Privacy Policy

Information we process

Spire: Rescue Brigade stores completed rescue operations, game settings and your selected language locally on your device. A randomly generated installation secret is stored in the iOS Keychain. This secret identifies the installation for optional progress synchronization; it is not an account, email address or password.

When the app synchronizes, the backend receives the installation secret over HTTPS and the numbers of completed operations. The database stores a SHA-256 hash of the secret and the completed-operation set, not the secret itself. It does not store your game settings or unfinished-operation state. Cloudflare receives your IP address and technical request information when your device requests the public API or this website, and terminates the public HTTPS connection before proxying requests to our Railway-hosted service. Railway also processes the requests and technical hosting information. The proxy handles the synchronization request, including its authorization header and progress payload, in order to deliver it to the backend. The app does not include advertising or analytics SDKs, collect precise location, or request your name or email address.

How we use information

Local storage lets the game work offline, remember your preferences and show completed operations after reopening. The backend stores completed-operation progress for the same installation and verifies possession of the installation secret before reading, changing or deleting it. Technical request information is processed to deliver and secure the hosted service. We do not use progress for advertising, tracking or building marketing profiles.

Service providers and sharing

Cloudflare provides the public HTTPS reverse proxy for the API and website and processes requests to deliver and protect the service. The backend and this privacy website run on Railway, which processes requests and technical hosting information to operate the service. Completed-operation data and the hashed installation identifier are stored on the service's persistent volume. We do not sell personal information or share progress with advertising or analytics providers. Information may be disclosed where legally required. The public privacy contact email is for privacy inquiries; the app does not send emails or provide an in-app contact form.

Data retention

Local progress and settings remain on the device until you reset them or remove the app's local data. The installation secret is kept in Keychain and may remain after uninstalling the app, depending on iOS behavior. Server progress remains until deletion is requested using that secret or the service's data is removed. Infrastructure log retention is governed by Cloudflare's and Railway's practices; the app does not control their retention periods. The application does not create or manage database backups, and no app-controlled backup copy is retained after deletion. Provider-managed logs or infrastructure copies are not erased by the app's reset request.

Deleting your information

Use the confirmed progress-reset action in Settings to clear local completed-operation progress and request deletion of the matching server record. If the device is offline, the app retains the deletion request locally and retries when connectivity returns; remote deletion is complete only after the server acknowledges it. The backend's authenticated DELETE /progress operation removes the entire progress row for that installation. It does not erase Cloudflare's or Railway's technical logs or provider-managed copies. Keep the installation secret until deletion is acknowledged. If the secret is lost, the app cannot identify, restore or delete that installation's server progress through an account or login, because neither exists.

Permissions and your choices

The app does not request camera, microphone, contacts, photos, location, tracking or notification permissions. You can play the rescue operations offline. Device network settings control connectivity; disabling connectivity prevents synchronization and website requests while local play remains available. The game settings let you change language, sound and haptic preferences and reset progress.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete or restrict processing of information, object to processing, or complain to your local privacy regulator. Completed progress is visible in the app and can be reset using its deletion controls. For a privacy request, contact bertram.pritchard@icloud.com. Please do not email the installation secret. Because we have no accounts or identity directory, we may be unable to locate a particular server record without a request authenticated by the installation secret.

Security

The public API and website use HTTPS to Cloudflare, which terminates TLS and forwards requests over HTTPS to the Railway origin. These infrastructure providers process traffic as part of operating the service. The app stores the installation secret in iOS Keychain, and the server stores only its SHA-256 hash as the database key. Each progress request is scoped to that key; a different installation secret cannot read or delete another installation's progress. The backend validates operation numbers and request sizes, uses time limits and a persistent SQLite database, and does not intentionally log bearer secrets or progress payloads. Possession of the secret grants access to its progress, so do not share it. No storage or transmission method can provide an absolute security guarantee.

Children’s privacy

Spire: Rescue Brigade is intended for players aged 14 and older. It does not offer accounts, chat, advertising or forms collecting children's contact information. If you believe information about a child has been processed inappropriately, contact bertram.pritchard@icloud.com so the concern can be assessed. Do not send a child's installation secret or other unnecessary identifying information by email.

Changes to this policy

This policy may be updated when the game's data handling or hosting practices change. The current policy is available through the Privacy Policy link in Settings and at this website's /privacy address. The effective date at the top identifies this version. Future changes will describe the practices actually used by the application and its backend.