Privacy Policy

01Information the app stores on your device

The app saves your progress in its private storage on your phone so that it is there the next time you play:

• Run results: scores, stop grades, ratings, streaks, and the logbook of completed runs.
• Records and mastery grades per line, and which lines you have unlocked.
• Daily-run results.
• Settings, such as the graphics level, whether automatic train control is on, and whether alerts are on.
• Your install ID and player ID (section 2), and the board name you chose, if any.
• Run reports and usage events that have not yet been sent to our server, so a run driven offline is sent later.
• Perks earned by watching a rewarded ad: a second attempt at the day's daily run, and a one-day pass on a locked line.

On Android the app opts out of cloud backup, so this data is not copied to your Google account. On iPhone it is part of the phone's own backup (to iCloud or a computer), like other apps' data, so restoring your phone from that backup restores your progress. Uninstalling the app deletes it from the phone; see section 8 for what stays on the server.

Pictures you take in photo mode are saved to your phone's gallery (Android) or photo library (iPhone). The app only adds pictures there; it never reads or uploads your photos. For the in-app gallery it also keeps its own copy of each picture, with the settings it was taken with (line, place, train, camera, time of day and weather), in its private storage. These copies never leave your phone; they are deleted when you delete them in the gallery, use DELETE MY DATA, or remove the app. Like the rest of the app's data they are not copied to your Google account on Android, and are part of the phone's own backup on iPhone.

02Information sent to our server

The app talks to a server we run so that every line can have a world board and so that we can see which stations are too hard and which phones run the game badly. The server is hosted on Amazon Web Services in the United States. It receives:

• Player identity. The first time it runs, the app makes a random install ID and registers it with the server, which answers with a player ID. Neither is tied to a Google account, a phone number, an email address, or the device's advertising ID. If you choose a name for the world boards, that name is stored with your player ID and shown to other players beside your scores. You do not have to pick a name to play.
• Run reports. Every finished run: the line, direction, train, weather and settings used, when the run started and finished, the stopping and timing error at each station, the points and grade, and whether the run ended in a wreck. Only complete, free runs of a whole line without a retry are placed on the boards; the rest are kept for the difficulty statistics.
• Device and performance data. Sent with each run report: the phone model, the Android or iOS version, the graphics chip, the app version, how long the scene took to build, and how smoothly it ran. This is how slow phones are found and fixed.
• Usage events. Small events such as a board being opened, a name being set, or alerts being switched on or off, with your player ID and a random per-session ID.

Board rows show your chosen name, or no name, together with your points, grade and rank. Nothing on the server identifies you beyond the player ID and the name you chose.

03Alerts (optional)

You can ask to be told when another player beats your best on a line. Nothing is set up unless you say yes, either on the card shown after your first run on a world board or with the ALERTS switch in SETTINGS. When you switch alerts on, the app asks Android or iOS for notification permission, asks Firebase Cloud Messaging for a push token (on iPhone, Firebase delivers through Apple's push notification service), and sends that token and your time zone to our server so that one notification can reach you, at most one a day per line and only in daytime. Switching alerts off, or deleting your data, removes the token from our server and from the phone. Firebase processes the token under the Google Privacy Policy, and on iPhone Apple delivers the notification under the Apple Privacy Policy.

04Crash reports (Firebase Crashlytics)

If the app crashes or stops responding, Firebase Crashlytics sends Google a crash report: the stack trace, the phone model and its Android or iOS version, a Firebase installation ID, and which line, train and screen the app was on. We use these reports only to find and fix bugs. Firebase Analytics is switched off in the app. Crash reports are kept by Firebase for 90 days and are processed under the Google Privacy Policy.

05Advertising (Google AdMob)

The free version of the app shows ads served by Google AdMob: a banner strip on the title board, the run board, the logbook and in the cab; an occasional full-screen ad after a run; and rewarded ads that you choose to watch for a perk in the game (a penalty waived, a second attempt at the daily run, a day's pass on a locked line, or keeping a streak through a retry). Rewarded ads are never shown unless you tap to watch one. Buying the ad removal through Google Play or the App Store turns off the banner and full-screen ads; rewarded ads stay available for you to choose.

To request an ad, Google's Mobile Ads SDK sends Google information about your device, such as its model, operating system, language, IP address (from which an approximate location may be inferred), the app's identifier, and the device's advertising identifier: the Android advertising ID, or on iPhone the IDFA, which Google receives only if you allow tracking (below). Google uses this to select and measure ads, and, where you have allowed it, to personalise them. Google processes this information under the Google Privacy Policy; how Google uses information from apps that use its services is described at policies.google.com/technologies/partner-sites.

