Privacy Policy

1. Who we are

This policy applies to the Puzzle Vault mobile application and this website (together, the Service). The data controller is Scott Cameron, trading as SwiftPath ("we", "us").

We are based in the Province of Quebec, Canada. Under Quebec's Law 25 we must tell you who is accountable for personal information here: the person in charge of the protection of personal information is Scott Cameron, reachable at privacy@tryswiftpath.com.

That address is also the right one for any question about this policy or your personal information.

2. What we collect, and why

Account information

If you choose to create an account, we collect your email address and a securely hashed password. We use these solely to authenticate you and to sync your puzzle progress across your devices. Account sign-in is email and password only — we do not use social logins and we do not import your contacts.

Progress information

Levels completed, stars earned, move counts and settings. If you do not create an account this stays on your device. If you do, it is stored against your account so you can restore it on another device.

Usage and diagnostic information

We use analytics to understand how the games are actually played — which levels are too hard, where people stop, and what crashes. This includes:

• In-app events such as a level started, completed or abandoned, and which of the games was opened
• Device and app information: device model, operating system version, app version, language and region
• Crash reports and performance traces, including stack traces and the state of the app at the time of a crash
• A randomly generated installation identifier, and your IP address, which our analytics providers use to derive an approximate (country-level or city-level) location

We do not use this information to build advertising profiles, and we do not use advertising identifiers (Apple's IDFA or the Android Advertising ID) at all.

Purchases

Puzzle Vault is bought through the Apple App Store or Google Play, and those stores process your payment — we never see or store your card details, billing address or full transaction record. We receive only confirmation that a valid purchase, trial or subscription exists for your store account, and its status.

Support correspondence

If you email us, we keep your message and email address for as long as needed to deal with the issue and to keep a record of it.

3. Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use a small number of processors who handle information on our instructions:

• Google Firebase (Google LLC / Google Ireland Ltd) — authentication, progress storage, analytics and crash reporting.
• Mixpanel (Mixpanel, Inc.) — product analytics on in-app events.
• Apple and Google — app distribution and payment processing, under their own privacy policies.

We may also disclose information where we are legally required to, or to establish or defend legal claims.

4. Where your information is processed

We are based in Canada, and our processors store and process information outside Canada, including in the United States. While information is in another country it is subject to the laws of that country, and may be accessible to its courts and law enforcement.

Before entrusting personal information to a processor outside Quebec we assess whether it will receive adequate protection there, as Law 25 requires, and we put a written agreement in place with that processor.

Where information is transferred out of the United Kingdom or European Economic Area, that transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

5. Our basis for processing

In Canada we process personal information with your consent under PIPEDA — express consent where you create an account or opt in to analytics, and implied consent for the processing that is plainly necessary to run the app you have installed.

If you are in the UK or EEA, we rely on the following bases under the UK GDPR and EU GDPR:

• Performance of a contract — operating your account and syncing your progress.
• Legitimate interests — keeping the app stable and secure, and understanding how it is used so we can improve it. We have weighed this against your interests and limited what we collect accordingly.
• Consent — where consent is required for analytics on your device, we ask for it and you can withdraw it at any time in the app's settings.
• Legal obligation — where we must keep records.

6. How long we keep it

We keep personal information only as long as we need it for the purposes described above, or as long as the law requires us to. In practice:

• Account and progress information — until you delete your account. We then remove it from our live systems within 30 days. Backups are overwritten on their ordinary cycle and deleted information may persist in them for up to 12 months, during which it is not used for anything except restoring the service after a failure.
• Analytics events — in aggregated or pseudonymised form for up to 25 months.
• Crash reports — up to 12 months.
• Support email — up to 36 months after the issue is closed.

We may keep information for longer where we need it to resolve a dispute, enforce our agreements, or meet a legal or tax obligation.

7. Deleting your account and information

You can delete your account and all associated information from Settings → Account → Delete account inside the app. This is permanent and removes your progress along with it.

You can also request deletion by emailing privacy@tryswiftpath.com from the address associated with your account. We may need to verify that the request really comes from you before we act on it, and we may ask you for information for that purpose.

We action verified requests without undue delay and in any event within the period the law allows us — normally 30 days. Where a request is complex, or where you have made several, we may take the extension the law permits, and we will tell you within the initial period if we need it and why.

8. Your rights

Depending on where you live, you may have the right to access a copy of your information, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent.

If you are a California resident, you additionally have the right to know what is collected, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA.

To exercise any right, email privacy@tryswiftpath.com. We may need to verify your identity first. We respond within the period the law allows us — normally 30 days — and may take the extension the law permits where a request is complex or repetitive, telling you within the initial period if we do.

If you are unhappy with our response, you may complain to the Office of the Privacy Commissioner of Canada, or, if you are in the UK or EEA, to your local supervisory authority.

9. If you are in Quebec

Law 25 gives you some rights in addition to those above:

• Portability. You may ask us for the computerised personal information you have given us in a structured, commonly used technological format, or ask us to send it directly to another organisation where that is technically feasible.
• De-indexation. You may ask us to stop disseminating personal information about you, or to de-index it, where dissemination contravenes the law or a court order.
• Profiling and tracking. If we use technology that identifies, locates or profiles you, we tell you and give you a way to turn it off. Our analytics is the only such technology we use, and Settings → Privacy in the app turns it off.
• Automated decisions. We do not make any decision about you based exclusively on automated processing.
• Confidentiality by default. The app's privacy settings are set to the highest level of confidentiality by default, without any action needed from you.

If a confidentiality incident creates a risk of serious injury, we will notify the Commission d'accès à l'information and the people affected, and keep a register of such incidents as the law requires.

10. Opting out of analytics

You can turn off analytics and crash reporting at any time in Settings → Privacy inside the app. Turning it off does not restrict any part of the game.

11. Children

Puzzle Vault is not directed at children under 13 (or the equivalent minimum age where you live), and we do not knowingly collect personal information from them. The app contains no advertising and no social features. If you believe a child has given us personal information, contact privacy@tryswiftpath.com and we will delete it.

12. Security

Information is encrypted in transit using TLS and encrypted at rest by our processors. Passwords are stored only as salted hashes and are never visible to us. No system is perfectly secure, but we limit access to personal information to those who need it.

13. Changes to this policy

If we change this policy we will update the date at the top, and for material changes we will notify you in the app before they take effect.

14. Contact

Scott Cameron, trading as SwiftPath — privacy@tryswiftpath.com