Privacy Policy

Last updated: 2026-09-02

This Website and Application are owned and operated by OFT Games LLC, a Georgia, USA limited liability company.

Who we are

Cyclogram is published by OFT Games LLC. For privacy questions, requests, or to exercise your rights, contact privacy@otfdp.com.

The short version

If you never sign in, we never receive your data. Cyclogram plays entirely on your device. Your puzzles, progress, energy and settings are stored locally, and nothing is sent to our backend unless and until you choose to create an account. Signing in is optional and is not required to play.

The exceptions, which apply whether or not you sign in, are advertising, purchases, and a check for app updates — all handled by third parties, all described below.

What we collect

Nothing reaches our backend. The following is stored only on your device and is removed when you uninstall the App:

Puzzle progress (boards started, boards solved, best times, the daily cyclogram)
Cells collected and which pictures they have unlocked
Energy balance and the timestamp used to calculate refills
Entitlements from any purchases you have made
Settings (sound, haptics, theme, tutorial completion)

We cannot see any of it, and we cannot recover it for you if the device is lost.

Signing in with Apple or Google creates an account with our backend provider (Supabase), identified by a randomly generated UUID together with the identifier your provider gives us. From Apple this may be a private relay email address rather than your real one, depending on the choice you make in Apple’s sheet.

Once signed in, the local data listed above is copied to our backend so it survives a lost or replaced device. Where local and account data disagree, they are combined as follows:

Entitlements (packs, ads removed) — combined, so you keep everything you have paid for
Progress (cells, trophies, tutorial state) — you choose which to keep
Energy — always the lower of the two balances

That last rule is deliberate, and we would rather explain it than have it look like a bug: energy is spendable currency, and taking the higher balance would let anyone repeat sign-out and sign-in for free energy.

Advertising identifiers

Cyclogram shows ads through Google AdMob. On iOS and Android, AdMob may read your device’s advertising identifier (IDFA on iOS, GAID on Android) to deliver and measure ads.

AdMob also sees the IP address your device connects from, and uses it to estimate roughly which area you are in — city level or broader — so that the ads shown are not wholly unrelated to where you are. This is an estimate drawn from the connection itself. We never receive it, and the App has no location permission and no way to locate you.

On iOS, we ask your permission first through Apple’s App Tracking Transparency prompt. In the European Economic Area, the UK and Switzerland, we present Google’s consent form on first launch. You may decline or withdraw consent at any time — ads will still be shown, but they will not be personalized, and the game is otherwise identical.

Purchases

In-app purchases — picture packs, energy, and removing interstitial ads — are processed by the Apple App Store or Google Play. Your payment details are handled entirely by Apple or Google and are never seen or captured by us. We receive only:

A transaction identifier confirming the purchase succeeded
The product identifier purchased

We ask you to sign in before your first purchase. This is so that what you buy is attached to an account rather than to a single device — particularly energy, which the app stores cannot restore to you if the device is lost. If an entitlement does reach the App without an account, for example through the store’s own restore function, it is stored locally and combined with your account the next time you sign in.

App updates

On launch, the App asks Expo’s update service whether a newer version of its code is available. That request necessarily reveals your device’s IP address and the version and platform you are running to Expo, which hosts the update. It carries nothing about you, your progress or your account, and it happens whether or not you are signed in.

What we do not collect

Your name, email, postal address or phone number, unless you sign in with Apple or Google
Your contacts, photos, microphone, camera, or precise location, ever. The App never asks for location permission and cannot see where you are
Any data from outside this App

How we use what we collect

Purpose	Data used
Saving your progress across devices and reinstalls	Account identifier and game state
Showing ads	Advertising identifier, consent state, ad interactions
Granting what you have bought	Transaction identifier, product identifier

We do not sell personal data. We do not share data with third parties except as listed below.

Third parties

The App relies on these services, each with its own privacy policy:

Supabase (backend storage and authentication, for signed-in players only) — https://supabase.com/privacy
Expo (checking for app updates on launch) — https://expo.dev/privacy
Google AdMob (advertising) — https://policies.google.com/privacy
Apple App Store (iOS purchases, distribution, Sign in with Apple) — https://www.apple.com/legal/privacy/
Google Play (Android purchases, distribution, Google Sign-In) — https://policies.google.com/privacy

Your rights

Depending on your jurisdiction, you may have the right to:

Access the data we hold about you
Correct inaccurate data
Delete your data (“right to be forgotten”)
Export your data in a portable format
Object to processing for direct marketing or analytics
Withdraw consent for advertising at any time

To exercise any of these rights, email privacy@otfdp.com describing your request. We will respond within 30 days. If you have never signed in, we hold no data about you and there is nothing for us to retrieve or delete — uninstalling the App removes everything.

