Privacy Policy
Roaming Brush Beasts
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Roaming Brush Beasts stores your creature drawings and names, saved designs, district progress, murals, routes, run replays, language and sound preferences locally on your iPhone. The app automatically creates a random installation authorization secret and a separate random encryption key in Keychain. The server receives the authorization secret in HTTPS requests and stores its SHA-256 hash, not the secret itself. Private backups contain a device-encrypted snapshot and an update time; the separate encryption key is not sent to the server. If you choose to publish a verified challenge, its title, obstacle route, creature shape measurements, identifier and publication time are stored as public content. The server receives ordinary network information such as request address and time; transient in-memory rate limiting uses request IP addresses or installation hashes and timestamps. The app does not use accounts, advertising identifiers, analytics SDKs or cookies.
How we use information
Local data makes drawing, offline play, checkpoints, replays and the mural gallery work. Installation authorization isolates private backups and restricts deletion of published routes to their creator. Encrypted backups allow restoration within an installation that still has its Keychain keys. Public route content lets players discover and play creator-verified challenges. Submitted input replay frames are processed to verify a route and are discarded after verification. Rate limits and operational error information protect availability and help diagnose failures.
Service providers and sharing
The application backend and its persistent storage are hosted by Railway, which processes service traffic and infrastructure information to provide hosting. Railway infrastructure may receive IP addresses, request metadata and operational logs. The application server does not log installation secrets, snapshots, replay bodies or IP addresses; it logs storage or exception type names on errors. Public challenge titles, routes and shape measurements are available to other players and anyone requesting the public catalog. Do not put personal information in a challenge title. There are no advertising, analytics, email delivery or social sign-in recipients in the app. Data is not sold by this application.
Data retention
Local game data remains until reset, removal of the app data by the operating system, or removal of the app. Keychain entries may remain separately from app files under iOS behavior. The server keeps the latest encrypted backup and published challenges until the installation deletes them; a new successful backup replaces the previous snapshot. Rate-limit entries are held only in process memory and expire after inactivity or service restart. No application-managed backup schedule or fixed infrastructure-log retention period is configured or asserted. Hosting-provider backup or infrastructure-log retention is governed by its actual service settings and policies, not a duration promised here.
Deleting your information
Reset all progress in Settings clears local drawings, routes, replays and district history and queues deletion of the installation’s server snapshot and published challenges. If offline, the deletion remains pending and is retried when the app is active online or when Sync now is selected. Own published challenges can also be deleted individually. Uninstalling alone does not send a server deletion request. Deleting database records removes them from active application use; SQLite storage pages, infrastructure logs or provider backups may retain residual copies until their normal overwrite or provider-managed expiration. The app cannot erase another person’s downloaded copy of a previously public route. Losing both installation authorization and encryption keys prevents access to or restoration of the private backup; no account recovery is offered.
Permissions and your choices
The game requests no location, contacts, camera, microphone, photo-library or notification permissions. Network access supports optional backup and public challenges; core drawing and play work offline. You can stop network activity using device network controls or stop using the application. You can change language and sound in Settings and reset stored game data there. iOS accessibility settings, including Reduce Motion, are respected.
Your privacy rights
You can view and edit local drawings and routes, restore an available installation backup, delete your public challenges and reset your data in Settings. Depending on your location, you may have rights to request access, correction, deletion or restriction of personal information. Privacy questions and requests can be sent to SophroniaVardon@icloud.com. This address is a privacy contact only; the app has no email delivery or support form. Because there are no accounts and the server stores installation hashes, we may be unable to identify your private records from an email address alone. Never send your installation secret or encryption key by email.
Security
HTTPS protects data in transit. Private backup snapshots are encrypted on the device with AES-GCM using a separate random Keychain encryption key. The authorization secret is installation-specific; the server hashes it and checks ownership for private backup access and deletion. Server input validation, payload limits, replay verification and rate limiting reduce abuse. Local state uses iOS file protection. Keychain keys use a this-device-only accessibility class and are not offered as a cross-device sign-in or recovery mechanism. No security system is infallible; access to an unlocked device or its keys can expose its data.
Children’s privacy
This creative game is intended for players aged 12 and older and may be used by teenagers. It does not ask for age, name, email, account details or precise location. Public route titles are user-entered, so players should never include identifying information. A parent or guardian can use the app’s reset and route deletion controls and may contact SophroniaVardon@icloud.com with privacy concerns. The service does not use behavioral advertising or child profiling.
Changes to this policy
This policy may change when the game’s processing or hosting changes. The current policy is available through Settings and at this public privacy URL, with its effective date. Material processing changes will be reflected in the updated policy and relevant application information. Contact SophroniaVardon@icloud.com for questions about a change.