Privacy policy
Cartouche is a daily puzzle app made by Ogee Labs Ltd. You can play without an account; this policy explains what we handle when you do, and when you don't.
Last updated: 25 October 2026.
Who we are
The data controller is Ogee Labs Ltd, company number 17543263, registered office 66 Paul Street, London, England, EC2A 4NA ("we"). Contact us about privacy at privacy@cartouche.games.
If you play without an account
- Your games, streaks and settings stay on your device. We don't receive them.
- When the app downloads puzzles, our content network (Cloudflare) handles the request, which includes your IP address and device information. We use this only to deliver the puzzles and keep the service secure.
- If the app crashes, it sends a crash report (device model, operating system, app version and what the app was doing) to our crash-reporting service (Sentry) so we can fix it. Crash reports don't include your name or account.
If you sign in
Signing in with Apple or Google is optional. It lets you keep your history across devices, add friends and use the supporter tier.
| What | Why | Legal basis |
|---|---|---|
| Your Apple or Google account identifier and email address (which may be an Apple private relay address) | To create and sign in to your account | Contract |
| Your name from Apple or Google, used once to set a default display name (first name and initial, e.g. "Ada L."), and the display name you choose | Shown to your friends on leaderboards | Contract |
| Your results: the puzzle, your guesses in order, your score and the time you spent | To score your game fairly on our server, keep your history, rank friends' leaderboards and count anonymous statistics | Contract |
| Friends and challenge links you create or accept | To run friends and challenges | Contract |
| Reports you make about a friend's display name, or reports about yours | To keep display names appropriate | Legitimate interests (a safe service) |
| A setting that turns social features off, set from your device's age information if you're under 13 | To protect children: they can play, but not use friends or names | Legal obligation and legitimate interests |
| A token from Sign in with Apple | So we can revoke Apple's link to Cartouche when you delete your account, as Apple requires | Contract |
| Whether you have the supporter tier, its renewal date and store (from our subscription provider, RevenueCat) | To unlock supporter features. Apple or Google take the payment; we never see your card details | Contract; tax records are a legal obligation |
| Limited records of actions such as accepting challenges | To prevent abuse (rate limits) | Legitimate interests |
What others can see
- Friends see your display name and your results on each day's friends leaderboard. They never see your guesses, email or account details.
- Everyone can see anonymous statistics for each puzzle (how many players reached each score). We publish them only once at least 50 players have a result, and show small counts as "fewer than 10", so no individual can be picked out.
- We don't sell your data, and we don't show advertising.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts and the database | London, UK |
| Cloudflare | Delivering puzzles, this website | Global network |
| Sentry | Crash reports | See Sentry's terms |
| RevenueCat | Supporter-tier subscription status | United States |
| Apple and Google | Sign-in, app distribution, payments | Their own terms apply |
| Google Workspace | Our email, if you write to us | See Google's terms |
Where data leaves the UK, we rely on the safeguards UK law allows, such as adequacy regulations or the international data transfer agreement.
How long we keep it
- Account data, results, friends and challenges: until you delete your account. Deleting it removes them; anonymous statistics already counted stay counted.
- Challenge links stop working after 7 days; abuse-prevention records are deleted after they expire (a day at most).
- Crash reports: as set in our crash-reporting service (typically 90 days).
- Emails to support: as long as we need them to help you, then deleted.
- Records needed for tax: as long as the law requires.
Deleting your account
In the app, go to You, then Account, then Delete account. Or see how to request deletion without the app. If you have the supporter tier, cancel it in your App Store or Google Play settings first: deleting your account doesn't stop the store billing you.
Children
Cartouche is for a general audience and isn't directed at children. Anyone can play, but if your device indicates you're under 13, friends, display names and challenges are turned off.
Your rights
You can ask to see, correct, delete or move your data, and object to or restrict how we use it. Write to privacy@cartouche.games; we'll reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this policy, we'll update this page and the date above, and tell you in the app if the change matters.