Privacy
What we hold, and what we chose not to.
Updated September 27, 2026 · In effect from September 27, 2026
The short version
There is no email address or password on a Cantle account. We hold an anonymous ID, the display name you pick, your results, and whether you have Pro. There is no advertising in the game and no third-party analytics in it either. Nothing we collect is used to track you across other apps or websites.
If you want it all deleted, the fastest way is Settings → Delete account & data, at the bottom of Settings in the app. It takes effect on our server at once. If you cannot reach it, write to [email protected] with your friend code.
Who is responsible
- Controller
- ФОП Галас Юрій Володимирович (Halas Yurii Volodymyrovych, sole proprietor)
- Registered address
- Ukraine. The full registered address is shown on the App Store and Google Play listings, which show it for every trader, and we will send it on request to [email protected].
- Contact
- [email protected]
What we collect
| What | Specifically | Why | Kept |
|---|---|---|---|
| Account | An anonymous ID generated on your device, a friend code, the display name you choose, a four-character tag that tells you apart from anyone with the same name, a sign-in token (stored only as a one-way hash), your platform (iOS or Android), the app version you last opened, and the days your account opened the app (dates only, to count daily players) | So your account, progress and purchases survive reinstalling the app | While the account exists |
| Avatar | The color, symbol and wallpaper you pick for yourself (a set of choices, not a picture you upload) | So other players see the mark you chose next to your name | While the account exists |
| Preferences | Who may send you friend requests and duels, and which reminders you accept | So the server can respect them before anything reaches you | While the account exists |
| Recovery code | A one-way hash of a one-time code, issued only when you ask for one, that moves your account to another phone | Getting your account onto a new device | Until it is used, or a new one replaces it |
| Results | Which board you played, how long you took, how many moves, whether it was flawless, and when you submitted; your current and best streak | Leaderboards, your own history, and what your friends see | Your history: while the account exists. Leaderboard rows: see How long we keep it |
| Progress backup | Practice counts and times, streak bookkeeping (longest run, freezes), which achievements you have earned and when | So your record survives a new phone | While the account exists |
| Friends and blocks | Who you have added, requested or blocked, with dates and the counters that limit repeated requests. Capped at 100 friends and 200 blocks; a blocked player is never told | The friends feature, and keeping blocked players off your leaderboards and out of your requests, duels and invites | Until either account is deleted. Removing a friend or unblocking ends the link, but the dated record of the two accounts stays until then |
| Duels | Who played whom, the board, each side’s time and moves, and the result | Running the duel and the record between the two of you | Unplayed invitations are deleted a week after they expire. Played duels are kept; see How long we keep it |
| Pro | For each Pro purchase: the store, the product, the store’s transaction number, and when it started and ends. No receipt and no payment details. One-time items (themes, symbol sets, wallpapers) are not recorded on our server at all | To give you Pro on every device you use | While the account exists |
| Device check | A one-way hash of a random value the app makes for itself on your phone (not an identifier the phone or its operating system knows), sent only when a result goes to a leaderboard. Android versions before 1.0.6 used the identifier the operating system gives the app; the current version no longer reads it. The server salts and hashes the value on arrival and never keeps the original | So one person cannot take several places on the same board | Deleted once it is 48 hours old, by a clean-up that runs every two days, whether or not you ask |
| Network address | The IP address your device connects from. Cloudflare, which sits in front of our server, sees it; our server uses it in memory for about a minute and does not store it | Rate limiting and protection against abuse | Not stored by us |
| Notifications | A push token, whether the device is iOS or Android, its language, its time zone and your quiet hours — only if you turn notifications on | To send the notifications you asked for, in your language and not at night | Until you delete your account, or until the push service tells us the token no longer works. Turning notifications off stops them, but does not remove the token |
| Crash reports | The error, the stack trace, your platform and app version, and your anonymous ID when the app was signed in | So a fault affecting many players is visible to us at all | 30 days |
| Reports | Reports about a display name or a time: who reported whom, the name as it read then, and the board and place it was seen on | Moderating names and leaderboards | Until the report is dealt with, or either account involved is deleted. A short record of each moderation decision is kept; see How long we keep it |
| Messages to us | Your email address and whatever you wrote | To answer you | 12 months |
What other players see. On a leaderboard: your display name, tag, avatar, result (time, moves, whether flawless) and whether you have Pro. Your friends also see your friend code, your streaks, today’s results and your duel record with them. A duel opponent sees your name, tag, avatar and result. Your anonymous ID is never shown on a leaderboard; the app receives it only for your friends, for players with a pending friend request between you, and for your duel opponents.
What stays on your phone
Your settings — language, board look, sound, haptics — stay on the phone and are never sent to us, except the language, time zone and quiet hours that go with notifications, described above. The nicknames you give friends are visible only to you and never leave the phone.
On phones that support it, the app asks the operating system for an age range (never a date of birth). The answer stays on the phone. It decides whether you can type your own display name, and whether friend requests from leaderboards are allowed.
What we do not collect
This list is as much a part of the policy as the one above.
- No email address and no password: there is no such field on an account.
- No real name, phone number, postal address or date of birth.
- No location.
- No access to your contacts, photos or files.
- No advertising identifier. There is no advertising in the game.
- No third-party analytics, and no attribution or marketing SDK. None is built into the app.
Crash reports go to our own server rather than to a crash-reporting vendor, so that data stays on infrastructure you have already trusted with your scores.
Nothing we collect is used for tracking, in the sense Apple’s App Tracking Transparency framework defines it. We never link it to data from other companies for advertising, and we never sell it.
