Privacy Policy
Co Meal Friendly
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Co Meal Friendly stores earned level stars, game settings, a suspended game round and synchronization state in a SQLite database on your iPhone. A random installation secret is generated automatically and kept in this device's Keychain. When synchronization is enabled, the app sends that secret over HTTPS and sends level stars and music, sound, haptics and reduced-motion settings to the backend. The server stores a SHA-256 hash of the secret, installation creation time, the progress snapshot, revision and update time. It does not store the raw secret. Suspended rounds and language preferences remain on your device. Visiting this website or using the API also sends normal network information, including an IP address and request metadata, to the hosting infrastructure. No name, email address, contacts, precise location, advertising identifier or account credentials are requested by the app.
How we use information
Local data lets you play offline, continue a paused shift, retain earned stars and apply your preferences. Installation authorization limits server reads, changes and deletion to the holder of that installation's random secret. Server storage synchronizes stars and settings for this installation when connectivity is available; it does not provide an account, cross-device transfer or recovery after loss of the secret. Technical request information supports delivery, rate limiting, service health and troubleshooting. There are no advertising, analytics, purchase or outbound-email features.
Service providers and sharing
The backend and this public website are hosted on Railway, which processes stored application data and network requests as the infrastructure provider. Railway and its infrastructure operators may process network and operational logs, including IP addresses and request metadata. Application error logs contain an event name and random request identifier, not progress payloads or installation secrets. Public website traffic on the custom domain also passes through Cloudflare's edge network. Cloudflare receives IP addresses and request metadata, and website response headers enable browser network-error reporting to Cloudflare. The app uses Apple operating-system networking, Keychain and local storage services, with no third-party analytics or advertising SDK. Data is not sold or shared for advertising. Information may be disclosed where legally required.
Data retention
Local progress remains until you delete it through Settings or remove the app. The app's local save directory is excluded from device backup, and the Keychain secret uses device-only accessibility. A new installation does not reuse a prior installation's secret. Server data remains on the Railway persistent volume until deletion is requested; no automatic expiry period is configured. The application does not configure scheduled database backups. Hosting and edge-network logs, network-error reports and any infrastructure copies follow the respective providers' applicable retention practices; the application does not set or promise a fixed retention period for them.
Deleting your information
Settings contains Delete my data. With a network connection, this deletes the installation and progress rows from the active server database, revokes the old secret, clears local progress and settings, removes the Keychain secret and turns synchronization off. Synchronization resumes only when you explicitly enable it, creating a new installation. An unsuccessful deletion is shown as an error and can be retried. Deleting the app alone does not send a server-deletion request. Database deletion clears active records and checkpoints the write-ahead log; infrastructure logs or copies may remain under the hosting provider's retention practices and are not promised immediate erasure. If you lose the installation secret, neither the app nor the contact address can identify or recover that installation's progress from an email address.
Permissions and your choices
The app does not request camera, microphone, photos, contacts, location, tracking or notification permissions. Music, sound effects, haptics and reduced motion can be changed in Settings; system Reduce Motion is also respected. Gameplay continues offline without server access. You can delete server data and leave synchronization disabled. Device or operating-system controls can further restrict the app's network access where available.
Your privacy rights
Depending on your location, you may have rights to access, correct, delete, restrict or object to processing of personal information, and to complain to an applicable supervisory authority. You can view progress in the game, change settings and request deletion in the app. For privacy questions or requests, contact raf.coldwell@icloud.com. This is a public privacy contact only; the app has no email delivery or support-ticket system. Do not email your installation secret. Because there are no accounts or email identifiers, a request without the installation's authorization may not let us identify the relevant server records.
Security
HTTPS protects communication in transit. Each installation uses a cryptographically random secret stored in device-only Keychain storage; the backend stores its hash and authorizes each progress operation using it. Local and server SQLite storage hold progress, with server file permissions, input validation, bounded requests and rate limiting. No shared application credential is embedded in the client. Possession of the installation secret permits access to that installation, so it should remain private. These measures reduce risk but cannot guarantee absolute security.
Children’s privacy
The game is intended for casual players aged 12 and older and is not directed to children under 12. It does not ask for age, name or contact information and has no accounts, advertising, chat or social sharing. A parent or guardian with access to the installation can use the in-app deletion control. Privacy concerns about a child's use may be sent to raf.coldwell@icloud.com.
Changes to this policy
This policy describes the current app and backend. If processing changes, the policy will be updated at this address and its effective date will change. Review this page for the current version. Material changes will be communicated through an appropriate app or policy update.