Coreline Privacy Policy
Coreline is a puzzle game. There is no advertising, no third-party analytics and no third-party tracking of any kind. You can play all of it without an account: signing in to Google Play Games is optional and unlocks nothing.
Almost everything stays on your device. Four things leave it, and this policy explains exactly what each one sends: your progress backup, your Daily Core result, feedback you choose to write, and, if you are signed in to Play Games, your achievements. The first three go to a server run by the developer and to nobody else. The fourth goes to Google.
What stays on your device
Your progress is stored on your phone: cores charged, scores, best runs, streaks, the codex, your theme and your settings. So is a small on-device record of attempts, burnouts and rewires, which is used only to tune the game's difficulty. None of it leaves the device unless you use one of the three features below.
Backing up your progress
So that a lost or replaced phone does not cost you the campaign, the game backs your progress up automatically after you charge a core. This starts on its own, the first time you finish a core, without asking. You do not have to turn it on and there is no separate account.
- It sends the progress data listed above to a server operated by the developer. That includes the on-device difficulty record, because it travels with your save.
- It is stored under a recovery code that the app generates for you. The server keeps only a one-way hash of that code, never the code itself, so the save can be returned to whoever presents the code and to nobody else.
- The recovery code is shown to you in Settings. It is the only way to restore a save, so keep it if you want that ability.
- A save stays on the server until you ask for it to be deleted. It is overwritten each time it is backed up, and it is not otherwise expired.
- No name, email address, phone number, contacts, location or advertising identifier is ever sent or stored.
The Daily Core
If you play the Daily Core, the game sends that day's date, your score and how long you took, so it can tell you how you compare with other players.
- It is sent with a pseudonymous identifier: a random value created on your device the first time it is needed, then hashed. It is not your device ID, not an advertising ID, and it is not linked to your backup or to you.
- It cannot be used to identify you, and it is not shared with anyone.
Sending feedback
If you write a message in Settings and tap send, the game sends that message, which build of the app you wrote it on, and the pixel size of your screen.
- Nothing is sent unless you write something and tap send. Unlike the backup, this never happens on its own.
- No name, email address, recovery code, device identifier or progress data is attached. There is no way to reply to you, and no way to tell which messages came from the same person.
- It is stored so the developer can read it and fix what you reported. Nothing in the app or on the server can read a message back out, so what you write is never shown to another player.
Google Play Games
The game can show achievements through Google Play Games. This is optional and gates nothing: every core, every district, every spark and the whole codex work signed out, and the game never asks you to sign in to play.
- If your device signs you in to Play Games, Google receives that you played this game and which achievements you have earned. That exchange is between you and Google under Google's own privacy policy, not something this game stores.
- The developer does not receive your Google account, your name, your email address or your Play Games player ID, and none of it is attached to your backup, your Daily Core result or your feedback.
- Achievement progress is sent to Google as counts, such as how many cores you have charged. Those counts come from the progress already on your device.
- You can turn Play Games off in your device's settings. The game carries on exactly as before, minus the achievements.
Things every web server sees
The server is hosted on Cloudflare. Like any server, it can see the IP address a request comes from.
Two counters use that address to stop abuse, and both forget. Restore attempts are counted per address per day. Feedback messages are counted the same way, and that counter stores a one-way hash of the address rather than the address itself, so the count cannot be turned back into a list of who sent what.
IP addresses are never attached to your save, your daily result or your feedback, are not used to build a profile, and are not shared.
Deleting your data
Ask at the address below, quoting your recovery code, and the save held under it will be deleted. Uninstalling the app removes everything held on your device, but it does not remove a backup already on the server: that needs the request above.
Children
Coreline collects no personal information from anyone, including children.
Changes
Any change to this policy will be published here with a new date.
Contact: jufravazto@gmail.com