Privacy policy
ScubaWord is made by Flexicoder Ltd. You can play without creating a named account or using Sign in with Apple. We use a randomly assigned player identifier to provide your gem wallet and purchase access.
Who is responsible for your information?
Flexicoder Ltd is responsible for the information described in this policy. Contact business@flexicoder.com about privacy or your data.
Information used by the app
- Player and wallet information: a random player identifier, a protected recovery credential, gem transactions and balance, purchased stickers, reef access and the completion information needed to calculate rewards. Our server stores hashes of authentication credentials, rather than the original credentials.
- Purchase information: product and transaction identifiers, purchase and refund records, and entitlement status. Apple processes payments. We do not receive your payment-card details or Apple Account password. RevenueCat helps validate purchases, restore eligible purchases and maintain the virtual-currency balance.
- Technical information: the app version, device and operating-system information used by the purchase service, and network information such as IP addresses handled by our hosting provider. Authentication and request records help prevent abuse and diagnose service problems.
- Support messages: if you email us, we receive your email address and what you choose to send. The app prepares an editable feedback email containing the app version, device model and operating-system version. It does not send that email automatically.
Game progress, preferences and dive records are also stored on your device. The Messages extension uses the app’s shared sticker collection to make collected wildlife available in iMessage; we do not read your conversations or contacts.
Usage statistics
We use PostHog’s EU Cloud service to understand how players discover and use ScubaWord’s features and help improve the game. Usage statistics are enabled by default. You can turn them off at any time in Settings → Help improve ScubaWord → Share usage statistics. Your choice is saved across app restarts and updates, and turning statistics off does not affect your ability to play.
We record app opens; dive starts, completed levels and dive outcomes, including partial dives; views of sticker collections and individual stickers; and successful gem-funded sticker collections and reef-travel unlocks. Events can include the reef, site, dive type and length, level number, outcome, collection view and sticker involved. Reef and site values describe locations in the game, rather than your physical location. An offline collection or travel action may be recorded as provisional while awaiting wallet confirmation.
Events also include their time, app version and build, iOS version, device type and model, analytics software version, app environment, and random app and session identifiers. The random app identifier persists between launches and links events from the same installation. These records are pseudonymous: they are linked to an app installation without including your name or contact details. We do not link them to your wallet or RevenueCat identity or create person profiles in PostHog.
Our analytics events exclude names, email addresses, wallet and RevenueCat identifiers, purchase receipts, recovery credentials, gem balances, scores, advertising identifiers, GPS coordinates and screen recordings. Automatic tap and screen capture are disabled. Location enrichment is disabled and PostHog is configured to discard client IP data. Network services still receive the connection information needed to handle requests.
Why we use this information
We use information to operate the game and wallet, deliver purchases and rewards, restore eligible access, prevent duplicate or fraudulent transactions, provide support and understand purchase performance through RevenueCat’s reporting.
Where UK or European data-protection law applies, we rely on performing our contract with you to deliver the game’s purchased services; our legitimate interests in keeping the service secure, resolving problems and understanding purchase performance; and compliance with applicable legal obligations. Where processing requires consent, we will ask for it.
Recovery and iCloud Keychain
The wallet recovery credential is stored in Apple Keychain and is eligible to synchronize through iCloud Keychain when you enable it. Flexicoder does not receive your Apple Account credentials. Availability and timing of synchronization depend on your Apple settings and devices. Restoring a Travel Visa or World Passport through Apple and RevenueCat is separate from recovering your gem wallet. Deleting the app does not itself request deletion of the server wallet.
Service providers
We use Apple for App Store purchases, Keychain and platform services; RevenueCat for purchase validation, entitlements, purchase reporting and virtual currency; and IONOS for website and wallet hosting. These providers process the information needed for their services. Relevant policies are available from Apple, RevenueCat and IONOS.
PostHog processes the usage statistics described above on our behalf through its EU Cloud service. See PostHog’s privacy policy for information about its processing and safeguards.
Providers may process information in countries outside your own, including the United States. Applicable transfer arrangements and safeguards are described in their privacy and data-processing terms.
Advertising and tracking
Advertising is disabled in this release. The app does not request advertising tracking permission or show rewarded adverts. We do not sell personal information or use it to track you across other companies’ apps or websites for advertising. This privacy page contains no advertising or analytics scripts.
How long information is kept
We keep wallet and ownership records while needed to maintain your balance, recover access and prevent duplicate transactions. Purchase records may need to be retained to handle refunds, accounting, legal obligations or disputes. Support correspondence and security records are retained only for as long as needed for their purpose. Provider retention and backup schedules also apply. We review deletion requests against these needs and explain any information that must be retained.
Usage events and metadata follow PostHog’s default Product Analytics retention policy for our active plan. Its published retention policy guarantees retention for one year on free plans and seven years on paid plans. Older data may be permanently deleted by PostHog; these periods are not promises of deletion on a fixed date.
Your choices and rights
You can contact us to request access, correction or deletion of information, and where applicable restriction, portability or objection to processing. We may need proportionate evidence that the wallet or purchase belongs to you before acting. Never send your recovery credential, password or payment-card details by email. Deleting wallet data can affect your gem balance and collection; we will explain the consequences before carrying out a deletion request.
Turning off Share usage statistics stops new usage-event collection. Requests already sent may finish processing. This does not delete events previously received by PostHog. Analytics records are separate from wallet and purchase records, so we cannot locate your events using your email address or wallet ID alone. Contact us about analytics access or deletion requests and we will explain the available options and any limits on locating the relevant records. The app does not currently provide a self-service way to delete analytics records.
You may also complain to your local data-protection authority. In the UK, this is the Information Commissioner’s Office.
Children and changes to this policy
We do not ask players for their name, date of birth or contact details to play. A parent or guardian can contact us about information supplied by a child. App Store purchase permissions and parental controls are managed through Apple.
We will update this page when our information practices change. The date above identifies the latest version.