Privacy policy

Version/effective date: 2026-10-18

This policy covers the WristMaze Apple Watch app and wristmaze.com (together, the “Services”). The website presents WristMaze as Coming soon, with optional Analytics and Marketing behind a consent banner. Launch sign-up and support forms, video delivery, a separate media host and press-kit downloads are not offered in this release.

1. Who is responsible

Crawle AB, Sweden, is the controller where it determines why and how personal data is processed under this policy. Apple and some Google services act under their own terms as explained below.

Organisation number: 559595-6862
Postal address: Jaktgatan 8, 115 45 Stockholm, Sweden
Privacy contact: support@crawle.io

2. The Apple Watch app

The app has no advertising, tracking or developer analytics. It has no Crawle AB account and does not send gameplay or motion data to a Crawle AB server.

You can find the policy address, wristmaze.com/privacy, in the app’s Settings under Privacy policy. Open that address on a phone or computer.

Data or activity	What happens	Purpose and legal basis
Watch motion	The app reads motion and tilt input while you play. It is processed on the watch and is not sent to Crawle AB.	Run the game. No off-device collection by Crawle AB.
Progress and settings	Level progress, times, settings and pending leaderboard submissions are stored on the watch. In the in-app-purchase build, the watch also stores two purchase-status flags: a cached verified entitlement and a pending approval.	Save your choices and provide the game. Performance of the app contract (GDPR Art. 6(1)(b)).
Game Center	If you sign in to Game Center, the app sends a completion time and attempt count to Apple’s leaderboard service. It reads leaderboard scores and Game Center display names. To mark your own row, it compares rank, time and display name on the watch; it does not read or store Apple player identifiers. The game remains playable without Game Center.	Provide the optional leaderboard you request. Performance of the service (Art. 6(1)(b)). Apple processes Game Center data under Apple’s terms and privacy notice.
App Store purchase	The release is either paid upfront, with no StoreKit purchase inside the app, or free with one non-consumable StoreKit purchase. In the StoreKit build, product and transaction details are used in memory and the two purchase-status flags described above are stored on the watch. In either model, Apple handles payment and Crawle AB does not receive your payment-card details through the app.	Provide the app and any purchased unlock (Art. 6(1)(b)); meet legal obligations where applicable (Art. 6(1)(c)). Apple processes purchase and account data under its own terms and privacy notice.

Apple explains that Game Center can process game activity, scores, nicknames, avatars and Game Center identifiers in its Game Center & Privacy notice. Apple explains its App Store purchase processing in App Store & Privacy.

3. The website

Ordinary visits and security

Cloudflare delivers and protects the website on its Free plan, providing the proxy, TLS, caching and security. It processes your IP address and technical request information, such as the requested page and traffic-routing information, to deliver pages and protect the service.

Only Cloudflare connects to the origin server, hosted by Hetzner in Helsinki, Finland. Crawle AB’s web application keeps no visitor access log; its logs are limited to start-up and operational errors. This is not a claim that Cloudflare keeps no request or security data.

The legal basis for website delivery and security is Crawle AB’s legitimate interest in providing a reliable, secure public website (GDPR Art. 6(1)(f)). You can object to processing based on legitimate interests; it may continue where compelling legitimate grounds, such as necessary security, override your interests, rights and freedoms.

Fonts, page graphics and static pictures are served with the website. The pages do not use a third-party font or graphics service or a separate media host. This release creates no form records. Consented Analytics and Marketing create the consent records described below.

When a consent-record request is submitted, the origin also uses the IPv4 address, or the network part of an IPv6 address (/64), in an in-memory rate-limit counter for security and abuse prevention. The legal basis is our legitimate interest in protecting the service (Art. 6(1)(f)).

Client IP keys are kept only in memory and expire within one hour.

Enquiries by email

The privacy contact is support@crawle.io, hosted on Google Workspace for crawle.io. If you email us about the Services or your privacy rights, we use your sender address, message and any information needed to identify and handle the request. Handling GDPR rights requests and keeping necessary evidence of compliance uses the legal basis of a legal obligation (Art. 6(1)(c)). Answering other enquiries uses our legitimate interest in responding to you (Art. 6(1)(f)). These messages are not used for marketing or joined to your Analytics ID.

