Privacy Policy
They Baiters Love
This policy explains how this application handles information and how to contact us about privacy.
Information we process
They Baiters Love stores level stars, finale times, unlocked and selected cosmetic items, prop selections, language and audio/accessibility preferences, and an unfinished round locally on your iPhone. An automatically generated random installation identifier and secret are stored in the iOS Keychain. The secret is restricted to this device and is not a user account. When connectivity is available, the app sends the installation identifier and secret over HTTPS to register its installation, and synchronizes level stars, best finale times and unlocked cosmetic identifiers. The server stores a hash of the secret, the installation identifier, these results and database timestamps. It does not store your unfinished round, preferences or prop layout. Public leaderboard responses contain rank, stars and finale time without names or installation identifiers. Requests to the API and public website also expose technical request information, such as IP address, request time and connection metadata, to the Railway hosting infrastructure and the Cloudflare edge serving the custom domains. The app does not request your name, email, contacts or location and has no advertising or analytics SDK.
How we use information
Local storage allows offline play, continuing interrupted shows and keeping your settings. Installation credentials authorize access to your own server record. Server processing synchronizes this installation's results, combines earned progress without reducing stars and displays anonymous player-reported leaderboard results. It does not provide cross-device login or recovery after the installation secret is lost. Short-lived server rate-limit counters and infrastructure request information support operation, reliability and abuse prevention. No email delivery or support form is part of the app.
Service providers and sharing
Railway hosts this application's backend, persistent database volume and public privacy page and processes technical network information needed to deliver those services. HTTPS requests for the application's custom domains pass through Cloudflare's network edge before reaching Railway, so Cloudflare processes the requests it forwards and their technical connection information. Anonymous stars and finale times may appear on the public leaderboard. The application has no other third-party SDKs, advertising partners, analytics recipients or social sign-in providers. Apple provides iOS networking, local storage and Keychain services; device backup behavior depends on your Apple settings. We do not sell personal information. Information may also be disclosed when required by applicable law.
Data retention
Local progress remains until you erase installation data in Settings or remove the application, subject to operating-system storage and backup behavior. The device-only Keychain secret can survive reinstallation on the same device; cross-device recovery is not offered. Server installation records and results remain until an authorized deletion request removes them; the application does not implement a fixed automatic expiry. Rate-limit counters are held in process memory for approximately one minute and disappear on process restart. Server application logs contain operational event codes and request identifiers for internal failures, not request bodies or credentials. Railway may retain infrastructure logs or backups under its own service operation and account configuration. Cloudflare may retain technical request logs under its service operation and account configuration. No fixed infrastructure-provider retention duration is asserted here.
Deleting your information
Settings offers Delete installation data with confirmation. It clears local game progress, layouts, unfinished play and preferences while retaining your chosen interface language. The app requests deletion of the installation record, level results, cosmetics and authorization hash from the live server database, which also removes those results from the leaderboard. If offline, the app retains the credential and a pending deletion marker solely to retry the request; starting a new show is disabled until deletion completes. On confirmed deletion, or a retry showing that the installation is no longer authorized, the credential is removed. Device and hosting backups, if any, may continue to contain earlier copies under the respective provider's retention and restoration processes. Deleting the app alone does not send a server deletion request. Without the installation secret we cannot promise to identify or recover a particular anonymous record.
Permissions and your choices
The app requests no location, camera, microphone, photo-library, contacts or notification permissions. Network synchronization uses ordinary internet connectivity. Music, sound effects, haptics and reduced motion can be changed in Settings, and system Reduce Motion is respected. You may stop network transfers through device connectivity controls and continue playing offline, except while a previously requested server deletion is pending.
Your privacy rights
For privacy questions or applicable access, correction, deletion or other data-protection requests, contact constance.wycliffe@icloud.com. Use the in-app deletion control for direct authorization of this installation's deletion. Because records are pseudonymous and there are no accounts or names, locating a record without its installation credential may not be possible. Do not send your installation secret by email. Rights and complaint options depend on the law where you live; you may contact your local data-protection authority when applicable.
Security
The deployed service uses HTTPS. The app keeps its random installation secret in device-only Keychain storage. The server stores only a cryptographic hash and checks authorization for every private progress or deletion request; another installation cannot read or change your private record using its own secret. Input sizes and values are validated and request rates are limited. Game files use atomic writes and iOS file protection. No shared server credential is embedded in the app. These controls reduce risks but do not guarantee absolute security of devices, networks or hosting infrastructure.
Children’s privacy
The game's intended audience is age 10 and older. It has no accounts, chat, advertising, purchases or requests for names or contact details. Automatic installation-scoped synchronization and hosting request processing still occur as described above. A parent or guardian can use the device's connectivity controls and the in-app deletion control, or contact the privacy email with concerns about a child's information.
Changes to this policy
This policy describes the released application's actual local storage and backend processing as of the effective date shown above. If processing changes, the policy and effective date will be updated on this page and the accessible in-app Privacy Policy link will continue to open it. Material changes will be explained in the updated policy and, where required, through an appropriate notice.