Privacy Policy
Boat in Post
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Boat in Post stores campaign completion, bonus stamps, edited routes, paused voyages, sandbox layouts, Harbour Sort progress, language, audio and motion preferences, and optional reminder settings locally on your iPhone. Daily Post also keeps a local queue of unsent results. When you use Daily Post, the service creates a random installation secret stored in the iOS Keychain. The PostgreSQL database stores only a hash of that secret, its creation time, and your daily result dates, turn counts, bonus status and creation times. Daily level definitions are shared game content, not personal records. The app does not request your name, email address, contacts, photos or location. Requests to the API and public website necessarily expose network information such as IP address, request time and endpoint to the hosting infrastructure. The application uses temporary rate-limit counters keyed by network address and token hash; it does not intentionally log raw tokens or result bodies.
How we use information
Local data lets you continue puzzles, retain earned stamps and use your preferences. The installation secret authorizes access only to the daily results belonging to this installation. The server supplies daily game content, stores results idempotently and returns your recent history. Temporary request limits protect availability. Optional local notifications remind you about Daily Post at 10:00 and are scheduled on your device; there is no email delivery system.
Service providers and sharing
The application API, public privacy page and PostgreSQL database are hosted on Railway. Railway and its infrastructure providers process network requests, technical logs and stored data to operate this service. Apple provides the iOS Keychain, local notification and device backup facilities according to your device settings. No advertising, analytics, social sign-in, payment or marketing SDK is included. The game does not sell data or send progress to an external leaderboard. The public contact address is for privacy inquiries, not an in-app messaging service.
Data retention
Local progress remains until you reset it or remove the application, subject to iOS storage and backup behavior. The installation Keychain item can persist after uninstalling; use the in-app deletion control before removal to revoke it. Server installation records and daily results remain until deletion is requested; there is no automatic age-based purge configured. The API returns only the latest 30 daily results, which does not itself erase older database records. In-memory rate-limit entries expire when their window resets or the service restarts, and the map is bounded. Railway infrastructure log and backup retention depends on Railway configuration and practices; no fixed duration is asserted here. Database backups, if retained by the hosting provider, may contain earlier copies until their normal expiry; deletion from active tables cannot promise immediate erasure from such copies.
Deleting your information
Settings contains Delete data and progress. After confirmation, the app deletes the installation and all associated results from the active server database, then removes its Keychain secret, local progress, pending results and scheduled reminders. If the required server request fails, the app preserves your secret and local data so you can retry instead of falsely reporting deletion. No network request is necessary if no server secret has been created. Removing the app alone does not send a server deletion request. A lost secret cannot be used to recover or transfer results, because there is no account or sign-in recovery. You may contact valentynlazariev0@gmail.com for a privacy inquiry; do not include the secret in an email.
Permissions and your choices
Notifications are optional and requested only when you turn on the Daily Post reminder in Settings. You can disable the reminder in the game or revoke notification permission in iOS Settings. Turning reminders off cancels pending reminder requests without changing game progress. The game does not request location, camera, microphone, contacts, photos or tracking permission. Internet requests for Daily Post use ordinary network access; offline play uses bundled game content and queues results locally.
Your privacy rights
You can view recent daily results, change local settings and request deletion through the app without creating an account. For questions about access, correction, deletion or other rights available under applicable law, contact valentynlazariev0@gmail.com. We may need enough information to understand a request, but we do not ask you to disclose the installation secret by email. Because this service has no personal account identifiers, we may be unable to identify server records after the secret is lost.
Security
Public requests use HTTPS. A cryptographically random installation secret is stored in the device-only Keychain; the server stores a SHA-256 hash and checks it before accessing installation-specific records. Database queries restrict daily results to the authorized installation and use parameterized statements. Server credentials stay in Railway service variables, outside the application and source repository. Payload validation, request deadlines, bounded connections and request limits reduce misuse. No system can guarantee absolute security; keep your device protected and do not share the installation secret.
Children’s privacy
Boat in Post is intended for players aged 12 and above and is not designed to collect identifying information from children. It has no accounts, advertising, purchases or social communication. If you believe a child has provided personal information through a privacy inquiry, contact valentynlazariev0@gmail.com so the issue can be addressed.
Changes to this policy
This policy reflects the current application and backend behavior as of the effective date above. Material changes to processing will be described by updating this public policy and its effective date. The Privacy Policy link in the application opens the published current version.