CYDICan You Draw It?

CYDI Privacy Policy

Effective date: 14 July 2026 · Last updated: 8 October 2026

CYDI (“Can You Draw It?”) is a casual drawing game available on the web at playcydi.com and as an Android app. This policy explains what information the game collects, how it is used, and the choices you have. CYDI does not require an account, a login, or your real name to play.

1. Information We Collect

Stored on your device

Most of your data never leaves your device. It is saved in your browser’s (or the app’s) local storage on the device you play on:

This on-device data is not automatically sent to us. Clearing your browser/app data, switching devices, or reinstalling can erase it. On Android, your device may include it in your own Google account backup. You can also move it yourself using the in-game Backup & Transfer code feature.

Information sent to our servers

Some optional features send a limited amount of data to our servers (hosted on Cloudflare):

Game content updates

CYDI may download updated game content, such as shapes, categories, level ordering, and related metadata, from our servers. This content may be cached locally on your device for faster loading and offline use. The downloaded game-content catalog does not contain personal information and is not linked to your real identity.

Analytics

We use analytics to understand how the game is used and to improve it. Analytics events record non-identifying facts such as “a shape was completed” or “an item was bought with in-game coins,” together with a small set of attributes: the app version, whether it is the Android app or the website, the general country (see below), and details of the game event itself. Events never include your name, email, player ID, IP address, or display name — identifying fields are blocked before an event is sent and again on our server.

Our server stores these event records — without any of the random installation or session numbers described below — for about 3 months, and keeps longer-term statistics only as aggregate totals. On the website, we also use Cloudflare Web Analytics for aggregate site metrics (such as visits, referrers, and performance). This is disabled during development.

To balance the game’s coin economy, analytics events also record game-economy details: how many coins a game or reward paid, what coins were spent on and that item’s in-game price, progress milestones such as unlocking a category, and your coin balance, number of games played and days since you started playing as ranges (for example “1,000–2,500 coins”) — never your exact coin balance. The days-since-you-started range is calculated on your device; the start date itself is never sent. When a bonus-Coins rewarded ad is offered, we also record whether an ad was available and how the offer relates to your next unlock, again as ranges. When a rewarded ad offers a premium-Ink trial instead, we record which ink was offered and the trial’s steps (granted, first used, finished, each time more plays were added by watching an ad - counted in a range up to 5+ - and whether the ink was then kept or looked up in the Shop) and, when one of these inks is bought with coins, whether its trial was never received, still running or already finished and how many times plays were added, with no additional identifier. CYDI Coins cannot be bought with real money, so none of this involves payment information.

If an analytics event cannot be sent right away, the app may keep it on your device for up to 5 days and send it on a later launch. So that such an event is never counted twice, some important events (for example app opens, coin purchases, and ad outcomes) carry a random one-time event number; our server keeps these numbers for 7 days only to recognise duplicates, and then deletes them.

Play Together sends the same kind of aggregate events — for example that a room was created, that a game of a given length and difficulty started, or that a round finished. They carry only counts and settings, such as how many players were in the room and which round number it was. They never include the room code, any nickname, your seat in the room, or anything you drew.

When you create or join a Play Together room, the app also tells our server which app version it is (for example “0.53.0”) and whether it is the Android app or the website. This is used only to check that your version can still play online, and to ask you to update if it cannot. It is not stored with the room, and it does not include the random installation or session numbers described below.

So that we can tell “one person played ten rounds” from “ten people played one round each,” an analytics event also carries two randomly generated numbers: one that stays the same for this installation of the game, and one that identifies the current play session. They are created on your device, are not derived from your identity, your account, your IP address, or anything about your device, and are not used to track you across other apps or websites. On our server they are used only to count how many distinct installations and sessions there were on each day. Each day’s list of these numbers is stored separately from the event records, grouped only by platform and by the visit labels described below, and is not currently deleted automatically. Clearing the app's or browser's local data starts a new random number.

Analytics events also record a two-letter network-country code, inferred from the connection as seen by our hosting provider (Cloudflare). This helps us understand where the game is played and whether technical or advertising issues are concentrated in particular countries. Your device is never asked where it is, and CYDI requests no location permission. It is country level only: no city, no region, no coordinates, no GPS, and no network operator. We do not store your IP address. The country code is stored with event records and in aggregate totals, never together with your player ID or the installation and session numbers. The country of a connection may also be used, at the moment of a request, to decide whether certain features — such as full-screen ads — are available in your region. If you use a VPN or proxy, the country recorded is the one your connection appears to come from, which may not be where you are.

