Privacy policy

Sapper

Android and iOS game com.crackoncloud.sapper, published by crackoncloud · Last updated 24 September 2026

1. What the game stores on your device

All of it lives in app-private storage — a local database and a settings file — readable by Sapper and not by other apps. Uninstalling takes every bit of it with you.

• The board you are playing and any you left to continue: its shape, size, mine count, mode and band, the seed it was generated from, where the mines lie, the journal of every move so far, the time on the clock and the hints used. Reopening the app replays the journal and lands you where you stopped. A board you walked away from is marked abandoned, and an abandoned board older than a month is deleted — the only thing the game ever deletes.
• Every game you have finished: the preset, the mode, the shape, the time, its 3BV, the hints used, whether you won, the band, where it came from (Play, Daily, Ladder or Zen) and when — kept so the result card, the statistics and the history can show it
• Your personal best per preset and mode, which daily boards you have played and how they went, and each ladder board's stars and best time
• Your streak: the current run, your best, banked freezes, the last day solved and the days a freeze covered
• Your settings: sound and each haptic, reduce motion and animation speed, theme, colour-blind numbers and your own number colours, question marks, what a tap and a long press do, the long-press duration, the flag toggle, chording, pulsing numbers, double-tap flags, handedness, the daily reminder switch, the two diagnostics switches, the last mode, band and preset on the Play screen, the Custom card's shape and dials, and the screen you were last on
• The date of first launch, whether the rating sheet has been shown, and which first-run tips you have dismissed
• Whether Sapper Unlocked has been bought, as last reported by the store. It is kept device-local.

None of it identifies you, because none of it is asked for. There is no name, no email, no profile and no sign-in anywhere in this game. The results are append-only by design: no update ever deletes one, and there is no button in the app that does.

The backup file

Settings › Data › Export backup writes one file, sapper-backup-<date>.sapper, through the system's own file picker, to wherever you point it — a folder on the phone, a drive app, a cable. It holds your finished games' results, your bests, your daily boards, your ladder stars, your streak and most of your settings, including the two diagnostics switches; it does not carry a board in progress, your own number colours, or the unlock.

The file is sealed: its contents are encrypted and signed with a key built into the app, so that an edited file — three stars typed beside every ladder board — is refused on import. That key is the same in every copy of Sapper, so the seal is a guard against tampering, not a password protecting your data; treat the file as you would any other file you keep. The app never reads the file again unless you choose it in Import backup, and an import merges — a result already present is skipped, a best is the faster of the two, stars are the higher, a streak keeps the newer run and the better best — so nothing you have is ever lowered by it. An import also applies the settings the file carries, including the two diagnostics switches as they were when you exported it. Sapper has no way to send the file anywhere. Where you put it, and who else can read that place, is up to you and the app you saved it with.

The board id

Copy board id, on a result card, puts the board's id — its shape, size, mine count, seed and opening cell, the same text printed under the card — on the system clipboard. Nothing is copied unless you tap it, and where you paste it is your choice.

Your device's own backup

On Android, the game allows the platform's own backup, so if you have Android backup switched on, your device may copy the app's files into your Google account backup along with everything else on the phone. That is Android's backup of your device, made with your own account and governed by Google's terms — we neither see it nor hold a key to it. On iOS the same is true of an iCloud or an encrypted local device backup. Turning device backup off, or excluding the app from it, stops that copy being made.

2. Permissions, and exactly what each one is for

Permission	What Sapper does with it
Vibrate	The tick under a flag, a chord or a mine. Granted at install, never asked for, and idle while the haptics setting is off.
Notifications	One local reminder for the daily board, off until you switch it on in Settings › Data › Daily reminder. The permission is asked for at that moment and never on a cold open; a refusal leaves the switch off. It fires once a day around six in the evening, local time, and is scheduled by the phone's own clock — there is no push service, no token and no server behind it. On Android the app also listens for the phone finishing a reboot, only to put that alarm back.
Internet Network state	No board needs a connection: every board is generated on the device or shipped in the app, including the daily. It is here for the store — the purchase, the restore, Android's in-app update check and the rating sheet — and for the diagnostics in §3, which the two switches in Settings turn off.

That is the whole list. The advertising-identifier permission, and the two Privacy Sandbox advertising permissions that the analytics library would otherwise bring along, are explicitly removed from the Android manifest, because nothing in this game reads them. There is no storage permission, because the backup goes through the system picker; and no permission for location, contacts, the camera, the microphone, the phone, all-files access, or for listing the other apps you have installed.

