Legal
Privacy Policy
Quidsmith is a game that runs on your own device, in a browser or in the Android and iOS apps. It is made by Mulian Ltd, a small company in Edinburgh. This policy explains the limited data involved when you play, the lawful basis for it, and the choices and rights you have. Plain English, no surprises.
The short version
- You can play the whole game without an account. We do not ask for your name, email or any sign-up details to play.
- Playing signed out, your saved game and your cookie choice stay on your own device and are not sent to us.
- An optional account (sign in with Google, with Apple or with your email address) adds saves that follow you between devices, challenge rooms and hiscores. If you use one, we do hold data about you, see Accounts.
- You can delete your account and everything attached to it at any time, from Account in the game or by emailing us, see Deleting your account.
- There is no third-party advertising. Analytics, on the website only, stays off until you accept it, and you can change that at any time from Cookie settings in the game. The apps have no analytics at all.
- We only email you about the game if you ask us to. The newsletter is off unless you turn it on, and you can stop it at any time, see Newsletter.
- Membership is optional. If you buy one, payment is handled by Stripe on the website, or by Google Play or the App Store in the apps, and your card details never reach us, see Payments.
Who is responsible
The data controller for Quidsmith is Mulian Ltd, a private limited company registered in Scotland (company number SC903533), registered office 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN. This policy covers the Quidsmith website and the Quidsmith apps for Android and iOS. For any privacy question or request, including access, correction or erasure, contact hello@quidsmith.com.
What stays on your device
Quidsmith saves your progress in your browser's local storage so you can pick up where you left off, and it stores your cookie consent choice so it can stop asking. Both are strictly necessary for the game to work and are kept in your browser. The lawful basis is our legitimate interest in providing a working game (and, for the consent record, our legal obligation to honour your choice). Clearing this site's data in your browser removes them and resets the game.
While you are signed out, none of this is transmitted to us. If you choose to sign in, a copy of your save is also stored on our server so it can follow you to another device, see Accounts. Your cookie choice always stays on your device only.
Accounts (optional)
You never need an account to play. Signing in exists so your progress can follow you between devices, and so you can take part in challenge rooms and hiscores, which by their nature involve other people seeing something about you.
What we receive when you sign in. You can sign in in three ways. With Google Sign-In, Google passes us your email address and your Google display name. Google also sends a link to your profile picture; we discard it as it arrives and never store or show it. We never see your Google password, and we ask Google for nothing beyond those basic profile details. With Sign in with Apple, Apple passes us your email address, or, if you choose Apple’s Hide My Email, a private relay address that forwards to you, and the first time you sign in, your name if you choose to share it. We never see your Apple ID password. With email sign-in, you type your email address and we send it a one-time link and code; we receive only that address. Whichever you use, there is no password for us to store.
What we store. Linked to your account: your email address, a display name (taken from your Google name at first, or chosen by you, and changeable at any time), your saved games, your cross-run career statistics, and, if you take part, your challenge-room results and hiscore entries. A hiscore entry also stores the record of decisions you made during that run, because scores are re-simulated on our server to check they were genuinely played rather than typed in.
What other people can see. Your display name and your scores are public on hiscore boards, in any challenge room you join, and on any result page you choose to publish. Nothing else about your account is public: not your email, and not your saved games. Publishing a result page is always your explicit choice, never automatic.
Lawful basis. Providing the account features you asked for (performance of a contract), and our legitimate interest in keeping competitive boards honest by verifying submitted runs.
Deleting your account
You can delete your account in either of two ways:
- In the game: Account → Delete account, on the website or in the apps. It takes effect immediately.
- By email, without the game: write to hello@quidsmith.com from the address you sign in with, with “delete my account” in the subject. We will confirm it is your account, delete it and reply within 30 days, usually much sooner.
Deletion permanently erases your account, email address, display name, cloud saves, statistics, room results, hiscore entries, newsletter record and the membership record we hold. It cannot be undone. The only things kept are those described under Retention. The save on your own device is deliberately left alone, so you can carry on playing as a guest. Deleting your account does not cancel a store subscription, see Payments.
Newsletter (optional)
If you have an account, we can send you an occasional email about new features and what has changed in the game. A few times a year at most.
You have to ask for it. We ask once, shortly after you create your account, with nothing pre-selected. If you do not answer, or you close the message, you are not signed up. We never add you because you registered, bought something or played a lot.
What we use. The email address on your account, plus your display name to address the email. Nothing about how you play, and no run data.
Lawful basis. Your consent. We keep a record of when you consented and which version of the wording you were shown, so we can demonstrate that you actually chose it.
Stopping it. Turn off the newsletter under Account in the game, or use the unsubscribe link at the bottom of any newsletter we send. Both take effect immediately and neither affects your account. You will still receive service messages, such as sign-in links and codes, a reminder shortly before a one-off membership pass ends, and notices about your account itself, because those are how the account works and are not marketing. Our emails are sent through Resend, acting as our data processor.
Never shared. We do not sell, rent or pass your email address to anyone else for their own marketing.
Payments (optional)
The game is free and needs no payment. Optional membership can be bought in two places, and in neither do your card details reach us.
On the website. The payment is handled by Stripe. Purchases are sold through Onelink, Stripe's checkout service, whose reseller (Sold through Link, LLC) is the Merchant of Record. Stripe and Onelink are their own data controllers for the payment: you enter your card or payment details with them, not with us, and your card details never reach us.
