Royal Stones Privacy Policy

Royal Stones for iOS Privacy Policy

Effective date: August 25, 2026

This policy explains how FuzzyCastle handles information when you use Royal Stones on iPhone or iPad, sign in to a FuzzyCastle account, or participate in Royal Stones leaderboards.

Information Royal Stones uses

Guest play. You can play Royal Stones without creating an account. Game preferences, Treasury progress, and supported play information are stored locally on the device so the game can operate and remember your progress. Guest scores are not uploaded.

Account and authentication information. If you sign in, FuzzyCastle stores a stable internal account identifier, your generated or selected display name, the sign-in provider you chose, account status and security information, and account lifecycle dates. FuzzyCastle password accounts also store a username and a salted password hash; plaintext passwords are not stored. Apple sign-in does not request or retain your Apple email address or real name. Google may provide an email address and profile name. Those Google claims are not stored in the permanent account profile, but the current encrypted browser sign-in session may retain them for up to 30 days.

Leaderboard information. When you submit a signed-in score, FuzzyCastle stores your player identifier, display name, weekly personal-best score, and the Royal Stones difficulty represented by the leaderboard game identifier. Rank is calculated from the active leaderboard. A weekly leaderboard becomes eligible for deletion 30 days after it ends.

Technical, security, and diagnostic information. FuzzyCastle and its service providers process information needed to deliver, protect, and improve the service. This can include request times, route and method, response status, latency and size, IP address, user-agent or device information, correlation identifiers, and bounded authentication, security, lifecycle, and error outcomes. Some records can be linked to an account. This information is used for authentication, fraud and abuse prevention, troubleshooting, availability, performance, and service operation.

Traffic analytics and approximate region. Cloudflare provides aggregate traffic and Web Analytics used to understand audience size and service performance. Reports can include product interactions such as page or endpoint traffic and broad characteristics such as device type, browser, operating system, and country derived from network information. Royal Stones does not use this information for advertising or cross-app tracking.

iPhone and iPad credential storage

On iPhone and iPad, authentication uses a system authentication session and an authorization code protected with PKCE. The app keeps its short-lived access credential only in memory and stores a rotating refresh credential in the iOS Keychain. Native authorization codes expire after 120 seconds, access tokens expire after one hour, and refresh sessions expire after 30 days.

Service providers and sign-in providers

Google Cloud hosts FuzzyCastle authentication, leaderboard, database, logging, monitoring, backup, and related infrastructure. Cloudflare provides DNS, security, proxy, CDN/static hosting, and aggregate traffic analytics. If you choose Sign in with Apple or Google, that provider processes the authentication or revocation transaction under its own privacy terms.

FuzzyCastle does not sell player information. Royal Stones has no advertising network or data broker and does not use player information for targeted advertising or cross-app tracking.

Retention

Account identifiers, display names, credentials or provider associations, and account metadata remain while the account is active. Weekly leaderboard rows become eligible for deletion 30 days after the board ends. Google Cloud default operational logs are retained for 30 days; required administrative audit logs can remain for 400 days. Account security events are retained for up to 90 days. Cloudflare publishes up to seven days of Security Analytics history and retains Cloudflare account audit logs for 18 months.

FuzzyCastle keeps seven automated database backups and seven days of point-in-time recovery logs. A final backup created if a database instance is deleted can be retained for 30 days. Backups and audit records are restricted to recovery, security, compliance, and service administration and are not used for normal game operation.

Your choices and account deletion

You may play as a guest, sign out, remove local information by deleting the app, and change your FuzzyCastle display name subject to the displayed limits.

You can delete your FuzzyCastle account from Royal Stones by opening the signed-in account page, choosing Delete Account, and completing the confirmation. An accepted request immediately revokes existing browser and native credentials. Cleanup normally finishes in seconds or minutes and removes the FuzzyCastle profile and credentials, provider associations, display-name state, Royal Stones leaderboard records, and connected FuzzyCastle game data. Automatic retries and operator remediation support completion within 30 days. Sign in with Apple revocation is attempted when the required protected Apple token is available.

Limited backup, security, fraud-prevention, audit, deletion-confirmation, or legally required records may remain only for their stated retention period. They are access-restricted, excluded from normal product use, and account links are removed where the implementation supports it. De-identified or aggregate information that no longer identifies an account may be retained.

Children's privacy

Royal Stones does not knowingly request personal information from children. Account and leaderboard features are optional, and the game contains no advertising or cross-app tracking.

Contact

For privacy questions or help with account data, contact fuzzycastle@gmail.com.

Changes to this policy

FuzzyCastle may update this policy when Royal Stones or its supporting services change. The effective date above will be revised when a material update is published.