Privacy Policy

1. Who we are

Sacrament SIA, a limited liability company (SIA) registered in Latvia (registration number 40203729609) ("we", "us", "our") operates the Cluedoku app and website (the "Service"). For the purpose of EU and UK data-protection law, we act as the controller of personal data processed through the Service.

We have not appointed a Data Protection Officer because our processing activities do not meet the thresholds in Article 37(1) of the EU General Data Protection Regulation. Privacy enquiries are handled directly by us at the contact address below.

2. Scope

This Privacy Policy describes how we collect, use, share, and otherwise process personal data in connection with the Service. It applies to all users of the Service. Third-party services we link to or that integrate with the Service operate under their own privacy policies, which we encourage you to review.

3. Personal data we process

We process the following categories of personal data, depending on how you use the Service:

• Account data — for example a chosen username, optional email address, password (stored as a one-way hash), avatar, language, and the date the account was created.

• Sign-in provider data — if you sign in or link your account with a third-party provider (such as Google, Apple, or Discord), we receive basic profile information from that provider, such as a provider account identifier and, where you allow it, your email address and display name. We use this only to create or link your account and to sign you in.

• Usage and gameplay data — for example the features you interact with, the levels you start and finish, the time you spend, in-game progression, in-game items and balances, ratings, achievements, leaderboard positions, and similar activity records.

• Social data — for example friend connections and any messages or interactions you have with other users through the Service.

• User-generated content — for example content you create or upload through any in-app editor or profile tool.

• Transaction data — where you make a purchase, the storefront, transaction identifier, product purchased, amount, currency, and status. We do not store full payment-card or wallet details; those remain with the payment processor.

• Technical and log data — for example IP address, device and operating-system information, app version, language and time-zone, identifiers used to keep you signed in, and diagnostic and error logs.

• Communications — any message you send to us, including the contents of support requests.

4. Why we process personal data

We use personal data to: provide and operate the Service; create, maintain, and secure your account; deliver game features such as progress saves, leaderboards, matchmaking, and social interactions; process purchases and grant entitlements; communicate with you about your account, the Service, and changes to it; protect the Service and our users against fraud, abuse, cheating, and security incidents; comply with our legal obligations; and improve and develop the Service.

5. Legal bases (EU / UK / EEA)

We rely on the following legal bases under the GDPR and the UK GDPR:

• Performance of a contract — to provide the Service to you and to fulfil purchases you make (Art. 6(1)(b)).

• Legitimate interests — to keep the Service secure, prevent abuse, analyse and improve our products, and operate our business (Art. 6(1)(f)). Where we rely on legitimate interests, you may object as described in section "Your rights".

• Compliance with legal obligations — for example tax, accounting, anti-fraud, and responding to lawful requests (Art. 6(1)(c)).

• Consent — where required by law (for example, certain marketing communications or non-essential analytics). You may withdraw consent at any time without affecting the lawfulness of past processing (Art. 6(1)(a)).

6. Sharing your personal data

We share personal data only as necessary to operate the Service or as required by law. Categories of recipients include:

• Service providers (processors) — including hosting, database, content-delivery, email, push-notification, customer-support, and analytics providers who act on our instructions and under written agreements.

• Payment processors and storefronts — Apple, Google, Stripe, and any other payment provider that processes a purchase on your behalf. They process your data under their own privacy policies.

• Sign-in providers — Google, Apple, and Discord, where you choose to authenticate or link your account through them. They process your data under their own privacy policies.

• Other users of the Service — limited information you choose to make visible (for example, username, avatar, public scores, or messages sent through in-app features) is visible to other users by design.

• Authorities and other third parties — where we are required by law, court order, or regulatory request, or where we believe in good faith that disclosure is necessary to protect rights, safety, or the integrity of the Service.

• Acquirers — in connection with a merger, acquisition, financing, reorganisation, or sale of business assets, in which case the recipient will be required to honour this Privacy Policy.

We do not sell personal data or share it with advertisers for cross-context behavioural advertising.