In the Android and iOS apps. The purchase is made through Google Play or Apple’s App Store, using the payment method on your store account, under the store’s own terms and privacy policy. We use RevenueCat, acting as our data processor, to check purchases with the store and keep your membership in step between the apps and the website. RevenueCat receives your account’s internal user ID (a random identifier, not your name or email), the purchase receipt or token from the store, the product bought and basic device information such as platform and app version. It does not receive your payment details.
What we receive and store. From Stripe, or from the store via RevenueCat, we receive a payment and customer reference and your membership status, which we store against your account so we know what you are entitled to. We do not receive or store your card number. The lawful basis is performance of the contract to provide the membership you bought.
International transfers. Stripe, Google, Apple and RevenueCat may process payment data outside the UK, including in the United States, under appropriate safeguards such as the UK extension to the EU-US Data Privacy Framework and standard contractual clauses. See Stripe's Privacy Policy.
Cancelling and deletion. You can cancel a membership at any time, which stops future renewals. Cancel it where you bought it: a website membership from the "Cancel membership" button on your account page, which opens Stripe's billing portal (or email us and we will help), and an app membership in Google Play (Payments & subscriptions) or in your Apple ID subscription settings. We cannot cancel a store subscription for you. Deleting your account removes the membership record we hold but does not stop the billing, so cancel an active subscription as well.
Analytics
With your consent we use Google Analytics 4 to understand, in aggregate, how the game is used, for example which screens are visited, so it can be improved. Analytics is optional and off by default; the lawful basis is your consent. You accept or decline it through our own message on first visit and can change your choice at any time from Cookie settings. The tag runs in Google's Consent Mode: until you accept, it stores nothing on your device and sends only anonymous, cookieless signals. If you accept, Google Analytics may set cookies and collect usage data including a randomly generated identifier and an approximate location derived from your IP address. We do not receive your name, email or precise location, and we do not use this data to identify you.
Advertising
Quidsmith carries no third-party advertising. We removed Google AdSense entirely: no advertising script is loaded on any page, no advertising cookie is set, no advertising identifier is created, and no data about you is shared with an advertising network or used to build a profile. There is nothing here to opt out of.
The only promotional content you may see is written by us and is about Quidsmith itself, for example an invitation to support the project. It is served from our own site, sets no cookies and makes no request to any other company. Members do not see it at all, because an ad-free game is part of what membership provides.
Google Analytics, described above, is the only third-party service that runs in your browser. Its advertising signals are permanently switched off in our configuration, so your analytics data cannot be used for advertising or personalisation even if you accept analytics.
Cookies and your choices
Necessary storage (your save and consent choice) is always on. Analytics is optional and off by default, and there is no advertising storage to consent to. You can review or change your choice at any time using the Cookie settings link in the game, which reopens the analytics message; declining returns analytics to its no-cookie state.
Retention
Data held on your device (your save and consent choice) remains until you clear it. Google Analytics data, if you accept analytics, is retained according to Google's settings, typically up to 14 months for user-level data.
If you have an account, the data attached to it is kept for as long as the account exists, and is erased when you delete it. Two things deliberately outlive the account: a hiscore board that has already closed keeps a frozen record of its final standings, which stores a display name and score but is detached from the account; and a result page you chose to publish stays public until you delete it. If you have never signed in, we hold nothing about you on our servers at all. Payment providers and the app stores keep their own transaction records for as long as the law requires, under their own policies.
Third parties and international transfers
Account data is stored on our behalf by Supabase, acting as our data processor, on servers in Ireland (EU). Google provides Google Sign-In and tells us your email and name when you choose to use it. Apple provides Sign in with Apple and tells us your email address (or a relay address) and, the first time, your name if you share it. Our emails are sent by Resend, and purchases are handled by Stripe, Google Play, the App Store and RevenueCat, as described under Payments.
When you accept analytics on the website, your browser communicates directly with Google, which may process data outside the UK, including in the United States, under appropriate safeguards such as the UK extension to the EU-US Data Privacy Framework and standard contractual clauses. Google's handling of this data is governed by its own policies. See Google's Privacy Policy and the Google Analytics opt-out add-on.
Your rights
Under UK GDPR you have the right to access, correct or erase personal data, to object to or restrict processing, to data portability, and to withdraw consent at any time. You can exercise most of these yourself: change your display name, turn the newsletter off or delete your account from Account in the game, change your cookie choice from Cookie settings, or clear this site's data to remove your local save. For anything else, contact hello@quidsmith.com. You also have the right to complain to the Information Commissioner's Office (ICO).
The apps
The Android and iOS apps are the same game as the website, made by the same company, handling data the same way. Three differences are worth stating plainly.
- No analytics, at all. The website loads Google Analytics only if you accept it. The apps load no analytics, set no analytics cookies and show no cookie message, because there is nothing to consent to.
- Your sign-in is stored by the operating system. In the apps the session is held in the platform's own secure key-value store rather than in browser storage, so it survives the housekeeping that clears a browser.
- Purchases go through the store. Membership bought in an app is paid through Google Play or the App Store and checked by RevenueCat, see Payments. A membership bought on the website or in an app works in both once you are signed in.
Apple and Google receive no game data, saves, scores or account details from us. They see only what any app distributor sees: that the app was downloaded, any purchase you make through their store, crash reports the operating system collects, and any review you choose to write. The apps request no device permissions beyond internet access and use no advertising identifier.
Children
Quidsmith is intended for a general audience and is not directed at children under 13. We do not knowingly collect data from them.
Changes
If this policy changes materially, the date above is updated and, where the change affects cookies, the consent message asks again. Continued play after an update means the current policy applies.