Privacy Policy

Cryptic Learning LTD (“Cryptic Learning”, “we”, “us”) is a company incorporated in England and Wales. We operate the Cryptic Learning educational puzzle-game platform.

For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, we are the data controller for the personal information described in this policy. You can reach our privacy contact at privacy@crypticlearning.com.

We deliberately collect as little as we can get away with. Specifically:

• Account information. Your email address, and a one-way scrypt hash of your password. We never store your password itself and cannot recover it.
• Gameplay information. Which games you have started, the scene you reached, and whether you completed it — so you can pick up where you left off.
• Content you create. If you author games, the puzzles, text, images, and video you upload, together with the account that uploaded them.
• Technical information. Our hosting and logging systems record standard request data, including IP address, browser user agent, the page requested, and any server error that occurred. We use this to keep the service working.
• Messages you send us. If you email us, we keep the message and our reply.

We do not use analytics, advertising, tracking pixels, or profiling of any kind. We do not buy personal information from anyone, and we never sell yours.

The UK GDPR requires us to have a lawful basis for each use of your personal information. Ours are set out below.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded that they are not. You may object to that processing at any time — see section 8.

We set strictly necessary cookies only. They keep you signed in and protect the sign-in form against cross-site request forgery. We do not set analytics or advertising cookies, so there is no consent banner to dismiss.

Our Cookie Policy lists each cookie individually.

We do not sell, rent, or trade personal information. We share it only with service providers who process it on our behalf, under contract, and only so that we can run the service:

• Amazon Web Services (AWS). Hosting, application database, media storage, and error logging.

We may also disclose information where we are legally required to do so, to enforce our Terms of Service, or to protect the rights and safety of our users. If Cryptic Learning is ever acquired, personal information may transfer with the business — you would be told before it did, and this policy would continue to apply until you were given notice of a new one.

Your information is stored on Amazon Web Services infrastructure in their Europe (Ireland) region — inside the European Economic Area, rather than in the United Kingdom.

Transfers of personal information from the UK to the EEA are covered by the UK Government’s adequacy regulations, which recognise that the EEA gives your information an equivalent level of protection. Where information is transferred anywhere outside the UK or the EEA, we rely on the International Data Transfer Addendum to the European Commission’s standard contractual clauses.

• Account and gameplay information — for as long as your account exists. Delete your account and we delete them.
• Content you authored — until you delete it, or we remove it under our Terms of Service.
• Server and error logs — no longer than is necessary for the purposes described in section 3.
• Email correspondence — no longer than is necessary to deal with your enquiry and any follow-up to it.

We are still setting firm retention periods for the last two, and will publish them here once we have. We keep information for longer than necessary only where the law requires it, or where it is needed to establish, exercise, or defend a legal claim.

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• have your information erased;
• restrict how we use your information, or object to us using it;
• receive your information in a portable, machine-readable format; and
• withdraw any consent you have given, at any time.

Email privacy@crypticlearning.com to exercise any of these. We will respond within one month. Exercising your rights is free, and we will never treat you differently for doing so.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.

Cryptic Learning is built for education, and many of the people who benefit from it are school-aged. You must be at least 13 years old to create your own account. Younger students should use the service through a school or an adult who holds the account and supervises its use.

We do not knowingly collect personal information from a child under 13 without the consent of a person holding parental responsibility. If you believe a child has given us their information, email privacy@crypticlearning.com and we will delete it promptly.

Passwords are hashed with scrypt using parameters chosen to make offline cracking expensive. Traffic is encrypted in transit with TLS, and information at rest is encrypted by our infrastructure provider. Access to production systems is limited to those who need it.

No system is perfectly secure. If we ever suffer a breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours, and tell you without undue delay where the risk is high.

We will update this policy as the service changes. The date at the top always reflects the current version. If a change materially affects your rights, we will tell you by email or by a prominent notice in the app before it takes effect.

For anything relating to your privacy, email privacy@crypticlearning.com. For anything else, the contact page lists the rest of our addresses.