Privacy Policy
Novice Belt Magnet
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Novice Belt Magnet stores campaign progress, best mistake counts, completed orders with dates, preferences, a paused round, local daily fallback history and unsent server daily results on your device. On iPhones, a randomly generated installation secret is stored in the iOS Keychain and is not an account or your name. Daily requests send the requested UTC date. When you play a server-provided daily order, the app sends its date, mistake count and whether you won using the installation secret in an HTTPS authorization header. Results for the labelled local daily fallback remain on your device and are not uploaded as server challenges. The server stores a SHA-256 hash of that secret with the daily result and update time, rather than the secret itself. Our Railway hosting infrastructure receives network information such as IP addresses and request metadata when you access the API or this website. We do not ask for your name, email, location, contacts, photos or payment details. The app contains no advertising or analytics SDK.
How we use information
Local data supports offline campaign play, progression, settings, your order collection and resuming a paused shift. Server data provides consistent daily game configurations, saves and returns the daily history for the installation authorized by its secret, and permits deletion of that installation's results. A temporary in-memory rate limiter uses network and installation identifiers to protect availability. Notifications, if enabled, remind you about the daily order locally on your device. No server sends email or push notifications.
Service providers and sharing
The backend and PostgreSQL database are hosted on Railway, which processes requests, service logs and stored data as infrastructure provider. No separate advertising, analytics, social sign-in or email delivery service is integrated. The app communicates with its configured HTTPS backend and opens this public policy in your browser. Apple provides iOS system features including Keychain and local notifications. We do not sell your data or share game results publicly. We may disclose information where legally required. Infrastructure providers may maintain operational logs under their own practices; we have not established a fixed retention period for those logs.
Data retention
Local progress and completed orders remain until you reset them or remove the app's local data. The installation secret uses a device-only Keychain accessibility setting; iOS can retain Keychain items after uninstalling, so reinstalling is not a reliable server deletion method. Server daily results remain until an authorized deletion request; the current service has no automatic expiry. Daily configurations are game content and may be retained independently of player results. The rate limiter keeps temporary entries in process memory and removes or replaces them as windows expire. No application-managed backup job is configured. Railway may retain infrastructure backups or logs according to its service practices; deletion from the active database does not promise immediate removal from any such retained copies. Local save files may also be included in iOS device backups according to your device settings. The device-only Keychain secret does not migrate through those backups, so restoring local progress does not guarantee access to server history.
Deleting your information
Settings offers Reset all progress with confirmation. While online, it first deletes all daily results authorized by your installation secret from the active server database, then clears local campaign data, collection, paused shift and queued results, cancels reminders and removes that Keychain secret. If server deletion fails, the reset is not reported as successful and your local data remains so you can retry. Removing the app does not itself request server deletion. We cannot recover or authorize access to installation history after its secret is lost. Requests sent to the privacy contact are handled outside the app; there is no account-based recovery.
Permissions and your choices
The only optional permission is local notifications, requested when you enable the daily reminder in Settings. You can disable the reminder in the app, which cancels its scheduled notification, or withdraw notification permission in iOS Settings. The game needs no camera, microphone, photo library, contacts or location permission. It uses internet access for the daily service and deletion, while the campaign and an explicitly labelled local daily fallback work offline.
Your privacy rights
You can view your local records and installation daily history in the app and delete them through Settings. You may have additional access, correction, deletion, restriction or objection rights depending on your jurisdiction. Contact pavlovskakateryna9@gmail.com for privacy questions or requests. This address is a public privacy contact, not a required registration field. Because we do not collect a personal identity, locating a specific installation's server records requires a verifiable authorized request from that installation; do not send your secret by email.
Security
The app uses HTTPS, stores its unique random installation secret in the device-only iOS Keychain, and sends it only in an authorization header, never in a URL. The server hashes installation secrets, validates requests, uses parameterized PostgreSQL queries and restricts private history, result writes and deletion to the presented installation authorization. The app's local save is written atomically with iOS file protection. Application logs do not intentionally include authorization headers, request bodies or client URLs. No system can guarantee absolute security, and infrastructure logs remain subject to the hosting provider's controls.
Children’s privacy
The game is designed for casual players aged 12 and older and is not specifically directed to children under 12. It does not request personal profiles or contact information. If you believe a child has supplied personal information through a privacy enquiry, contact pavlovskakateryna9@gmail.com so the issue can be reviewed.
Changes to this policy
We may update this policy when the game's processing or hosting changes. The effective date at the top identifies the current version. Updated policy text is published at this public privacy address and remains accessible from Settings in the app. Material changes will be described in the updated policy and, where required, communicated within the app.