Privacy Policy

Shadow Echo (影迴) — Last updated: 8 April 2026

Overview

Shadow Echo is an AI-powered detective puzzle game. We are committed to protecting your privacy. This policy explains what data we collect, how we use it, and your choices.

Data We Do NOT Collect

• We do not require account creation or login.
• We do not collect your name, email address, phone number, or any personally identifiable information.
• We do not collect or access your contacts, photos, location, or any on-device data outside the app.

Data Collected Automatically

Device Attestation

We use Apple App Attest to verify that requests come from a genuine copy of the app on a real device. This generates a unique cryptographic key pair on your device. The public key is sent to our server and stored for up to 90 days to authenticate subsequent requests. This key cannot identify you personally; it only confirms the device is running an unmodified version of the app.

Game Session Data

When you play a case, our server stores the following data temporarily:

• Session ID — A random identifier created each time you start a new case.
• Conversation history — Your recent in-game dialogue with NPC characters.
• Discovered clues and NPC emotional states — Used to drive gameplay logic.
• Turn count and ad bonus count — Tracked per device per case.

Session data is automatically deleted after 24 hours. Turn state is deleted after 7 days.

IP Address

Your IP address is used temporarily for rate limiting (preventing abuse). IP-based counters are stored for at most 1 hour and then automatically deleted. Our application does not log IP addresses. Note that hosting infrastructure (e.g., CDN, load balancer, or reverse proxy) may temporarily process IP addresses at the network level as part of standard operations.

Local Device Storage

The following data is stored locally on your device only and never sent to our servers:

• Language preference
• Case completion history and unlock progress
• Audio settings (music and sound effects)
• Consent acceptance status
• Unlocked character backstories

You can clear all local data by deleting and reinstalling the app.

AI-Powered Dialogue

When you interact with in-game characters, your messages are sent to our server, which routes them through Vercel AI Gateway to a third-party AI language model to generate character responses.

• Messages sent to the AI contain only your in-game dialogue, case context, and NPC background — no personal data, device information, or IP address.
• Vercel AI Gateway handles API routing subject to its own privacy policy.
• Player inputs are sent solely for the purpose of generating in-game dialogue and are not used by us for any other purpose. Third-party AI providers' handling of API inputs is governed by their own terms of service.
• Our server does not retain conversation data after the session expires (24 hours).

Content Moderation

All player messages are automatically screened for content that violates our usage policy (sexual content, hate speech, self-harm encouragement, etc.). Messages that violate the policy are blocked and not forwarded to the AI model. When a message is blocked, a short excerpt may be retained for abuse monitoring. AI-generated responses that fail safety filtering may also be retained for the same purpose.

AI-generated NPC responses are also filtered for safety and to prevent the AI from breaking character.

Advertising

Shadow Echo displays rewarded video advertisements provided by Google AdMob. Ads support the game — you watch them to unlock cases, earn extra turns, and access character stories.

• Google AdMob may collect device identifiers and usage data in accordance with Google's Privacy Policy.
• We use Apple's App Tracking Transparency (ATT) framework. You will be asked for permission before any advertising identifier (IDFA) is shared with the ad network.
• If you deny tracking permission, you will still see ads, but they will not be personalised.
• We do not operate any ad network ourselves; all ad serving and data collection is handled by Google AdMob.

Analytics

We use Firebase Analytics (provided by Google) to understand how the game is played. The following anonymised events are collected:

• Case started, completed, or abandoned (with case ID, difficulty, score, and turn count)
• Ad watched (with ad type and result)
• Turn limit reached (with case ID)

These events are not linked to any personal identifier. Firebase may assign its own anonymous instance ID. See Firebase Privacy Information for details.

Third-Party Services

Data Retention Summary

Children's Privacy

Shadow Echo contains fictional depictions of crime scenes and is intended for mature players aged 16 and above. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information, please contact us and we will delete it promptly.

Security

We employ the following measures to protect your data:

• All communication between the app and our server uses HTTPS encryption.
• Apple App Attest ensures only genuine app instances can access our API.
• Rate limiting protects against automated attacks.
• User input is sanitised before processing to prevent injection attacks.

Your Rights

Since we do not collect personal data or require accounts, there is generally no personal data to access, correct, or delete. All server-side data is automatically deleted within the retention periods listed above.

You can:

• Deny ad tracking permission via the ATT prompt or in iOS Settings > Privacy > Tracking.
• Reset all local game data by deleting and reinstalling the app.
• Contact us with any privacy concerns at the address below.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the app after changes constitutes acceptance.