Cipher Isles Privacy Policy

This policy explains what information the mobile game Cipher Isles ("Cipher Isles", "the game", "we", "us") uses, why, who else is involved, and the rights you have. It applies to Cipher Isles on iPhone and Android phones. The game is published by John Osakwe (Etest Tech Hub). Its bundle ID and package name is com.etesttech.cipherisles. Audience: 13+ minimum, 16+ recommended.

This is the privacy policy URL for the App Store, Google Play, and the Google AdMob consent message.

1. Who is responsible for your data

Cipher Isles is made by John Osakwe (Etest Tech Hub), Lagos, Nigeria, the data controller for the processing described here.

Contact for anything about privacy, including requests to use your rights: info@etestweb.com

2. The short version

Cipher Isles works offline. There is no account and no sign-up. We never ask for your name, email address or phone number.
Your progress (islands, solved puzzles, coins, relics, daily voyage streak and settings) is stored only on your device. We don't receive it, and it is not uploaded to a cloud service.
The game has no analytics SDK of our own and no crash-reporting SDK of our own. The only SDKs inside it are AdMob (ads and consent), RevenueCat (purchases) and the storage plugin that keeps your progress on the device.
Cipher Isles shows rewarded video ads from AdMob, only if you choose to watch one, to earn a hint. It does not show banner or interstitial ads. Where the law requires it, Google's consent message (UMP) appears first, and on iPhone Apple's App Tracking Transparency prompt follows.
If you buy the Explorer Pass, Remove Ads or a hint pack, Apple or Google handles the payment, and RevenueCat confirms your purchase so the game can unlock it.
We do not sell your personal information.

3. Data that stays on your device

Cipher Isles saves its data in the game's private storage on your device. This includes the islands you have reached, the puzzles you have solved, your coins and hint balance, the relics you have found, your daily voyage streak, and settings such as sound effects, music, text size and reduced motion. None of this is sent to us.

Deleting the game deletes this data from your device. Clearing the game's storage does the same.
There is no login, no player name and no public leaderboard.
Report a word. If you use "Report a word" in Settings, the word is saved on your device and your mail app opens with a message to info@etestweb.com that contains the word, the reason, the puzzle you were playing and the app version. Nothing is sent unless you send that email, and the email is the only way a report reaches us.

4. Data handled by third parties

Advertising: Google AdMob (rewarded video only)

Cipher Isles uses AdMob (Google LLC; for users in the EEA, UK and Switzerland, Google Ireland Limited) for rewarded video ads and its consent message. To show and measure ads, prevent fraud, and limit how often you see the same ad, the Google Mobile Ads SDK may process your device's advertising identifier (IDFA on iOS if you allow tracking, or the Android advertising ID), your IP address (which can indicate your approximate location), device and app information, and how you interact with ads.

Ads are always optional. A rewarded video plays only after you tap a hint button and choose "Watch a short video", and it gives you 1 hint of that kind. Cipher Isles does not show banner or interstitial ads, and no ad plays on its own, at launch or in the middle of a puzzle.
If no ad is available, the game tells you and does not grant the reward.
Order of prompts: Google's consent message (UMP) comes first, only where it is required (EEA, UK and Switzerland). On iPhone, the App Tracking Transparency prompt comes next, and only when ads are allowed. Choosing "Ask App Not to Track" or declining consent never blocks a feature.
Personalized ads are shown only with your consent: through Google's consent message (UMP) in the EEA, UK and Switzerland, and on iPhone only if you allow tracking. Without consent you see non-personalized ads, which still use limited data for the purposes above. Features are never locked because you decline consent.
You can change your ad choices in Settings, About, "Privacy choices (ads)" (shown where consent applies), or in your device settings (iOS: Settings, Privacy & Security, Tracking; Android: Settings, Google, Ads), or by resetting your advertising ID.
Explorer Pass and Remove Ads buyers do not see any ads, including the hint videos.
Google's privacy policy: https://policies.google.com/privacy and how Google uses data from partner apps: https://policies.google.com/technologies/partner-sites

What the app declares to Apple and Google

The iPhone app ships a privacy manifest, and the Apple and Google store listings carry matching privacy answers. They list: the advertising identifier (IDFA, only if you allow tracking; used for third-party advertising, and the one item used to track), an anonymous app user ID and purchase history (RevenueCat, linked to that ID, for unlocking and restoring purchases), ad interaction and advertising data, approximate location from your IP address (all for advertising), and performance and crash data from the ads SDK (for app functionality). On Android the app requests the advertising ID permission for AdMob. The only system data the game itself reads is its own saved settings, stored through the platform's standard key-value storage. We do not collect your name, email, contacts, precise location, photos or health data.

Purchases: Apple, Google and RevenueCat

Cipher Isles offers the Explorer Pass as a monthly subscription, a yearly subscription (with a 7-day free trial for eligible new subscribers) and a one-time lifetime purchase. It also offers a one-time Remove Ads purchase and hint packs (consumable, they never expire). Payments are processed by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. We never see your card or payment details. Prices vary by country and are shown in your local currency before you confirm.

