This policy explains what personal data Lantern & Whistle processes, why, for how long, and what you can do about it. It covers the iOS app, the Android app and the website at lanternandwhistle.com.
Lantern & Whistle is a pass-the-phone party game. Most people play it without ever creating an account. We built it so that the game itself works with no personal data leaving your device.
1. Who is responsible
The data controller is:
Little Lion Labs (trade name: Sidrion Labs) Sole proprietorship registered in the Netherlands Chamber of Commerce (KvK): 42012326 Prinses Julianastraat 12, 2802 JR Gouda, the Netherlands
Privacy requests: privacy@lanternandwhistle.com General support: support@lanternandwhistle.com
If you are in Turkey, the KVKK disclosure text at /tr/legal/kvkk applies in addition to this policy.
2. What we process
2.1 Playing without an account
Everything the game needs is stored on your device only:
- game state of the current case (so you can resume after a crash);
- your notebook: for each case you have closed, the case, the street's stars (★, nights found out of three), the date you played it and the outcome of each night (found / lost);
- the player names you type in at the start of a round;
- settings (language, sound, haptics, reduced motion);
- a random install id (a UUID generated on first launch; it is not tied to your device identifiers);
- a cached list of what you own.
Player names, clues and answers typed during a game never leave your device, also not when you sign in. Notebook sync (see 2.2) uploads only the notebook fields listed above.
2.2 Account (optional)
You can sign in with Apple, with Google, or with an email magic link / 6-digit code. There are no passwords. If you do, we process:
| Data | Source | Why |
|---|---|---|
| Email address and whether it is verified | you, Apple or Google | sign-in, receipts, security notices, recovery |
Provider subject id (Apple sub, Google sub) and the fact that an Apple address is a Hide My Email relay | Apple / Google | to recognise you next time |
| Encrypted Apple refresh token | Apple | so we can revoke Sign in with Apple when you delete your account |
| Display name (optional) | you | shown in the app only |
| Preferred language | you | interface language in emails |
| Notebook: for each closed case the case id, the stars (★), the date played and each night's outcome (found / lost); no player names | your device, when you sign in and whenever you tap "Sync notebook" in Settings → Account | cross-device sync |
| Session records: refresh-token hash, install id, timestamps | the app | keeping you signed in, revoking sessions |
| Magic-link records: email, token hash, code hash, attempt counter and a salted hash of the requesting IP address | the app | one-time sign-in and abuse limits |
| Audit log entries (what changed on your account and when) | the app | security, support, disputes |
Accounts are for people aged 13 and over (see section 8).
2.3 Purchases
Lantern & Whistle sells one-time purchases only. No subscriptions, no ads.
App Store / Google Play. Apple or Google processes your payment. We receive and store the purchase record needed to unlock content and to honour refunds: product id, Apple original transaction id or a hash of the Google purchase token, order id, purchase date, state (active, refunded, revoked), environment (sandbox/production), the amount and currency reported by the store, and the storefront country. We never see your card.
Website (Stripe / Link). Web purchases are sold through Stripe as reseller and merchant of record ("Sold through Link"). Stripe collects your payment details, billing name and address, email and, where it asks, phone number, and uses them as an independent controller under its own privacy policy (stripe.com/privacy; for Link, link.com/privacy): to take the payment, calculate and collect tax, prevent fraud, send receipts and invoices, and handle support, refunds and disputes. We receive and store: product id, Stripe payment-intent id, Stripe customer id, amount, currency, the billing country (used for the country check), your email address, and the result of the payment. Card numbers stay with Stripe. If you buy a gift, we also store the recipient email address you enter, until the gift is redeemed or voided.
Purchase records are bookkeeping records (see retention, section 6).
2.4 Telemetry
We collect ten anonymous usage events to understand whether the game works and which words people skip: app_open, case_started, night_completed, case_closed, offer_shown, offer_dismissed, purchase_started, purchase_completed, word_skipped (pool, word, language) and restore_tapped.
Each event carries the random install id, the app version, platform, language and a timestamp. Nothing else. We do not store IP addresses with telemetry, do not use advertising identifiers, do not fingerprint devices and do not use any third-party analytics or tracking SDK.
2.5 Support
When you write to support@lanternandwhistle.com or privacy@lanternandwhistle.com we process your email address, the content of your message and anything you attach (for example a receipt).
2.6 Infrastructure logs
Our servers run on Microsoft Azure. Request logs needed to operate and secure the service (including client IP addresses) are kept by Azure Log Analytics for 30 days. They are not joined with telemetry or accounts and are not used for profiling.
