Privacy · Updated November 12, 2026
Your glass.
Your progress.
Isle of Glass is developed by Ali Haroon. This policy covers the iPhone game, optional community and private support service, and this website.
Version notice: Banner ads apply to version 1.3 and later. Optional measurement, iCloud sync, daily reminders, solve sharing and Remove Ads below are prepared for version 1.8 and apply only when available in your installed build.
The offline campaign
Campaign moves, progress, daily activity and streak records, preferences, and local Workshop records stay in the app’s on-device database. They are not uploaded unless you enable optional sync or measurement as described below. You can play the campaign without a profile or internet connection. Device backups may include local game data according to your Apple settings.
Optional gameplay measurement (version 1.8)
Measurement is off by default. If enabled, the app sends limited first-party events: session start and active duration, tutorial start/finish/skip, puzzle start/solve/leave, hint use or exhaustion, inconclusive hint checks, sharing actions, and completed Remove Ads purchases. Events include a random installation identifier, event identifier, local calendar day, app version, and, where relevant, puzzle ID, puzzle edition, daily mode and active seconds. We use these events to find confusing levels and measure return visits. They are not used for advertising or cross-app tracking. No campaign moves, board images, names, email addresses, advertising identifiers or support messages are included.
The service stores a cryptographic hash of the installation identifier. Events are excluded from reports after 90 days and removed on a subsequent service request; this is not an exact-time erasure guarantee. Switching measurement off clears the local queue and requests deletion of that installation’s server events. If offline, deletion retries when the app reconnects. A cryptographic deletion marker remains to prevent delayed uploads recreating records. Re-enabling waits for deletion to finish and creates a new identifier. Uninstalling while offline may prevent deletion from arriving, so retention rules still apply.
Optional iCloud sync (version 1.8)
If enabled, earned completions, discoveries, legacy completion awards, solve dates, and gameplay settings for haptics, contrast and automatic colors sync through your Apple iCloud account. Earned progress merges across devices. In-progress boards, Workshop files, community credentials, measurement consent and notification permission stay local. Delivery can be delayed; offline play remains available. Turning sync off or resetting local progress does not erase an existing iCloud copy, which can return if you enable sync again. Apple handles iCloud data under its policies and your account settings.
Daily reminders and sharing (version 1.8)
Reminders are optional local notifications, requested only after you choose to enable them and select a time. They pause after 28 days without reopening the app. A solve suppresses that day’s reminder when the app next schedules notifications. Solve sharing opens the iPhone share sheet with a decorative card, puzzle name or daily date, streak and app link. It does not include the solution. Nothing is shared until you choose a destination; that destination handles content under its own policies.
Remove Ads purchase (version 1.8)
An optional one-time Apple in-app purchase removes banner ads. Apple processes payment and provides signed purchase and entitlement information so the app can unlock and restore access and respond to refunds. We do not receive payment-card details. Hints and puzzles remain free, with no subscription. Restore purchases is available in Settings.
Banner ads in version 1.3
Version 1.3 adds bottom banner ads provided by Google AdMob. We request limited, nonpersonalized ads and do not request Apple’s tracking permission or permission to access the advertising identifier (IDFA). We disable Google’s publisher first-party ID and automatic device-location collection. The app does not request contacts, location, camera, microphone or photo-library permission. Campaign progress, puzzle designs and private support messages are not supplied as ad-targeting data.
Limited ads restrict personalized targeting and advertising use of local identifiers. They do not mean no data collection: network requests still transmit an IP address, and fraud-prevention storage may apply. See Google’s limited ads explanation. Google’s advertising SDK may process network information, including an IP address and approximate area inferred from it; app- or developer-scoped device identifiers; ads shown and ad interactions; other app interactions; performance information; and crash or diagnostic data. These support ad delivery and measurement, fraud prevention, analytics and service improvement. See Google’s iOS SDK data disclosures and how Google uses information from partner apps.
Google’s consent service checks whether a privacy message is needed and stores your choices. Where required, a privacy form appears before ads can be requested. Where ongoing privacy options are required, Settings → Ad privacy choices lets you revisit them. The app only requests ads when the consent service permits it. If an ad cannot load, the campaign remains playable. Ads require an internet connection; the campaign does not.
Google’s processing, retention and available controls are described in its Privacy Policy. Deleting local game data does not delete records already held by Google. An ad may open an advertiser’s website or app, which follows its own policies. To flag an inappropriate ad, use its reporting controls or private support. There are no paid hints or subscriptions.
Optional community sharing
Browsing the community contacts our hosted service. Publishing a puzzle requires an optional profile. Creator blocking works locally without a profile; when signed in, your blocks also sync to the service. The app generates a random access secret and keeps it in this device’s Keychain. The server stores only its cryptographic hash, a random profile identifier, a generated alias, creation time, accepted terms version, and moderation status. There is no email/password sign-in or recovery.