Enquiries are read only by one authorised person at Crawle AB; Google provides the mail hosting. Enquiries, including privacy requests and mailbox copies, are deleted no later than 12 months after the matter is closed, unless law requires longer storage. We make no data-region commitment for this mailbox; §4–5 explain the provider and possible international processing.

Security cookies and other browser storage

Cloudflare may set cf_clearance after a security challenge; the site’s Challenge Passage setting is 30 minutes. During a challenge it may also set cf_chl_rc_i, cf_chl_rc_ni and cf_chl_rc_m to diagnose problems in visitors’ browsers. Cloudflare sets and controls these diagnostic cookies and publishes no fixed lifetime for them in its cookie reference. Bot Fight Mode, Zaraz, Cloudflare Web Analytics and all Managed Transforms are off. No extra Cloudflare logging product is enabled; §6 explains the standard security datasets and Cloudflare’s separate retention criteria.

Cloudflare Network Error Logging was switched off on 18 October 2026. New responses no longer install its reporting policy. Browsers that received the earlier policy may still send network-diagnostic reports to Cloudflare for up to seven days from their last receipt. These reports can include the requested URL, timing, protocol and error/status information, as described in Cloudflare’s NEL information. The earlier policy’s browser lifetime is separate from cookies and from how long received reports are kept.

The cookie policy explains these security cookies, the necessary choice storage and the optional Google cookies separately.

Analytics and Marketing choices

Accept all allows Analytics and Marketing. Reject all refuses both. Choose offers independent Analytics and Marketing switches, initially off. You can change either at any time through Cookie settings in the footer; refusing either does not limit the site.

The site uses basic Consent Mode. Tag Manager and Google Analytics 4 (GA4) load only after you allow Analytics and our server acknowledges the consent record below. Before then, no analytics or advertising request, including a cookieless ping or consent-status ping, goes to Google. A Marketing-only choice is saved and recorded, but loads nothing from Google: Marketing works only together with Analytics in this setup.

Analytics measures visits and use so we can improve WristMaze. It covers page views, visit/session timing, reaching 90% of a page, outbound link clicks, clicks on file-download links and chosen calls to action. Where an App Store link is available, its clicks can be measured; a click does not show whether a purchase follows. This release offers no launch/support form, video delivery or press-kit download, so those are not described here as active measurement purposes.

Google receives a pseudonymous browser/client ID, session information, event times, language and device details. Granular data collection is enabled for consenting visitors worldwide: this includes city and city-level coordinates (not GPS location), device brand/model, browser and operating-system versions, user-agent information and screen resolution. Google also receives the connection’s IP address; it says EU, Swiss and UK IP addresses are used for location derivation and discarded before logging. Its non-EU/Swiss/UK IP guidance explains the handling of other visitors’ addresses.

Page addresses sent to Google exclude fragments and query details except approved campaign tags. Unknown campaign values are dropped, not sent as free text. A not-found page uses one fixed address; the referrer is reduced to its site origin, without its path or query. Link fields use our authored URLs and fixed labels. Each Google measurement request carries the Consent Mode state; we do not send a separate consent-choice event.

Marketing enables Google Analytics Advertising Features: Google signals for aggregated demographic, interest and cross-device reports, and advertising personalisation permissions. Google signals can associate visits with data about eligible people signed in to Google who have enabled ads personalisation. These features are enabled worldwide only for visitors who allow both choices. We and Google use the first-party GA4 identifier together with Google’s own advertising cookies or identifiers for these features.

There is no Google Ads account link, export of conversions to Ads or sharing of remarketing audiences in this setup. Ad-personalisation settings prepare for a later advertising setup; that requires updated information and a new choice before activation. We keep Analytics data sharing and product links off. We do not use User-ID, user-provided data collection, enhanced conversions or email matching, and do not send names, email addresses or enquiry-message contents to Google.

