REFRACTWho we are
Sid Nik is the developer responsible for Refract: The Odyssey and its website. This policy covers the Android game, purchase verification, the website and email support. References to 'we' mean Sid Nik. For privacy questions or requests, contact SidNikApps@outlook.com.
The game, without a profile
Refract does not require a game account or a player profile. Gameplay, device sensor readings and puzzle answers are processed locally and are not sent to our purchase-verification service. The app has no advertising, behavioural analytics or third-party crash-reporting SDK.
Music, sound effects and the Epilogue are bundled with the app. The first chapter works offline. After a purchase has been verified and stored on a device, that installation can also play the remaining chapters offline without a recurring online deadline. Reinstalling or restoring a purchase requires a connection. We do not sell personal data or use it for advertising.
Device signals used for puzzles
Depending on the puzzle, Refract reads touch positions and gestures, device time, motion, orientation, compass readings, battery and charging state, media volume and volume-key events, screen-brightness settings and flashlight state. These signals are processed in memory to present and evaluate puzzles. They are not saved as a sensor history or transmitted to us. Only resulting level completions are saved.
The app does not record microphone audio, take photographs or access camera images, GPS location, contacts or messages. Observing flashlight state does not open the camera. Refract provides vibration feedback and keeps the screen awake while visible; it does not automatically rewrite system brightness settings.
Clipboard and puzzle input
A text puzzle supports copying and pasting text. Clipboard text is read only when you explicitly choose Paste, including a paste keyboard shortcut, not on launch, focus or return to the app. Pasted text is checked locally. Unrelated clipboard contents are not retained, logged or transmitted. Other puzzle inputs are also evaluated locally without an input history.
Copying text places it in the Android clipboard. The operating system or keyboard may separately manage clipboard history under its own settings.
Purchases and verification
Google Play handles payment and the purchasing Google account. Our app and verification service do not receive your payment-card details or Google account email. Google may make transaction information available to the developer through its merchant and order-management tools under its own policies.
To verify or restore the full_journey purchase, the app sends a purchase token, app and product identifiers, a hash derived from a randomly generated installation identifier, a one-time request nonce and a Play Integrity token over HTTPS to our separate verification service hosted on Cloudflare. Google Play and Play Integrity process purchase and app/device-integrity information. The service uses these to check entitlement, acknowledge completed purchases, prevent fraud and process refunds or revocations.
The app may recheck an existing purchase when it starts or returns to the foreground. A new installation identifier is created if its secure local data is removed. It is not an advertising identifier. Purchase verification does not transmit puzzle progress, answers, sensor history or clipboard contents.
Google and Cloudflare process technical network information such as IP addresses and request timing. Our service uses IP addresses transiently for rate limiting, not as a stored field in the purchase ledger. We do not enable request-body or purchase-token logging in the application service.
If you choose to redeem a complimentary access code, the app sends that code, app and product identifiers, a separate hashed random installation identifier and a one-time nonce over HTTPS to the same Cloudflare service. This verifies authorized access without a Google account, payment or Play Integrity request. The service stores only the authorized code's digest in its configuration, not a redemption or device ledger. It does not log codes or request bodies. Cloudflare still processes technical network information and transient IP rate limits.
Purchase storage and retention
On the device, the app stores an encrypted purchase token, an installation secret and a signed entitlement proof in secure storage. These records are excluded from the app's Android cloud-backup and device-transfer rules. They allow offline entitlement checks and online restoration; they are separate from puzzle progress.
A redeemed complimentary code, its separate installation secret and a signed access proof are also kept in secure storage, outside Android cloud backup and device transfer. The proof permits up to seven days of offline complimentary access and is renewed online at startup or return to the app while the code remains active. A code may be revoked. Use Access code, then Remove access code to remove its local credential and proof without removing a paid purchase or puzzle progress. The separate installation secret remains until local app data is removed. Complimentary access does not create a purchase or transaction record.
The verification service keeps a record keyed by a purchase-token digest, including the encrypted purchase token, purchase state, acknowledgement status, verification timestamps, retry counts and a bounded list of notification identifiers. Active records currently have no automatic expiry because the entitlement is permanent. When the service records a revocation, it removes the encrypted token and keeps a digest-keyed revocation record and timestamp to prevent replay.
Contact us to request deletion of server-side information. We may need limited purchase evidence to locate and verify a request; never send card details, passwords or raw security tokens. Deletion of verification records can affect our ability to verify or restore access. Any information retained for fraud prevention, disputes or legal obligations is limited to those purposes. Google manages its own transaction records and retention independently.
Local progress, backups and deletion
The app stores completed-level identifiers, whether the introduction has been seen, and your sound preference in private local storage. There is no developer-operated cloud save or game account to delete. Purchasing or restoring access does not complete puzzles or restore puzzle progress.
Use Android Settings, open the app's storage settings and choose Clear storage or Clear data to remove local data. Wording varies by device. This resets progress, preferences and locally cached purchase access; a verified purchase can be restored online with the purchasing Google Play account. Uninstalling also removes local app data and is not a refund request.
Android or the device manufacturer may back up or transfer progress and preferences according to your device settings. A device restore may restore those preferences. We do not receive or control these backups; manage them through the relevant provider.
If you contact us
If you email support, we receive your email address, message and any details or attachments you choose to send. We use them to answer enquiries, investigate issues and handle related requests. Do not send passwords, payment-card details or unrelated personal information. We do not add you to a marketing list.
Email is handled through Microsoft Outlook. We retain correspondence only as long as needed to resolve the enquiry and related follow-up, dispute or legal obligation. You can request deletion; information required by law or for a legal claim may be kept for that limited purpose.
This website
The website is hosted on Cloudflare, which processes technical requests such as IP addresses, URLs, timestamps and browser information to deliver and protect it. The site itself has no analytics scripts, advertising pixels, account system or contact form. It does not set cookies or use browser storage. Fonts and images are hosted with the site.
Opening the online policy, credits or an external link from the game launches an external service with its own privacy practices. The bundled policy and software licenses can be read in the app offline.
Other services and security
Google Play handles installation and payments under Google's policies. Google or the device platform may provide developers with store reports, crash reports or performance diagnostics according to their own settings. These are separate from in-app analytics, which Refract does not implement.
Service providers such as Google, Cloudflare and Microsoft may process information outside your country, including outside the European Economic Area. Their privacy policies describe international processing and transfer safeguards.
Local data is kept in private app storage. The website and verification endpoint use HTTPS, and purchase tokens are encrypted at rest in our verification service. No storage or transmission method is completely secure. We may disclose information where required by law or necessary to establish, exercise or defend legal claims.
Your choices and rights
Where the GDPR or similar law applies, purchase verification and restoration support performance of the purchase contract. Our legitimate interests include securing purchases, preventing fraud, resolving enquiries and operating the website; legal obligations may require limited retention. Support correspondence is used to respond to your request.
Depending on your location and circumstances, you may request access, correction, deletion, restriction or portability of personal information, or object to processing. Where processing relies on consent, you may withdraw it. You may also complain to your local data-protection authority. Contact SidNikApps@outlook.com for a request.
We cannot remotely access or delete local puzzle progress; use Android's storage controls. We do not use personal information for profiling or automated decisions with legal or similarly significant effects. The game does not ask for your age or identity. A parent or guardian may request removal of personal information a child sent to support.
Changes to this policy
If the game or data practices change, we will update the policy and its date. Where required, we will provide additional notice or obtain consent before a new use of personal information.