Privacy policy

1Who runs Tiltanic

Tiltanic is a free game. You can play it in the iPhone and iPad app from the App Store, and in a browser at tiltanic.com. SawannaMicroHolding - Piotr Lewandowski runs both from Poland and decides how your data is used. This makes SawannaMicroHolding - Piotr Lewandowski the “controller” under the GDPR (the EU data protection law).

Contact: privacy@tiltanic.com

2What Tiltanic stores on your device

Tiltanic sets no cookies. The game keeps this on your device, in the storage of the app:

• Local storage: your best score, runs, streak (with its shield), the days you played in the last 4 weeks, name, sound and language choices, the tag of the link or the name of the site that first brought you, today’s ranking code, your last 8 daily scores, the gifts you found, the look you wear, the visitors and skies you met, the gifts switch, the codes of your friend lines (a random number for each line and a random secret of this phone for it), the hours you usually play, your chosen reminder time and the day of your last “yesterday’s place” check. For your friend lines it also keeps the captain names and scores of the other members, the names you give them on this phone, your open dares and your best run of the day. For stream rooms it keeps the room you made as a streamer, with its code and a random secret key that never leaves this phone except in your own posts to that room, and the room you joined today, with its code and a random code of this phone.
• Session storage: when the page reloads itself to get a new version of the game, the tab keeps two short marks: the time of that reload, so that the page never reloads twice within 10 minutes, and the random session ID for a few seconds, so that the visit counts once. The browser drops both when the tab closes.

Delete the app to delete all of this from your phone.

3What our servers receive and keep

• Server logs. Our host, Amazon CloudFront, logs each request: time, IP address, page address, browser type, referring page and result.
• Analytics. The game sends small events with no cookie and no ID that stays on your device. Each page load makes a random session ID that lives in memory. When the page reloads itself to get a new version of the game, the ID waits a few seconds in the tab’s session storage, so that the visit counts once. It is never kept after the tab closes. An event can carry device type, operating system, browser, language, input mode, tilt readings, scores, play time, load time, errors, days since your first visit and the link tag or site that sent you. We work out your country from your IP address and keep only the country code.
• Analytics from your save and your visit. Some events carry plain numbers that the game reads from your save or from your visit. They hold no name and no ID. They are: whether the page was visible when it opened; how the browser opened it (new visit, reload or back); the way you came in (the “via” tag: dare link, crew link or moving your progress into the app); whether you used an old link; how long you stayed on the title before you left; how you pressed sail (button, sea or key); your streak as a size bucket (0, 1, 2, 3 to 6, 7 to 13, 14 to 29, or 30 and more), its state and your shield count; on how many of the 27 days before today you played (0 to 27), and whether your save began to count them later; the number of friend lines on your phone; and your taps on the streak chip. The “via” tag can also say “post”, for a link in one of our own posts.
• Analytics for each run. For each run the game sends: the kind of end card, the goal on it and the gates to reach it, whether a ghost or a bot raced you and whether you won, the step in your first chapter, a mark for a peak run, the medal that the game showed, how long you took to retry, whether the share button showed, and the gift of the run (its kind and slot). It also reports whether its ladder file loaded, how long that took and its size. The card also sends the kind of line that shows under the button, the score of a friend just above your best when the card names one, and how many taps beside the button counted as a new try.
• Analytics for sharing, lines and gifts. When you share, the game sends the tap, the wait for the result in steps of 100 milliseconds, the time of the short link, one letter for an error, and whether the picture of your crash went with the share, or a short code for why it did not. The picture itself is made on your phone and goes only to the app that you pick. It never goes to our servers. For friend lines and gifts it sends the step that you reached, such as “answer posted”, “line left”, “locker opened” (with the number of gifts you own) or “gifts off”. These events can also carry small counts and results: the members, scores and days together of a line, how many friends of a line came back and whether their return gave you the lamp or the flagship, the result of a call to our server and how long it took, whether a run started soon after a friend’s answer, your place of yesterday and the number of players when the title showed it, and your steps with the daily reminder. For stream rooms it sends the steps “room made” and “room renamed” when a streamer makes or renames a room, and the step “room opened” when a viewer opens a room link (once a day on a device for each room). These steps carry no name and no key. A run in a room also carries one number that says whether a viewer or the streamer played it. If a room link first brought you to the game, your first visit is tagged “live” with the code of that room.
• Daily ranking. If you beat your best on today’s course, the game sends the run: a random code for today, your inputs, your score and your captain name, which is a title, a word and a number from the game’s own lists. The run also sends the look of your boat. If you hold the pirate pack, it also sends your licence token. The server checks the token and never stores it. You cannot type a name, so no typed text is sent. The public board shows the top 10 names with scores and boats. The ranking database stores no IP address.
• Friend lines (crews). When you play a friend’s dare, or when a friend plays yours, the game sends your best run of the day to a small group of up to 40 phones. We call it a line or a crew. The server checks the run. It keeps the score, a captain name from the game’s own lists, and a random code of your phone that works only for this line. Every member of the line sees the score and the captain name. You cannot type a name, so no typed text is sent. A line has no account and no link to your ranking entry, your analytics or your other lines. Before each run the game tells you who sees your score. You can leave a line (“leave crew”), which deletes your part, or switch it off (“crew sees my score: off”). A line also keeps the day on which each friend answered a dare, and a short list of one-way hashes of the member codes of the friends who then came back and played on a later day. They are tied to the random code of a phone, not to an account. They stay for 8 days after the last run, or for 30 days after it once two players have played the same day or a friend has come back.
• Stream rooms (for streamers and their chat). A streamer can make a room on a computer. The streamer types a name for it, 2 to 20 letters, digits and simple marks. The room keeps that typed name, its random code, the day it was made and a one-way hash of a random key that the streamer’s browser keeps. Anyone who has the room link sees the name and the board of the room. When a room is made or renamed, and when a room first has 10 players in one day, we also get a message on Telegram with the name and the link, so that we see new rooms and can close one that breaks our rules. A viewer who opens the link plays the course of the day. The server checks each run. The board of a room for one day keeps, for each viewer, a one-way hash of a random code of that phone, the best score of the day, whether it was a warm-up run and a captain name from the game’s own lists. The board also keeps the streamer’s best score of the day and the streamer’s ghost, which holds the inputs of that best run. Anyone who has the link sees both, for as long as the board lives. A viewer cannot type a name, so no typed text of a viewer is sent. A room has no account and no link between a viewer’s row, the ranking entry and the analytics. The room database stores no IP address.
• Share links. A link holds a code in its address: your captain name as three numbers (your friend’s game shows it in words, in their language), the score, the sea, a random number and a small number that shows your friend the look of your boat. A link holds no text that you typed. Our logs record the address when someone opens a link.
• Short links. A short tiltanic.com/s link stands for a game link. So the redirect works, our server stores the text of that link and nothing else, and deletes it after 400 days. The shortener’s database stores no IP address, and the shortener keeps error logs only, with no request data.
• Dashboard. stats.tiltanic.com is protected by a password and is not public. Its records hold no IP address and no stored ID.
• Email. If you write to privacy@tiltanic.com, Amazon Web Services (SES) receives the mail and keeps a copy for 30 days. It is forwarded to our mailbox at Google (Gmail). We use it only to answer you.