The legal basis for Analytics and Marketing is your consent (GDPR Art. 6(1)(a)). Their optional storage/access also needs consent under LEK, Chapter 9, Section 28. Withdraw either through Cookie settings. You can also use Google’s ad controls, Google’s Analytics opt-out and browser storage controls. Google explains its own handling in How Google uses information from partner sites. The cookie policy explains each control and storage duration.

Consent records

When you grant an optional purpose, we keep a server-side record with a random ID, the server time, notice version, choices and control used. Later changes and withdrawals add history. We also keep withdrawal/deletion-handling status and, where recorded, the time of a manual deletion to demonstrate how choices and requests were handled. The version identifies the banner and policy wording you saw; this release’s consent notice is version 2026-10-launch. A first-time Reject all creates no server record or ID and sends no consent-record request; the rejection can still be remembered on your device.

When you allow Analytics, the server commits the grant before Google loads. The record ID is then GA4’s browser/client ID, replacing the random identifier GA4 would otherwise create. It links the measurement to its consent, not to an email address or enquiry. A fresh Analytics grant after turning it off gets a new ID; an expired/deleted record also needs a fresh acknowledged grant before measurement can restart.

The consent record contains no IP address, user agent, page address, browsing history or message text. Request delivery/security still involves the technical processing described above. We do not join the ID to an email address or enquiry. Authorised website operators use the evidence only for consent compliance and related requests, not statistics or advertising. Google receives the client ID, not the server-side consent history for measurement or advertising. The records use the website hosting and backup services in §4–6.

The legal basis for keeping this evidence is compliance with the obligation to demonstrate consent and honour withdrawals (GDPR Art. 7, under Art. 6(1)(c)), not consent to analytics. We delete an ID’s records from the live database 15 months after its consent ends by withdrawal, lapse or replacement. If a withdrawal cannot reach the server, the withdrawn purpose still stops in the browser, but evidence retention runs from the saved consent’s six-month expiry. Backup copies follow §6.

Cookie settings shows your consent-record ID while your browser holds the acknowledged record. Save it before withdrawing all purposes or clearing storage if you want to quote it later: after Reject all, the current ID is no longer shown there. You may give a saved ID to us to help locate your records when exercising your rights. The browser keeps unacknowledged withdrawals, with their IDs and old notice versions, in wm_consent separately from the current choice. It retries them first on later pages, before a new choice; a new choice, notice version or ID does not discard them. They remain until the server records them or confirms that it no longer holds the ID, unless you clear the browser’s storage.

Withdrawal and data already held

Turning Analytics or Marketing off stops that purpose’s new collection in your browser immediately; earlier lawful processing remains lawful. Marketing cannot collect without Analytics. A withdrawal that reaches our server is recorded, including from an older notice version. Recording it does not automatically submit a deletion request to Google.

User-level and event-level measurement already stored in GA4 follows the 14-month retention setting in §6, with the two-month exception for age, gender and interests. Withdrawal does not restart that retention period. Google deletes data that reaches the end of the period in its monthly deletion process. Standard aggregated reports remain.

You can ask for earlier deletion by writing to support@crawle.io with the consent-record ID shown in Cookie settings while available, or an ID you saved before withdrawing or clearing your browser. We handle the request without undue delay and use Google Analytics’ User explorer → Delete user control to request deletion by hand, then confirm the action taken. If you no longer have the ID, you can still write to us and we will try to locate the data and help. We may not be able to find your GA4 data from your email address alone; please do not send unnecessary identifying or sensitive information. An ID used only for Marketing, with Analytics never allowed, has not been measured by GA4.

User deletion applies to the ID, not just one consent purpose, so deleting that ID can also remove its earlier Analytics-only history.

For deletions made in User explorer, Google says the data stops showing in that exploration within 24 hours and is permanently removed within the following 63 days. Those periods follow the deletion requested in User explorer, not your withdrawal click or email. Our confirmation of the action taken is not proof that Google’s erasure has finished. Already-aggregated reports remain.

A six-month choice expiry, a new notice version or a new ID alone does not request early deletion from Google; the retention setting still applies.

