Privacy Policy

1Who we are, and what this covers

This privacy policy is issued by Cygnus Works LLC ("Cygnus Works", "we", "us"), which is the controller of the personal data described below. "You" means the person playing.

It covers the Android games that have a page on this site, and this website. The games share one code base, so they collect the same things in the same ways, and one policy is easier to keep true than twelve. Each game also has a short page naming the app and listing the Google services that particular game uses.

It does not cover every game Cygnus Works publishes. Thanatide has its own privacy policy at thanatide.cygnusworks.com/privacy-policy, and that policy is the one that applies to it. Keelhold, Fathom, Frylings and Elephant Pop are covered by the policies on arcade.cygnusworks.com.

Every game in that table is registered with Google Play and none is on the store yet. Each page describes what that game does, and each one is checked again before that game ships. Games added later are added to the table. If a future game does something this policy does not describe, the policy changes before that game ships.

Anything you reach by following a link out of a game or off this site belongs to somebody else and runs under their policy. This one stops at our boundary.

2What is stored on your device

Each game keeps one save in the app's own private storage on your phone, under a key made from the game's name, such as minesweeper.save.v1. Nothing in it is sent to us. Here is what it holds:

• whether you have bought the ad removal, and the list of product ids your device knows you own
• which skins you own and which one is equipped
• how many ads have been watched, how many failed to load lately, and which day that count belongs to
• the daily puzzle state: the last day you completed one, your current streak, your best streak, and how many you have played
• leaderboard scores and achievements that are waiting to be sent to Google, and the list of achievements you have earned
• your settings: sound, music and vibration
• the game's own records, which is usually best times and wins

That data stays on the device. We do not receive it, hold it, back it up or have any means of reading it. Uninstalling the game deletes it, and once it is gone we cannot put it back, because we never had a copy.

Android does one thing here that we should mention. If you have your phone's backup switched on, Android may include this app data in the backup it keeps for you under your Google account. That is a feature of Android, between you and Google, and it happens without the game sending anything anywhere itself. You can turn device backup off in your Android settings.

3Permissions the apps declare

The games do not ask for, and cannot obtain, access to your location, contacts, camera, microphone, photos or files.

4Advertising

The games show ads supplied by Google AdMob. There are three formats and no others.

• A banner across the top of the screen while you play. It sits above the board and the buttons, never over them.
• A full-screen ad after a game you finished. Not after every one, and never within a few minutes of the last one. It is never shown after a loss.
• A rewarded ad you choose to watch in exchange for something in the game, such as a hint or another try. It only ever runs because you asked for it.

Buying the ad removal in a game stops the banner and the full-screen ads there.

To select and measure those ads, Google receives and processes information from your device. That includes your device's advertising identifier and app set identifier, your IP address, from which Google can estimate a general location such as the city, general device and operating system information, diagnostic information such as how long the app takes to start, and what happened with the ad, such as whether it was shown, watched or clicked. Google acts as an independent controller of that data and handles it under Google's own privacy policy, which we do not control and cannot vary. Google describes how it uses data in its advertising products at policies.google.com/technologies/partner-sites.

We do not receive any of it. Your advertising identifier, your IP address and any per-person record of what you were shown never reach us. What comes back to us from Google is aggregate reporting: totals and revenue, with nobody identified.

Consent, if you are in the EEA, the UK or Switzerland

Before a game requests its first ad, it asks Google's consent SDK whether a consent form applies to you, and shows the form if one does. Only after that does the ad library start up. Which players see a form is decided by Google from the region of the device, not by any check of ours.

Where you give consent, ads may be personalized. Where you do not, ads are requested without personalization, or not at all.

You can change your mind at any time. For as long as Google says the choice applies to you, the game shows a Privacy options button, which reopens Google's form. It is not shown to players the choice does not apply to, which is also Google's requirement.

Declining does not change the game. It sees no difference between an ad it is not allowed to request and an ad that failed to load, and in both cases it hands over the rewarded extras free a few times a day. No level, feature or content is held back from anyone for saying no.

Your controls on the device

• Reset or delete the advertising identifier in Android under Settings, then Privacy, then Ads. Resetting breaks the link between past and future advertising data. Deleting it makes apps receive a string of zeros instead.
• Opt out of ads personalization in the same place. Ads still appear, they are just chosen without a profile.
• Remove the ads entirely with the purchase described next.

5Purchases

Each game sells a small number of one-off items. There are no subscriptions and no consumables, so nothing can be bought twice. The usual list is an ad removal plus one or more skin packs; the exact product ids for a game are on that game's page.

