Privacy policy

1. Who we are

Lightlock, Twintangle and Punchfold are made and published by Ishan Jayman, trading as Raa Studio, based in Colombo, Sri Lanka. In data-protection terms we are the controller of the information described here.

2. What the games send us

This is the complete list. It is drawn from the database schema rather than written from a template, so if something is not here, we are not storing it.

A random device identifier

A UUID the app generates the first time you open it. This is not your device's advertising identifier, not your IDFA, and not anything Apple or Google assigns — it is a random number that means nothing outside our database. It is how your progress finds its way back to you without an account.

Country

A two-letter country code taken from your device's region setting. Not your city, not your coordinates, not your IP-derived location.

Game Center or Google Play Games ID — only if you sign in

If you choose to sign in, we store the player identifier your platform gives us, so your progress survives a new phone. We do not receive your real name, email address or friends list.

What happened in a game

Per level: whether you solved it, how many moves you used, the par, stars earned, how long the attempt took, how many continues or hints you used, and your app version. Per player: current level, combo streak, coin balance, trophies.

Move logs

The sequence of moves you made. We keep this for two reasons: the server replays it to work out what you actually earned rather than believing the app, and it lets us show you a past solve. We keep the log for ranked runs and for a short rolling audit window; for ordinary campaign runs the log is discarded once the result is validated.

Coin movements

Every change to your coin balance with a reason — level reward, daily reward, continue, hint, skip, ad reward, purchase — and a reference such as a run identifier or a purchase transaction identifier. This is what lets us explain a balance and stop the same reward being credited twice.

A display name — only if you choose one

Optional, and only needed to claim a place on a public leaderboard. If you set one, it is public. Everything else stays private to your account. Do not use your real name if you would rather not be identified.

Your IP address, briefly

Like any website or API, ours receives your IP address as part of the connection. Cloudflare sits in front of our server and uses it for routing and abuse protection. We do not store it in our database alongside your play data.

3. What we do not collect

Worth stating explicitly, because a lot of mobile games do collect these:

• No analytics SDK. No Firebase Analytics, no Amplitude, no Mixpanel, nothing of that kind. We considered Firebase and decided against it.
• No crash-reporting SDK. No Crashlytics or Sentry in the shipped apps.
• No advertising identifier collected by us, and no cross-app or cross-site tracking by us. See section 5 for what Google's ad SDK does on its own account.
• No contacts, photos, camera, microphone, calendar, or precise location. The apps do not request these permissions.
• No name, email address, phone number or postal address — unless you email us, in which case we obviously have your email address.
• No purchase of data about you from anyone, and no sale of your data to anyone. We have never done this and have no plans to.

4. Why we hold any of it

Under the GDPR and equivalent laws we need a lawful basis for each purpose. Ours:

• To run the game you asked to play — saving progress, restoring it on a new device, keeping your coin balance correct. Basis: performance of a contract with you.
• To make sure scores are real — replaying submitted move logs so a leaderboard means something, and identifying accounts that cheat. Basis: our legitimate interest in a fair game, balanced against the fact that the data is gameplay rather than anything sensitive.
• To show leaderboards — only with the display name you chose to set. Basis: your consent, given by setting a name, and withdrawable by clearing it.
• To show ads — see section 5. Basis: consent where the law requires it for personalised advertising, and legitimate interest for non-personalised ads.
• To honour purchases — crediting coins against a transaction reference, once. Basis: performance of a contract.

5. Advertising

The games show rewarded ads — the ones you can choose to watch to continue a level. These are served by Google AdMob. Google acts as an independent controller of the data its SDK collects, which typically includes your device's advertising identifier, IP address, device type and interactions with the ad. We do not receive that data; we only learn that an ad was watched, so we can credit the reward once.

How Google uses it is described in Google's privacy and terms.

6. Purchases

Coin packs are bought through the App Store or Google Play. Those stores handle the entire payment. We never receive or store your card number, billing address or any payment credential.