Legal basis
Where the GDPR applies:
- Contract: running your account, your results, your friends and duels, and your purchases.
- Legitimate interests: keeping the service up, fixing crashes, and stopping cheating and abuse.
- Consent: push notifications, which you turn on yourself and can turn off at any time.
Who else sees it
We do not sell personal data and we do not share it for advertising. These are the companies that process some of it on our behalf:
| Who | For what | Where |
|---|---|---|
| Apple | Distributing the app and taking payment; on iPhone, delivering push notifications | US and worldwide |
| Distributing the app and taking payment; on Android, delivering push notifications (Firebase Cloud Messaging) | US and worldwide | |
| RevenueCat | Checking purchases with the stores. It receives your anonymous ID as the customer ID, together with your purchase history | US |
| DigitalOcean | The server the game talks to, and weekly copies of it | Frankfurt, Germany |
| Cloudflare | The network in front of our server, this website, our DNS, backups, and mail sent to the addresses on this site | EU and worldwide |
| Expo | Delivering push notifications, if you turn them on: the push token and the text of each notification pass through its service on the way to your device | US |
| Google or Apple | One anonymous connectivity check when our server does not answer — a plain request to a standard reachability address (gstatic.com or captive.apple.com), the same ones your phone’s operating system contacts whenever it joins a network; no cookies, nothing about you or your game | worldwide |
Where it lives
The game server and its database are in Frankfurt, Germany. Backups of the database are kept with Cloudflare and DigitalOcean and replaced as they age; a backup is kept for up to 30 days.
Apple, Google, RevenueCat and Expo are in the United States, so purchase data — and, if you turn notifications on, push data — reaches them there. Each relies on the safeguards set out in its own data protection terms: the EU–US Data Privacy Framework where the provider is certified under it, and the European Commission’s Standard Contractual Clauses otherwise or in addition. We do not restate those terms here, because a provider can change which mechanism it relies on without telling us; the version each publishes is the one that applies.
How long we keep it
Retention is given per category in the table above. Deleting your account in the app takes effect on our server immediately; a request by email is carried out within 30 days. Either way we delete your ID, display name, tag, avatar, preferences, friend code, sign-in token, any recovery code, your history and synced progress, platform and app version, the days you opened the app, your friends, requests and blocks, your Pro record, your notification token and settings, and every report you filed or that was filed about you. Crash reports lose their link to you at once and are gone within their 30 days.
A few things stay, without anything that points back to you:
- Leaderboard rows. Your times stay on the boards they were set on, as an anonymous row with no name, tag or ID, so that nobody else’s place changes. Boards older than 180 days keep only their top 100 rows.
- Played duels. Your opponent keeps their result; your side of it becomes anonymous. A duel still open is deleted.
- The device check. It was never attached to an account, and it is deleted on its own 48-hour schedule.
- Moderation records. If a moderator acted on your name or on a report, a short record of that decision is kept, and it may include the name involved. A name a moderator removed is kept on the list of names that cannot be used again.
- The stores and RevenueCat. Apple, Google and RevenueCat keep their own records of purchases; RevenueCat’s is filed under your anonymous ID.
- Backups. A deleted account is not restored from a backup, and backups age out within 30 days.
Security
Traffic between the app and the server is encrypted in transit. The server accepts connections only through Cloudflare and only on the ports it needs, and access to it is restricted to keys we hold. Backups travel over encrypted connections.
We hold no payment details at any point: card numbers go to Apple and Google and never reach us.
Children
Cantle is not intended for anyone under 13. Where the law you live under sets a higher age for consenting to the processing of personal data, that higher age applies instead. We do not knowingly collect anything from a child below it. If we learn that an account belongs to one, we delete the account and everything tied to it. If you think a child in your care has an account, the quickest route is Settings → Delete account & data on their phone; otherwise write to [email protected] and we will remove it.
Your rights
Wherever you live, write to [email protected] to get a copy of your data, correct it, or have it deleted. Deletion is also a button in the app (Settings → Delete account & data, at the bottom), and that is the fastest route. The page at cantle.app/delete walks through it step by step. Include your friend code, or we cannot tell which account is yours. That code says which account you mean; it does not prove the account is yours, because friend codes are made to be shared. Before deleting anything we may ask for something only the account holder would know, and if we cannot establish that, we will say no rather than destroy someone else’s account. We reply within one month, which is the period the GDPR allows. If a request turns out to be complicated we may need longer, and we will say so inside that month.
European Union, EEA and United Kingdom
The GDPR gives you rights of access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time, which does not affect what was done beforehand.
You can also complain to your national supervisory authority. We have not appointed a representative in the Union under Article 27 of the GDPR. Send any request from the EU to [email protected], and it is answered in the same time as any other.
The trader details required by the Digital Services Act appear on our App Store and Google Play listings.
United States
California. Under the CCPA as amended by the CPRA you may ask what we collect, ask us to delete it, ask us to correct it, and you will not be treated differently for asking. We do not sell or share personal information as the CCPA defines those words. There is no advertising in the game and no third-party analytics in it.
Other states. Virginia, Colorado, Connecticut, Utah and a growing list of others give comparable rights. We handle every such request the same way, whichever state you write from.
Children. Cantle is not directed to children under 13, and we do not knowingly collect personal information from them. If we find that we have, we delete it.
Ukraine
Personal data is processed in accordance with the Law of Ukraine “On Personal Data Protection”. You have the right to know who holds your data and why, to see it, to have inaccurate data corrected, and to have it deleted, and you may apply to the Ukrainian Parliament Commissioner for Human Rights.
Changes
If this policy changes we update the date at the top. For anything material we will say so in the app before it takes effect.