Privacy Policy

Last updated: November 3, 2026

Introduction

Lateral ("we", "our", or "us") makes the Lateral mystery game for iPhone and Android and runs the lateralgame.net website. This policy explains what data the app and the website collect, why we collect it, who we share it with, how long we keep it, and what you can do about it.

The Short Version

• Lateral has no user accounts. The app never asks for your name, email address or phone number.
• The app creates a random device ID and uses it as your user ID. Our server, our analytics tools and our crash reports all receive this ID, so the data described here is linked to your device. It is not anonymous.
• The questions and guesses you type are stored on our server in the EU (Frankfurt, Germany) together with your device ID. They are also sent to a third-party AI service provider, without your device ID, so that AI can generate the game's answers.
• We use Amplitude and Google Analytics for Firebase for analytics, Firebase Crashlytics for crash reports, Firebase Cloud Messaging for push notifications and RevenueCat for purchases. Apple (on iPhone) or Google Play (on Android) handles all payments.
• On iPhone, Google also receives your device's advertising identifier if you allow tracking when the app asks. You can change this at any time in iOS Settings. On Android, the app does not collect your advertising ID.
• On iPhone, the app includes Meta's SDK so we can measure our ads on Facebook and Instagram. Meta receives app installs and launches, two in-game milestones (finishing the intro, solving your first case), each time the Premium screen is shown (including when the app shows it at launch) and which screen showed it, and, when you buy something, purchase events from RevenueCat, which come with your IDFV and IP address. Meta does not receive your name, your email or anything you type, and it receives your advertising identifier only if you allow tracking. Turning off Share usage analytics stops the app's own events to Meta; purchase events RevenueCat sends may still reach Meta.
• Some of our service providers are in the United States, so your data is transferred there.
• Lateral does not show ads.

Your Device ID

The first time you open Lateral, the app creates a random ID and saves it on your device: in the iOS Keychain on iPhone, and in the app's storage and Google's Block Store on Android. The ID does not contain your name or any other detail about you, but it is persistent: it stays the same when you reset your progress in the app, it stays on your device when you delete and reinstall the app, and it moves to a new phone if you set that phone up from a backup of this one (on Android, when your Google backup is turned on).

We use this ID as your user ID with our server (Supabase), Amplitude, Google Analytics for Firebase and Firebase Crashlytics. This lets us connect your game records, analytics events and crash reports to each other. Because of this, all of the data below is linked to your device ID.

Information We Collect

Questions and Guesses You Type

• To solve a case, you type questions and guesses as free text. Our server stores this text with your device ID, together with the answer the game gave and which case facts it revealed.
• To produce the answer, our server sends your typed text to a third-party AI service provider. We do not send your device ID or any other identifier to it.
• Please do not type personal information, such as your name or contact details, into the game.

Game Records

• For daily cases: how many questions and hints you used and when you solved the case. We use this to show statistics such as how your time compares with other players.
• Your hint balance, stored with the purchase ID that RevenueCat gives your device.
• A hash of your IP address (a one-way scrambled form of it). We use it only to limit how many requests one connection can send and to prevent abuse, and we clear it after 24 hours.

App Usage (Analytics)

• What you do in the app, such as opening screens, starting and solving cases, using hints, opening a notification or the widget, sharing, and making purchases. These events record the length of the text you type, but never the text itself.
• Details such as your current streak and remaining hints.
• Device and app details, such as device model, operating system version, app version and language, and device identifiers: the Firebase installation ID and, on iPhone, the Identifier for Vendor (IDFV) that Apple gives us.
• Your approximate location (city and country). The app does not use GPS or Location Services. Amplitude and Google work out your approximate location from your IP address, and Amplitude also stores the IP address.
• Performance and error details, such as how long answers and case lists take to load, error types and server status codes.

Crash Reports

When the app crashes or hits an error, Firebase Crashlytics collects a crash report: technical details about the error, your device model, operating system and app version, the app's state (such as its language, whether you have Premium and your tracking choice) and recent app events. Crash reports carry your device ID.

