Privacy Policy

Overview

Crystallis: The Sweet Atlas (the "App") is built with privacy as a first-class design constraint. We do not sell or share personal data, we do not run analytics SDKs, advertising SDKs, or behavioural tracking pixels. We do not use IDFA or App Tracking Transparency.

Network use is limited to two narrowly-scoped purposes described below: push notifications via OneSignal, and a release-status check against our own server.

Data stored on your device

All in-app preferences — favorited sweets, appearance mode, Brix unit, and haptic preference — are stored locally on your device using Apple's standard UserDefaults storage. This data never leaves your device and is automatically removed when you uninstall the App.

Push notifications (OneSignal)

If you grant notification permission, the App uses OneSignal to deliver occasional product updates. The data exchanged is limited to:

• Apple-issued push token (required to deliver any push notification)
• Device's IDFV (a per-vendor identifier — used as our installation key)
• Standard device metadata that OneSignal collects per its own policy (timezone, device model, OS version, app version)

We do not use IDFA or any cross-app tracking identifier. You can revoke permission at any time in iOS Settings → Notifications → Crystallis.

Release-status check

On launch the App contacts our own server to learn whether the installed build is up to date. The request is a small JSON POST containing:

• The bundle identifier (app.crystallis)
• The app version (e.g. 1.0.0)
• The OneSignal push subscription identifier, or — if not yet available — IDFV

The server responds with one of three states: actual (continue normally), optional_update (suggest the user update), or mandatory_patch (open an in-app patch experience). No personal information is included in either direction.

Data we do not collect

• Name, email, phone, address, billing
• Location, contacts, photos, microphone, camera
• IDFA or any advertising identifier
• Behavioural analytics or click-stream data

Children's privacy

Crystallis is suitable for all ages and complies with COPPA and GDPR-K. Because we do not collect personally identifiable information, no data about children is processed at any time.

Your rights

Under GDPR, CCPA, and similar regulations you have the right to access, correct, or delete personal data held about you. Because we hold no such data on our servers (the OneSignal push token is the only personal identifier and it is rotated by Apple), these requests reduce to uninstalling the App, which removes all locally stored preferences and severs the OneSignal subscription.

If you have a specific deletion request, email support@crystallis.app and we will purge the corresponding OneSignal record within 30 days.

Third-party services

• OneSignal — push notification delivery. Privacy policy.
• Cloudflare — release-manifest CDN. Privacy policy.

Changes to this policy

If we change how the App handles data, an updated version of this policy will ship in a future App update. The "last updated" date above will reflect the change. Continued use of the App after an update constitutes acceptance of the new policy.

Contact

Questions about this Privacy Policy can be sent to support@crystallis.app. We respond within 24 hours, Monday–Friday.