Privacy Policy

Information we process

Cosmics Friendly Adventure stores your story progress, puzzle choices and app preferences as a local save in the app’s Application Support storage on your iPhone so that your journey can continue after closing the app. The save uses device file protection until first unlock. The core story can be played offline. Installation credentials are stored in the iPhone Keychain with a device-only accessibility setting. If you opt in to a reminder, the app schedules a local notification on your device; it does not register a remote push token. Bundled ambient sounds and effects play locally and do not record audio. The optional Signal Archive connects to our service to download signal puzzles and save their tuning progress. When you use it, the app creates a random installation identifier and a random authentication secret. The server stores the identifier, a salted bcrypt hash of the secret, registration time, signal dial values, completion state and update time. It does not store the plaintext secret. These installation records are not a named account and are not linked to an email address or other installations.

Our hosting infrastructure necessarily receives network requests, which can include your IP address, request time and basic connection information, including requests for the public privacy page. The application server temporarily uses socket peer addresses and installation identifiers for request limits. We do not include advertising or analytics SDKs, contact forms, account registration, location tracking or collection of contacts, photos, microphone recordings or payment information.

How we use information

Local information keeps the story, puzzle progress and preferences available on your device. Signal Archive records let the same installation retrieve and update its saved signal tuning state. An optional local reminder invites you back after three days; its schedule stays on your device. The authentication hash protects that installation's records from requests without its credentials. We validate signal completion on the server. Network processing, short-lived request counters, random error request identifiers and operational service events support delivering the service, diagnosing failures and limiting excessive requests. We do not use this information for advertising, profiling or selling personal information.

Service providers and sharing

The online service and privacy website are hosted on Railway, which processes requests and stores the service database on its infrastructure on our behalf. Railway and its infrastructure providers may process connection information and operational logs in providing hosting. Our application does not log authentication secrets, authorization headers, installation identifiers, request bodies or saved dial values. Application error logs contain a random request identifier and a general failure event. Hosting-level logs and their retention are controlled separately by the provider; we do not promise a specific provider log-retention period. The iOS app contains no third-party client SDKs. We do not add social networks, advertising providers, analytics services or outbound email services. Information may also be disclosed if required by applicable law. If you email the privacy contact, your own email provider and the recipient's email provider process that message outside the app.

Data retention

Local story progress and preferences remain on your device until you use Delete Game Data or remove the app, subject to your device's storage and backup settings. Installation credentials are kept in the device-only Keychain so that the app can authenticate future Archive requests. They are not transferred by this app to another device and there is no account recovery. Keychain behavior on app removal is managed by iOS, so do not assume uninstalling erases those credentials. Removing the app should not be relied on as a server deletion request. Server installation and signal records remain until you request deletion using the installation's credentials or the service is removed. There is no automatic inactivity-deletion schedule. In-memory request-limit counters stop applying after a minute and are lost when the server process restarts. Expired counter entries are cleared as the bounded counter map needs space. Infrastructure logs, device backups and any provider-managed snapshots follow their own settings and retention; deletion from the active service database does not promise immediate removal from those separate systems.

Deleting your information

Use Delete Game Data in the app’s Settings to erase the current game data. If online Archive credentials exist, the app first sends an authenticated deletion request and requires confirmation from the service before removing the local save and Keychain credentials. The server removes the current installation and its saved signal progress from the active database, and the old credentials no longer grant access. If the network request fails, the app keeps the save and credentials and shows a retry option. After successful deletion, the app removes the local save, installation credentials and pending local notifications. A later Archive setup creates a separate installation.

Removing the app is not a server deletion request. Losing credentials can make it impossible for us to reliably identify a particular installation for deletion. You can contact vedmist@atomicmail.io for privacy requests and explain the circumstances without sending your authentication secret. Provider backups, infrastructure logs and device backups are not represented as being erased immediately by the app’s deletion control.

Permissions and your choices

The game does not request access to your location, contacts, camera, photo library or microphone. Local notification permission is requested only if you choose the optional reminder. You can disable reminders in the app or revoke notification permission in iOS Settings; this does not erase saved gameplay. There are no remote push notifications or push tokens.

You can play the main story offline and choose whether to open the online Signal Archive. You can disable Online Archive Signals in the app Settings to use only the built-in exercises; you can also stop using the feature or disconnect network access. Existing server records remain until deleted through Delete Game Data. Your device’s settings control storage, network access and device backup choices where available. The public privacy page can be opened without creating an installation or accepting cookies; the service does not set tracking cookies.

Your privacy rights

Depending on the law that applies to you, you may have rights to access, correct or delete personal information, restrict or object to processing, or raise a concern with a data-protection authority. Contact vedmist@atomicmail.io with privacy questions or requests. Provide enough context to understand the request, but do not send your installation secret or other confidential credentials. Because the service uses random installation credentials rather than named accounts, we may be unable to associate a request with a server record without appropriate verification. The app’s Delete Game Data control is the direct way to remove the current installation's active server data. We do not require an account or payment to use this control.

Security

The deployed online service uses HTTPS for communication. The server stores a salted bcrypt hash instead of the installation's plaintext authentication secret, verifies credentials for private requests, and separates saved progress by installation identifier. Input validation, bounded request sizes, request timeouts and rate limits reduce common abuse. Database files are kept in persistent service storage, and the server does not deliberately log private credentials or gameplay payloads. The local save uses iOS file protection, and installation credentials use the device-only Keychain. Device storage and hosting access protections also depend on their respective platforms. No transmission, device or storage system can be guaranteed completely secure. Keep your device protected and do not share the installation's secret.

Children’s privacy

Cosmics Friendly Adventure is designed for players aged 14 and older. It does not ask players for names, email addresses, dates of birth, precise location or chat messages, and it has no advertising or social posting features. The optional online Archive still processes the limited installation and network information described in this policy. A parent or guardian can help a younger player keep play offline, use the deletion control or contact vedmist@atomicmail.io about privacy concerns. We do not verify players' ages or obtain parental consent through the app.

Changes to this policy

We may update this policy when the game's features, service processing or applicable requirements change. The effective date at the top identifies the current version. The public policy remains accessible from the app and the service website without authentication. A change to this document does not itself request new device permissions. Questions about a policy change can be sent to vedmist@atomicmail.io.