Privacy Policy

Summary

• No required personal loginCrystal Clues does not require a name, email address, password, or social login. Players may optionally choose a public leaderboard name.
• Global ScoresFor Global Scores, the app creates an anonymous player identity and sends an optional leaderboard name plus saved Campaign progress. Replay-verified play also sends bounded gameplay actions and restart events. Device snapshots keep saved games from disappearing when replay authority is unavailable. Replay/device provenance is separate from paid-Letter disclosure; only a Campaign that used a paid Letter receives * beside its score.
• Optional paid creditsCrystal Clues contains optional App Store and Google Play purchase paths for 4 Letter Credits. New checkout can be enabled or disabled by a production service control. Apple or Google handles payment details; Crystal Clues does not receive or store card or bank-account numbers.
• No precise locationCrystal Clues does not request location permission or precise location. When crash reporting is enabled, Sentry may derive coarse country or region from the network request even though storage of new raw IP addresses is disabled.
• No advertising or trackingCrystal Clues does not show ads, sell personal information, or use information for cross-app tracking.
• Saved progress and recoveryCampaign progress, settings, onboarding state, a resumable verified-run record, a durable pending Global Scores synchronization queue, and the private Letter Credit recovery key are also stored on the device.
• Crash diagnosticsIf production crash reporting is enabled, crash and diagnostic information is sent to Sentry and may be linked through a pseudonymous app-installation identifier.

Information Stored On Your Device

Crystal Clues may store saved campaign progress, current score and powerups, audio and motion settings, onboarding state, restart state, an anonymous authentication session, the current verified-run action history, pending Global Scores updates, RevenueCat purchase state, and the Letter Credit recovery key. Pending score updates remain in an on-device outbox until the service acknowledges the exact update, allowing a saved Campaign to synchronize after an interruption or temporary loss of connectivity. The recovery key is stored using operating-system secure storage.

Android cloud backup is disabled. On iOS, Keychain-backed secure values can persist after app removal and may be available again after reinstall; uninstalling is therefore not a reliable deletion method. Players should keep a private copy of the recovery key if they buy credits and use Delete All when they intend to delete the wallet link and local key.

Information Sent Off Your Device

For Global Scores and verified restart limits, Crystal Clues sends:

• A randomly generated anonymous user identifier and either a generated public alias or the optional leaderboard name entered by the player.
• For every saved Campaign: difficulty, a deterministic run identifier, current board, derived score, boards completed, run status, and a client update sequence. These values may be queued on the device and synchronized when connectivity returns.
• For replay-verified Campaigns: current attempt, bounded gameplay actions, powerups, board-completion state, and restart events used to derive and validate the score.
• Request nonces, idempotency identifiers, timestamps, and rate-limit events.
• Supabase session tokens and Firebase App Check tokens used to authenticate the anonymous player and verify app integrity.

The public leaderboard shows the chosen leaderboard name or generated alias, rank, score, paid-Letter marker, difficulty, boards completed, run status, synchronization provenance, and update time. All Scores and the active-difficulty sections include both replay-verified Campaigns and device-synchronized Campaigns. A Campaign is marked with * and excluded from the Unassisted view only after an authoritative paid-Letter spend; device synchronization, replay availability, earned Letters, Shuffle, Zap, guesses, restarts, and score penalties do not create that marker. If the same Campaign later has replay-verified data, the service de-duplicates the two records. The leaderboard uses a separate random public entry identifier and does not show the private authentication identifier.

Entered names are validated, checked for common unsafe or impersonating forms, length-limited, and rate-limited. Public names are governed by the overall Terms of Use without a separate in-app acceptance step. Players can report and hide public names; the service retains the report, name snapshot, reason, moderation status, and hide relationship while the anonymous accounts remain active.

Letter Credit Purchases And Recovery

For optional Letter Credit purchases and recovery, Crystal Clues sends or processes:

• A random wallet identifier used as the RevenueCat App User ID.
• App Store or Google Play/RevenueCat purchase transaction ID, product ID, purchase date, store, and test or sandbox status.
• Current credit balance, credit grants, credit spends, and whether a campaign used paid assistance.
• Purchase-event identifiers, event type, payload digest, reconciliation status, revocation reason, remaining credits attributed to each purchase, and whether a refunded purchase requires review.
• A recovery key sent over HTTPS when it is created or entered. The server retains only an HMAC digest of the key, not the readable key itself.

RevenueCat processes purchase history to validate receipts, prevent purchase fraud and support purchase-related customer history and analytics.

When checkout is available, paid Letter Credits can be purchased for Campaign play; existing balances, synchronization, and recovery can remain available while new checkout is disabled. Using one reveals one answer letter and permanently marks that campaign Assisted. Assisted campaigns remain ranked in Global Scores with * beside the score.