4Advertising (Google AdMob)

The app shows ads from Google AdMob. This is how they work:

• What Google receives. When an ad shows, Google receives your IP address and facts about your phone and the app, such as its model, the iOS version, the language and the app version. Google uses them to show and measure ads and to stop fraud, and decides for itself how it uses this data: policies.google.com/privacy
• No tracking, no personalised ads. The app does not show the iOS tracking question (App Tracking Transparency), so iOS gives it no advertising ID: the ID reads as zeros. The app does not track you across the apps and sites of other companies. Every ad request also carries Google’s tag for users under the age of consent. Google says that a request with this tag has no personalised ads, no remarketing and no advertising ID. The app also sets the maximum ad content rating “PG” (parental guidance), so Google leaves out ads with a higher rating.
• Consent in the EEA, the UK and Switzerland. In these places, Google’s consent form asks for your choice before the app asks for ads. You can change your choice at any time with the “ad choices” link on the title screen of the app. Without your consent, Google serves only limited ads, which use no personal data to personalise.
• Report an ad. If an ad is not right for you, tap “report an ad” on the pause screen of the app. It starts an email to privacy@tiltanic.com. You can also write to that address at any time.

If you own the pirate pack, the app shows no ads.

5The iPhone and iPad app

The iPhone and iPad app from the App Store is the same game inside an app. The game files are in the app, so it starts without a connection. So this policy applies to the app, with these differences. This section lists what the app adds.

