This policy explains how Prismo ("the app"), our daily light puzzle for iPhone and Android, handles information, including the leaderboard and challenge pages it uses on sintios.com. Prismo is made by Sintios ("we", "us"), the trading name of KAVIO LABS SOFTWARE LIMITED, which is the controller of the data stored on our server as described here.
1. What stays on your phone
Your puzzles and the moves you make, your results, streak, streak freezes, statistics, hint wallet and settings are kept in the app's private storage on your phone. Puzzles are generated on the phone, so the game works offline.
Your phone's own backup (iCloud or Google backup, if it's on) may include this data, as with any app. That backup belongs to your Apple or Google account; we can't access it.
2. Leaderboard and challenge links
When you're online and finish a daily puzzle, the app sends to our server at sintios.com:
- a random install ID created by the app when it's first opened. It isn't your Apple or Google account, your advertising ID or anything else about your phone. Our server immediately turns it into a keyed hash (HMAC-SHA256) and stores only that hash, so one result counts once per install;
- the game, the puzzle number, your score (gems and mirrors used), your time, and a display name only if you add one.
On the leaderboard you appear under a random name such as "Player 3F9A". Leaderboard rows are deleted automatically 14 days after the puzzle's day.
If you choose Challenge a friend, the app uploads the puzzle number, a spoiler-free summary of your result (mirrors, gems, time and moves) and, only if you type one, a name of up to 20 characters. The server returns a link (sintios.com/c/p… followed by a random code). Anyone with the link can open it and see that summary. Challenge links are deleted automatically after 30 days.
Our server doesn't store IP addresses. To limit abuse, it briefly counts requests under a one-way hash of the address mixed with a secret that changes daily; these counters are deleted after 2 days and can't be turned back into an address. Like any website, our hosting provider sees your IP address when you connect and may keep short-lived access logs.
Leaderboard and challenge entries aren't tied to an account, an email or a name we know, so they are anonymous to us.
3. The optional Sintios account
Prismo works without an account. In Settings you can choose Have a Sintios account? Sign in. If you do, we hold:
- your email address, used to send you a one-time sign-in link (single use, valid 15 minutes). There is no password;
- what is linked to your account, so it can turn on in the app and on your other devices;
- sign-in links and sessions, stored only as hashes.
Sign-in emails are sent from our own server. We don't use your email for marketing, and the account isn't linked to your leaderboard or challenge entries. Your puzzles and streak stay on your phone; they are not uploaded to the account.
4. Purchases
Prismo Plus and hint packs are sold through the App Store (Apple) or Google Play (Google), which process the payment. We receive no card details. The app checks your purchases with Apple or Google on your phone, and keeps your hint balance on your phone.
Buying on sintios.com and your Sintios account
You can also buy Prismo's paid features on our website (Prismo on the web). The seller is KAVIO LABS SOFTWARE LIMITED and Stripe (Stripe Payments UK Ltd and its affiliates) processes the payment, by card, Apple Pay or Google Pay: your card or wallet details, billing details and email go to Stripe, never to us. Stripe acts as an independent controller for its own legal and fraud-prevention duties (Stripe's privacy policy).
For web purchases, and only if you choose to sign in (Settings → Sintios account), we keep a small Sintios account: your email address; what you bought, its status and dates, Stripe's reference numbers and when you ticked the box to start access straight away; and sign-in links, codes and sessions, stored only as hashes. You sign in with a link we email you (single use, valid 15 minutes); there is no password. The app asks our server which purchases are linked to your email so it can unlock them; nothing else about how you use Prismo is sent. We don't use the account for marketing.
Deleting it: in the app (Settings → Sintios account → Delete account) or at sintios.com/account. Any web subscription is cancelled and your email, purchase list and sign-ins are deleted from our server straight away. Payment and invoice records are kept by Stripe, and by us in our accounts, for as long as tax and accounting law requires (in the UK, generally six years); they are used for nothing else. App Store labels: if you sign in, "Contact Info: Email Address", linked to you, used for app functionality only.
5. Reminder notifications
The daily reminder is off until you turn it on. It is a local notification scheduled on your phone at the time you choose. It does not use a push server, and we don't receive anything when it's shown. Turn it off in the app's Settings or in your phone's notification settings.
6. Ads (Unity Ads)
The game is free to play and is partly paid for by ads served by Unity Ads (Unity Technologies and its affiliates). We use two kinds:
- Rewarded ads, only when you tap for them: in the hint sheet, "Watch a short ad" gives you one free hint when your free daily hints and hint wallet are used up. The board is paused while the ad runs.
- Occasional full-screen ads between levels: only when you leave a result screen, never during a puzzle or in menus, the shop or the paywall, never in your first session or first three levels, at most one every three levels and at least two minutes apart. If you have bought anything (Plus, Remove Ads, hints or any other pack), you never see these. On iPhone you can also buy Remove Ads on its own.
The app has no banner ads. To show, cap and measure ads and to prevent fraud, the Unity Ads software in the app collects data from your device and sends it to Unity: device identifiers (the advertising ID (IDFA on iPhone, only if you allow tracking; Google advertising ID on Android) and an identifier for this app on this device), your approximate location derived from your IP address, device and network information (model, operating system, language, screen, connection), and how you interact with ads. Diagnostics such as crash and performance data about the ad software may also be sent. Unity uses this data for advertising and analytics and, on iPhone, for tracking only if you allow it. Unity acts as an independent controller for this data; see Unity's privacy policy, which also explains how to opt out and how to ask Unity for access to or deletion of that data. We don't link this data to your identity or to your leaderboard entries or Sintios account, and we don't receive it about you from Unity, only totals such as how many ads were shown.