Crash Reporting

When crash reporting is enabled, Crystal Clues may send crash logs, stack traces, app version, operating system, device model, and runtime diagnostics. Crash diagnostics can include app-freeze and watchdog-termination error reports. These error reports are separate from performance and usage tracing. Sentry may derive approximate country or region from the request; Crystal Clues does not request precise location or location permission, and Sentry storage of new raw IP addresses is disabled. Sentry can attach a pseudonymous app-installation identifier to diagnostic events. Crash and diagnostic information, and approximate location associated with those events, may therefore be linked to the same installation even though the identifier is not a required personal login. Crystal Clues does not use it for advertising or cross-app tracking. Crash reporting has default personal-information collection, screenshots, and view-hierarchy capture disabled; these settings do not mean diagnostic data is anonymous or unlinked. The application's JavaScript crash reporter applies filters for known authorization, billing-account, recovery-key, purchase-token and transaction-ID fields and secret-token patterns to its events and breadcrumbs before upload. Native crash events use a separate Sentry SDK path and are not processed by that JavaScript filter.

How Information Is Used

Information is used to save and resume play, synchronize saved Campaigns, validate replay-verified scores, display and moderate Global Scores, process reports and player-specific hiding, deliver and recover paid Letter Credits, reconcile refunds, prevent duplicate purchase grants, mark assisted play, enforce restart rules with server time, prevent replay and automated abuse, diagnose failures, and improve reliability. Purchase history is also used for RevenueCat's purchase-related analytics. Approximate region derived during crash processing is used only for diagnostics and service operation. Information is not used for targeted advertising.

Service Providers

• Supabase provides anonymous authentication, database storage, and Edge Function processing.
• Google Firebase provides App Check and platform app-integrity verification.
• Apple provides App Store purchase processing, StoreKit transaction status, App Attest, and DeviceCheck for iOS.
• Google Play processes Android purchases and payment details.
• RevenueCat processes in-app purchase status, transaction history and purchase-related analytics.
• Sentry may provide crash reporting, diagnostics, and derived coarse-geography processing in production.

These providers process information to operate, secure, and support Crystal Clues. Their own legal terms and privacy practices also apply.

Retention

Most on-device data remains until Delete All, app deletion, or replacement by newer records. Acknowledged pending score updates may be compacted or removed from the local synchronization queue. On iOS, the Keychain-backed Letter Credit recovery key may persist across uninstall/reinstall, so Delete All is the supported way to remove it together with the remote wallet link. Server replay-verified runs, device-synchronized Campaign snapshots, report/hide, moderation, Letter Credit wallet records, and any legacy Global Scores acceptance record created by an older app release remain associated with the anonymous player until Delete All successfully deletes that player or the developer removes records for operational or legal reasons.

After deletion, Crystal Clues may retain a store transaction ID and basic transaction/revocation facts without a player or wallet link to prevent duplicate grants, reconcile refunds, prevent fraud, or meet legal obligations. Apple, Google Play, RevenueCat, and Sentry retain records according to their own policies and applicable requirements; these may include diagnostic or derived coarse-location records associated with a pseudonymous installation identifier.

Deletion

Open Settings and choose Delete All. With an internet connection, Crystal Clues first deletes the anonymous server account and its leaderboard, replay-verified run, device-synchronized Campaign snapshot, restart, nonce, submission, rate-limit, legacy accepted-Terms, report/hide, moderation, Letter Credit balance, recovery digest, and player-linked purchase/spend records, then deletes local campaign, pending leaderboard-sync queue, score, restart, settings, onboarding, recovery key, and identity records.

Unused paid credits are permanently lost. Detached transaction facts may remain only for duplicate-grant prevention, refund/revocation processing, fraud prevention, or legal obligations. A random internal deletion receipt lets the app confirm deletion if the response was interrupted; it is not displayed to the player. After completion, the receipt retains no player identifier and expires through service cleanup.

If server deletion cannot be confirmed, the app keeps the local identity so the player can retry instead of orphaning remote data. Deleting the app cannot by itself request deletion of server records and, on iOS, may leave the Keychain-backed recovery key available to a later reinstall. Use Delete All for confirmed in-app/server deletion; a saved recovery key can recover unused credits on a new installation only while the wallet link still exists.

See Delete Crystal Clues Data or email crystalclues.support@gmail.com for help.

Children

Crystal Clues is a general-audience puzzle game. A player may optionally enter a public first name or nickname for Global Scores, but should not enter a full legal name or other private information. Crystal Clues does not provide profile biographies or chat. If you believe a leaderboard name or information relating to a child requires review or deletion, contact support.

Changes

If Crystal Clues changes its data practices, this policy and the store privacy disclosures will be updated.

Contact

Privacy questions can be sent to crystalclues.support@gmail.com.