Every purchase is processed by Google Play under Google's terms and privacy policy. We never receive your card details, your billing address or your Google account credentials. What the game does is ask Google Play whether this device's Google account owns the product, and show the price Google Play reports for your country. That is the whole exchange.

Because the entitlement belongs to your Google account and not to us, it survives a reinstall or a new phone. Every game has a Restore button that asks Google Play to confirm it again, and each game also rechecks on launch. Google Play holds the order. The game records only an entitlement on the device: the product ids your Google account owns, kept in the save described in section 2. The game sends no record of a purchase to us, so a restore is always between the game and Google Play. Refunds are handled by Google Play.

6Google Play Games Services

Play Games is optional. No game requires it, and skipping it does not take anything out of the game you are playing.

It is a Google sign-in using your Play Games profile. Where a game is set up for it, the game asks Play Games to sign you in when it starts, and Play Games shows its own prompt if it needs one. If you decline, or you have no Play Games profile, the game plays exactly the same and nothing nags you about it afterwards. Each game's page says which parts of this that game uses. None of the games on this site is set up for Play Games yet, so today none of them signs in or sends anything to it.

• Leaderboards. When you finish a game or a daily puzzle, your time or score can be sent to Google and listed on that game's leaderboard under your Play Games profile name, where other players of the same game can see it. Scores made while you are signed out or offline wait on your device and go up the next time you are signed in.
• Achievements. Unlocks are recorded on your device first and sent to Google when there is a connection and you are signed in.
• Saved games. Where a game offers cloud saves, a copy of that game's save is stored by Google in your Play Games saved games, under your Google account, so it can follow you to another device. It holds the same fields listed under what is stored on your device.

Your Google account details do not come to us. Leaderboard entries, achievements and saved games are held by Google under Google's privacy policy. What Google gives us is reporting on how the leaderboards and achievements are being used.

You can sign out, or delete what Play Games holds for one game or for all of them, from the Google Play Games app. We cannot do that for you, because the data sits under your Google account rather than with us.

7This website

These pages are static HTML, one stylesheet and one script. There are no analytics, no embedded fonts and no trackers. Apart from the optional sign-in below, nothing on the site asks you for anything or sets a cookie.

Signing in is optional, and the games do not use it. The header of every page has a Sign in link for the Cygnus Works account. There is one Cygnus Works account: every cygnusworks.com site signs in with it, and so do Meridian Void and Thanatide. None of the games on this site has an account or reads this one, and signing in changes nothing in them. The account is kept by Google's Firebase Authentication, in our project meridianvoid-cc010: your email address and a hash of your password, or the Google account you picked, and a display name if there is one.

The Sign in link goes to cygnusworks.com/account, our own site, and comes back here afterwards. Signing in, creating an account and resetting a password all happen there, and its privacy page says what that page loads. This site loads one small script from cygnusworks.com that shows who is signed in, and talks to Google only to refresh the session.

Once you are signed in, your browser keeps one cookie, cw_account, for cygnusworks.com and its subdomains, this site included. It holds the session's refresh token and the name the page shows. It lasts a year from your last visit (Safari cuts that to seven days), and Sign out on any Cygnus Works site deletes it for all of them. The site also keeps a short-lived token in the tab's session storage, which goes when the tab closes. Your browser sends the cookie along with requests to the cygnusworks.com sites, so our hosting provider receives it, but nothing on those servers reads it.

Delete Account inside a game that has one removes only that game's data and keeps the sign-in, because the other games use it too. cygnusworks.com/account/delete deletes the account and its data in every game, and the sign-in last.

The site is served by our hosting provider and the content delivery network in front of it, which receive and may log requests, including your IP address, the page requested, the time and your browser's user-agent string, to keep the site up and to defend it. We do not analyze those logs, build profiles from them, or join them to anything else.

8What we do not do

• No accounts in the games, no sign-up, no password, no email list, no newsletter. The website sign-in in section 7 is optional and separate from the games.
• No analytics SDK, no crash reporting SDK, no telemetry and no session recording.
• No advertising or tracking beyond the Google AdMob integration described above.
• No cookies set by us apart from the one the optional sign-in keeps, and no tracking scripts on this website.
• No access to your location, contacts, camera, microphone, photos or files.
• No server of ours holding your progress, your times or any record of your play.
• No sale of personal information, and no sharing of it with anyone other than the Google services named in this policy.

9Children

The games are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13, or under 16 where local law sets that line. We do not build a children's audience for them and we do not design them for one.

If you believe a child has provided personal information through one of our games, write to us at the address in Contact. In practice we hold nothing to delete, but we will tell you exactly which Google control applies and help you use it.