What we do store is the transaction identifier the store gives us, so that a given purchase credits coins exactly once even if the network drops halfway through. Apple's and Google's own privacy policies cover what they do with your payment information.

7. Where your data lives

• Our database runs on a single server hosted by Hetzner in Virginia, United States.
• Cloudflare sits in front of it and serves cached, identical-for-everyone content — level packs, configuration — from roughly three hundred locations worldwide.
• Backups are encrypted and stored in Cloudflare R2.
• We are based in Sri Lanka, so our staff access to the database happens from there.

If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside it. Where we rely on processors for that, transfers are covered by the European Commission's Standard Contractual Clauses, which both Cloudflare and Hetzner offer as part of their data-processing terms.

8. How long we keep it

• Your player record, progress and coin balance — for as long as the account exists. If you do not play for a long time we may delete inactive accounts; we will not do so without at least 30 days' notice where we have a way to reach you.
• Move logs for ordinary campaign runs — discarded automatically after a short audit window once the run has been validated.
• Move logs for ranked and daily runs — kept while that leaderboard period is live and for a period afterwards so results can be re-checked if a score is disputed.
• Daily leaderboard tables — stored by day and dropped wholesale as they age out.
• Backups — rotated on a schedule, so deleted data can persist in a backup for a short period after deletion before ageing out naturally.

9. Your rights

Depending on where you live, you have some or all of the following rights. We honour all of them for everyone, regardless of where you are, because maintaining two standards would be more work than maintaining one.

• Access — ask for a copy of what we hold about your player record.
• Correction — have inaccurate information fixed.
• Deletion — have it all removed. See section 10.
• Portability — receive your data in a machine-readable format.
• Objection and restriction — object to processing we base on legitimate interests.
• Withdraw consent — for example by clearing your display name, or changing your ad-tracking choice.
• Complain — to your local data-protection authority if you think we have got this wrong. We would rather you told us first so we can fix it.

Email hello@raastud.io. We will reply within 30 days. There is no charge. Because accounts are anonymous by design, we may need you to prove you control the device or signed-in account in question — usually by sending the request from the app or confirming your player identifier.

10. Deleting your data

Email hello@raastud.io with the subject "Delete my data" and include your player identifier if you can find it (it is shown in the game's settings screen). We will delete your player record and everything attached to it — progress, coin ledger, run history, move logs and leaderboard entries — within 30 days, and confirm when it is done.

Two honest caveats. Encrypted backups rotate on a schedule, so a deleted record can survive in a backup for a short period before ageing out. And where we are required to keep a minimal record — for example a purchase reference needed for tax or refund purposes — we keep only that, and nothing that identifies how you played.

11. Children

These games are suitable for a general audience, but they are not directed at children under 13, and we do not knowingly collect data from them. We do not ask for age, so we have no reliable way to detect this on our own.

If you are a parent or guardian and believe a child under 13 has been playing and has a record on our server, email hello@raastud.io and we will delete it promptly.

12. Security

• All traffic between the games and our server is encrypted with TLS.
• Sessions use signed tokens rather than stored passwords — there is no password to leak, because there is no password.
• The database is not reachable from the public internet; it publishes no port outside the server.
• Applications sharing our hardware are isolated from one another on separate private networks, and that isolation is verified by a script on every deployment rather than assumed.
• Backups are encrypted before they leave the machine.

No system is perfectly secure. If you find a vulnerability, please tell us at hello@raastud.io before disclosing it publicly, and we will work with you.

13. Changes to this policy

If we change this policy we will update the date at the top. If a change is significant — a new category of data, a new recipient, a new purpose — we will say so in the app before it takes effect, not quietly.

14. Appendix: what we declare to the stores

Apple's privacy labels and Google Play's Data safety form ask the same questions in different words. This is what we declare, so you can check it matches what you read above.