On the website, an analytics event also carries a few short labels describing how that visit reached us — for example “youtube”, “shorts” or the name of a campaign — taken from the campaign tags in the link you followed and, failing that, from the domain of the site that linked to us. We record only these short labels: never the full address you arrived at, never the full address you came from, and nothing about the page you were reading. The labels are read once when the visit starts and are used only to count how many visits and sessions each source brought, and how many of those visitors went on to play.

The Android app records the same kind of short labels once, for the installation itself. The first time it runs, it asks Google Play which campaign led to the install and keeps only those same few labels — for example “youtube” or the name of a campaign. Alongside them it records whether this looks like the first launch of a newly installed app, and roughly how long ago the install happened as a coarse range (under a day, under a week, and so on) rather than a time. We never store the full referral address. Nothing here identifies your device or your Google account: no advertising ID, no device ID and no account details are read or sent for this purpose. The app asks Google Play this once per installation and not again.

Advertising (Android app)

The CYDI Android app may offer optional rewarded advertisements through the Google AdMob / Google Mobile Ads SDK. Rewarded ads may be offered in exchange for optional in-game rewards, such as bonus Coins or temporary access to a premium Ink (for example, a few plays with Rainbow Ink); the reward may vary. In Play Together and 2 Players, a rewarded offer may appear only after a completed game and never during active gameplay. Watching is entirely your choice: you can always decline and simply continue, and any coins you have already earned are yours either way.

The Android app may also show a full-screen advertisement between games, at a natural transition such as moving on to the next shape or starting another attempt - never in the middle of a round. These ads are not tied to any reward, and closing one simply returns you to the game. They are served by the same Google Mobile Ads SDK, only after the same consent check, and involve the same data described below.

A reward that depends on an ad is granted only when an ad is actually served and completed in the way Google’s ads SDK itself confirms as a completed reward. If an ad cannot be requested, cannot be shown, or does not reach that confirmation, no ad-based reward is granted. Declining, closing, or skipping an ad never reduces the coins you have already earned.

Before requesting an ad, the app checks with Google’s User Messaging Platform (UMP) whether ads may be requested and shows a consent form where one is required. If ads may not be requested, no ad is requested and no ad-based reward is granted.

When ads are served, the Google Mobile Ads SDK may automatically collect and share the following for the purposes of advertising, measurement, analytics, and fraud prevention, subject to your consent choices and Google’s policies:

On Android, the app declares the advertising ID (AD_ID) and Android Privacy Sandbox permissions used by the ads SDK. For more information, see “How Google uses information from apps that use its services” ( https://policies.google.com/technologies/partner-sites ).

The web version of CYDI does not load any advertising SDK and makes no ad requests.

Connection data

As with any website or online service, our hosting provider (Cloudflare) processes basic connection data such as your IP address at the network level in order to deliver requests. CYDI itself does not read, log, or store your IP address. The one thing CYDI keeps from that connection is the coarse country code described under Analytics above.

2. How We Use Information

3. Advertising & Consent Choices

Where required, a consent form is shown before any ad request, managed through Google’s User Messaging Platform. Where applicable, a “Privacy Options” entry is available in the app’s Settings so you can review or change your ad-consent choices at any time. For more information about how Google uses data in its advertising products, see Google’s resources linked below.

4. Service Providers

5. Data Retention

6. Your Rights & Choices

To ask us to delete data held about you, see Request data deletion or email privacy@playcydi.com.

7. Children

CYDI is intended for a general audience and is not directed to children under 13 (or the minimum age of digital consent in your region). We do not knowingly collect personal information from children. The game requires no account or real name, and users are instructed not to enter personal information as their display name. The default profile name is “Anonymous Player.” If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Virtual Coins & Development Status

9. Changes to This Policy

We may update this policy as the game evolves. When we make material changes, we will update the “Last updated” date above.

10. Contact

Privacy questions or requests: privacy@playcydi.com
General support: support@playcydi.com

Play CYDI →