Privacy Policy

Mechanym has no accounts. We don't ask for your location or contacts, we ask for a name only when you share or play a challenge, and we ask for an email address only when you want a reply to a message. We process:

• A player ID. A random identifier created on first play. The app keeps it in your keychain, so it survives reinstalls. With iCloud Keychain on, Apple syncs it to your other devices, so they share your rounds. The website keeps it in your browser's local storage. It links your rounds together so you can resume them and so nobody plays the same daily twice.
• Your rounds. The words, guesses, and custom secrets you type, the machine's answers and verdicts, your score, and when you played. Our server stores these with your player ID.
• Challenges. When you share a round or a custom secret, our server stores the challenge with your player ID. When you play one, it stores that you did. The name you choose for challenges, and your score in each one, show on its board to anyone with the challenge's link. Pick any name you like; it doesn't need to be your real one.
• Usage counts. How many times per day each install asked the machine, to keep usage within fair limits.
• Device and browser checks. The app sends a DeviceCheck token from Apple, and the website runs a Cloudflare Turnstile check, when it starts a session. Turnstile evaluates signals from your browser to tell people from bots.
• Your IP address and request details. Used to deliver pages and API responses, to rate-limit abuse, and for the Turnstile check. We don't store IP addresses in our database; they can appear briefly in server logs.
• Purchase status. Whether Plus is active, from Apple and RevenueCat. When the app connects to our server, it sends RevenueCat's anonymous app user ID, and our server asks RevenueCat whether Plus is active, so paid rounds start only with Plus. We don't store the app user ID or receive payment details.
• Messages you send us. Whatever you write, if you contact us by email, through the app's feedback page, or through the website's contact page. The feedback and contact forms ask for an email address only if you want a reply. The app's feedback page also offers anonymous details about your setup: the app version, your system version, your device model, whether Plus is active, and your language. They're on by default, and you can turn each one off before sending. Neither form sends your player ID.
• Anonymous usage data, in the app. Events like starting or finishing a round and its mode, seeing the Plus offer and how a purchase ended, an error the app showed you, and opening the app. They include the app version, your system version, and whether you're on an iPhone or iPad, and an anonymous ID: the identifier Apple gives our apps on your device, salted and hashed on the device, so it can't be turned back into that identifier. They never include your words, your player ID, or your purchase IDs. You can turn usage data off in the app's settings, under Privacy.

The website sends anonymous page views, referral sources, bounded campaign labels, scroll depth, section views, App Store clicks, and daily-game actions and outcomes to PostHog EU Cloud. These events never include what you type, your player ID, round IDs, or the contents of shared links. PostHog uses a daily rotating hash to count visitors without cookies or analytics storage in your browser. We create no person profiles and record no sessions. The website respects your browser's Do Not Track setting. We don't use advertising or track you across other apps and websites, and we don't set cookies.

• to run rounds: answer your words, judge your guesses, and save your progress
• to let you resume a round and keep one daily per player per day
• to show challenge boards to the friends you share them with
• to provide Plus and restore it on your devices
• to keep the service secure and fair, and to prevent abuse and automated use
• to fix problems and answer your messages
• to see how the app is used and where it goes wrong, from anonymous usage data
• to comply with legal obligations

We don't sell your data or use it for advertising.

The machine is an AI model. When you play a word or make a guess, our server sends it to OpenAI together with the round's context: the hidden rule or answer, earlier words and guesses in the round, and for a custom secret, the rule its author wrote. OpenAI returns the machine's answer or verdict.

We don't send your player ID, IP address, or any other identifier to OpenAI, and we ask OpenAI not to store the requests. OpenAI may still keep API data for up to 30 days to monitor abuse, under its own policies, and doesn't use API data to train its models.

Please don't type personal information, such as names, addresses, or anything about your health, into the game.