We keep the record ID and withdrawal/deletion-handling status with the consent evidence for the same live-database period; where a manual deletion is recorded, that includes its time. Backup copies follow §6. We do not keep a copy of deleted measurement. Our routine logs contain no consent/client IDs or request bodies. An erasure request for the proof itself is assessed individually: proof is retained only as necessary for a legal obligation or legal claims, with the reason explained to you.

Google Search Console

Crawle AB can view Google Search performance and indexing reports to find and fix discoverability problems. Search Console does not add code or cookies to the site. The legal basis for using those reports is Crawle AB’s legitimate interest in maintaining and improving the site (Art. 6(1)(f)).

4. Who receives data

Recipient	Service and location	Role
Apple	App Store, StoreKit and Game Center; processing may occur globally	Apple provides these separate platform services under its own terms and privacy notices. It is not described here as Crawle AB’s processor for those independent services.
Cloudflare	Website proxy, TLS, caching and security on the Free plan; may process data outside the EEA	Its Customer DPA describes its processor role for customer content and customer logs. Its own Privacy Policy also describes limited processing in its own controller role.
Hetzner Online GmbH	Website server and consent/deletion-record database hosting in Helsinki, Finland	Processor under Crawle AB’s data-processing agreement.
Google Analytics and Google Tag Manager	Consented website measurement and, with Marketing, Google Analytics Advertising Features; ID-based deletion requests; processing may occur outside the EEA	Google acts as processor for GA4 customer personal data under the Google Ads Data Processing Terms. Analytics data sharing and product links remain off. Google’s own services and identifiers are also explained in its linked privacy information.
Google Workspace and Google Drive	Privacy enquiries and replies through support@crawle.io on crawle.io’s Workspace; encrypted website database backups on Drive; processing may occur outside the EEA	Google’s Cloud Data Processing Addendum describes its processor role for customer personal data.
Google Search Console	Search performance and indexing reports	A separate service under Google’s terms, with no visitor-side tag or cookie on WristMaze.

Hetzner’s data-processing agreement is accepted. Cloudflare’s Customer DPA forms part of its service agreement. Crawle AB accepted the Google Ads Data Processing Terms for the Analytics account on 17 October 2026; the account country is Sweden. The Cloud Data Processing Addendum is also accepted for crawle.io’s Google Workspace, including mail and Drive. An account country is not a data-location guarantee. Cloudflare’s own Privacy Policy describes its separate roles.

5. International transfers

The website’s origin server and database are in Finland. Apple, Cloudflare, Google Analytics/Tag Manager, Google Workspace (privacy mail), Google Drive (encrypted backups) and their service providers may process personal data outside the EEA, including in the United States. A Finland server and the worldwide availability of the site are not EU-only processing guarantees.

Transfers outside the EEA need a valid mechanism: an applicable EU adequacy decision, or appropriate safeguards such as EU Standard Contractual Clauses with supplementary measures where necessary. The EU–US Data Privacy Framework applies only to actively certified recipients and covered data. Cloudflare’s Customer DPA includes contractual safeguards for restricted transfers. Google’s advertising/analytics transfer information and Cloud/Workspace transfer information identify the EU–US Data Privacy Framework as its adopted mechanism for applicable EEA-to-US transfers. Google’s Ads Data Processing Terms and Cloud Data Processing Addendum provide for SCCs, under their stated conditions, where an adopted alternative mechanism does not cover the restricted transfer. This does not describe every recipient or every transfer as DPF-covered. The European Commission explains international transfer mechanisms and adequacy decisions.

Contact support@crawle.io for information about, or a copy of, the applicable safeguards.

The website database is backed up locally and in encrypted form to Google Drive. The Drive copy is encrypted before upload; the decryption key is not on the server. It includes the consent and withdrawal/deletion-handling records described above. Privacy mail is separate from that website database.