Purchases

• Apple (on iPhone) or Google Play (on Android) processes all payments. We and RevenueCat never see your card or other payment details.
• RevenueCat keeps your purchase and subscription history under its own random customer ID, so the app knows what you have bought.
• Purchase events are also sent to Amplitude and Google Analytics for Firebase. Google Analytics records in-app purchases automatically. RevenueCat also receives your Firebase app instance ID, which lets it link your purchases to Google Analytics, unless you turn off analytics in the app's Settings.
• On iPhone, RevenueCat also receives your IDFV, your IP address, your IDFA (only if you allowed tracking) and the anonymous ID that Meta's SDK creates for your device. RevenueCat sends your purchase, renewal and refund events to Meta with these, so we can see which ads led to purchases. If you turn off analytics in the app's Settings, RevenueCat drops the Meta SDK's anonymous ID, but it keeps the identifiers it already has, so these purchase events can still reach Meta.

Push Notifications

When you open the app, Firebase Cloud Messaging creates a push token for your device, and Firebase collects your device model, language and time zone so it can deliver notifications. This happens even if you have not allowed notifications, but notifications are shown only if you allow them. We may use it to send you notifications about the game, such as new cases or offers. Reminders that the app schedules on your device do not use this service and stay on your device.

Advertising Identifier

On iPhone, your device's advertising identifier (IDFA) is collected only if you tap "Allow" when the app asks for permission to track. Google Analytics for Firebase, Meta and RevenueCat then receive it while Share usage analytics is on. On Android, the app does not collect your advertising ID. See "Tracking and Advertising Identifiers" below.

Data That Stays on Your Device

Your progress, the home screen widget, reminders, the share sheet and the rating prompt work on your device. The only thing sent from them is the analytics event that they were used (for example, that you tapped the widget).

What We Do Not Collect in the App

The app does not collect your name, email address, phone number, contacts, photos, precise location or microphone audio.

Website and Support

• The contact form at lateralgame.net/contact asks for your name, email address, a topic and your message. We use these only to answer you.
• To limit abuse, the website keeps your IP address in the server's memory to count how many messages are sent from it in 10 minutes. We do not write it to a database, and it is gone when the server restarts.
• Our website does not use analytics or advertising cookies.
• We keep support messages for as long as we need them to handle your request. You can ask us to delete them.

How We Use Your Information

• To run the game: answer your questions, reveal case facts, save daily results, show statistics and keep track of your hints and purchases.
• To keep the service working and fair: limit requests and prevent abuse.
• To understand how players use the game, improve the cases and fix bugs and crashes.
• To measure our ads on Facebook and Instagram: which ads lead to installs, first games and purchases (iPhone only).
• To send push notifications, if you allowed them.
• For advertising purposes at Google, only on iPhone and only if you allowed tracking.
• To respond to support requests.

Services We Share Data With

• Supabase (our server and database; the database is in Frankfurt, Germany, EU, and the server code that handles a request may run in the Supabase region closest to you): your device ID, the questions and guesses you type, game records, daily results, your hint balance with your RevenueCat ID, and the IP hash that is cleared after 24 hours. See Supabase Privacy Policy.
• A third-party AI service provider (United States): receives the text you type, without any identifier, and generates the game's answers. The provider may keep this text for up to 30 days to monitor for abuse.
• Amplitude (United States), product analytics: usage events and details, your device ID, the device identifiers listed above, IP address and the city and country worked out from it. See Amplitude Privacy Policy.
• Google Analytics for Firebase (Google, United States): a copy of the same usage events and details we send to Amplitude, your device ID as user ID, screen views and sessions it records itself, in-app purchases, the Firebase installation ID, IDFV (iPhone), approximate location from your IP address, and your IDFA on iPhone only if you allowed tracking. See Firebase Privacy Policy and How Google uses information from apps that use its services.
• Firebase Crashlytics (Google, United States): crash reports with your device ID.
• Firebase Cloud Messaging (Google, United States): your push token, device model, language and time zone.
• RevenueCat (United States), purchase management: its own random customer ID for your device, your purchase and subscription history, your Firebase app instance ID and, on iPhone, your IDFV, IP address, IDFA (only if you allowed tracking) and the Meta SDK's anonymous ID, which it sends to Meta with your purchase events. See RevenueCat Privacy Policy.
• Meta (Meta Platforms, United States and Ireland), ad measurement on iPhone: app installs and launches, the two milestones and the Premium screen views described above (including which screen showed it), the anonymous ID its SDK creates for your device, device details (such as model, operating system, language and time zone), your IP address, and your IDFA only if you allowed tracking. From RevenueCat, with the purchase events it sends, Meta also receives your IDFV, your IP address and that anonymous ID. Meta does not receive your name, your email or anything you type. Installs from our ads are also reported to Meta through Apple's SKAdNetwork, without identifiers. See Meta Privacy Policy.
• Apple (iPhone): processes payments, manages subscriptions, delivers push notifications and shows the tracking permission prompt. See Apple Privacy Policy.
• Google Play (Android): processes payments, manages subscriptions and stores the device ID in Block Store. See Google Privacy Policy.
• Resend — Delivers the messages you send through our website contact form (your name, email address and message) to our support inbox. See Resend Privacy Policy.
• Cloudflare — Routes email sent to our support address to our inbox. See Cloudflare Privacy Policy.
• Vercel — Hosts our website and contact form. See Vercel Privacy Policy.