• Your save: the app keeps your save in its own storage on your phone. It holds the same items as the local storage described in section 2. iOS may include it in a backup of your iPhone or iPad, in iCloud or on your computer. This is Apple’s backup, which you control in your phone’s settings, and we do not receive that copy. Deleting the app deletes the save from the phone.
• The app mark: the app adds the word “TiltanicApp” and its version number to its identification text, called the “user agent”, which it sends with each request. Our server logs and our analytics use this mark to tell the app from a browser.
• Game updates: the app can download an update of its own game files from tiltanic.com, as a zip file, and checks it before it uses it. Such a request holds only what every web request holds, such as your IP address (section 3) and the version of your game files. An update fixes errors and adds daily content to the same game.
• Moving your progress into the app: the game can put a progress code in a link that opens the app, or on your clipboard. The code holds your save, such as your best score, your streak and your captain name (three numbers), and the licence of a pirate pack that you own. It stays on your phone: the link or the clipboard never sends it to us.
• Daily reminder (optional): you can turn on one notification a day. The app then shows a notification on your phone at about the time when you usually play, to say that the new sea is open. iOS asks for your permission first. The app makes this notification on your phone: nothing is sent to us for it, and no server sends it. The app keeps your choice and the time of day on your phone, in its own storage, and never sends that time. You can turn it off in the app or in your phone’s settings. Our analytics count only the steps that you take, such as “asked”, “yes”, “no” and “off”, with no name and no ID.
• Ads (Google AdMob): the ads in the app come from Google AdMob. Section 4 says how they work.
• Apple: the App Store delivers the app and its updates. Apple handles your install, your Apple account and your purchase under its own terms and privacy policy: apple.com/legal/privacy. We see the totals that Apple gives to developers, such as downloads and sales by country, and the reviews that players post on the App Store, with the name that Apple shows and the text.
• Game Center (optional): if you are signed in to Game Center on your phone, the app can send your achievements and scores to Apple’s Game Center. Apple handles them under its own terms. We do not receive your Game Center name or ID.
• Crash reports: when the app closes because of an error, or its page view breaks, it keeps a short report on your phone and sends it to our server at once, or at its next start. The report holds the error and the place in the app’s code, the last 40 steps of the app (for example “page loaded”, with the page address but never the part after ? or #), the app version, how often the app was started, how long the app had run, the model of the phone, its iOS version and the language. It holds no name, no save, no codes and no ID of you or your phone, and our server does not keep your IP address with it. We use these reports only to find and fix errors.
• Permissions: the app uses the internet and the motion sensor of your phone, as the browser game does. It does not ask for your contacts, your location, your camera, your microphone, your photos or your files. It does not ask to track you. If you turn on the daily reminder, iOS asks if the app may show notifications.

Analytics, the daily ranking and friend lines work in the app as on the web. To delete your data on our servers, write to privacy@tiltanic.com, as described under your rights.

6Who processes data for us

• Amazon Web Services (AWS) hosts the site, the logs, the ranking, short-link and friend-line databases and the dashboard in the USA (us-east-1).
• Google provides the ads in the app (section 4) and our mailbox (Gmail). Google decides for itself how it uses this data.
• Telegram delivers to us the messages about stream rooms: the name that a streamer typed and the link of the room. Telegram decides for itself how it uses this data.
• Apple delivers the app, takes the payment for the pirate pack and runs Game Center. See sections 5 and 12.

Your data may be processed in the USA, under safeguards that AWS and Google offer, such as standard contractual clauses.

7Why we use data, and the legal basis

We use data to run the game, keep it secure, learn how people play, show the daily ranking and pay for the game with ads. The legal basis is our legitimate interest (GDPR Article 6(1)(f)). You can object (section 9).

In the EEA, the UK and Switzerland, the legal basis for the ads in the app is your consent (GDPR Article 6(1)(a) and Article 5(3) of the ePrivacy Directive). You give it in Google’s form. Without it, Google serves only limited ads. You can take it back at any time with the “ad choices” link on the title screen of the app.

For the pirate pack, the legal bases are in section 12.