7. Personalised ads and tracking: your choice
- UK, EU and EEA: after your first finished level the app asks once whether Unity may use your data for personalised ads ("Yes, personalise ads" or "No, thanks"). The game works the same either way. Your region is taken from your phone's language and region setting, on the phone.
- Everywhere: you can switch personalised ads on or off at any time in Settings → Personalised ads. Off means Unity shows ads without using your data for personalisation.
- iPhone: the app asks for permission to track (Apple's App Tracking Transparency) once, after your first finished level. It never asks at launch. You can change this in iOS Settings → Privacy & Security → Tracking. Without permission the advertising ID is not shared.
- Android: you can reset or delete your advertising ID in your phone's Settings → Privacy → Ads (the exact place depends on the phone).
8. Service providers
- Our hosting provider runs sintios.com and the leaderboard, challenge and account server, and stores the data in sections 2 and 3 for us. It processes data only to host the service.
- Cloudflare, Inc. provides DNS, TLS encryption and network protection in front of sintios.com, so your connection passes through Cloudflare's network, which may process it in data centres outside your country, including the United States, under standard contractual clauses. See Cloudflare's privacy policy.
- Unity Technologies serves the ads in the app as an independent controller, as described in section 6 (Unity's privacy policy).
- Apple and Google process App Store and Google Play purchases under their own policies: Apple's privacy policy, Google's privacy policy.
Apart from Unity Ads, the app contains no third-party advertising, analytics or crash-reporting code. If you choose to share diagnostics with app developers in your phone's settings, Apple or Google may share anonymous crash reports with us. The challenge pages load no third-party scripts, fonts or trackers.
9. App Store and Google Play labels
- Data Not Linked to You: Identifiers (Device ID: the random install ID in section 2) and Usage Data (Gameplay Content: daily score or stars, time, and the spoiler-free challenge summary), used for app functionality.
- Data Linked to You: Contact Info (Email Address), only if you sign in to the optional Sintios account, used for app functionality.
- Data Used to Track You (Unity Ads): Identifiers (Device ID), Location (Coarse Location) and Usage Data (Product Interaction, Advertising Data), not linked to you, used for third-party advertising and analytics. On iPhone the advertising ID is only shared if you allow tracking.
- Also not linked to you (Unity Ads): Diagnostics (Crash Data, Performance Data), used for analytics and not for tracking.
- Google Play data safety: approximate location, device or other IDs, app interactions, crash logs and diagnostics are collected and shared with Unity for advertising and analytics, encrypted in transit, in addition to the data in sections 2 and 3.
10. What we don't do
- We don't sell or rent your information.
- We don't build profiles or track you across apps or websites ourselves; tracking by Unity Ads happens only as described in sections 6 and 7.
- We don't use analytics tools of our own, and we don't receive or store advertising identifiers.
11. Delete your data
This works the same on iPhone and Android.
- On your phone: delete Prismo to remove your puzzles, streak, stats and settings. Remove it from your phone's backup too, if you want no copy left there.
- Sintios account: in Prismo, go to Settings → Sintios account → Delete account. You can also sign in at sintios.com/account and choose Delete account. Your email address, what is linked to the account and your sign-ins are deleted from our server straight away. Signing out only removes the account from this phone; it doesn't delete it.
- Leaderboard and challenge links: these are anonymous and contain no email or account, so we can't find them by name. Leaderboard rows are deleted automatically after 14 days and challenge links after 30 days.
- Ad data: for data held by Unity, use the request options in Unity's privacy policy; resetting your advertising ID also breaks the link to past ad data.
- By email: if you can't use the app or the website, email [email protected] from the address of your Sintios account with the subject "Delete my Prismo data". We'll delete the account within 30 days and confirm by email. We use your message only for this request.
Our hosting provider may keep encrypted backups of the server for a limited time (up to 30 days); deleted data is gone from them once that period ends. Purchase records are kept by Apple or Google under their own policies.
12. Why we may use it (legal bases)
Where the UK GDPR, the EU GDPR or similar laws apply, we rely on performance of our contract with you to run the leaderboard, the challenge links you ask us to create and the optional Sintios account, and on our legitimate interests in keeping the service fair and secure (one result per install, rate limits), balanced against your privacy through hashing and short retention. Personalised ads in the UK, EU and EEA are based on your consent, which you can withdraw at any time in Settings → Personalised ads.
13. Your choices and rights
Leaderboard and challenges need a connection; if you play offline, nothing is sent to us. You can switch personalised ads off at any time in Settings. Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your data, to data portability, and to complain to your data protection authority (in the UK, the Information Commissioner's Office). Contact [email protected].
If you email us for support, we use your email address and message only to reply, and keep them only as long as needed for that purpose.
14. Children
Prismo is meant for players aged 13 and over and is not directed at children under 13, so its ads are not aimed at children. It asks for no contact details or location (a name on a challenge is optional) and has no chat. The optional Sintios account is meant for adults; if you believe a child has given us an email address, contact us and we'll delete it.
15. Security
All connections use HTTPS. Install IDs, sign-in links and sessions are stored only as hashes, challenge codes are random, and data is deleted on a fixed schedule so there is little to lose. No system is perfectly secure, so please keep your phone locked.
16. Changes and contact
If we change how Prismo handles data, we'll update this policy and its date first and, for significant changes, tell you in the app or release notes.
Sintios · [email protected] · Prismo support