Tracking and Advertising Identifiers

On iPhone (App Tracking Transparency)

Before your first case, Lateral shows Apple's prompt asking whether the app may track your activity across other companies' apps and websites.

• If you tap "Allow": Google Analytics for Firebase also receives your IDFA, and the app tells Google (through Google's consent mode) that your data may be used for advertising: ad storage, ad user data and ad personalization are set to "granted". Google may then use this data for advertising purposes, such as measuring and personalizing ads, under Google's policies. Meta also receives your IDFA, from its SDK and with the purchase events RevenueCat sends, and may use it under its own terms, for example to measure and personalize ads.
• If you tap "Ask App Not to Track": your IDFA is not collected and these advertising signals are set to "denied". Meta still receives the app events and purchase events described above with its anonymous ID, without your IDFA. The analytics, crash reports and server data described above are still collected and linked to your device ID, because the app needs them to run and improve the game.
• To change your choice later: open iOS Settings, go to Settings > Privacy & Security > Tracking, and turn Lateral on or off. The change applies the next time you open Lateral.

On Android

Lateral does not ask for tracking permission on Android and does not collect your Android advertising ID. The app tells Google (through Google's consent mode) that your data may not be used for advertising: ad storage, ad user data and ad personalization are always set to "denied". The analytics, crash reports and server data described above are still collected and linked to your device ID, because the app needs them to run and improve the game.

Analytics and Notifications

To turn off analytics, open the app's Settings > Privacy and turn off Share usage analytics. The app sends one last event to Amplitude saying that you turned it off; after that, Amplitude and Google Analytics for Firebase receive no more usage events from the app, and RevenueCat no longer receives your Firebase app instance ID. Meta receives no more events from the app (its automatic install and launch events stop too), and RevenueCat drops the Meta SDK's anonymous ID, so later purchases are no longer linked to it; the device identifiers RevenueCat already received stay with it, so purchase events RevenueCat sends can still reach Meta. Crash reports (Firebase Crashlytics) stay on so we can fix crashes. The setting is saved on your device: if you delete and reinstall the app, analytics is on again until you turn it off. If you do not want any more data collected at all, delete the app; it stops sending data once it is removed.

To turn off push notifications, go to Settings > Notifications > Lateral on iPhone, or Settings > Apps > Lateral > Notifications on Android.

Legal Bases

If you are in the European Economic Area, the United Kingdom or Turkey (GDPR and KVKK), we rely on:

• Your consent for tracking on iPhone (when you tap "Allow") and for push notifications. You can withdraw it at any time in your device settings.
• Our legitimate interests in running the game and its features, keeping it secure and fair, understanding how it is used, measuring our ads and fixing crashes.
• Providing the service you ask for when you make a purchase or contact support.