7. International transfers

Sacrament SIA is established in Latvia (European Union). Some of our service providers are located outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards under data-protection law, including the European Commission’s Standard Contractual Clauses (or the UK equivalent) together with supplementary technical and organisational measures. You may request a copy of these safeguards by contacting us.

8. Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Service to you, comply with our legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. When personal data is no longer needed, we will erase or anonymise it, or, where that is not technically feasible, securely isolate it from further processing.

9. Your rights

Subject to applicable law, you have the right to: access your personal data; request correction of inaccurate or incomplete data; request erasure or restriction of processing; object to processing carried out on the basis of our legitimate interests; receive a portable copy of certain data; and, where processing is based on consent, withdraw that consent at any time. To exercise any of these rights, please contact us at [email protected] from the contact details associated with your account.

If you are in the EU, UK, or EEA, you also have the right to lodge a complaint with your local data-protection authority. The supervisory authority for Sacrament SIA as a Latvia controller is Datu valsts inspekcija (https://www.dvi.gov.lv).

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide additional rights, including the right to know what personal information we have collected about you, the right to delete it, the right to correct inaccurate information, and the right to opt out of any "sale" or "sharing" as those terms are defined under California law. We do not sell personal information and do not engage in cross-context behavioural advertising; you can still submit a request and we will honour it. We will not discriminate against you for exercising these rights.

10. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe a child has provided us with personal data, please contact [email protected] so we can investigate and, where appropriate, delete the data. Where local law sets a higher digital-consent age, that higher age applies.

11. Cookies, local storage, and device identifiers

We use cookies, browser storage, and similar technologies that are strictly necessary to operate the Service, such as keeping you signed in and remembering your in-app session state. Where we ever use non-essential cookies or analytics technologies, we will request your consent in the Service before they activate, and you will be able to change your choice at any time.

On mobile, we may use platform-provided identifiers solely to deliver functionality you have enabled, such as push notifications. We do not use advertising identifiers for behavioural tracking.

12. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit, password hashing with industry-standard work factors, per-device session revocation, IP-based abuse mitigation, and routine purge of stale credentials. No system is perfectly secure, however; if you suspect your account has been compromised, please contact us at [email protected] promptly.

13. Our content and assets

The Service includes software, design, text, art, suspect and character designs, room and location layouts, environment art, icons, logos, audio, music, sound effects, animations, puzzle mechanics, clue language, level data, puzzle solutions, generators, and story content (collectively, the "Assets"). The Assets are owned by us or our licensors and are protected by copyright, trademark, database, and other intellectual-property laws.

Your use of the Service does not transfer or licence any of our Assets to you beyond the limited, personal, non-commercial right to play that is described in our Terms of Service. The collection of personal data described in this Privacy Policy does not in any way grant you, or anyone with whom you share data extracted from the Service, the right to copy, reproduce, distribute, modify, publish, scrape, mirror, data-mine, or otherwise reuse our Assets.

In particular, and without limiting our Terms of Service, the following are strictly prohibited and are not authorised by this Privacy Policy: (a) downloading, extracting, or republishing our Assets, in whole or in part, in any product, service, content, app, game, dataset, or experience that is not the Service itself; (b) using any of our Assets — including art, level data, puzzle solutions, clue text, suspect designs, and source code — to train, fine-tune, evaluate, benchmark, prompt, or ground any machine-learning model, generative AI system, or similar work; (c) using automated tools, bots, scrapers, browser extensions, or modified clients to access, collect, or stage our Assets at scale; (d) circumventing or attempting to circumvent any technical, contractual, or rate-limit measure designed to protect our Assets; and (e) presenting our Assets in a way that misrepresents their origin, suggests endorsement, or removes proprietary notices.

Notwithstanding any privacy-rights request, we will not export, hand over, or otherwise make available our Assets in response to a personal-data request — your personal data is yours, but the Assets remain ours. If you believe that any third party is misusing our Assets, please notify us at [email protected].

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the current version. Where changes are material, we will provide reasonable notice through the Service or by other means before they take effect.

15. Contact

Sacrament SIA, a limited liability company (SIA) registered in Latvia (registration number 40203729609).

For privacy enquiries and data-rights requests: [email protected].