Privacy Policy

Last updated: 11 Sep 2026 · Effective: 11 Sep 2026

This policy explains what personal data Riddleix Studios collects when you use The Lost Phone, how we use it, who we share it with, and what rights you have.

1.Who we are

Riddleix Studios ("we", "us") is the data controller for the personal data described in this policy.

Trading name: Riddleix Studios
Operated by: Parthsarthi, Spanish autónomo
Contact: riddleix.studios@gmail.com
Jurisdiction: Spain

If you are in the European Economic Area, you can contact us using the details above for any question about how we handle your data. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es.

2.What data we collect

We collect the minimum data needed to run the game and let you sign in across devices.

If you play as a guest (no sign-in)

A guest identifier — a random UUID generated on your device the first time you open the app. It does not identify you personally.
Gameplay state — which episodes you've started or completed, which clues you've solved, items you've pinned. Associated only with your guest identifier.
Nickname — if you choose one, or one selected for you from a fixed word list.

If you sign in with your email

Everything above, plus:

Your email address, used to send you a one-time sign-in link ("magic link"). We do not send marketing.
Sign-in event logs — timestamp, IP address, and user-agent string of each sign-in attempt, retained by our authentication provider for security and abuse prevention.

Leaderboards

If your play results in a leaderboard entry, your nickname and your result (for example, completion time) are visible to other players. Your email is never shown publicly.

We do not collect

Your real name, physical address, or phone number
Your device's advertising identifier
Location data
Contacts, camera, microphone, or storage data
Any data via third-party analytics or advertising SDKs — the app does not include any

3.Legal basis (GDPR)

We rely on the following legal bases under Article 6 of the GDPR:

Contract performance (Art. 6(1)(b)) — for the data required to provide the game you're playing, including gameplay state and sign-in.
Legitimate interests (Art. 6(1)(f)) — for security logging and abuse prevention on authentication. Our legitimate interest is protecting the service; you can object to this processing using the contact details above.
Consent (Art. 6(1)(a)) — where we ever ask you explicitly for something optional. We currently do not.

4.How we use it

To run the game — save your progress, sync it across your devices if you sign in.
To authenticate you — issue and verify magic-link sign-in tokens.
To display leaderboards, if applicable.
To detect and prevent abuse — repeated failed sign-ins, spam, exploitation.
To respond to your questions or deletion requests.

We do not profile you, target advertising at you, or make automated decisions with legal effects.

5.Who we share it with

We use a small number of processors and infrastructure providers. Each is bound by a data-processing agreement and processes your data only on our instructions.

Provider	Purpose	Data	Location
Supabase Inc.	Database, authentication, file storage	All data listed in §2	EU
Vercel Inc.	Web hosting for thelostphone.com	Server logs (IP, user-agent, request path)	United States
Supabase Inc. (transactional email via shared sender noreply@mail.app.supabase.io)	Delivery of magic-link sign-in emails	Your email address, the sign-in link	United States
Google LLC / Google Play	App distribution on Android	Install/uninstall counts, crash reports (via Google Play, not us)	Global

If your data is processed outside the EEA, the transfer is covered by the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

We do not sell your data. We do not share your data with advertisers.

6.Retention

Gameplay data — kept while you have an active account, or (for guests) while the guest identifier remains on your device. Anonymised aggregate statistics may be kept indefinitely.
Email address — kept while your account is active.
Sign-in logs — retained by our authentication provider for 30 days for security purposes.
Deleted accounts — see Delete Your Account. Personal data is removed from live systems within 30 days and from backups within a further 30 days.

7.Your rights

Under the GDPR, you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Erase your data ("right to be forgotten") — see Delete Your Account for the quickest route.
Restrict or object to processing.
Data portability — receive your data in a machine-readable format.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with the AEPD (see §1).

To exercise any of these rights, email riddleix.studios@gmail.com. We will respond within 30 days.

8.Children

The Lost Phone is rated for teens (13 and older) and is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.

9.Cookies and similar technologies

The mobile app does not use cookies. The website at thelostphone.com uses only strictly necessary cookies to keep you signed in. No analytics or advertising cookies are set.

10.Security

Your data is encrypted in transit using TLS (HTTPS/WSS) and encrypted at rest in our database provider's infrastructure. Sign-in uses one-time links rather than passwords, which removes an entire category of credential-theft risk. Only the studio operator has administrative access to the production database.

No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

11.Changes to this policy

We will update this policy when our practices change. The "Last updated" date at the top of the page reflects the most recent version. Material changes will be announced within the app.

12.Contact

Riddleix Studios
Email: riddleix.studios@gmail.com
Postal: Urb Santa Clara 17, Bargas, Toledo

For questions about this policy, deletion requests, or any other data-protection matter, email us. We respond within 30 days.