← Back to Turning Circle

Your data

Privacy

Effective date: RELEASE_PRIVACY_EFFECTIVE_DATE

Release setup is incomplete. The publisher must replace every RELEASE_* value on this page and obtain an appropriate legal review before publication.

This notice explains how RELEASE_OPERATOR_LEGAL_NAME (“we”, “us”) handles information when you play Turning Circle on the web or in a packaged mobile app. You can play the numbered campaign without creating an account. An optional account is needed only for account features such as submitting a result to an online leaderboard.

Information we handle

InformationWhen and why
Local game data Campaign progress, settings, personal-best times, and replay inputs are stored on your device so the game can work offline. This data remains local while you are signed out. Before sign-in, the game explains that signing in submits eligible current-version local bests and future clears for verification. Accepted bests can restore their corresponding completed levels and unlocks on another signed-in device; settings, Hard Mode, and records that were not accepted remain local.
Account information If you create an optional account, Supabase Auth handles your private email address and verifies your password. We receive an account identifier and the separate public username you choose. When you sign in with that username, our score service briefly processes the username and password to resolve your private email and ask Supabase to verify it; the email is not returned to the app or used as your leaderboard identity.
Leaderboard result and proof When you sign in, eligible current-version local bests and future clears are submitted. We receive the level and ruleset version, elapsed simulation ticks, deterministic replay inputs, final-state proof, request identifier, and account identifier. The server re-simulates the replay to verify the score and reject altered or incompatible results.
Public leaderboard data A verified result can publish your chosen username, time, rank, level or ruleset version, and verification time. If the result is currently in a level's top three, the server's canonical replay inputs are also public so other players can watch the run or race it as a non-colliding ghost. Your email address is never displayed publicly.
Service and security data Our hosting and authentication providers may process IP address, request time, device or browser information, error details, and security events to deliver the service, prevent abuse, and diagnose faults. Ordinary network requests disclose an IP address even though Turning Circle does not use behavioural analytics.

What we do not do

Turning Circle contains no ads, advertising SDKs, tracking pixels, or behavioural analytics. We do not sell personal information and do not share it for cross-context behavioural advertising. We do not access contacts, precise location, photos, microphone, or camera.

How we use information

The applicable legal basis depends on where you live and can include providing the service you request, our legitimate interest in securing a fair game, compliance with law, or your consent where required. The release owner must document jurisdiction-specific bases here: RELEASE_PRIVACY_LEGAL_BASIS.

Providers

Supabase provides email-and-password authentication and related account infrastructure. RELEASE_HOSTING_PROVIDER hosts the published web game and score-verification service. Apple or Google processes store, installation, payment-account, and diagnostics information under its own terms when you obtain a mobile build through its store. These providers process information to supply and secure their services; Turning Circle does not add their data to an advertising profile.

Retention and deletion

Local game data Until you clear it in the game or browser, clear app storage, or uninstall.
Account and submitted results While the account is active. After a verified deletion request, account data and account-linked submissions are deleted or irreversibly de-identified within RELEASE_ACCOUNT_DELETION_DAYS days, unless retention is legally required.
Operational and security logs RELEASE_SECURITY_LOG_RETENTION_DAYS days.
Encrypted backups Deleted data can remain inaccessible in rotating backups for up to RELEASE_BACKUP_RETENTION_DAYS days before expiry.

See Delete your account and data for the request process. Removing an online account does not automatically erase local progress from each device; that data is controlled on the device.

International processing

Providers may process information outside your country. Before release, the publisher must identify production regions and transfer safeguards here: RELEASE_DATA_REGIONS_AND_SAFEGUARDS.

Security

We use encrypted transport, short-lived authentication tokens, server-side replay verification, access controls, rate limits, and least-privilege service credentials. No system can be guaranteed completely secure. Never send your password or authentication token to support.

Children

An account is not required to play. Turning Circle is not designed to knowingly collect personal information from a child who cannot consent under applicable law. Such players should use offline play without an account, with a parent or guardian where required. A parent or guardian can contact us to request deletion.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal information, or appeal a response. Contact RELEASE_PRIVACY_EMAIL. You may also complain to your local data-protection authority. We will verify requests without asking you to send your password.

Changes and contact

We will update the effective date and provide notice appropriate to the change. Questions can be sent to RELEASE_PRIVACY_EMAIL. Operator address: RELEASE_OPERATOR_POSTAL_ADDRESS. Published site: RELEASE_PUBLIC_SITE_ORIGIN.