Privacy Policy
Space Bend Atelier
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Space Bend Atelier stores campaign progress, the current room and undo history, completed daily challenges and streak information, settings, cached daily rooms and pending results on your device. Saved solution drawings and their room number, move count and date are stored in the app's private local files, not your photo library. A randomly generated installation secret is stored in the iOS Keychain with device-only accessibility. When the app requests daily rooms, sends a daily result or deletes server results, it sends this secret over HTTPS. The server stores a SHA-256 lookup fingerprint and a bcrypt hash of the secret, rather than the original secret, and stores the challenge date, move count and result timestamp associated with that installation. Railway infrastructure receives network requests and may process IP addresses, request times, URLs and operational metadata. The app does not request your name, email address, contacts, location or an account.
How we use information
Local data lets you continue rooms, undo moves, view your progress, keep drawings and play offline. The installation credential authorizes access to your own daily results. The backend supplies today's room and the previous seven daily rooms, stores your best submitted result per day and handles deletion requests. Cached rooms and pending results allow offline play and later synchronization. Optional local notifications remind you about a daily room at 9:00 using the device's notification system; no remote push provider is used. Operational metadata supports hosting, abuse limits, availability and diagnosis of failures.
Service providers and sharing
The backend and PostgreSQL database are hosted on Railway. Railway and its infrastructure providers process the requests and stored data necessary to operate the service, including infrastructure logs. The app contains no advertising, analytics, social sign-in or email delivery SDK. Your saved drawings and campaign history are not uploaded. Daily results are not exposed publicly or shared with other installations. Data is not sold or used for advertising. Information may be disclosed where required by applicable law. If you contact the published privacy email yourself, your email provider and the receiving email provider process that message; the app does not send emails.
Data retention
Local progress and drawings remain until you delete them or reset local data; app removal normally removes its local files. iOS backup behavior may retain local app files according to your device and backup settings. The device-only Keychain secret is not intended for transfer to another device and may survive reinstalling the app on the same device. Server installation hashes and daily results remain until an authorized deletion request removes them; the application does not apply an automatic expiry period. Generated challenge content is retained independently and contains no personal player history. No particular Railway infrastructure-log or backup retention duration is promised. Deleted records may remain in previously made backups until those copies are replaced or expire under the hosting configuration; deletion removes the active database records. Pending uploads older than seven UTC days are removed from the upload queue because the server only accepts current and recent challenges; local completion history is retained.
Deleting your information
In Settings, Delete my server results sends an authorized request that deletes this installation's server results and installation hash record, and clears pending result uploads on the device. It requires a working connection and reports a failure rather than claiming deletion succeeded. A later daily request may create a fresh empty installation record using the same secret. Reset local progress and album deletes local game records, drawings, cached rooms and pending uploads but does not delete server results. Delete server results before removing the app or losing the secret. There is no account-based recovery, and we cannot use an email address to retrieve an installation's private results. Individual album drawings can also be deleted locally.
Permissions and your choices
The app requests optional local notification permission only when you first open Daily challenge. Declining this permission does not prevent play. You can withdraw notification permission in iOS Settings, which stops presentation of scheduled reminders. Language, touch feedback and unfolding animation can be changed inside the app; system Reduce Motion is respected. No camera, microphone, photos, contacts or location permission is requested. The app uses network access for the daily service, with local challenge fallback when unavailable.
Your privacy rights
Depending on your location, you may have rights to access, correct, delete or restrict processing of personal data, or complain to a data protection authority. Use the app's deletion control for installation-scoped results. For privacy questions or rights requests, contact Somerleigh3Rotherham@icloud.com. We may need enough information to understand and verify your request without requesting your installation secret by email. The absence of an account and loss of the device credential can prevent us from identifying which private records belong to you.
Security
The client uses HTTPS and stores its random installation credential in the iOS Keychain with device-only accessibility. The backend validates the credential on protected endpoints, stores bcrypt hashes with a lookup fingerprint and scopes result queries and deletion to that installation. Request size limits, rate limits, database constraints and parameterized queries help protect the service. Local saved files use iOS file protection. Application error logs omit raw credentials and result payloads. Hosting infrastructure has its own processing and logs. No system can guarantee absolute security; avoid sharing your credential or device with untrusted people.
Children’s privacy
Space Bend Atelier is designed for adult puzzle players and is not directed at children under 13. It does not request age, names or contact information from players. If you believe a child has supplied personal information in connection with the service, contact Somerleigh3Rotherham@icloud.com so the concern can be reviewed. Core campaign play is available offline without submitting daily results.
Changes to this policy
This policy describes the app and backend as of the effective date above. If processing changes, the public policy and its effective date will be updated, and the app's Privacy Policy link will continue to provide the current version. Please review this page periodically. Material changes will be explained here rather than silently described as unchanged practices.