To confirm what you own, restore purchases and unlock the right features, the game uses RevenueCat, Inc. (USA). RevenueCat processes a random app user ID created on your device, your purchase history (product, dates, receipts or purchase tokens from Apple or Google), and basic device and app information such as the operating system, app version, country and IP address. RevenueCat's privacy policy: https://www.revenuecat.com/privacy

App stores

Apple and Google may provide us with aggregated, anonymous statistics (such as download counts and crash rates) if you have chosen to share diagnostics with them, under their own privacy policies. Cipher Isles does not include an analytics or crash-reporting SDK of our own.

5. Subscriptions, free trial and canceling

The monthly and yearly Explorer Pass renew automatically until you cancel. The yearly pass starts with a 7-day free trial for eligible new subscribers, then renews at the yearly price shown in the game before you confirm.
Payment is charged to your Apple ID or Google Play account. Your subscription renews unless you cancel at least 24 hours before the end of the current period.
To cancel: on iPhone, open Settings, tap your name, then Subscriptions. On Android, open Google Play, tap your profile, then Payments & subscriptions, then Subscriptions. Deleting the game does not cancel a subscription.
The lifetime pass, Remove Ads and hint packs are one-time purchases. They do not renew.
Restore purchases: if you reinstall the game or change device, use Restore purchases in the game to unlock what you already own.
Refunds are handled by Apple or Google under their policies.

6. Why we use data, and our legal basis (GDPR)

If you are in the EEA, the UK or Switzerland, we rely on the following bases under GDPR and UK GDPR:

Purpose	Data	Legal basis (GDPR Art. 6)
Unlocking your Explorer Pass or purchases and restoring them	RevenueCat data in section 4	Performance of a contract (6(1)(b))
Personalized rewarded ads	Advertising ID, ad interaction data	Your consent (6(1)(a)), which you can withdraw at any time
Non-personalized ads, ad fraud prevention, frequency capping	Limited device data, IP address	Our legitimate interest in funding the game (6(1)(f)), and consent where the law requires it
Responding to your emails	Your email address and message	Legitimate interest (6(1)(f))

You can withdraw consent for personalized ads at any time in Settings, About, "Privacy choices (ads)" (where shown) or in your device's ad and tracking settings. Withdrawing consent does not affect ads already shown. Cipher Isles keeps working with non-personalized ads, or with no ads if you buy the Explorer Pass or Remove Ads.

7. International transfers

Google and RevenueCat may process data in the United States and other countries outside your own. Where data from the EEA, UK or Switzerland is transferred, these providers rely on recognized safeguards such as the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. We are based in Nigeria, so emails you send us are processed there. Your progress and settings never leave your device through the game.

8. How long data is kept and how to delete it

Data on your device: until you delete the game or clear its storage. This is the main way to delete your Cipher Isles data.
RevenueCat purchase records: for as long as needed to provide your purchases and meet legal and tax obligations, then deleted under RevenueCat's retention policy.
Advertising data: under Google's retention policies.
Emails to us: up to two years after the conversation ends.
Deletion requests: email info@etestweb.com and we will delete or arrange deletion of any personal data we or our processors hold about you, within one month.

9. Your rights

If you're in the EEA, UK or Switzerland (GDPR / UK GDPR), in Nigeria (Nigeria Data Protection Act 2023) or in another place with similar laws, you have the right to:

access the personal data we hold about you
correct it
delete it ("right to be forgotten")
restrict or object to its processing, including processing based on legitimate interest
data portability, where it applies
withdraw consent at any time, without affecting earlier processing
complain to a data protection authority, such as the one in your country (in the UK, the ICO; in Nigeria, the NDPC)

Because there's no account, we can't link on-device progress to you by name, and we hold no copy of it to export. To make a request about RevenueCat purchase data, email us from the address on your App Store or Google Play receipt, or include your order ID. Requests about advertising data can also be made directly to Google.

US residents (California and other states): you may have the right to know, delete, correct and opt out of the sale or sharing of personal information, and not to be discriminated against for using these rights. We don't sell personal information. Personalized advertising may count as "sharing" or "targeted advertising" under some US state laws. You can opt out with your device's ad settings or the "Privacy choices (ads)" entry in Settings described above, or by emailing info@etestweb.com. Where the law allows, you may use an authorized agent to make a request for you.

10. Children

Audience: 13+ minimum, 16+ recommended. Cipher Isles is built for teens and adults. It is not directed to children under 13, it is not part of any Kids Category or families program, and we don't knowingly collect personal data from children. We do not ask for your age. If you believe a child has used the game in a way that sent us personal data, contact us and we'll delete it.

11. Security

Your progress stays on your device. Data shared with RevenueCat and Google is transmitted over encrypted connections.

12. Changes

If this policy changes, we'll update the date at the top. If a change is significant, we'll also mention it in the game's release notes.

13. Contact

John Osakwe (Etest Tech Hub), Lagos, Nigeria. info@etestweb.com