Mello privacy policy

Effective July 19, 2026

Information kept on your device

Mello stores game saves, scores, streaks, settings, Daily completion, and ad-frequency counters locally. The mobile apps mirror those values into app-private Preferences storage so progress can survive a WebView storage cleanup. Mello does not automatically send stored game data to Mello or a game server. If you choose Share, the Daily result text is handed to your device's sharing service.

Optional account information

Mello uses Firebase Authentication, a Google service, for optional accounts. Email-and-password sign-in is available on the website and in the mobile apps. The website may also offer Google, Apple, Microsoft, or GitHub when that provider is enabled for Mello; sign-in buttons that are not configured are not shown. If you use email and password, Firebase processes the email address and password-based credential you provide. If you use another sign-in provider, that provider authenticates you and shares an identity token and the profile fields you approve or make available, which may include an email address, display name, profile image, or provider-specific identifier. Apple may provide a private relay email address when you choose Hide My Email. Mello does not receive your Google, Apple, Microsoft, or GitHub password.

Firebase assigns a user identifier and processes linked sign-in methods, authentication sessions, verification state, and ordinary security metadata needed to protect the service. Connecting a provider from a signed-in account links that method to the same Firebase user identifier; Mello does not automatically merge separate accounts. Mello uses account information only to create and protect the account, keep you signed in, send requested verification or password-recovery messages, show the account's available profile details, manage sign-in methods, and provide self-service account deletion. Firebase delivers email-account messages, and their links currently open Firebase-hosted action pages before continuing to the Mello account page. Authentication provider redirects return through the secure Mello account origin.

Signing in never uploads or syncs game saves, scores, streaks, settings, Daily completion, or ad-frequency counters. Mello does not provide account email addresses, display names, profile images, provider identifiers, or Firebase user identifiers to Google AdSense. Website account pages use a separate account.mellopuzzle.com origin and do not load AdSense, so ad-enabled pages cannot read the account origin's browser storage. The mobile apps currently expose only email-and-password authentication; they do not show a social sign-in button unless a signed native integration is added and configured. Learn more in Firebase's privacy and security documentation.

Website delivery

Cloudflare delivers and protects mellopuzzle.com and the isolated account.mellopuzzle.com account origin. It may process ordinary request information such as an IP address, browser type, and operational security logs. Mello uses Cloudflare's deployment observability to diagnose failures; it does not add gameplay analytics or connect those logs to scores and saves kept in your browser.

Website advertising and privacy choices

Mello may load Google AdSense on the website's home puzzle, About, and Support pages to fund development. The account origin, privacy policy, offline page, and native apps do not load AdSense. Google and its advertising partners may use cookies, local storage, IP addresses, device and browser information, approximate location, page and referrer information, and ad interactions to deliver, personalize, measure, and protect advertising. Google may limit personalized advertising where required privacy choices are unavailable. Regional privacy messages and controls, when shown, let visitors manage consent. Google's use of information is described in its partner-sites policy.

Advertising may appear on the home puzzle, About, and Support pages. It is separate from Mello's game logic and never changes pieces, scoring, difficulty, the shared Daily seed, or outcomes. The iPhone, iPad, and Android apps do not currently include the AdSense code, a third-party ad SDK, analytics, advertising-identifier access, or cross-app tracking. Between-round messages in the native apps remain Mello house messages.

Sharing and links

When you choose to share a Daily result, Mello uses the system share sheet when available; otherwise it copies the result to your clipboard. Mello does not share anything automatically or learn which app or person you choose. Opening a support or policy link uses your browser and is subject to that service's own privacy practices. If you choose a Google, Apple, Microsoft, or GitHub sign-in button, your browser communicates with that provider and its privacy policy also applies.

Account retention and deletion

Firebase keeps an account's available email address, optional display name and profile image, Firebase user identifier, linked provider identifiers, verification state, and authentication records until the account is deleted or the information is otherwise removed as required to operate and protect the service. You can disconnect a non-final sign-in method from the account page. Disconnecting Apple requires recent Apple confirmation and successful authorization revocation so it cannot bypass the Apple-linked deletion safeguards. Disconnecting it from Mello does not delete your account with Google, Apple, Microsoft, or GitHub. You can delete a Mello account from Settings in a Mello app or from the account page. A recent sign-in may be required. Deletion removes the Firebase Authentication account and cannot be undone. If Apple is connected, the web account page first requests recent Apple confirmation and asks Firebase to revoke that Apple access token before deleting the Firebase account. If Apple confirmation is unavailable and the account also has a password, recent password confirmation provides a secure deletion fallback. A missing token or failed revocation does not prevent Mello account deletion. If Mello cannot confirm revocation, it tells you to visit account.apple.com, open Sign-In & Security, choose Sign in with Apple, select Mello, and choose Stop Using Sign in with Apple. A provider-linked native app opens the secure web account page for this confirmation instead of attempting an unsupported in-app provider prompt. Deletion does not delete an identity-provider account, and you may separately manage provider authorization in that provider's settings. Verification or recovery messages already delivered may remain in your email service, and service providers may retain limited security records as described in their policies.

Account deletion does not erase device-local gameplay data because that data is never attached to the account. Clear mellopuzzle.com site storage or uninstall the native app separately if you also want to remove local saves, scores, streaks, settings, Daily completion, and ad-frequency counters.

Children and local-data retention

Mello is a general-audience puzzle and is not directed to children under 13. People under 13 may use guest play but must not create a Mello account or use a third-party sign-in button. Website delivery, advertising, and optional accounts may process data as described above. Browser and installed-PWA game data remains until you clear the site's data; uninstalling a PWA may not clear it. Android backup and device transfer are disabled. On iPhone and iPad, Apple may include app-private preferences in an encrypted device or iCloud backup according to your backup settings; restoring that backup may restore the data. Deleting either native app removes its current local app data.

Support information

Mello is developed and published by Michael Schillereff. Visit Mello support for troubleshooting, account help, deletion instructions, accessibility help, and release information. Mello does not collect inquiries through a website form.

Return to the puzzle.