Flow Reactor — Privacy Policy

Effective: 2026-10-23 App: Flow Reactor (Web · Android · iOS) Controller: BeyondWega UG (haftungsbeschränkt), Auf dem Kamp 74, 28865 Lilienthal, Germany — represented by its managing director Andreas Klaus Korol Contact: team@beyondwega.com

Plain-English summary

Flow Reactor is a clean-ship puzzle game. Playing collects no personal data. Your progress is saved on your own device only. There are no ads, no in-app purchases, no analytics, and no third-party SDKs that send data off the device.

The only exception is optional: if you choose to join the online leaderboards, you create an account on our own server, and we store the data listed under Online leaderboards below. Until you sign in, create an account or recover one with your recovery code, the game never talks to our server — not even when you open the leaderboards.

If you uninstall the app or clear its data, your local progress is permanently gone — there is nothing on our servers to restore. Because of that, the game lets you export your progress yourself: Settings → "Back up progress" hands you a save code you can copy and keep.

What we collect

Nothing while you play. The optional online leaderboards are the only exception — see Online leaderboards. Specifically, we never collect:

• No name, email, phone number, address, or any other contact information.
• No location data (GPS, IP-derived, or otherwise).
• No device identifiers (advertising ID, device fingerprint, IMEI, MAC).
• No usage analytics, crash reports, telemetry, or gameplay events sent to us — apart from the leaderboard results you submit after signing in.
• No microphone, camera, contacts, photos, or other sensitive device data.
• No payment information (the game is offered free with no in-app purchases).

What we store on your device

Your gameplay progress — current level, completed levels, settings — is stored locally on your device:

• On Android in app-private storage via the Capacitor Preferences plugin (SharedPreferences under the hood).
• On iOS (when published) via NSUserDefaults.
• On Web (ll.beyondwega.com) in your browser's localStorage.

We never read, receive, or transmit this data — it stays in your device's local app storage. Any backup or transfer of it is handled entirely by your own operating system or browser, under your own account (for example Android's device backup or device-to-device transfer, Apple iCloud on iOS, or your browser's profile on the web) — it is never sent to us or to any third party. On Android we additionally turn off automatic cloud backup of the save (android:allowBackup="false"). You can erase it any time via your OS's "Clear storage" / "Clear site data" controls or by uninstalling the app.

If you join the leaderboards, the game additionally keeps your sign-in on the device (on the web as a cookie that only our leaderboard server can read, plus a random marker in the browser's storage so that open tabs notice a sign-in change; in the app as a session token in the app's own storage) and, while you are offline, up to 100 solved levels waiting to be submitted, plus a note that you confirmed the Reignition notice in this session. Signing out or deleting your account removes them. Your save itself is never sent.

Your save is yours — and you can back it up yourself

Because your progress lives on that one device only, the game can hand it to you as a save code: Settings → "Back up progress" renders your progress as a block of plain text you can copy and keep anywhere you like — a note, an email to yourself, a message.

Exactly what the code carries — and what it does not. The code contains your progress: stars per level, which levels you have solved, energy earned and spent, purchases, blueprints, cosmetics. It deliberately does not contain your settings, neither of the two "where was I last" markers, and no gameplay timestamps — the per-level timestamps are stripped on export, so nothing in the code speaks about you rather than about your progress.

You cannot paste it back yet. The app cannot promise you, on any storage it has, that a restored save is really stored durably — in a private browser window it is gone with the session, under storage pressure the browser evicts without asking, and on Android the system reports a write as done before it has reached the disk. Replacing a save halfway would be worse than not restoring it at all, so we do not offer it while we cannot keep it. Your code stays valid and becomes redeemable once restoring ships — keep it.

That code is neither generated nor stored nor transmitted by us: it is produced on your device, and where it goes is entirely your decision. It contains your game progress and nothing else — no identifier, no contact data, nothing from which a person could be derived.

Online leaderboards (optional)

The game works fully without an account. If you choose to join the online leaderboards, you create an account on our own server (ll.beyondwega.com). The server is operated for us by Hetzner Online GmbH in Germany as our processor (Art. 28 GDPR); no other party receives your data.