3. Why we process it, and on which legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running the game, unlocking what you bought, restoring purchases | performance of a contract, Art. 6(1)(b) |
| Accounts, sign-in, sync, export, deletion | performance of a contract, Art. 6(1)(b) |
| Bookkeeping of our sales and payouts | legal obligation, Art. 6(1)(c) |
| Security: rate limiting, abuse prevention, audit log, revoking stolen sessions | legitimate interest, Art. 6(1)(f) |
| Anonymous telemetry | legitimate interest, Art. 6(1)(f), in a form designed not to identify you |
| Refund handling, disputes | performance of a contract and legal obligation |
| Answering support requests | performance of a contract / legitimate interest |
We do not send marketing email. We do not sell or rent personal data. We do not make automated decisions with legal effect about you.
4. Who receives data (processors and independent controllers)
| Recipient | What | Where |
|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd.) | hosting, database, logs | West Europe region (Netherlands) |
| Resend, Inc. | transactional email (magic links, receipts, security notices) | EU sending region; Resend is a US company and acts under Standard Contractual Clauses |
| Stripe and its affiliates, including Link | web purchases: Stripe is merchant of record and an independent controller for the payment data it collects (see 2.3); processor for the purchase data we keep in our Stripe account | EU and US; Stripe transfers under SCCs / EU–US Data Privacy Framework |
| Apple Inc. / Apple Distribution International Ltd. | Sign in with Apple, App Store purchases | per Apple's privacy policy |
| Google LLC / Google Ireland Ltd. | Sign in with Google, Google Play purchases | per Google's privacy policy |
Apple, Google and Stripe (for web purchases) are independent controllers for the data they collect through their own platforms and checkout. Cloudflare provides DNS for lanternandwhistle.com only; no traffic is proxied through it.
5. International transfers
Our systems are in the EU. Where a processor transfers data outside the EEA (Resend, Stripe), the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision (for Stripe, Inc. the EU–US Data Privacy Framework). You can request a copy of the relevant safeguards at privacy@lanternandwhistle.com.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data | until you delete the account; then anonymised immediately |
| Notebook sync data | until you delete the account |
| Purchase records | 7 years from the purchase (Dutch tax law, Art. 52 AWR). After account deletion they are kept without any personal data; only a one-way hash links them to the deleted account |
| Telemetry | 13 months |
| Magic-link records | valid 15 minutes; deleted within 48 hours |
| Session (refresh token) records | until expiry or revocation; expired records are purged daily |
| Audit log | 24 months |
| Support email | 24 months after the request is closed |
| Infrastructure logs | 30 days |
| Locked accounts awaiting scheduled deletion (see Apple note below) | 30 days, then deleted |
7. Your rights
Under the GDPR you can:
- obtain access to your data (Art. 15) — the app's Settings → Account → Export gives you a JSON file;
- have it corrected (Art. 16);
- have it erased (Art. 17) — Settings → Account → Delete account, or https://lanternandwhistle.com/account/delete if you cannot sign in;
- restrict processing (Art. 18);
- receive it in a portable format (Art. 20) — the same export;
- object to processing based on legitimate interest (Art. 21);
- not be subject to automated decisions (Art. 22) — we make none.
Write to privacy@lanternandwhistle.com. We will verify that you control the account email (magic link) before acting and reply within one month.
You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority in your own country. People in Turkey: see the KVKK text for the application procedure and the Kişisel Verileri Koruma Kurulu.
8. Children
The game is suitable for families, but accounts and purchases are for people aged 13 or over. Younger players can play on a parent's device without any account. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, email privacy@lanternandwhistle.com and we will delete it.
9. Sign in with Apple and Hide My Email
If you use Apple's Hide My Email, we receive a relay address ending in @privaterelay.appleid.com. We store that it is a relay address, send email to it only through Apple's relay, and never replace a real email address on your account with a relay address. If you turn the relay off in your Apple ID settings, email from us will stop reaching you; sign-in keeps working. If you choose "Stop using Apple ID" for Lantern & Whistle, Apple notifies us: we revoke your sessions and remove the Apple identity. If it was your only sign-in method, the account is locked and deleted after 30 days unless you recover it with a real email address we hold.
10. Security
Data travels over TLS. Access tokens live 15 minutes; refresh tokens are rotated on every use and a reused token revokes the whole session family. Apple refresh tokens are encrypted at rest. Webhooks from Apple, Google and Stripe are signature-checked. The database is in the EU and accessible only to the API. No method of transmission or storage is perfectly secure; if a breach affects you we will tell you and the supervisory authority as the law requires.
11. Cookies
The website uses one strictly necessary cookie after you sign in and nothing else. See the cookie notice at /en/legal/cookies.
12. Changes
We will post changes here with a new "updated" date. For material changes we will also show a notice in the app or email account holders. Older versions are available on request.
13. Contact
Little Lion Labs (Sidrion Labs) · Prinses Julianastraat 12, 2802 JR Gouda, the Netherlands · privacy@lanternandwhistle.com