Privacy policy

Quill

Android and iOS game com.crackoncloud.quill, published by crackoncloud · Last updated 16 September 2026

1. What the game stores on your device

All of it lives in app-private storage — a local database and a settings file — readable by Quill and not by other apps. Uninstalling takes every bit of it with you.

• The puzzles you have opened, as the generator built them: the board, its type, size, level and seed, and where it came from (the shelf, a pack, the Post)
• Your position in an open puzzle, stored as the moves you have made rather than as a picture of the board, so reopening the app replays them and lands you where you stopped, with the time and hint count so far
• Your results: each solve's type, size, level, mode, time, hints used and the date, plus the extras a type keeps (the rank, score and word count on a Hive, the words and score on a Grid, the guesses on a Five, the rungs on a Ladder, the author on a Cipher)
• Your bests, per type, size and level, and which packs you have completed
• The Post days you have opened and which of the eight you solved, kept once built so a change to the generator never rewrites a day you have already seen
• Your streak: the current run, your best, banked freezes, the last day solved and the days a freeze covered
• Your hint bank, and the moment it last refilled
• Your settings: look, room, accent, tile face, text size, sound, music, haptics, ambient motion, reduce motion, colour-blind marks, large targets, left-handed layout, US or UK spelling, the clock, nudge, auto-advance, confirm-restart, the language, and the diagnostics switch
• The screen you were last on, the date of first launch, whether the rating sheet has been shown, and whether the welcome card has been dismissed
• Whether Quill Unlocked has been bought, as last reported by the store. It is kept device-local.

None of it identifies you, because none of it is asked for. There is no name, no email, no profile and no sign-in anywhere in this game, and the only field a player types into is a word guess on a board. Reset progress in Settings › Data asks twice and deletes the lot; it keeps the unlock and your diagnostics choice.

The backup file

Settings › Data › Export backup writes one file, quill-backup-<date>.quill, through the system's own file picker, to wherever you point it — a folder on the phone, a drive app, a cable. It holds the database rows above, your settings and your streak; it does not carry the hint bank. The contents are sealed (encrypted and signed with a key that ships in the app, so an edited file is refused as Not a Quill backup); that is a seal against a text editor, not a secret from you, and what the file holds is the list above. The app never reads the file again unless you choose it in Import backup, and an import merges — a best or a streak is never taken away by it. Quill has no way to send the file anywhere. Where you put it, and who else can read that place, is up to you and the app you saved it with.

Your device's own backup

On Android, the game allows the platform's own backup, so if you have Android backup switched on, your device may copy the app's files into your Google account backup along with everything else on the phone. That is Android's backup of your device, made with your own account and governed by Google's terms — we neither see it nor hold a key to it. On iOS the same is true of an iCloud or an encrypted local device backup. Turning device backup off, or excluding the app from it, stops that copy being made.

2. Permissions, and exactly what each one is for

Permission	What Quill does with it
Vibrate	The tick under a tile. Granted at install, never asked for, and idle while the haptics setting is off.
Internet Network state	No puzzle needs a connection: every one is generated on the device, including the day's Post. It is here for the store — the purchase, the restore, Android's in-app update check and the rating sheet — and for the diagnostics in §3, which the switch in Settings › Data turns off.
Notifications Android only	Declared in the manifest for a daily reminder — only if today's Post is unsolved — that is planned for a later release. In this release nothing is scheduled, no notification is ever posted, and the permission prompt is not shown. When the reminder ships it will be a switch in Settings, off until you turn it on, and this page will say so.

That is the whole list. The advertising-identifier permission that the analytics library would otherwise bring along is explicitly removed from the Android manifest, because nothing in this game reads it. There is no storage permission, because the backup goes through the system picker; and no permission for location, contacts, the camera, the microphone, the phone, all-files access, or for listing the other apps you have installed.

3. Send diagnostics

One switch, in Settings › Data, whose own subtitle is the promise: Crash reports and which puzzles are hard. No ad id, no user id. It can be turned off at any time, permanently, from that screen. It is honoured before anything is collected rather than after: all three collectors ship disabled in the app's own manifest and property list, and are switched on only after the stored preference has been read. A player who turns it off is off from that moment, and stays off across launches.

The switch starts off in the EEA, the United Kingdom and Switzerland, and on elsewhere. A device that names no country at all takes the cautious side and starts off too. Either way the switch is yours, in both directions, from the first launch.