What we store, and only if you sign up:

• a private login name and a public nickname (by default a generated pseudonym such as Zahnrad-4821),
• a hash of your password and of your one-time recovery code (never the password itself),
• when you gave your consent and to which version of the consent text,
• for each level you solved after signing in: your best result, the sequence of rotations that produced it (so our server can replay and verify it), and when it arrived,
• for each re-scrambled Reignition level you solve after signing in and after confirming the in-game notice in the Reignition leaderboard: which level and pack, the rotations of your first solution (to replay it), and when it arrived,
• whether and when you confirmed that in-game notice (and which version of it),
• your weekly stars (deleted after two weeks) and your streak of days with a solved level,
• when the account was created and last used (the basis of the automatic deletion below),
• a counter of failed sign-ins and, after repeated failures, until when sign-in is paused,
• your active sessions (a hash of the session token, creation, last-use and expiry time).

What we do not store: no e-mail address, no IP address, no device identifier, no location, no play time. Your IP address is used only in memory to limit abusive request rates; the leaderboard service never writes it to disk or to its logs, and our web server keeps no log of requests to the game at all — neither access nor error logs.

Public: your nickname and your results appear in the leaderboards and can be seen by anyone. Your login name never does.

Legal basis: your consent (Art. 6 (1) (a) GDPR), given when you create the account. You must be at least 16, or have your parents' permission (Art. 8 GDPR).

Retention: until you delete your account. Accounts without a sign-in for 24 months are deleted automatically. Weekly values are deleted after two weeks. We keep encrypted backups on a Hetzner storage server in Germany; in normal operation each backup is deleted after about 25 days. If our backup job ever stops, we delete the remaining backups by hand as soon as we notice.

Your rights: in the game, under Leaderboards → Account, you can download all data stored about you (JSON), change your nickname, and delete your account at any time. Deleting the account also withdraws your consent; it does not affect what was lawful before. Deletion is immediate and also survives a restore of our backups. Deleting without the app: the same account works on the web — sign in at ll.beyondwega.com → "Leaderboards" → "Account" → "Delete account and all leaderboard data". If you can no longer sign in, write to team@beyondwega.com with your login name; we delete the account once you confirm it with your recovery code. Reporting a nickname: if you see an offensive nickname, write to team@beyondwega.com — we reset it or block the account. You also have the right to access, rectification, restriction and objection, and to lodge a complaint with a data protection authority — for us, the State Commissioner for Data Protection of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen, Hannover). For anything else, contact team@beyondwega.com.

Network use

The Android app declares the INTERNET permission. Normal gameplay initiates no network requests — no analytics ping, no remote save, no ads, no in-app purchase verification. You can play Flow Reactor fully offline. The permission is used only when you sign in, create an account or recover one in the optional online leaderboards: then the game talks to our leaderboard server (ll.beyondwega.com), and while you are signed in it loads the leaderboards and submits the levels you solve.

The web version (ll.beyondwega.com) is served as static files; loading it is a normal HTTP request, and our web server keeps no log of it. Gameplay then runs locally in your browser.

Third parties

Flow Reactor contains no third-party advertising SDKs, no analytics SDKs, no social-login SDKs, and no other third-party libraries that report data off the device. Our leaderboard server is hosted by Hetzner Online GmbH (Germany), which processes data only on our behalf (Art. 28 GDPR). The only other third parties involved are the platform stores (Google Play, Apple App Store) — their own privacy practices apply to the act of downloading the app and are independent of Flow Reactor itself.

Children

Playing Flow Reactor collects no data from anyone, including children. The app is suitable for general audiences. To join the online leaderboards you must be at least 16 years old or have your parents' permission; we ask for this confirmation when the account is created.

Your rights (GDPR / CCPA)

If you have no leaderboard account, we hold no personal data about you: there is nothing for us to access, correct, erase, port, or sell, and the local data on your device is fully under your control. If you believe we hold data about you and want to verify this directly, write to team@beyondwega.com and we will confirm in writing.

If you have a leaderboard account, your rights are listed under Online leaderboards — export and deletion work directly in the game. We do not sell personal data.

Changes to this policy

When we change what we collect, we update this policy and show the change in the game before it applies. The current version is identified by the "Effective" date at the top.

Contact

Questions about this policy:

team@beyondwega.com

BeyondWega UG (haftungsbeschränkt), Auf dem Kamp 74, 28865 Lilienthal, Germany.

This policy also ships inside the game itself, in English and German (Settings → "Privacy"), so it is readable offline; its source is packages/game/src/scene/privacyPolicy.ts, and packages/game/src/scene/privacyPolicy.test.ts holds the in-game versions against this page.