6. How long data is kept

Data	Retention
On-watch progress, settings, queued scores and, in the StoreKit build, two purchase-status flags	Until the app or its data is removed, or the relevant value is replaced.
Game Center and App Store data	Under Apple’s retention rules and your Apple account choices. Crawle AB has no separate server copy in the audited app.
Email enquiries and mailbox copies, including privacy requests	While the matter is handled, then deleted no later than 12 months after closure, unless law requires longer storage.
Origin consent-request rate-limit keys	Client IP keys are kept only in memory and expire within one hour.
GA4 user-level and event-level data, including Google signals	Retention setting: 14 months, with reset on new activity off; age, gender and interest data: 2 months. Withdrawal stops new collection; earlier manual deletion can be requested as described in §3. A choice lapse alone does not request early deletion. Standard aggregated reports remain.
Consent and withdrawal/deletion-handling evidence on our server	While the consent is active, then deletion from the live database 15 months after its recorded end, with the failed-withdrawal/expiry rule in §3 and backup caveat below.
Consent storage and cookies	Browser choice valid for 6 calendar months; GA4 cookies use a default of up to 2 years, shorter where the browser caps it (Chrome: 400 days). See the cookie policy for physical storage, renewal and withdrawal.
Website database backups	Used only for recovery. Local copies rotate after 14 days. Drive keeps daily copies for 30 days, one monthly copy for 12 months and always the newest recovery copy; retired copies spend up to 30 days in trash. The retention policy for older copies is about 13 months including trash. Drive rotation runs with uploads, so stopped uploads can leave copies, including the newest, beyond that period. Before a restored database returns to use, its retention sweep deletes records past their period, and we re-apply erasures made since that backup. Withdrawals stay in force in your browser.
Cloudflare technical/security data and security cookies	Cookie periods are in the cookie policy. Cloudflare publishes up to 31 days of history for its Free-plan Security Events and Security Analytics datasets. These are dataset history periods, not a promise that all Cloudflare-held data is erased then. For its own controller processing, Cloudflare’s Privacy Policy §11 uses purpose, data sensitivity, risk and legal requirements to determine retention. No extra logging product is enabled.

Where law requires longer storage, only the necessary data is kept. For data other than email enquiries, necessary evidence may also be retained to establish, exercise or defend legal claims.

7. Your choices and rights

Subject to the GDPR’s conditions and exceptions, you may:

ask whether we process your personal data and receive a copy;
correct inaccurate or incomplete data;
ask for deletion or restricted use;
object to processing based on legitimate interests;
receive data you supplied in a portable format where the right applies;
withdraw consent at any time; and
complain to a supervisory authority.

Contact support@crawle.io to exercise a right. We may need enough information to verify the request. We normally respond within one month; if a permitted extension is necessary, we explain it within that month. The Swedish supervisory authority is Integritetsskyddsmyndigheten (IMY). Its complaint page explains how to complain. IMY also gives a plain-English overview of data subject rights.

8. What is optional

Analytics and Marketing are both optional. Reject either or both without limiting the site; use Cookie settings to change them at any time. Marketing alone does not activate Google in this setup. Game Center is optional and the game remains playable without it. The website offers no account, launch sign-up or support form. If you send a privacy enquiry, we need a reply address and enough information to handle it.

Crawle AB does not use the data described here for decisions based solely on automated processing that have legal or similarly significant effects.

9. Children

The website is not directed at children under 13. If you are under 13, do not allow Analytics or Marketing: choose Reject all or leave both switches off. You can still read and use the site without allowing either purpose.

In Sweden, the age for a child’s own consent to an information-society service is 13; other countries can require a higher age. If you cannot give valid consent under the law that applies to you, keep both optional purposes off. This website does not offer a parental-authorisation flow for these choices.

If you are a parent or guardian and believe a child has allowed these features, first open Cookie settings and copy the consent-record ID if available. Then turn both choices off and contact support@crawle.io. We will review the request and try to locate the data and handle any deletion request. You may still contact us without the ID. These website choices do not change the app’s on-watch game processing.

10. Security

We use access controls, TLS, limited server access, encrypted offsite backups and data minimisation. No system is completely secure. Please do not put unnecessary sensitive information in a privacy enquiry.

11. Changes

We may update this policy when the Services or law changes. We will publish the new version and effective date here. If a change materially affects a consent, we will ask again before relying on that consent.

The planned opt-in public top-100 website leaderboard is not offered in version 1.0 and is not covered as a live feature by this policy. The policy and consent flow must be updated before that feature launches.

Cookies from Crawle AB