You can also:

Disable personalized ads at any time through Settings → Privacy options (EEA, UK and Switzerland), or by revoking tracking permission in iOS Settings → Privacy & Security → Tracking
Reset your advertising identifier in your device’s settings

California Residents (CCPA / CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

The right to know what personal information we collect, use, and disclose
The right to delete your personal information
The right to opt out of the sale or sharing of your personal information. We do not sell or share your personal information as those terms are defined under CCPA / CPRA.
The right to non-discrimination for exercising your privacy rights

To exercise your California privacy rights, contact us at privacy@otfdp.com.

Our legal basis for processing is:

Performance of a contract (delivering App features you use)
Consent (for personalized ads, where required)
Legitimate interest (for non-personalized service operation)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the GDPR, including:

Right of access (Article 15) — you may request, in writing, a copy of the personal data we process about you.
Right to rectification (Article 16) — you may request, in writing, correction of inaccurate personal data.
Right to erasure (Article 17) — you may request deletion of your personal data, in writing, subject to applicable exceptions.
Right to restrict processing (Article 18) — you may request, in writing, that we limit how we use your data. We are not obligated to comply with such requests and you may opt not to use the Service.
Right to data portability (Article 20) — you may request your personal data in a structured, commonly used, machine-readable format. Such requests must be made in writing.
Right to object (Article 21) — you may object, in writing, to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw consent in writing at any time.

To exercise these rights, contact us at privacy@otfdp.com. We will respond within 30 days (or within the timeframe required by applicable law). You have the right to lodge a complaint with your local data protection supervisory authority.

International Data Transfers

We store and process data in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. By accessing and using this Service, you agree to this data transfer provision.

Children

Our Application and Website are not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13.

If we learn at any time that we have been providing services to or have collected the information of a child under 13, we will immediately destroy this personal information unless we are legally obligated to retain such data. Please email us at privacy@otfdp.com if you believe that we have unintentionally collected the information of a child under 13.

We encourage parents and guardians to observe, participate in, and monitor their child’s online activity.

Security

Data in transit between the App and our backend is encrypted via HTTPS. Data at rest in our backend is encrypted by the provider (Supabase). Access to account data is restricted at the database level so that an account can only ever read and write its own rows.

Sign-in is handled by Apple and Google. We never see, receive or store a password.

No system is perfectly secure. While we implement reasonable security measures, we cannot guarantee absolute security.

Data retention

If you have not signed in, we retain nothing, because we never received anything. Uninstalling the App removes all local data from your device.

If you have signed in, your account data is retained while the account exists. Uninstalling the App does not delete it — that is the point of having an account, since it lets you return on a new device. To remove it permanently, use the in-app deletion option (Settings → Account → Delete my account) or email privacy@otfdp.com.

Account Deletion

You may delete your account at any time:

In the app: Settings → Account → Delete my account
By email: contact us at privacy@otfdp.com

Deletion is permanent and removes your progress, entitlement records and account identity from our backend. Purchases themselves are held by Apple or Google, not by us, and can be restored through the store on a future install.

Cookies

We do not use cookies.

Changes to this policy

We may update this policy from time to time. Material changes will be surfaced in the App on next launch. The “Last updated” date at the top reflects the most recent revision.

Governing Law and Dispute Resolution

These Terms are governed by the laws of the State of Georgia, United States, without regard to conflict of law principles.

Any dispute arising from these Terms or your use of Cyclogram shall first be attempted to be resolved through good-faith negotiation. If negotiation fails, disputes shall be resolved through binding arbitration administered by the American Arbitration Association in accordance with its Consumer Arbitration Rules. The venue of arbitration shall be Savannah, Georgia. The arbitrator’s decision shall be final and binding.

Class Action Waiver: You agree that any dispute resolution proceedings will be conducted on an individual basis only, and not in a class, consolidated, or representative action.

Small Claims Exception: Notwithstanding the above, either party may bring an individual action in small claims court in Chatham County, Georgia.

International Users: If you reside in the European Union, European Economic Area, United Kingdom, or any other jurisdiction where mandatory consumer protection laws apply, nothing in this section limits your rights under those laws. You may bring claims in your local courts if required by applicable mandatory consumer protection legislation, and any mandatory statutory consumer rights in your jurisdiction are not waived by these Terms.

Contact

privacy@otfdp.com