If you are in the EU, the UK, or Switzerland, we rely on:

• Contract (Art. 6(1)(b) GDPR) to provide the game, save your rounds, and provide Plus.
• Legitimate interests (Art. 6(1)(f) GDPR) to secure the service, prevent abuse, keep server logs, answer messages, and collect anonymous usage data, which you can turn off at any time in the app's settings. Our interest is running a fair and reliable game, and improving it.
• Legal obligations (Art. 6(1)(c) GDPR), for example tax records.

Storing the player ID and progress on your device is strictly necessary for the service you ask for, so it doesn't require consent (§ 25(2) no. 2 TDDDG).

These providers process data on our behalf or as part of the service:

Cloudflare, Inc.

Runs our API at api.mechanym.com, its database (stored in Western Europe), rate limiting, and Turnstile, the browser check on the website. Cloudflare processes your IP address and request data to deliver and protect the service, and may process data in the United States.

OpenAI, L.L.C.

Answers and judges the words, guesses, and custom secrets in each round. See “How the machine judges your words”. OpenAI processes this data in the United States.

Apple Inc.

Distributes the app, bills Plus through the App Store, and provides DeviceCheck, which confirms that API requests come from a genuine iPhone or iPad.

RevenueCat, Inc.

Manages Plus in the app. It receives an anonymous app user ID and your App Store purchase records to tell the app, and our server, whether Plus is active. It does not receive your player ID or anything you type.

PostHog, Inc.

Receives anonymous usage data from the app and website and stores them in its EU cloud in Frankfurt, Germany. PostHog doesn't receive your player ID or anything you type, builds no profile of you, and discards your IP address.

Hetzner Online GmbH

Hosts the website on a server in Germany. The web server receives your IP address and request details when you load a page.

Resend, Inc.

Delivers messages from the app's feedback page and the website's contact page to our inbox, and sends a confirmation to the reply address you leave. Resend processes the message, the details you chose to send, and your email address in the United States.

Namecheap, Inc.

Provides the email service for our contact address, so it processes the messages you send us.

When data goes to the United States, we rely on the EU–US Data Privacy Framework where the provider participates, and otherwise on the European Commission's Standard Contractual Clauses. We may also disclose data when the law requires it or to protect our rights.

A challenge link carries the day and your score: how many words and guesses you used and whether you solved it. It contains no identifier and none of the words you typed.

A link to a custom secret contains the whole secret you wrote: its rule and example. Anyone with the link can read it, and playing it sends the secret to our server and to OpenAI as described above.

The app stores your settings, your recent daily rounds, and your player ID on your device, and your player ID in iCloud Keychain when you use it. Unless you turn usage data off, it also keeps the usage data's hashed ID and any events waiting to be sent. The website stores your player ID, the last 30 days of your daily rounds, and whether you've seen How to play in your browser's local storage. Clearing the website's data in your browser removes them and gives you a new player ID.

We keep your rounds and usage counts while Mechanym runs, so your progress and daily history stay available. We delete them when you ask us to. Server logs are kept only briefly, as needed to operate and secure the service. PostHog keeps usage data for up to seven years, the most our plan allows. Our server doesn't store feedback; it's delivered by email, and emails are kept as long as needed to handle your request. Records we must keep by law are kept for the legally required period.

All traffic is encrypted, sessions expire after an hour, and requests are checked and rate-limited. No system is perfectly secure, but we work to protect your data.

Mechanym isn't directed at children under 13, and we don't knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we'll delete it.

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy
• have inaccurate data corrected
• have your data deleted
• restrict processing
• object to processing based on legitimate interests
• receive your data in a portable format

To exercise them, email dennis@swiftedmind.com. Because there are no accounts, include your player ID so we can find your rounds. The app shows it in Settings under Privacy.

This browser's player ID is .

You can also complain to a data protection authority. Ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

Residents of some US states have rights to know, access, correct, and delete their personal information, and to opt out of its sale, sharing for targeted advertising, or profiling. We don't sell or share personal information, don't use it for targeted advertising or profiling, and won't treat you differently for exercising your rights. Email us to make a request.

We update this policy when Mechanym or the law changes. The date at the top shows the latest revision. We'll point out material changes on the website or in the app.

Questions about privacy go to dennis@swiftedmind.com, or by post to: