Privacy Policy

Information we process

Mini Chart Boss stores your game progress, current round, earned stars and preferences on your iPhone. A random installation identifier and a random backup access secret are stored in the device Keychain. No account, name, email address, location, contacts or advertising identifier is required.

If you choose to back up, the service receives that identifier, access secret and game snapshot over HTTPS. It stores an encrypted snapshot, a hash of the secret, the random identifier and a last-save timestamp. Your snapshot includes language, audio, haptic, motion and telemetry preferences. Optional anonymous gameplay statistics contain only level number, turns and outcome. The server immediately combines these into counts and turn totals; it does not store individual telemetry events or attach installation identifiers to them.

Connections to the public service and privacy website expose network information such as IP address and request metadata to Railway. The application service temporarily uses client network addresses in memory to limit requests. Application error logs contain request identifiers and generic error codes, not backup secrets or snapshots.

How we use information

Local storage lets you play offline and resume your game. Optional backup lets you save or restore the snapshot associated with your installation secret, and the secret authorizes access and deletion. Optional aggregate statistics help assess level difficulty. Network metadata is used to operate, secure and diagnose the service. We do not use the information for advertising, tracking across apps or selling personal information.

Service providers and sharing

The backend and public privacy website are hosted by Railway, which processes service traffic and stores the encrypted database on a persistent volume. Railway may process infrastructure and network logs under its own service practices. This application does not set a separate retention period for Railway infrastructure logs. No advertising network or third-party analytics SDK is included.

If you export your backup access file or choose a destination in the system file interface, that destination may receive the access credentials. Anyone who obtains those credentials can access or delete your associated backup. Sharing the file is your choice; the app does not send email or provide a support submission form. Disclosure may also occur when required by applicable law.

Data retention

Local progress remains on your device until it is reset or removed. Keychain data follows Apple's device and Keychain behavior and may have a different lifecycle from app files. The server retains the latest encrypted backup and its authorization hash until you request deletion; saving again replaces the previous snapshot. We have no scheduled expiry for the backup.

Anonymous aggregate level totals may be kept for balancing and cannot be separated into a particular player's events. The application does not create separate database backup copies. Railway-managed infrastructure, snapshots or other recovery copies, if present, follow Railway's applicable retention and removal processes; we do not promise immediate erasure from provider-managed copies. Files you export remain at your chosen destinations until you remove them.

Deleting your information

Use Delete server data in Settings to remove the encrypted snapshot, installation identifier, authorization hash and saved timestamp from the active application database. This requires your installation secret and an internet connection; the app reports failures rather than claiming deletion succeeded. Deleting a cloud backup does not reset your local game. You can create a new backup with the same credentials afterward.

Use the game's local reset control to clear local progress. Delete exported access files from their destinations separately. If you lose the secret, the service cannot guarantee recovery or verify a request for that particular backup. Anonymous aggregate statistics contain no installation link and cannot be selectively removed by installation. For privacy requests, contact the address shown below; do not include your backup secret.

Permissions and your choices

The game requires no access to location, photos, contacts, camera or microphone. Backup and restore are optional and require a network connection; the main game works offline. Anonymous gameplay statistics are disabled by default and can be enabled or disabled in Settings. Turning them off stops future submissions and does not reverse totals already aggregated. You can change language, music, sound, haptics and reduced motion locally. Exporting or importing backup credentials uses the system file interface and occurs only when you choose it.

Your privacy rights

Depending on the law that applies to you, you may have rights to access, correct, delete or restrict processing of your information, or raise a concern with a privacy authority. The app provides controls to back up, restore, reset local progress and delete its cloud backup. You can contact the privacy address below for questions or requests. We may need enough information to verify a request without exposing another person's data. We do not collect an email-based account and cannot reliably identify a backup from an email address alone. Never email your installation secret.

Security

Public app-to-server requests use HTTPS. Backup snapshots are encrypted at rest with AES-256-GCM using a server-only key. The service stores a hash of the high-entropy installation secret and checks authorization independently for reads, updates and deletion. The client keeps its secret in the device Keychain. Inputs and payload sizes are validated and requests are rate limited. These measures reduce risk but do not guarantee absolute security.

An exported backup access file contains the secret in readable form so it can be imported on another device. Protect that file as you would a password. Loss of the device secret or exported copy can make restoration impossible; exposure can allow someone else to access or delete the backup.

Children’s privacy

Mini Chart Boss is intended for a general adult casual-game audience and is not directed specifically at children. We do not ask for a birth date or knowingly request children's personal information. If you believe a child has provided personal information through this service, contact the privacy address below so the concern can be assessed. The game does not include advertising or purchases.

Changes to this policy

This policy may change when the game's storage, optional online features or service practices change. The effective date at the top identifies the current version. The current policy is available from Settings and at this public address without signing in. Review it when you use new online features. Material changes will be reflected in the updated policy and, where appropriate, the app's release information.