Privacy policy

Keyhole · com.alkisyuv.keyhole

There is no account and no advertising. Most game data stays on your device. Our relay counts requests to tagged challenge and store links to understand which sharing sources bring visits. These are aggregate request counts, not counts of people or installs. What leaves your device is listed below, with its purpose and retention.

What stays on your device

The source label on a received Challenge Wire

The app keeps a received wire's campaign label alongside that case's result so a reply can preserve the same source. It is not a separate player profile. If you choose to share a reply, the label is included in its outgoing link; a new wire or store share uses app-share.

Why: To preserve the source when replying to a shared challenge. Kept: On the device until another wire for that case replaces it, or you clear app data or uninstall.

Your progress, ratings and notes

Which puzzles you have solved, your streak, your rating and each case's rating, the notes you type on a case, and what you have bought.

Why: So the game remembers where you were. Kept: On your device until you uninstall the app or clear its data.

What leaves your device

Visits through tagged challenge and store links

Opening a tagged /c challenge link or /get store link sends its campaign label to our relay. The counter stores only the UTC date, campaign label, route (/c or /get), and number of requests. It does not store IP addresses, device or player ids, cookies, full URLs, other query fields, referring pages or individual visit times. Labels must describe sharing sources, never people. Repeated visits, link previews and bots can count; opening an installed app directly can bypass the relay. We forward valid labels to Google Play in the store link's referrer as utm_source, with utm_medium=referral. We do not read install-referrer results in the app or link these counts to purchases. Cloudflare processes requests as our hosting provider; its infrastructure and recovery copies are subject to its own policies.

Why: Analytics: to compare sharing sources using aggregate requests, separately for challenge and store links. Kept: In the active counter for the current UTC date and the preceding 89 dates. Expired rows are removed on reads, writes and a daily cleanup alarm. At most 64 source labels per date are retained; further labels are combined as overflow without retaining their values. Google Play handles the forwarded referrer under its own policies. Goes to: The game relay, a Cloudflare Worker run by the developer, at relay.yuv.run.

A random device id and a display name

A 20-character random id minted once on the device, plus the name you go by at a table ("Detective" unless you change it). It is not an account. The relay receives this id and display name and shows the name to other players. A name you choose may identify you; you can keep the default or use a nickname.

Why: So a seat at a table survives a reconnect and the right player gets the right turn. Kept: On your device until you clear app data or uninstall; a new name replaces the local name. The relay keeps room membership while the room exists. Ordinary empty rooms are removed by their idle cleanup. Saved standing rooms can remain until closed; the current server does not guarantee a fixed expiry for them. Goes to: The game relay, a Cloudflare Worker run by the developer, at relay.yuv.run.

What you do in a shared game

While you are in a room, the moves you make pass through the relay to the other players in that room: questions asked, accusations, votes.

Why: There is no other way to play a game with someone on another phone. Kept: For as long as the room exists. Rooms are not archived. Goes to: The game relay, a Cloudflare Worker run by the developer, at relay.yuv.run.

Questions you type for the house to rule on

Some modes let you ask a free-text question and have the house answer yes or no. That question, together with the case it is about, is sent to Anthropic's API, which produces the ruling.

Why: The ruling is made by a language model; the question has to reach it. Kept: Not stored by the app. Anthropic's own retention applies to the request. Goes to: Anthropic, the language model that rules on typed questions.

Feedback you choose to send

If you write a report through the feedback screen, its text is delivered by formsubmit.co to a dedicated inbox. Nothing is attached to it that identifies you.

Why: So a bug or a bad puzzle can be reported and fixed. Kept: In the inbox it is delivered to. Goes to: formsubmit.co, which forwards a feedback report to an inbox.

Purchases

Packs and the lifetime unlock are bought through Google Play. The app is told what you own; it never sees a card number, and no payment detail passes through it.

Why: To unlock what you paid for, on any device signed in to the same Google account. Kept: By Google Play and RevenueCat under their own terms. Goes to: Google Play and RevenueCat, which handle purchases and entitlements.

What is never collected

No account and no sign-in: there is nothing to register.
No e-mail address or phone number is requested.
No location of any kind.
No contacts, photos, files, microphone or camera access.
No advertising SDK, no ad identifier, and no adverts.
No analytics or crash-reporting SDK.
Nothing is sold or shared with data brokers.

Children

The game is not directed at children. No age or contact details are requested. Players can choose a display name for a room or keep the default.

Deleting your data

Uninstalling the app, or clearing its data from Android's app settings, removes everything held on the device. Rooms are not archived; a shared game disappears when the room ends. To ask about anything else, write to hello@yuv.run.

Changes

We update this policy and review the Google Play Data safety declaration when our data handling changes.

Contact

hello@yuv.run