Effective Date: May 30, 2026 Last Updated: July 13, 2026

1. Introduction

This Privacy Policy describes how CYPHER (“the App,” “we,” “us,” or “our”) handles information in connection with your use of the CYPHER mobile application. CYPHER is operated by Ashton Sims, an individual developer based in Boca Raton, Florida, USA.

CYPHER uses online accounts so that your card collection, token balance, and trades are real, secure, and consistent for everyone. That means some data about your account lives on our servers. This Policy explains exactly what that data is, what we deliberately do not collect, and how to delete everything.

The short version:

  • You can use CYPHER without telling us who you are — a new install gets an anonymous account.
  • If you choose Sign in with Apple (required only for trading), we receive your email address — and nothing else. We never ask for your name.
  • We store your game data (cards, tokens, packs, trades) on our servers so it can’t be forged and trades are real.
  • We run no ads, no third-party analytics, no tracking, and we never sell your data.
  • You can delete your account and all its data from inside the App, any time.

2. Your Account: Anonymous by Default

When you first open CYPHER, the App creates an anonymous account — a randomly generated account ID with no email, no name, no phone number, and no connection to your identity. Everything you do before signing in (opening packs, collecting cards, earning tokens) is tied to that anonymous ID only.

You can use most of CYPHER this way indefinitely. We could not identify you from an anonymous account even if asked to.

If you choose to sign in with Apple (required to trade cards with other users, and to keep purchases restorable across devices):

  • We receive your email address from Apple. If you use Apple’s Hide My Email feature, we receive the private relay address instead of your real one — that works fine with CYPHER.
  • We do not request or receive your name. The App asks Apple for the email scope only.
  • Your existing anonymous collection and balance are attached to your signed-in account — nothing is lost.
  • A public collector handle (like “CosmicKick7788”) is generated automatically for you. You do not choose it, it contains nothing personal, and it is the only thing other users ever see about you. Other users never see your email, name, or account ID.

3. What We Store on Our Servers

To make the card economy real (so cards, serial numbers, tokens, and trades can’t be forged or duplicated), the following is stored in our database, keyed to your account ID:

  • Account data: your account ID; your email address (signed-in accounts only); your auto-generated collector handle; account timestamps (such as when the account was created and last signed in).
  • Game data: your card collection (which cards you own, their serial numbers, and how you got them), token balance and token transaction history, pack-opening history, set-completion rewards, and subscription entitlement status.
  • Trading data: your listings, your offers (including any token amounts attached to them), and completed trades.
  • Safety data: users you have blocked, and reports you submit about other users’ conduct (including the optional note you attach to a report). Reports are visible only to the developer — never to other users, and never to the person reported.
  • Purchase records: when you buy tokens or a subscription, Apple sends the App a signed transaction receipt. We store the Apple transaction ID, the product purchased, and the token amount credited so a purchase is never credited twice. We never see, receive, or store your payment details — no card numbers, no billing address, no Apple ID password. Apple processes all payments.

Like almost any online service, our infrastructure also produces short-term server logs (which can include IP addresses and error messages) used only for security and debugging. We do not use these to profile you.

4. What Stays Only on Your Device

Some data is stored locally on your device (using Apple’s standard app storage) and is not part of your server account: display caches of your collection and balance, app settings and progress flags (such as onboarding completion and daily-reward timing), Vault Showcase customization, and in-app notification history. Local data is removed when you delete the App.

5. What We Do NOT Collect or Do

We built CYPHER without the usual tracking machinery. The App contains no third-party analytics SDKs, no crash-reporting SDKs, no advertising networks, and no social media SDKs — its only server communication is with our own backend and with Apple. Specifically, we do not collect:

  • Your name or phone number
  • Your location (GPS, or any location tracking)
  • Your contacts, photos, or other on-device content
  • Your advertising identifier (IDFA), or any cross-app tracking identifier
  • Behavioral analytics or usage profiles

We do not sell, rent, or share your personal information with anyone for marketing or advertising. We do not track you across other companies’ apps or websites.

6. Who Processes Your Data

Two companies process data on our behalf, and we only use them for what’s listed:

  • Apple (Sign in with Apple; App Store purchases and subscriptions). Apple handles all payment processing and gives us only the purchase receipt data described above. Apple’s own Privacy Policy applies to what Apple collects: https://www.apple.com/legal/privacy/
  • Supabase (our database and authentication provider). Your account and game data described in Section 3 are stored in Supabase’s cloud infrastructure in the United States (US East, Northern Virginia). Supabase acts as our processor and, like any hosting provider, maintains standard operational logs.

Additionally, these legal pages are hosted on GitHub Pages; when you open them in your browser, GitHub receives the standard web-request data any website receives.

There are no other third parties.

7. How Long We Keep Data — and How to Delete Everything

Your account data is kept for as long as your account exists, so your collection stays yours.

You can permanently delete your account and its data at any time, from inside the App: Profile → Delete Account. When you confirm, in one pass:

  • Any active trades are safely unwound (other users’ escrowed tokens are refunded to them);
  • If you signed in with Apple, we ask Apple to revoke the App’s connection to your Apple ID;
  • Your account and every record tied to it are deleted from our servers — profile, handle, email, wallet, token history, cards, pack history, rewards, subscription records, purchase records, listings, offers, blocks, and reports;
  • The App’s local data on your device is wiped.

Deletion is immediate and irreversible; we cannot recover a deleted account. Two things survive deletion, neither of which identifies you: anonymous supply counters (e.g., how many of a card’s serial numbers have ever been issued — a number with no owner attached), and cards you traded to other users before deleting (those belong to their new owners; they carry no information about you).

Two practical notes: (1) an anonymous account has no credentials, so if you delete the App without signing in, that account and its collection become permanently unreachable — there is no way to recover it; (2) deleting the App from your device does not, by itself, delete your server account — use Delete Account for that.

8. Your Rights

Wherever you live, we honor the same set of rights: you can access the data we hold about you, delete it (the in-app deletion above is the fastest way), correct it, or ask us to export it — by contacting us at the email below. We will respond to verified requests within the timeframe required by applicable law (and aim for within 30 days regardless). You also have the right to lodge a complaint with a supervisory authority in your jurisdiction.

9. Children’s Privacy

CYPHER’s Terms of Service require users to be at least 13 years old (or older where local law sets a higher minimum for digital services). CYPHER is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has created an account, contact us at the address below and we will delete the account and its data.

10. Changes to This Privacy Policy

We may update this Privacy Policy as the App or the law changes. When we do, we will update the “Last Updated” date at the top and, for material changes, provide prominent notice in the App. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

Note: this Policy was substantially rewritten on July 13, 2026 to describe the online account system (accounts, server-stored game data, and trading) that replaced the App’s earlier fully-local design.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or CYPHER’s privacy practices, please contact us at:

Email: cypherapp.privacy@gmail.com

We aim to respond to all privacy-related inquiries within 30 days.