This policy explains what the Candy Path app and the candypath.app website do with your data. We collect as little as we can.
Who is responsible
IdeaBridge GmbH, Jahnstr. 17, 63808 Haibach, Germany. Managing director: Philipp Schickling. Email for privacy questions: support@candypath.app. Legal notice: Impressum.
The short version
- No ads. No tracking across other apps or websites. We do not sell data.
- No email, phone number or real name is needed to play.
- For cloud save, friends and leaderboards, the app creates an anonymous online account.
- You can delete your online data yourself in the app, at any time.
What stays on your phone
Settings and a working copy of your progress are stored on your device. Reminders are local notifications that your phone schedules itself. We do not send push notifications and we do not collect a push token.
What the app stores on our server
When you first open the app, it creates an anonymous account on its own. It does not ask for your name, email or phone number. The account holds:
- a random account ID;
- a display name (generated for you, and you can change it) and a jelly colour;
- your 6-character friend code and your friendships;
- your daily puzzle results (the day and your solve time) and your friend streaks;
- a backup of your game progress and in-game items (cloud save).
We use this data for three purposes: cloud save, friends and leaderboards. The legal basis is performance of the contract with you (Art. 6(1)(b) GDPR). We do not use it for advertising.
Who can see what
- Your friends see your name, your jelly colour, whether you played today, your time (once they have also solved that day's puzzle) and your shared streak.
- The global top 50 of each day shows name, jelly colour and time to all players.
- Choose a display name you are happy to show. Please do not use your real name if you prefer not to.
Our hosting provider
The data is stored with Supabase as our processor, in the EU (Frankfurt, Germany). We have a data processing agreement with them.
Link with Apple (optional)
You can link your account with Sign in with Apple, for example to restore your progress on another device. We receive only Apple's anonymous user identifier. We do not ask for your email. If you choose to share it, Apple gives it to us anyway, and we use it only to find your account again.
Purchases
In-app purchases are processed by Apple. We receive no payment data. The app only learns which items you bought, so it can unlock them.
Usage statistics
The app does not currently measure how you use it.
The website
This website uses no advertising or analytics cookies. The daily puzzle in the browser saves your best time and streak in your own browser (local storage) and sends them nowhere. The site is delivered by Cloudflare, which may process technical request data such as your IP address to deliver the pages and keep the site secure.
Children
Candy Path is suitable for all ages. We do not knowingly collect personal data from children beyond the anonymous data described above. If you are a parent and want your child's data removed, delete it in the app or write to us.
How long we keep data
We keep your online data until you delete it. In the app, go to Settings and tap "Delete online data". This deletes your account and all its rows immediately. You can also email support@candypath.app and we will delete it. Deleting the app alone does not remove the online account.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection under the GDPR. Email support@candypath.app and, if you can, include your friend code so we can find your account. You can also complain to a data protection authority. For us, that is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Changes
If we change this policy, we will update the date at the top. If a change matters for your data, we will also tell you in the app.