Crash reports

When the game crashes or hits an error it handled, a stack trace, the device model, the operating system version, the app build and the game's own breadcrumbs go to Firebase Crashlytics so the fault can be fixed. A handled error carries the name of the place in the code that handled it, and nothing else about what you were doing.

Usage events, and speed measurements

The same switch covers Firebase Analytics and Firebase Performance. The whole vocabulary is written out in the code as the only names an event may carry:

• Which screen is open — one of desk, play, post, packs, stats, settings or unlock
• What happened on a board: a puzzle started, solved, revealed or abandoned; a hint used; the hint bank run empty; Check pressed; a Post day completed; a pack completed; the Unlock sheet opened and from where; a purchase or a restore; a setting changed; the shelf of ready boards found empty, or a board served from the fallback set instead of generated; and a store receipt that failed to verify
• The parameters those carry, and no others: a type, a size, a level, a mode, a source, a duration in milliseconds, a hint count, an extras count, a progress fraction, a kind, a reason, a length, a count for the day, a streak length, a trigger, a result, a settings key, which look is on and whether a scene is showing
• One sampled event: one rejected word in ten is reported by its length, so the lexicon's gaps can be found. The word itself is never sent.
• Four timings: how long a puzzle takes to generate, how long the lexicon takes to load, a board's frame cost and the cold start, plus the platform's own app-start and frame measurements
• The Firebase app-instance ID, which is what makes two events from one install countable as one session. It is the SDK's own identifier: it names an installation rather than a person, it is reset when the game is reinstalled or its data cleared, and there is no account in this game to join it to.

None of what this switch sends is shared with anybody. Nothing here profiles anyone, and nothing is joined to data from any other company or app. Everything sent goes over HTTPS. Google acts as our processor for these reports, and their handling of them is covered by Google's own privacy terms.

The switch cannot carry a board, a word you found, a quotation or a guess, because every analytics parameter comes from the fixed list above and none of them is a string a player wrote.

4. Advertising

There is none. Quill contains no advertising SDK, requests no ad, and reads no advertising identifier: on Android the permission for it is removed from the manifest (§2), and on iOS the game never calls for App Tracking Transparency permission, so the prompt is never shown and the IDFA is never available to anything in the app. Google's own collection of the advertising ID by the analytics library is switched off in the build as well.

The app's iOS privacy manifest declares no tracking and no tracking domains. Nothing in this game is earned by watching anything, and the hint bank is bought with time or with the unlock, not with attention.

5. Buying Quill Unlocked

The unlock is one purchase, once — a non-consumable — made through Google Play Billing on Android or StoreKit on iOS. Both run in the store's own process, not in ours: the game never sees or stores a card, a billing address or a store account name. There is no server of ours in the path. On Android the signed purchase is checked against the app's licensing key on your own device, and nothing about that check leaves the phone; the entitlement is then cached locally, which is also why a purchase keeps working with no connection.

Restoring on a new device asks the store, not us; the Restore button is on the Unlock sheet. What the store collects in the course of a purchase is governed by Google's or Apple's privacy policy, not by this one. No puzzle type is behind the purchase, so nothing you have played becomes unplayable if a store ever fails to answer.

6. What you can do with your data

• Turn the switch off in Settings › Data. Collection stops from that moment. The app-instance ID is not carried to anyone else, and reinstalling the game or clearing its data gives the install a new one; reports already sent can be deleted on request — write to the address in §9.
• Export a backup from Settings › Data, and read it: it is your data, in a file you hold.
• Reset progress in Settings › Data, which deletes every puzzle, result, best, streak and statistic on the device. It asks twice, and the second time it reminds you to export a backup first if you want one.
• Uninstall. That removes everything the game kept on the device. Because we never held a copy, there is no server-side record to ask for the deletion of, and no deletion URL to send you to.

7. Children

Quill is a word game for a general audience and is not directed at children under 13. It has no social features, no messaging, no user profiles and no accounts, it shows no advertising, and it asks no one for a name, an email address or any other personal detail, at any age. The lexicon's exclusion list keeps slurs and obscenities out of every grid, forwards and reversed, and the Cipher's quotations are public domain. Because it is not a child-directed app it is not in Google Play's Designed for Families programme.

8. Changes to this policy

If what the game stores or sends changes, this page changes with it and the date at the top is updated. Anything that would move an answer here — an identifier of any kind, a cloud copy of your progress, a push service, an advertising SDK, or a third-party framework this page does not name — is a change to the product's own promises, not merely to its wording, and it is announced here before it is relied on.

9. Contact

Questions about this policy, or about anything Quill stores: support@crackoncloud.com