Privacy Policy

Cyphagenics Limited is the data controller for the personal data described in this policy. That means we decide why and how it is processed, and we are the ones accountable for it.

This policy covers the cyphagenics.io website and the Cybertoids game on iOS and Android. It does not cover the App Store or Google Play themselves — Apple and Google handle your data under their own privacy policies when you download or pay for an app.

We group personal data by how it reaches us.

Data you give us directly. If you sign up to the launch list, that is your email address and nothing else. If you create an account in the game once it launches, that is your display name, email address and password (stored only as a salted hash — we never see it). If you contact support, it is whatever you choose to put in your message.

Data we collect automatically. When you use the website or the game we record technical and usage information so the service works and so we can fix what is broken:

• Device and app information — device model, operating system version, app version, language and region settings.
• Log and diagnostic data — IP address, timestamps, error reports and crash traces.
• Gameplay data — progress, scores, in-game choices and settings, so your save works and leaderboards are accurate.
• Website analytics — pages viewed and referring site, collected in aggregate. See the cookies section below.

Data we receive from others. If you install the game from the App Store or Google Play, the store tells us that a purchase or download occurred and gives us a transaction identifier. It does not give us your payment card details — we never receive or store those.

Under UK and EU GDPR we need a lawful basis for every use of personal data. Ours are set out below.

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that the processing is limited, expected and not intrusive. You can object to it at any time — see your rights below — and we will stop unless we have compelling grounds to continue.

The cyphagenics.io website uses strictly necessary cookies to function — for example, to remember your cookie preferences. These do not require consent because the site does not work without them.

Any analytics or measurement cookies are optional. We set them only if you agree, and you can change your mind at any time through the cookie controls on the site or by clearing cookies in your browser.

Cybertoids does not use third-party advertising identifiers and does not track you across other companies' apps and websites.

We do not sell personal data, and we do not share it with data brokers or advertisers. We do use a small number of service providers who process data strictly on our instructions under a written contract:

• Hosting and infrastructure providers who run our servers and store data.
• An email delivery provider, used to send launch and account emails.
• Crash reporting and analytics providers, used to diagnose faults.
• Apple and Google, who distribute the app and handle payments in their stores.

We will also disclose personal data where the law requires it — for example in response to a valid court order — or to establish, exercise or defend legal claims. If we are ever involved in a merger, acquisition or sale of assets, personal data may transfer to the buyer, and we will tell you before that happens and explain your options.

We aim to keep personal data in the UK or the European Economic Area. Where a provider processes data outside those areas, we make sure the transfer is protected by an adequacy decision, by the UK International Data Transfer Agreement, or by Standard Contractual Clauses with the UK Addendum, together with any additional safeguards the transfer needs.

You can ask us for a copy of the safeguards that apply to a particular transfer by writing to privacy@cyphagenics.io.

We keep personal data only as long as we need it for the purpose we collected it, then delete or anonymise it.

Under UK and EU data protection law you have the following rights over your personal data:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted where there is no good reason for us to keep it. Request this at https://cyphagenics.io/delete-account, or confirm deletion from Settings in the app. Confirming in the app schedules deletion with a 30-day grace period: access is removed immediately, and personal data is purged after that window unless we must keep specific records by law.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive data you gave us in a common machine-readable format, or have it sent to another provider.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it without affecting anything we did before you withdrew it.
• Automated decisions — we do not make decisions with legal or similarly significant effects using automated processing alone.

To exercise any of these, email privacy@cyphagenics.io. We will respond within one month. There is no charge, and we will only ask you to verify your identity where we genuinely need to before releasing data.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are in the EEA you can complain to your local supervisory authority. We would rather you came to us first so we can put it right.

Cybertoids is designed to be family-friendly, and we expect families to play it together. Accounts, however, are for people aged 13 and over. The service is not directed at children under 13 and we do not knowingly collect their personal data.

If you are a parent or guardian and believe a child under 13 has given us personal data, email privacy@cyphagenics.io and we will delete it promptly.

We do not profile players for marketing purposes, and we do not serve behavioural advertising to anyone in the game regardless of age.

We encrypt data in transit with TLS and at rest, restrict access to the people who need it to do their jobs, store passwords only as salted hashes, and keep our systems patched. We review access regularly and log administrative actions.

No system is perfectly secure. If a breach happens that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly without undue delay.

We update this policy when the way we handle data changes. The effective date at the top of the page always tells you which version is current.

If a change materially affects your rights — for example a new purpose or a new category of data — we will tell you by email or in the app before it takes effect, and where the law requires it we will ask for your consent.

Questions, requests or complaints about privacy: privacy@cyphagenics.io. Anything else: support@cyphagenics.io.

You can also write to us at First Floor Office 25a, CEME Innovation Centre, Marsh Way, Rainham RM13 8EU, United Kingdom.