Version française

Privacy policy

Uncracked City, a detective game. Last updated: 19 October 2026.

Uncracked City is played without an account: we do not ask for your name, your age or your phone number. This page says what the game's server keeps, why, for how long, who helps us do it, and how to erase it all.

Controller: BNT Technologies. Contact: hello@uncracked.city.

What we keep

• An anonymous player. On first launch, the server creates a random identifier and a token, kept on your phone. With it: the game's language, your plan (free or premium), the date it was created and the date of your last visit, and the version of the app that created it and its system (Android or iOS), to count players apart from tests.
• Your Game Center or Play Games account, when your phone is signed in: only the id of your Game Center or Play Games account, checked with Apple or Google, to give you your progress back on a new phone or after a reinstall. Not your name, your friends or your address.
• Your progress, case by case: the places opened, the clues found, the board (pins and links), your attempts, your points and the case log. For a real case, the fact that you solved it, to show how many investigators have solved it, never naming them.
• The questions you ask and the suspects' replies, typed or dictated: they are kept with your progress, so that you find each interview where you left it.
• In a squad, your teammates see a short handle drawn from your identifier, never the identifier itself, and the squad shares one board.
• Your reports: if you report a suspect's line, we keep the line, your question and your comment, for moderation.
• Your email address, only if you give it. It is optional. We keep the address, the date you agreed, whether you confirmed it and whether you unsubscribed.

What we do not keep

• Recordings of your voice. When you tap « Dictate », the short recording is sent to the server, passed to OpenAI to be turned into text, then forgotten: it is stored nowhere. Only the transcribed text becomes your question.
• No advertising, no ad trackers, no selling of data. Our emails carry no tracking pixel and no tracked links.

Your questions are used to make the suspects answer: do not write personal information in them.

Why

• To run the game you start: save your game, make the suspects answer, play in a squad. The basis for this is the service you ask for by playing.
• To limit costs and abuse: a number of free questions per day, counted separately.
• To moderate reported lines.
• To write to you, only if you asked for it (mostly new cases): the basis is your consent, which you can withdraw at any time.

How long

• Player, progress, questions and replies, reports: until you erase them (see below).
• Technical counters (today's questions, the order of replies already heard, a line being read aloud): they erase themselves, within three minutes to seven days.
• To answer faster, the text of a question already asked may be kept with the suspect's reply, without your identifier or anything that links it to you. Since nothing links it to you, it is not erased with your data.
• Email address: until you remove it or erase your data. After an unsubscribe, it stays marked « unsubscribed », so that we no longer write to you, until you remove it.
• The server's technical logs: 30 days. They contain neither your questions nor your email address.
• The app's technical error reports (the error's text, where it happened, the app's version, the system and a hashed form of your identifier, to count the players it hits): 30 days after the error was last reported, without your questions.

Who helps us (processors)

• Amazon Web Services: the game's server, its images and its logs, in Paris.
• MongoDB Atlas: the database (players, progress, questions and replies, email), in Paris.
• Upstash: the temporary memory (counters, replies already given), in Frankfurt.
• Anthropic: makes the suspects speak; receives your free questions and the case's context, without your identifier.
• OpenAI: makes the suspects speak when Anthropic does not answer, turns your voice into text, compares a question with those already asked, and reads some lines aloud.
• ElevenLabs: the suspects' voices in French cases; receives the text of the suspects' lines, never your questions or your voice.
• Mailgun: sends the emails, if you gave an address; receives the address and the message, in Europe.
• Langfuse (European Union): follows the quality and cost of the suspects' replies. It receives the questions asked and the replies, with your anonymous player id. The delete button does not remove these traces: they are erased on their own after 30 days (to set in Langfuse).

Anthropic, OpenAI and ElevenLabs are American companies: these transfers outside the European Union rely on the GDPR's safeguards (the European Commission's standard contractual clauses, or the EU–US Data Privacy Framework). Under their API terms, Anthropic and OpenAI do not use what we send them to train their models. Safeguards to confirm: each provider's data processing agreement (DPA).

Erasing your data

In the game: Settings → « Start over » → « Erase everything ». The server then erases your player, your progress with your questions and the replies, your place in squads, your email address and the hashed form of your identifier in the error reports. Of your reports only the reported line stays, written by the suspect, without your identifier, your question or your comment. A squad keeps its shared board for the other players, with the questions asked on it, without your identifier. Without a network at that moment, the phone forgets at once, and the server erases on the next launch with a network.

For the email address alone: Settings → « Remove my address », or the « Unsubscribe » link in every email.

Uninstalling the game does not erase what the server keeps: erase from the game first. Since the player is anonymous, we cannot find it without the phone that created it.

Your rights

You can ask to access your data, correct it, erase it, take it with you, object to its use and withdraw your consent. Write to hello@uncracked.city. You can also complain to the CNIL, the French data protection authority (www.cnil.fr).

The email address is only to be given from the age of 15, or with a parent's agreement.