Privacy Policy

For the SuperInk mobile app and superink.app · Last updated 23 August 2026

SuperInk is a puzzle game. It collects the least it can get away with: enough to remember which puzzles you have solved and to put you on the highscore list. There is no advertising, no advertising identifier, no analytics product and no tracking across other apps or websites. Nothing is ever sold.

This policy tells you exactly what is collected, what it is used for, everyone it is shared with, how it is protected, how long it is kept and how to have it deleted.

Who is responsible

SuperInk is developed and published by camelstack GmbH, the developer named on the App Store and Google Play listings for SuperInk — app id com.camelstack.superink. camelstack GmbH is the controller of the data described here and is responsible for it.

Contact for anything to do with privacy, including requests to see or delete your data: contact@camelstack.com.

What this policy covers

The SuperInk app on iOS and Android, and the website at superink.app. Services linked from the app — the App Store, Google Play, Twitter/X — have their own policies and are not covered here.

What is collected

Data you give us

• Your email address — only if you choose to log in. Logging in is optional; it exists so your progress survives a reinstall or a change of device.
• Your username. A random nickname is generated for you when you first play; you can change it to whatever you like.
• Puzzle solutions you submit, and the puzzles you build yourself if you use the create mode.
• Feedback you send. The Feedback screen sends the star rating you tap and any message you type. Please do not put personal details in that box — it is a free-text field and whatever you write in it is what gets sent.

Data collected automatically

• A random install identifier (installId). When you first open the app it generates a random string and stores it on your device. It is not derived from your device, your hardware, your advertising identifier or anything about you. The app sends it with each request so the server can attach your solved puzzles and your score to something. If you delete and reinstall the app a new one is generated, and the previous progress is no longer reachable.
• Your score and which puzzles you have completed.
• App version and platform (iOS or Android), sent with each request so the server can keep older versions of the app working. This is not stored against your account.
• Your IP address, which any internet request necessarily reveals to the server. It appears in short-lived server logs and is used to operate and secure the service. It is not stored in the database and not linked to your account.
• Crash and error diagnostics — the error, where in the code it happened, and basic device and app-version information — so bugs can be found and fixed.

What is not collected

SuperInk does not access or collect your location, contacts, calendar, photos, microphone, camera, files, SMS, call logs, health data, financial data, installed-app list, or your device's advertising identifier. There are no third-party advertising or analytics SDKs in the app.

What it is used for

• to run the game: saving your progress, scoring it, and showing the highscore list
• to let you log in without a password, and to keep you logged in
• to keep older app versions working, and to find and fix crashes
• to answer feedback and support messages
• to protect the service against abuse

It is not used for advertising, for profiling, or for anything unrelated to the game. If you are in the EU or the UK: this data is processed to perform the service you asked for, and — for crash reporting and abuse protection — on the basis of a legitimate interest in keeping the game working.

Who the data is shared with

Nobody, in the sense that word usually means. Your data is not sold, not rented, not exchanged, and never handed to advertisers, data brokers or anyone else for purposes of their own. No third party is allowed to use it for anything but running SuperInk on our instructions, and we disclose it to authorities only where the law actually requires it.

What that leaves is infrastructure. Three suppliers necessarily hold data on our behalf, because software has to run somewhere and email has to be sent by something. They act as processors under contract — they are not free to do anything else with it, and it stays ours.

• MongoDB Atlas — hosts the database, so it holds what is stored on the server: your install identifier or email address, username, score, solutions and created puzzles.
• Resend — sends the login code, so it is given your email address in order to mail it to you. Only if you choose to log in; never otherwise.
• Slack — carries the messages you send from the Feedback screen to a private channel only the developer reads. Whatever you type is what is delivered.

The rest of our providers get no personal data at all

The other services SuperInk runs on — the hosting platform that serves the API and this website, the crash reporter, and the update service — receive only anonymous operational data. That is not a promise about their good behaviour; it is a property of what is sent to them:

• Crash reports carry no identity. The app and the server never attach a user, an email address, a username or an install identifier to an error report, and personally identifying request data is not enabled. A report is the error, the place in the code, and the app and device version — it cannot be traced back to your account, by us or by anyone else.
• Server logs are not indexed by account and hold no account data.
• The update service sees only that some installation asked whether a newer version exists, and which app and platform version it is on.

