statistics where it does, the app reads Google Play’s install-source tag once (for example “fillbrook_web / paper / paper_done”, meaning you came from a paper on our website), keeps it on your phone, and sends our website four short notes:

• when the app is first opened;
• if you come back the next day;
• in your second week;
• in your fifth week.

Each note holds only the tag, the app version, the platform (Android), the day the app was installed and your country (worked out by Cloudflare from the request, and kept only if it is one of the six countries in section 3.11). No advertising ID, no app or device ID, no account, and nothing that links one note to another is sent. The notes are counted with Cloudflare Workers Analytics Engine, which keeps them for three months; we keep monthly totals. To stop them, use Settings → Privacy options where it is available, or uninstall the app.

4. Legal bases (EEA and UK)

• To provide the app you asked for (contract): puzzles, coins, purchases and restoring purchases.
• Legitimate interests: crash reports, keeping the app and website secure, stopping reward and refund abuse, and replying to letters. We have weighed these against your interests and kept the data small.
• Consent: personalised advertising, and usage statistics and ad measurement where consent is required. You can withdraw consent at any time in Settings → Privacy options, which is available wherever this consent is asked for, or by writing to privacy@fillbrook.app. Withdrawing does not affect what happened before.
• Legal obligation: keeping purchase records for tax and accounting.
• Website counts (section 3.11): legitimate interests. They are aggregate, carry no identifiers, and nothing is stored on or read from your device to make them.
• Install-source notes (section 3.12): consent where it is required, legitimate interests elsewhere.
• Progress kept in your browser (section 3.11): needed to provide the puzzles you asked for.

5. Who we share information with

• Service providers that process data for us under contract: Google (Firebase), RevenueCat and Cloudflare (our website, puzzle downloads, the date check on our website, the website counts and install-source notes, and email forwarding). When the app checks the date with Cloudflare’s own website instead (section 3.8), Cloudflare acts on its own account, not for us.
• Google AdMob, which uses ad data as described in its own policies.
• Google Play, for payments and app distribution.
• Authorities, only if the law requires it.
• A buyer of the app, if Fillbrook is ever sold, bound by this policy.

We do not sell your information for money.

6. Your choices and rights

Everyone can:

• reset or delete the advertising ID in Android settings;
• turn notifications off;
• ask us for a copy of the information we hold, or ask us to correct or delete it, by emailing privacy@fillbrook.app.

Where Google’s privacy options are available (for example the EEA, the UK, Switzerland and US states with privacy laws), you can also change your ad and usage-statistics choices in Settings → Privacy options. Elsewhere there are no such choices to make, and that row says so.

Because there are no accounts, we find your records using the support code shown in Settings → About Fillbrook (Email us in the same place adds it to your message for you). Please include it in your email. We delete your RevenueCat record and coin history. If usage statistics were on, that record also holds your analytics app-instance ID, and we ask Google to delete the analytics data for it. We confirm by email within 30 days. We may keep purchase records we must hold for tax law, and we will tell you if we do. Without the code we can still delete letters and emails you sent us, but we can’t find your other records.

If you are in the EEA or the UK, you also have the rights to restrict or object to processing, to data portability, and to complain to a data protection authority: in Norway, where Eriksen ENK is established, Datatilsynet; in Ireland the Data Protection Commission; in the UK the Information Commissioner’s Office. You can complain to the authority where you live or work.

If you are in a US state with a privacy law (such as California), you have the rights to know, delete and correct your information, and to opt out of “sale”, “sharing” and targeted advertising. Use Settings → Privacy options, which offers the opt-out in those states, or email us. We will not treat you differently for using these rights.

If you are in Canada, Australia or New Zealand, you can ask to access or correct your information and complain to the Office of the Privacy Commissioner of Canada, the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

7. How long we keep things

8. Children

Fillbrook is made for adults and is not directed at children. On Google Play its target audience is adults aged 18 and over. We do not knowingly collect information from anyone under 13 (or under 16 in the EEA and UK). If you believe a child has used the app and we hold information about them, email privacy@fillbrook.app and we will delete it.

9. Security

Everything the app sends is encrypted in transit (HTTPS/TLS), and this website is served over HTTPS only. Only we can sign in to our service-provider accounts. No system is perfectly secure, but we keep the information small, so there is little to protect.

10. International transfers

Our service providers, including Google, RevenueCat and Cloudflare, may process information in the United States and other countries. Where information leaves the EEA or the UK, they rely on legal safeguards such as the European Commission’s Standard Contractual Clauses, the UK Addendum or the EU-US Data Privacy Framework.

11. Optional sign-in (not available yet)

We may later add an optional “Sign in with Google” so purchases can follow you between devices. It will always be optional. If we add it, we will update this policy first, explain what it collects (your Google account ID and email), and let you delete that account from inside the app and from our website.

12. Changes to this policy

If we change this policy, we will update the dates above and, for significant changes, tell you in the app where we can, before the changes apply.

13. Contact

Eriksen ENK, publishing on Google Play as “Fillbrook”
Privacy: privacy@fillbrook.app
Support and letters to the editor: Settings → Write to the editor in the app, or hello@fillbrook.app