Privacy Policy
Cipher
This Privacy Policy explains what information Cipher (operated by Erebos Lab) collects, how it is used, who it is shared with, and the choices you have. By using Cipher you agree to the practices described here.
Data-safety summary
At a glance, here is the data the app collects, whether it is linked to your identity, and whether it is used to track you across other companies’ apps and websites.
| Data category | Linked to you | Used for tracking | Purpose |
|---|---|---|---|
| Contact Info | Yes | No | Create your optional account, sign you in (Sign in with Apple supported), and respond to support. The game is local-first and fully playable offline with no account. |
| User Content | Yes | No | Operate optional cloud sync and the leaderboard. Your gameplay, stats, and settings otherwise live only on your device. |
| Contacts (Optional) | Yes | No | Find contacts who also play. Contacts are matched on your device and are never uploaded in the clear. |
| Purchases | Yes | No | Manage optional in-app purchases and subscriptions through Apple/Google via RevenueCat. Purchases are never required to play. |
| Usage Data | No | No | Optional analytics to improve the game. Analytics is opt-in and can be turned off in Settings → Privacy. |
| Diagnostics | No | No | Keep the game stable and diagnose problems. Not linked to your identity. |
What we collect
Contact Info
- Email address
- Name / display name
- Support messages you send us
Create your optional account, sign you in (Sign in with Apple supported), and respond to support. The game is local-first and fully playable offline with no account.
User Content
- Optional profile photo you choose
- Synced game stats and progress (only if you enable cloud sync)
Operate optional cloud sync and the leaderboard. Your gameplay, stats, and settings otherwise live only on your device.
Contacts (Optional)
- SHA-256 hashes of contacts (only if you enable find-friends)
Find contacts who also play. Contacts are matched on your device and are never uploaded in the clear.
Purchases
- Subscription / in-app purchase state for the optional “Cipher Pro” upgrade
Manage optional in-app purchases and subscriptions through Apple/Google via RevenueCat. Purchases are never required to play.
Usage Data
- Product-interaction events
Optional analytics to improve the game. Analytics is opt-in and can be turned off in Settings → Privacy.
Diagnostics
- Crash reports and performance data
Keep the game stable and diagnose problems. Not linked to your identity.
What we do NOT do
- The game is local-first and fully playable offline with no account.
- The core daily puzzle is ad-free.
- Raw contacts never leave your device — only salted hashes are used for find-friends.
- We do not sell your personal information.
Third parties who process your data
We share data only with the processors below, each bound to use it only to provide their service to us. Items marked "unverified" are placeholders we must confirm and name before this policy is treated as final.
- Apple App Store — In-app purchase billing and receipts
- Google Play — In-app purchase billing and receipts
- RevenueCat — Optional “Cipher Pro” in-app purchase and subscription state
- Apple — Optional “Sign in with Apple”
- Supabase — Optional cloud sync, profiles, and leaderboard (the app runs fully offline without it)
- Expo — Push notification delivery (via Apple/Google) and OTA updates
How we use your information
- Operate and personalize the app and its core features.
- Maintain your account, authenticate sessions, and provide support.
- Process payments and manage subscriptions/entitlements.
- Keep the service secure and prevent fraud and abuse.
- Comply with legal obligations and enforce our Terms of Service.
- Improve the product through aggregated, de-identified analytics.
Data retention
We keep personal information only as long as needed to provide the service. Account data is retained while your account is active and for a short recovery window after deletion, then deleted or anonymized. Billing records are retained as required by tax and accounting law. Backups are purged on a rolling basis.
Your rights and choices
Depending on your jurisdiction you may access, correct, export, or delete your personal data, object to or restrict certain processing, and withdraw consent. You can delete your account and its server-side data from within the app, or by emailing us. We respond within 30 days.
Children’s privacy
The app is not directed to children under 13 (under 16 in the EEA/UK) and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
Security
We use industry-standard safeguards including TLS in transit, encryption at rest for sensitive fields, hashed passwords, least-privilege access, and audit logging. No system is 100% secure; please use a strong, unique password.
Changes to this policy
We may update this policy. Material changes will be reflected by a new "Last updated" date and, where required, announced in the app.
Contact
Privacy questions? Email [email protected].