IP addresses reach these providers because no internet request can avoid revealing one. They are used to deliver and secure the response, are never stored in our database, and are never linked to your account.

What other players can see

The highscore list inside the app shows usernames and scores, and puzzles you publish in create mode are playable by others. Nothing else about you is visible to other players — in particular, your email address is never shown. Choose a username you are happy for other people to see; you can change it at any time in the app's menu.

Where the data lives

The database and the functions that serve the API run in the European Union (Dublin). Our other providers may process data outside the EU, including in the United States, under the safeguards their own policies describe — for transfers out of the EEA that means the European Commission's standard contractual clauses or an equivalent mechanism.

How the data is protected

• Everything is encrypted in transit. The app talks to the server over HTTPS, and the server talks to the database over an authenticated, encrypted connection.
• Encrypted at rest. The database is stored encrypted by MongoDB Atlas.
• There are no passwords to steal. Login is passwordless: we email you a 6-digit code that can be used once, stops working after ten minutes or five wrong guesses, and is stored only as a hash while it is valid. SuperInk never receives, and never stores, a password. A signed token then keeps you logged in until you log out or delete your account.
• The database is not reachable from the public internet. It requires credentials, and those credentials are held in a managed secret store rather than in the app or in the source code.
• Access is limited to the developer, on accounts protected by two-factor authentication, and only where it is needed to operate or fix the service.
• The app collects the minimum. Anonymous play is keyed to a random string rather than to any device or advertising identifier, so there is little to lose in the first place.

No system can be guaranteed perfectly secure. If a breach ever affects your data we will notify you and the competent supervisory authority as the law requires.

How long it is kept

• Your account data — username, score, solutions, and your email address if you logged in — is kept for as long as you keep the account, and is erased as soon as you delete it. There is no other expiry: the game is meant to remember your progress indefinitely, so nothing is deleted behind your back.
• Login codes are deleted the moment they are used, and in any case within ten minutes of being sent.
• Puzzles you published stay in the game after deletion, as puzzles, but are no longer linked to you or to any identifier of yours.
• Crash and error reports — which carry no identity in the first place — are deleted automatically by our crash reporter after its retention window, currently 90 days.
• Server logs, including IP addresses, are short-lived — days, not months — and expire on their own.
• Feedback messages and support emails are kept while the issue is open and for a reasonable period afterwards, so that a follow-up still makes sense, and are deleted on request.

Deleting your data

You can delete your account and everything attached to it at any time, from inside the app or from this website. It is an immediate and permanent deletion, not a deactivation: the account record and every solution belonging to it are removed from the database in the same request, and it cannot be undone.

This works whether or not you ever logged in — if you only played anonymously, the server still holds a profile for your device, and the same button removes it.

Full instructions, including how to do it after you have already uninstalled the app: Delete your account. Requests sent by email are handled within 30 days, and usually much sooner.

Your rights

You can ask for a copy of the data held about you, ask for it to be corrected or erased, ask us to restrict or stop processing it, ask for it in a portable form, and object to processing based on a legitimate interest. Write to contact@camelstack.com and it will be dealt with. There is no charge, and using these rights will never get you locked out of the game.

If you are in the EU or the UK and think your data has been mishandled, you also have the right to complain to your national data protection authority.

Children

SuperInk is not directed at children and does not knowingly collect data from anyone under 16. If you believe a child has provided data, write to contact@camelstack.com and it will be deleted.

Changes to this policy

If what the app collects changes, this page changes with it, and the date at the top is updated. Material changes will also be announced in the app. This page is always the current version, and it is the one both store listings link to.

Contact

Questions, requests or complaints about any of this: contact@camelstack.com. You can also reach us through the support page, or from the Feedback entry in the app's menu. By post: