Privacy Policy
Jol: Join own Land
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Jol stores your level stars, unlocked decorations, selected decoration, unfinished journey, language, sound, music and vibration preferences locally on your device. Gameplay works without a network connection. If you choose Save backup, the app obtains a random installation UUID and a 256-bit installation secret, stores the credential in the device Keychain and sends your level stars, current level and earned decoration identifiers to our server. The server stores the installation UUID, a keyed HMAC of the secret, creation and backup update timestamps, and progress in PostgreSQL. The plaintext secret is not stored in the database. Restore and deletion requests also use this credential. We do not ask for a name, email address, password, location, contacts, photos or advertising identifier. Network requests to the API or public website necessarily expose connection information such as an IP address and request metadata to Cloudflare and the hosting infrastructure. The application server uses IP addresses temporarily in memory to limit requests. There are no analytics or advertising SDKs in the app.
How we use information
Local data lets you continue unfinished journeys, keep earned stars and use your chosen settings. Optional server data provides a backup that only the installation credential can read, replace or delete. The UUID and HMAC authorize access without a user account. Connection metadata, readiness checks, bounded rate-limit counters and minimal error events support operation, security and diagnosis of the service. Public website requests are processed to deliver these pages. We do not use game data for advertising or sell it.
Service providers and sharing
Cloudflare terminates public HTTPS and proxies API and website requests to the backend hosted on Railway. Cloudflare processes request and connection information, including IP addresses, headers and API data, to deliver and protect this traffic. The PostgreSQL database is also hosted on Railway. Railway and its infrastructure providers process the data and network requests needed to run the service, including infrastructure logs. The application uses the PostgreSQL client library on the server and native Apple frameworks on the device; it does not send data to an advertising, analytics, social-login or email-delivery provider. Apple device backup services may include local app files according to your device backup settings. The installation Keychain credential is marked for this device only. We may disclose information when required by applicable law. The public privacy contact is godric.darnley@icloud.com; the app has no contact form or email-sending feature.
Data retention
Local game files remain until you reset local progress, remove the app's local data or delete the app, subject to your device's backup settings. Resetting local progress leaves your preferences and optional server backup separate. Keychain credentials can persist according to iOS behavior and are removed by the app after successful server deletion. Server installation and progress records remain until you request Delete server data; no automatic expiry is currently implemented. Temporary rate-limit windows expire in memory and are lost when the process restarts. Minimal application error logs, Railway infrastructure logs and Cloudflare request/security logs are subject to the respective providers' configured retention; we do not promise a fixed period that we have not verified. Any infrastructure backups follow their configured lifecycle and may retain previously stored records until they expire; deletion does not promise immediate removal from all backup media.
Deleting your information
In Settings, Delete server data removes the installation's UUID, credential HMAC, timestamps and backup from the application's active database tables. On success the app removes its local Keychain credential; a later optional backup creates a new installation. Local progress remains on your device. Reset local progress separately removes local stars, unlocks and the unfinished journey. Removing the app or resetting local progress does not itself delete a server backup. Backup copies held by infrastructure may expire later under their configured lifecycle. Because there is no account or recovery identity, losing the installation secret can make it impossible to locate, restore or authorize deletion of a particular backup through the app. Do not rely on recovery on another device. You can ask questions about deletion at godric.darnley@icloud.com, but do not email an installation secret.
Permissions and your choices
Jol requests no location, camera, microphone, photo-library, contacts or notification permission. Internet access is used for the optional backup operations and for opening the public privacy page. You can play offline and choose not to create a backup. Sound, music and vibration can be turned off in Settings; device audio and accessibility settings also apply. To stop future backup requests, do not use the manual backup actions. Delete server data removes the existing remote copy. Your device settings control system backups and removal of local app data.
Your privacy rights
Depending on your location, you may have rights to access, correct, erase, restrict or object to processing of personal data and to complain to a relevant data protection authority. The app's Restore, Save backup and Delete server data controls provide direct access to the installation's stored progress. We cannot recover a lost installation secret or identify a backup using a name or email, because those identifiers are not collected for gameplay. For privacy questions or rights requests, contact godric.darnley@icloud.com and describe your request without including your secret. We may need sufficient information to verify authority over the relevant data.
Security
Public API connections use HTTPS to Cloudflare, which forwards requests over HTTPS to the Railway service. The installation secret is generated randomly by the server, stored in the device Keychain with device-only accessibility and sent as an authorization credential, not as a URL parameter. The server verifies a keyed HMAC using a server-only key and scopes database access to the authenticated installation. Request validation, payload limits, bounded request rates and database constraints help protect the service. Application logs do not intentionally include authorization headers, request bodies or secrets. Local files are stored in the app's sandbox. These safeguards reduce risk but cannot guarantee absolute security. Anyone who obtains the installation credential can access its backup; keep device access secure.
Children’s privacy
Jol is designed for casual players aged 14 and older and is not directed to children under 13. It does not collect age or establish user accounts. Optional backup contains game progress and a random installation identifier rather than a child profile. If you believe a child has provided information requiring attention, contact godric.darnley@icloud.com. A server backup can be removed from the installation's Settings using Delete server data.
Changes to this policy
We may update this policy when the app's features, data processing or hosting practices change. The effective date identifies the current version. Material changes will be described in the updated public policy and, when appropriate, in the app's release information. Review the policy through Settings or the public privacy page before choosing optional backup features.