8How long we keep data

• Server logs with IP addresses: 90 days, then automatic deletion.
• Ranking entries: they expire 4 days after your run. The daily totals and the top 10: 400 days.
• Short link records: 400 days, then automatic deletion.
• Friend lines: the daily scores, up to 4 days after the run, and the last rows of an idle line stay up to 30 days. The list of members, the counted days, the day on which each friend answered a dare and the short list of friends that came back: 8 days after the last run, or 30 days after the last run once two players have played the same day or a friend has come back. A line is deleted at once when its last member leaves.
• Stream rooms: a room, with the name that its streamer typed and its random code: 30 days after the last run in the room (the streamer can also end a room earlier, and we can close one). The board of a room for one day and the rows of its viewers: 4 days after the last run. The counts of new rooms and of messages to us: 2 days.
• Error logs of the ranking service: 7 days.
• Error logs of the shortener service: 7 days.
• App crash reports: 90 days, then automatic deletion.
• Emails to us: the copy at AWS, 30 days.
• Dashboard records: no automatic deletion date.
• On your device: in the app, on the phone, until you delete the app. A copy in a backup of your iPhone or iPad follows the rules of your Apple account.
• The data of Google AdMob: see Google’s policies. The data of the App Store, your Apple account and Game Center: see Apple’s policies.
• The pirate pack: see section 12.

9Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction and a portable copy, and you can object to its use. Write to privacy@tiltanic.com.

Tiltanic has no accounts and no stored ID, so we often cannot tell which records are yours. To find IP-based records, send us your IP address and the time of your visit.

You can complain to your data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO): uodo.gov.pl

10Children

Tiltanic is for a general audience. It is not directed at children under 13, and we do not knowingly collect their personal data. If a child sent us personal data, write to privacy@tiltanic.com and we will delete it.

11Gifts from the sea

After some tries the sea gives your boat a gift. A gift is a look for the boat: paint, a hat, a flag or a trail. It is a picture only. It has no price and no cash value. You cannot sell or trade it. The chance is 3 in 10 after each try of 3 seconds or more. There is always a gift after 5 tries with none. The first try always gives a gift. Each gift is one that you do not have yet. A gift has a tier: plain, rare or gold. A random gift uses these weights: plain 6, rare 3, gold 1. For your first random gift that is about 82% plain, 16% rare and 2% gold. You cannot get a gift you own, so rare and gold gifts come more often as your set grows. On a day with a rainbow, an aurora or shooting stars, your first try on that day’s course gives the special gift of that sky, if you do not have it yet. The gifts, the look you wear and the visitors and skies you met stay on your phone. If you send a challenge, its link holds a small number that shows your friend your look. The game counts the gifts it gives, as plain numbers with no ID. You can turn gifts off in “my boat”.

12The pirate pack

The pirate pack is an optional purchase that you pay for once (see the terms). This section says what happens to your data when you buy it in the app. It does not apply to you if you never buy it.

• What the licence holds. Our server keeps one record for each licence: a random licence ID, where you bought (the App Store), the day it was made, its status (active or stopped, and why it stopped: refund or revoked), and how often it was used to unlock a device.
• A purchase in the app. The app sends the receipt of your purchase, as Apple signed it, to our server. The server checks the signature and keeps the transaction ID that Apple gives for the purchase. So one purchase makes one licence, and we can stop the licence when Apple tells us about a refund. We do not receive the name of your Apple account, your email address or your card details.
• What we do not keep. We never see your card details or your Apple account. The pay server does not read or store your IP address. Our host still logs a request as described in section 3.

Who handles your payment:

• Apple takes your payment in the app, sends you the receipt and handles refunds. Apple decides for itself how it uses your data, under its own terms and privacy policy: apple.com/legal/privacy.
• Amazon Web Services: our hosting keeps the licence records in the USA (us-east-1), under the safeguards in section 6.

Why we use the data, and the legal basis:

• To make your licence, and to give the pack back to you when you restore your purchase, we use your data to carry out our contract with you (GDPR Article 6(1)(b)).
• To keep the records of a sale that the tax and accounting law of Poland asks for, we use a legal obligation (GDPR Article 6(1)(c)).
• To prevent fraud and misuse, such as a licence that many people use, we use our legitimate interest (GDPR Article 6(1)(f)). You can object (section 9).

How long we keep it:

• The licence record: for as long as Tiltanic runs, also after a refund. After a refund the record stays as a stopped licence, so that the licence stays stopped.
• Records of the messages from Apple that we already handled: 30 days.
• Logs of the pay server: 30 days. They hold no email address or token.
• Backups of the licence database: a deleted record may stay in them for up to 35 days.
• Apple and Amazon keep their own records of a payment, under their own rules.

You have the rights in section 9. To find your record, we need the transaction ID of your purchase, which is in your Apple receipt. If you ask us to delete the record, the licence ends, and the pirate pack stops working. We must keep the records that the law asks for.

13Changes to this policy

We may change this policy. The new version will appear on this page with a new date.