3. Crash reports, and Usage events

Two switches, under Settings › Data. Either can be turned off at any time, permanently, from that screen, and each is honoured before anything is collected rather than after: all three collectors ship disabled in the app's own manifest and property list, and are switched on only after the stored preferences have been read. A player who turns one off is off from that moment, and stays off across launches.

Both switches start off in the EEA, the United Kingdom and Switzerland, and on elsewhere. A device that names no country at all takes the cautious side and starts off too. Either way the switches are yours, in both directions, from the first launch.

Crash reports

When the game crashes, a stack trace, the device model, the operating system version and the app build go to Firebase Crashlytics so the fault can be fixed, under Crashlytics' own installation identifier. Nothing about you or your boards is attached to it.

Usage events

The second switch covers Firebase Analytics and Firebase Performance together. These are the only events the game itself sends, and every parameter is one of the fixed values below:

• A board generated, with its preset, the band asked for, how many milliseconds it took and how many repairs and restarts the generator needed — so the generator's speed can be checked on real phones
• A board started, with its preset, mode, band and where it came from (Play, Daily, Ladder or Zen); a board ended, with whether it was won, the time, its 3BV, the hints used, the number of moves and the number of wrong flags
• A hint asked for, with the technique tier it showed, or that no safe move existed
• The Unlock page opened, and what led there; a purchase completed; and, on Android, a purchase receipt that did not verify on the device
• Firebase's own automatic events — the first open, a session starting, an app update — and the platform's app-start and screen-rendering measurements from Firebase Performance
• The Firebase app-instance ID, which is what makes two events from one install countable as one session. It is the SDK's own identifier: it names an installation rather than a person, it is reset when the game is reinstalled or its data cleared, and there is no account in this game to join it to. On iOS the collection of the vendor identifier by the analytics library is switched off in the build.

None of what these switches send is shared with anybody. Nothing here profiles anyone, and nothing is joined to data from any other company or app. Everything sent goes over HTTPS. Google acts as our processor for these reports, and their handling of them is covered by Google's own privacy terms.

The switches cannot carry a board, a seed or a board id, because every parameter comes from the fixed list above.

4. Advertising

There is none. Sapper contains no advertising SDK, requests no ad, and reads no advertising identifier: on Android the permissions for it are removed from the manifest (§2), and on iOS the game never calls for App Tracking Transparency permission, so the prompt is never shown and the IDFA is never available to anything in the app. Google's own collection of the advertising ID by the analytics library is switched off in the build as well.

The app's iOS privacy manifest declares no tracking and no tracking domains. Nothing in this game is earned by watching anything, and nothing in it is bought by the piece.

5. Buying Sapper Unlocked

The unlock is one purchase, once — a non-consumable — made through Google Play Billing on Android or StoreKit on iOS. Both run in the store's own process, not in ours: the game never sees or stores a card, a billing address or a store account name. There is no server of ours in the path. On Android the signed purchase is checked against the app's licensing key on your own device, and nothing about that check leaves the phone; the entitlement is then cached locally, which is also why a purchase keeps working with no connection.

Restoring on a new device asks the store, not us; the Restore button is on the Unlock page. What the store collects in the course of a purchase is governed by Google's or Apple's privacy policy, not by this one. The classic game is not behind the purchase, so nothing you play for free becomes unplayable if a store ever fails to answer.

6. What you can do with your data

• Turn either switch off in Settings › Data. Collection stops from that moment. The app-instance ID is not carried to anyone else, and reinstalling the game or clearing its data gives the install a new one; reports already sent can be deleted on request — write to the address in §9.
• Export a backup from Settings › Data. It is your data, in a file you hold, and this page lists everything in it.
• Uninstall, or clear the app's data. That removes everything the game kept on the device. Because we never held a copy, there is no server-side record to ask for the deletion of, and no deletion URL to send you to.

7. Children

Sapper is a logic puzzle for a general audience and is not directed at children under 13. It has no social features, no messaging, no user profiles and no accounts, it shows no advertising, and it asks no one for a name, an email address or any other personal detail, at any age. A mine is an abstract square on a grid, and a lost board a flash of red. Because it is not a child-directed app it is not in Google Play's Designed for Families programme.

8. Changes to this policy

If what the game stores or sends changes, this page changes with it and the date at the top is updated. Anything that would move an answer here — an identifier of any kind, a cloud copy of your progress, a push service, an online leaderboard, an advertising SDK, or a third-party framework this page does not name — is a change to the product's own promises, not merely to its wording, and it is announced here before it is relied on.

9. Contact

Questions about this policy, or about anything Sapper stores: support@crackoncloud.com