When you submit a puzzle, the service stores its board, rules, symbols, example solution, creator identifier, time, and review status. New submissions remain private until reviewed. Approved puzzles, their creator alias and identifier, and publication details are public. Your campaign progress and local undo history are not included. The service stores your blocking list privately and filters blocked creators from your gallery.
Reports and moderation
A report stores the selected reason, puzzle identifier, time, and your profile identifier if you use one. Reports and moderation decisions are visible to authorized operators, not other players. Report a mosaic in the app or use private support for safety, copyright, or appeal concerns. Do not post personal information or harmful material in public channels.
Private support
Support stores the topic and message you choose to send, a random request identifier, a hash of its private access code, status, timestamps, and the developer’s reply. It is separate from community profiles and does not require an email address. The code grants access to read or delete the conversation. The app stores access codes, pending drafts and cached replies in device-bound Keychain; the website shows the code for you to save and does not save it in browser storage. Avoid sending sensitive personal information. Anyone with the code can access the request; if you lose it, there is no identity-based recovery.
Hosting and service protection
The community runs through OpenAI Sites on Cloudflare infrastructure. Those providers process network information needed to deliver and protect the service. Our application database uses salted, time-windowed hashes of network addresses and request counters to limit abuse. It does not store raw IP addresses or use them to infer location. Counters expire after their rate-limit window; expired rows are pruned when requests arrive. This is not a promise that every expired row is physically erased at an exact hour.
Service providers processing information for us are required to protect it to the same or an equivalent standard described in this policy, including limited purposes, confidentiality, security, and assistance with deletion and privacy requests. Published Sites data is covered by the applicable OpenAI Sites data-processing terms (or business data-processing terms for business accounts), which include security duties and obligations for subprocessors. Cloudflare D1 documents encryption in transit and at rest. The application adds authenticated access, private support receipts, and deletion controls. These protections do not eliminate legal retention duties or promise uninterrupted service.
Technical infrastructure logs may contain request, network, and error information under the hosting providers’ practices. The application does not deliberately log authentication secrets, support messages, or puzzle submission bodies. We use this information for operation, security, moderation, and support, not advertising or analytics. Hosting and support processing may occur outside your country.
Deletion and retention
In Community → Profile, Delete community profile removes the server profile, its submissions and blocking list, and associated moderation records. Reports you made about other puzzles may remain without your profile identifier. You can remove an individual submission from My submissions. Removing a puzzle from the service cannot recall copies already downloaded or exported by other people.
Support requests are separate. Delete each request and reply using its private code in the app or support website. Closed requests may also be erased by the operator after resolution. Otherwise community and support records remain until you remove them or moderation removes them. Minimal cryptographic deletion markers remain without automatic expiration to prevent interrupted network requests from recreating deleted content; these markers contain no message, puzzle, alias, or access secret.
Settings → Delete all local game data removes campaign progress, local Workshop records and preferences. It also disables optional iCloud sync and measurement and requests measurement deletion as described above. It does not erase an existing iCloud copy, community server records, support requests, files shared elsewhere, or earlier device backups. Community and support access, pending drafts and cached replies remain in Keychain when you erase local game data, so you can still delete the separate server records. Delete community and support records using their own controls before discarding access to the device. Reset island progress resets the campaign and its daily activity records.
Files you choose to exchange
Workshop exports contain structured puzzle data and an example solution, not campaign progress or a verified account identity. The iPhone share destination handles the file under its own policies. Imported files stay local unless you explicitly submit a puzzle. File blocking prevents that exact design from being reimported. Blocking a community creator hides their known downloaded mosaics but cannot identify anonymous exported copies.
This website and external links
This website is hosted through OpenAI Sites on Cloudflare infrastructure. The hosting providers process network requests to deliver and protect the site under their applicable policies, including the OpenAI Sites data-processing terms. We do not add analytics scripts, advertising, or tracking cookies. Private support uses our separate hosted community service. Apple may collect diagnostics according to your iPhone’s Analytics & Improvements settings and Apple’s policies.
Your rights and contact
Depending on where you live, you may have rights to access, correct, delete, or restrict use of personal information and to complain to your local data-protection authority. Use private support, choosing Privacy or Deletion. Include only the information needed to identify your request or content; never send an access secret, password, identification document, or payment details. Operator: Ali Haroon, Isle of Glass.
Children and changes
The game is not marketed as a children’s service. The campaign does not require personal information. A parent or guardian should supervise optional online use when required by local law. Contact private support if a child has submitted personal information. We will update this policy when actual practices change and show a new date. See the community terms before submitting.