People’s Exhibit X · FILED DOCUMENT
PRIVACY POLICY
Effective October 8, 2026
TL;DR
The short version.
We run a daily puzzle. We don't want your data; we want you to enjoy the case. We collect the minimum needed to keep your streak working and, only if you ask for it, an email address to send you the daily briefing. We never sell or share personal data, and we don't run ads or ad trackers.
COLLECTION
What we collect.
An anonymous identifier so your streak and stats persist; your game results (which day, clue count, and solved outcome) so we can show you how you compare to other detectives and tune difficulty; Clearance entitlement state; and, for App Store purchases, linkage records that map an original transaction ID or derived app-account token to your anonymous identifier so later Apple notifications can be attributed and one receipt cannot unlock multiple accounts. The People’s Exhibit X web app keeps your game progress, settings, sign-in session and similar app data in your browser's storage; clearing site data removes them. Only if you sign up for the daily briefing, we also collect your email address, which is stored with our email service, not on our servers. If you sign in with Apple, Apple gives us an identifier for your account and the email address you choose to share, which may be a private relay address that forwards to you; if you sign in with an emailed link, we keep the address you verify, and a short-lived verification record stores it encrypted until the link is used, or for up to about a day if it is not. We use them only to sign you in to the same account on each of your devices. To protect your account, we also keep a scrambled, one-way fingerprint of the Apple sign-in identifier and email we trust for it, so a change made outside the app cannot be used to recover or delete your account; it is deleted with your account. If your account is locked this way, write to support@peoples-exhibitx.app and we will confirm it is you before we change or delete anything. Only while the People’s Exhibit X web app is limited to invited players, a strictly necessary signed access cookie confirms that an invited browser may open the app. It contains a random session token and expiry, not your invitation code or identity, lasts up to seven days, and can be removed by clearing browser site data; during that time we also mark the anonymous identifiers that play, so beta play is kept out of public statistics. While the web app is open to everyone, we do not set this cookie, and any cookie already in your browser simply expires. Our product analytics are cookie-free and count events in aggregate only: we store running totals per day, never a record of what any one person did, and never your identity, location, or a precise time. Separately, the People’s Exhibit X web app records once, with your anonymous identifier, a coarse label for how you first arrived (such as a search engine, a shared link, or directly), and when we test a design change, we record which version your anonymous identifier was shown; both are deleted with your account. We keep your anonymous game data until you reset it or ask us to delete it; raw solve records may be pruned after about 12 months while anonymous aggregates remain. If you play as a guest and then sign in, your guest progress is added to your account, and we delete the guest's own records at least 30 days later, unless the guest has purchase, billing or reward records, has been played on since the move, or became a full account; those records follow the retention described here. Newsletter unsubscribe stops future messages, while deleting the provider Contact requires a separate privacy request. Account deletion removes the Auth user and its sign-in identifier and email, and, when you confirm with Apple, ends this app's Sign in with Apple access (if you delete without Apple, remove the app under Sign in with Apple in your Apple ID settings), along with the current UID-keyed gameplay, entitlement, web-billing, and Apple purchase-linkage records; we keep only a record of the deleted anonymous identifier and its deletion time for 90 days, so late payment notifications cannot restore it. Your payment provider retains its own transaction records on its books as required by law.
COMMITMENTS
What we don't do.
No advertising networks, no advertising or analytics trackers (the one Google script in the People’s Exhibit X web app, described below, only checks for automated abuse), no selling or sharing of personal information, no profiles of you, no collection of names, precise locations, or anything we didn't list here.
PROVIDERS
Who helps us run it.
A few trusted services power the puzzle, and we share only what each needs to do its job. Google Firebase stores your anonymous game data and, only if you sign in or secure an account, its sign-in identifier and email. If you sign up for the daily briefing or sign in with an emailed link, Resend stores and delivers those emails. Apple provides Sign in with Apple, and bills and processes subscriptions bought in the iOS app. On the People’s Exhibit X web app's account page, the Sign in with Apple button and script load from Apple's servers, so Apple receives technical request data (such as IP address and browser type) when that page opens. The site is hosted on Firebase Hosting and Google Cloud (Google LLC); like any website host, Google automatically records technical request data (such as IP address, browser type and time) in security and operations logs under its standard retention settings. The iOS app includes Google's Firebase Authentication SDK, which collects diagnostic data not linked to your identity and never used for tracking. The iOS app also asks Apple's App Attest service, through Firebase App Check, to confirm that requests come from the genuine app; this uses a key created on your device and sends no personal information beyond the technical request data (such as IP address) that any connection carries, and Firebase (Google) exchanges Apple's attestation for a short-lived token. Our analytics are privacy-friendly and cookie-free, counting events in aggregate. If you email us, your message and email address are kept in our Apple iCloud Mail account so we can reply. To protect the game and its servers from automated abuse, the People’s Exhibit X web app uses Google reCAPTCHA Enterprise through Firebase App Check: a Google script assesses the browser (it collects technical information such as IP address and browser and device characteristics, and may read or set Google cookies) and gives the web app a short-lived token showing that a request came from it. Google's Privacy Policy and Terms of Service apply to that check. None of these receive your personal data to use for their own advertising, and we never sell or share it.
YOUR RIGHTS
Your choices.
You have the right to know what we hold, to get a copy of it, to correct it, and to request deletion subject to the limited retention described above, and you'll never be treated differently for exercising those rights. Unsubscribe from emails anytime with one click to stop future messages; request provider Contact deletion separately, and reset your game data, or permanently delete your current account and its current UID-keyed gameplay, entitlement, and Apple purchase-linkage records anytime in settings or through the public account-management page. We do not sell your personal information. Your payment provider retains its own transaction records on its books as described above. We do not share data for cross-context advertising (as those terms are used under California law), so there is nothing to opt out of, but you can still make any request at privacy@peoples-exhibitx.app and we'll complete it within 30 days. We don't track visitors across other sites, so a browser Do Not Track or Global Privacy Control signal doesn't change anything we do. If you're in the EU or UK, you also have the right to object to or restrict processing, to data portability, to withdraw consent, and to lodge a complaint with your local data-protection authority.
CHILDREN
Children.
People’s Exhibit X covers real criminal cases and is not directed to people under 16. Please don't sign up for emails if you're under 16. If we learn that we have collected personal information from someone under 16, we will delete it; if you believe that has happened, email privacy@peoples-exhibitx.app.
PAYMENTS
Payments.
Subscriptions bought in the iOS app are billed and processed by Apple; we never see or store card numbers. Your subscription links to your account so your benefits follow you.
SECURITY
Security.
We use industry-standard protections, hold as little as possible, and if a breach ever affects your data we will tell you promptly and plainly what happened.
WHERE DATA LIVES
Where your data lives.
We operate from the United States, and our providers process data in the US. Where this involves visitors in the EU or UK, we rely on your consent for the email briefing, on performing our agreement with you for your account and any subscription, and on our legitimate interest in running the game for anonymous play statistics, and on recognized transfer safeguards (such as the EU–US Data Privacy Framework or Standard Contractual Clauses) for sending data to our US providers.
UPDATES
Changes.
If this policy changes materially, we'll note it on this page with a new date, no silent edits.
Curated and operated by Inkwell General Store, LLC, a Maryland limited liability company, which is responsible for this policy. Questions: privacy@peoples-exhibitx.app