Your choices:

• In the European Economic Area, the United Kingdom and Switzerland, the app asks for your consent before requesting any ad, using Google's consent form, and you can change your choice at any time from the AD CHOICES row in SETTINGS. Declining leaves you with non-personalised ads or none.
• On iPhone, the app shows Apple's App Tracking Transparency prompt before Google may use the IDFA. If you choose not to allow tracking, the IDFA is not shared and ads are not matched to you across other companies' apps and websites. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
• On Android, you can reset or delete your advertising ID, and opt out of ad personalisation, in Android's settings under Privacy → Ads. With the advertising ID deleted, ads are non-personalised.

Our server never receives the advertising ID or anything else from the ads SDK; we see only aggregate reports from Google about ad impressions and earnings.

06In-app purchases through Google Play and the App Store

Locked lines and the ad removal can be bought through Google Play's billing system on Android, or through Apple's App Store on iPhone. Payment is handled entirely by Google or Apple; the app never sees your payment details. The store tells the app which products your Google or Apple account owns so that a purchase can be restored, including after you reinstall the app or change phones. Purchase records are kept by Google under the Google Privacy Policy and the Google Play Terms of Service, or by Apple under the Apple Privacy Policy and the Apple Media Services Terms and Conditions.

07Information we do not collect

• No account, and no name other than the board name you choose.
• No email address, phone number, contacts, location, camera, or microphone. The app never reads your photos; photo mode only adds the pictures you take (section 1).
• Our server does not receive device identifiers such as the Android ID, Apple's identifier for vendors, or an advertising identifier; advertising identifiers are used only by Google's advertising SDK, as described in section 5.
• Nothing is sold, and nothing is shared with anyone beyond the services named in this policy: Amazon Web Services, which hosts our server; Google (Play, AdMob, Firebase Crashlytics and Firebase Cloud Messaging); and, on iPhone, Apple (the App Store and push notifications).

The Android permissions the app uses are vibrate, for the click of the master controller's notches; Google Play billing, for in-app purchases; internet, for our server and the ads; notifications, asked for only when you switch alerts on; and network state and the advertising ID, which Google's advertising SDK needs to request and show ads; on Android 7 to 9 only, storage, asked for the first time you save a picture in photo mode. On iPhone the app asks only for notifications, when you switch alerts on; adding to your photo library, the first time you save a picture in photo mode; and tracking, through the App Tracking Transparency prompt described in section 5.

08Where data is kept and for how long

• Data saved by the app stays in the app's private storage on your phone, which other apps cannot read, until you clear the app's data in Android settings or delete the app (and, on iPhone, from any phone backup that holds it).
• Run reports, usage events and board rows are stored on Amazon Web Services in the United States and sent over HTTPS. Rows on the day boards expire after 90 days and rows on the week boards after 2 years; all-time board rows and run reports are kept while your player record exists. Copies of run reports and usage events in our statistics archive are kept indefinitely, marked with the player ID only (see section 9).
• Push tokens are kept only while alerts are on.
• Crash reports are kept by Firebase for 90 days. Data held by Google for ads, purchases and messaging is retained according to Google's policies.

09Deleting your data

Open the logbook from the title board and tap DELETE MY DATA. The server removes your player record, your name, your push token, your run reports and your rows on every world board, and the app wipes its records on the phone. This cannot be undone. Copies of run reports and usage events kept in our statistics archive stay there, marked only with the player ID; because the player record and name are gone, nothing links them to you or to your phone any longer. Lines and the ad removal you have bought are restored from Google Play or the App Store. Uninstalling the app without deleting first leaves the anonymous run reports on the server; email us (section 14) with your board name and we will remove them.

10Summary of data handling

11Children

The app is a general-audience game and is not directed at children under 13, and we do not knowingly collect data from them. Ads are requested from Google as described in section 5. Google and Apple require an account of a qualifying age to make purchases; those age rules are theirs.

12Your rights

You can delete everything the server holds about you at any time with DELETE MY DATA (section 9), and you can see your own board entries and run history in the app. Because we hold no name, email address or account for you, we cannot look up your data from a request alone; if you email us with your board name we will find and remove your records. Progress on your phone is under your control through your phone's app settings. Purchase history is under your control through your Google or Apple account, and advertising choices through the AD CHOICES row in SETTINGS and your phone's ad and tracking settings. Depending on where you live you may have further rights, such as access, correction, portability or objection; contact us and we will respond.

13Changes to this policy

If the app's data handling changes, for example if a future version sends data anywhere new, we will update this page and change the effective date at the top. Continued use of the app after a change means you accept the updated policy.

14Contact

Dion
Email: support@dionyang.com (the address behind the FEEDBACK row in SETTINGS)