Privacy Policy

Effective 12 July 2026

The short version: the whole game is end-to-end encrypted, there are no accounts, and we run no servers. We — the developers — cannot read your games, your names, your locations, or anything else. There are no ads, no analytics, and no tracking of any kind.

How the game keeps itself private

When someone starts a game, their device generates a random encryption key. That key travels only inside the invite links sent to the other players, and it never touches a server: in web links it sits in the URL fragment (the part after “#”), which browsers do not send when requesting a page. Every message the game exchanges — player names, guesses, locations, scores — is encrypted on the device with that key before it leaves the phone.

Encrypted messages pass through Apple's iCloud (CloudKit) purely as a mailbox. Apple's servers store ciphertext under random identifiers; neither Apple nor we can decrypt it. Only the people holding an invite link for that specific game can.

What the app uses on your device

Your name — whatever you or your host typed. It lives inside the encrypted game, visible only to that game's players.
Location (optional, with your permission) — used by the “Sense of Direction” mini game to compute the true direction to a target and to draw the results map. Your location is shared, encrypted, only with the players in your game — that reveal map is part of the game. Decline location access and you can still play everything else.
Contacts (optional, with your permission) — used by the game's host to fill in player names and address invites by iMessage. Contacts are read on the device only and are never uploaded anywhere. Invitees' numbers or emails stay on the host's phone.
iCloud account — the app uses your device's iCloud sign-in to write to the CloudKit mailbox. We never see your Apple ID or any account details.

What we collect about you

Nothing. The app contains no analytics, no crash-reporting SDKs, no advertising, no fingerprinting, and no third-party code that phones home. We operate no servers and hold no databases of users. We could not sell your data even if we wanted to, because we do not have any.

Data retention and deletion

Encrypted game records remain in Apple's CloudKit public database under random identifiers. Without an invite link's key they are unreadable noise. Leaving a game from within the app deletes its key from your device; deleting the app removes all locally stored games and keys. Standard Apple retention applies to the ciphertext itself.

This website

This site is static and hosted on GitHub Pages. It sets no cookies and runs no analytics. If you open an invite link in a browser, the secret key in the “#” fragment is read only by your browser on your device — it is never transmitted to the server. As with any web host, GitHub's infrastructure may keep standard server logs (for example, IP addresses); see GitHub's privacy statement. The headline font is loaded from Google Fonts, which serves the font file to your browser and may log that request; see Google Fonts and privacy.

Children

The app is a family party game with no accounts, no chat with strangers, no purchases and no data collection. Games can only be joined by someone who was privately sent an invite link.

Changes

If this policy changes, the new version will be posted at this address with an updated effective date.

Contact

Questions about privacy or the app: paul@treadgame.com