10How long anything is kept

The games store no personal data about you on any system of ours, so for them there is nothing to retain and no schedule to publish. A website account, if you made one, is kept until you ask us to delete it.

Data on your device stays there until you delete it or uninstall the game. Google keeps advertising, purchase and Play Games data under its own retention schedules, which we do not set. Our hosting and delivery providers keep their request logs under theirs.

11Deleting your data

Every route below is one you control yourself, without going through us:

• Progress, settings and purchase state on the device. Uninstall the game, or clear its storage from Android Settings, then Apps.
• The advertising identifier. Reset or delete it in Android Settings, then Privacy, then Ads. It applies to every app at once.
• Your ad consent choice. The Privacy options button in the game, where it applies to you.
• Leaderboard entries, achievements and cloud saves. The Google Play Games app can delete Play Games data for a single game or for all of them.
• Purchase records. Held by Google Play, so ask Google Play.
• The website sign-in. Sign out removes the cookie from your browser. To delete the account itself, write to us at the address in Contact.

You can also write to us and we will answer, but for most of the list above the answer will be a pointer to the switch, because we are not holding anything to delete.

12Legal bases, in the EEA and the UK

Where the EU or UK General Data Protection Regulation applies, we rely on these bases:

• Personalized advertising: your consent, Article 6(1)(a), given through the consent form and withdrawable at any time.
• Non-personalized advertising and fraud prevention: legitimate interests, Article 6(1)(f), in funding games given away for nothing and in keeping advertising fraud out of them.
• Processing a purchase: performance of a contract with you, Article 6(1)(b).
• Play Games leaderboards, achievements and saved games: your consent, given when you sign in to Play Games and withdrawable by signing out.
• Website and delivery logs: legitimate interests, Article 6(1)(f), in keeping the site available and secure.
• The optional website sign-in: performance of a contract with you, Article 6(1)(b), in providing the account you asked for.

13Your rights

Depending on where you live you may hold rights under the EU or UK GDPR, the California Consumer Privacy Act as amended, or comparable law. Those usually include the right to know what is held about you and to get a copy, to have it corrected or deleted, to receive it in a portable form, to restrict or object to how it is used, to withdraw consent, and not to be treated worse for having asked.

We can act on those rights only as far as we hold data about you. From the games we hold none: there is no game account to look up, no profile to correct and no record to export. A website account, if you made one, we can show you, correct or delete. What a game creates lives on your device and is yours the whole time, as set out in section 2. For data held by Google, the controls listed under Deleting your data are the ones that work, and Google's own policy sets out how to exercise your rights against Google.

You are still welcome to write to us at the address in Contact to exercise any right, and we will reply within 30 days. If you are in the EEA or the UK you also have the right to complain to your local supervisory authority.

14California

We do not sell personal information, and we never have.

Personalized advertising through AdMob can count as sharing personal information for cross-context behavioral advertising, as California law uses that phrase. The category involved is identifiers, meaning the advertising identifier, together with information about your interaction with an ad. It goes to Google, which uses it to select and measure ads. None of it comes to us.

To stop it, use any of these, which take effect without any account and without contacting us:

• Tap Do not sell or share my personal information on a game's settings screen. The button appears in the US states whose privacy law calls for it, and the choice applies to that game.
• Turn on Opt out of Ads Personalization in Android under Settings, then Privacy, then Ads. It applies to every app on the device. Deleting the advertising identifier there has the same effect and goes further.
• Buy the ad removal in a game, which stops that game requesting ads at all.

We do not use personal information for any purpose beyond what is described in this policy, and nobody is charged a different price, given a worse game, or refused anything for exercising a privacy right. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

15Where data goes

Google processes advertising, purchase and Play Games data, and the optional website account, on infrastructure that may sit outside the country you are playing from, using the transfer mechanisms set out in its own policy. We store no personal data on servers of our own, so there is no transfer of stored personal data on our side to describe.

16Security

This website and the games' network requests are served over HTTPS. No system is perfectly secure, but there is very little here to attack. We run no database holding player data and no archive of anyone's play, so there is nothing of yours to lose in a breach of ours.

17Changes to this policy

We revise this policy when what the games do changes. The date at the top of the page changes with it, and the current version is always published at this address. Continuing to play after a revision takes effect means you accept the revised policy.

18Contact

Questions, requests and complaints about this policy go to support@cygnusworks.com, addressed to Cygnus Works LLC. Put the name of the game in the subject line if it is about one in particular.

• All the games
• Support
• Terms of use