Transfers to the United States

Our database is in the EU (Frankfurt, Germany), but Supabase may handle requests outside the EU. Amplitude, Google, Meta, our AI service provider and RevenueCat, as well as Apple, Google Play and the providers that handle our website and support email, may process your data in the United States and other countries whose data protection laws may differ from yours. For these transfers we rely on the safeguards in these providers' data processing terms, such as the European Commission's Standard Contractual Clauses.

Data Retention

• IP hash on our server: cleared after 24 hours.
• Text you type, game records, daily results and hint balance on our server: we do not delete these automatically at the moment. We keep them until you ask us to delete them or until we no longer need them to run and improve the game.
• Our AI service provider: up to 30 days.
• Crash reports (Crashlytics): 90 days.
• Google Analytics: event data linked to your device ID is kept for up to 14 months. Totals in reports may be kept longer.
• Amplitude: for as long as we use Amplitude, unless we delete the data earlier, for example after you ask us to.
• RevenueCat: for as long as we use RevenueCat, unless we delete the data earlier after you ask us to. Apple and Google keep their own purchase records under their own policies.
• Meta: under Meta's own data policy. We cannot look this data up or delete it for you; see Meta's privacy settings.
• Push token: until it stops being valid, for example after you delete the app.
• Support messages: for as long as we need them to handle your request.
• Device ID: on iPhone, it stays in your device's Keychain, even after you delete the app, until the device is erased, and it is restored with a backup of the device. On Android, Google Block Store keeps it when you reinstall the app and can restore it on a new device from your Google backup.

Your Rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent. You can also complain to your local data protection authority (in Turkey, the Personal Data Protection Authority, KVKK). To use any of these rights, email us at support@lateralgame.net.

How to Request Deletion

Because Lateral has no accounts, your device ID is the only link between you and your data. To ask us to delete it:

• Email support@lateralgame.net with the subject "Delete my data".
• Include your device ID in your email. You can find it in the app under Settings > Privacy > Device ID; tap it to copy it. This is the fastest and most reliable way for us to find your data.
• If you cannot see a device ID, describe your device and how you used Lateral: your phone model, operating system version, app language, the city or country you played from, roughly when you installed the app and when you last played, which daily cases you solved, and a few questions you typed, as exactly as you remember them, with roughly when you typed them.
• If you bought something, also include the order ID from Apple's or Google Play's receipt email. Your purchase history and hint balance are stored under RevenueCat's ID, not your device ID, so we need it to find them.

What we can do:

• If we find your device ID, we delete your records from our server (the text you typed, game records and daily results) and ask Amplitude and Google Analytics to delete the data linked to it. Crash reports are deleted automatically after 90 days.
• If we find your purchases from the order ID, we delete your hint balance from our server and ask RevenueCat to delete your purchase history.
• Without a device ID, we can find your data only if the details you send match one device in our records. If we cannot match them with confidence, we will tell you, because we cannot delete data we cannot identify.
• The text we sent to our AI service provider carries no identifier, so we cannot match it to you. The provider may keep it for up to 30 days.
• We cannot delete Apple's or Google's own purchase records. After deletion, you can bring back active subscriptions with "Restore Purchases" in the app's Settings, but remaining hints stored on our server may be lost.
• The device ID stays on your device. If you keep playing after we delete your data, new data will be linked to the same ID.

We aim to reply within 30 days.

Children's Privacy

Lateral is rated 4+ on the App Store and PEGI 3 on Google Play. These ratings describe the content, which is suitable for all ages. The game is made for a general audience, not specifically for children, and it does not ask for anyone's age, so we cannot tell whether a player is a child. Every player, of any age, is covered by the practices in this policy, and we do not collect anything beyond what is described here. If you are a parent or guardian and believe your child has used Lateral, contact us and we will delete the data we can find, as described in "How to Request Deletion". Parents can also stop tracking on a child's iPhone in Settings > Privacy & Security > Tracking.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the new version on this page and change the "Last updated" date.

Contact Us

The developer of Lateral is responsible for your personal data (the "data controller"). If you have questions about this Privacy Policy or your data, email us at support@lateralgame.net or use the form at lateralgame.net/contact.