Privacy Policy · Neon Labs

This Privacy Policy explains what personal data we collect, why, and what rights you have. It covers both the https://neonlabs.pl website and the Neon Network games and the other apps we publish (currently Neon XO, Neon Snake, Neon Comet, Neon Shift, Neon Leo and Ariadne). Our promise is simple: no ads, no third-party tracking, and we never sell your data.

Who is responsible for your data

The data controller is:

Neon Labs Kamil Masłowski
ul. Księcia Bogusława X 8/6
74-200 Pyrzyce, Poland
NIP: 8531502974
Phone: +48 792 005 464

For any privacy question you can reach a human athello@neonlabs.pl.

The website

The website (https://neonlabs.pl) is a static marketing site. It setsno cookies for tracking or advertising, runs no analytics or fingerprinting scripts, and contains no advertising. Our hosting provider keeps standard, short-lived technical logs (such as IP address and request time) to serve the pages and protect against abuse; these are not used to profile you.

The games and your Neon Network account

One Neon Network account works across all of our games — you sign in once and your identity carries between titles. Creating and using that account is entirely optional, and only the following data is involved:

Email address — to create and secure your account and to confirm sign-up.
Password — stored only as a salted hash by our authentication provider; we never see it.
How you sign in — you can create the account with an email address and a password of your own, or with your Apple or Google account instead. If you choose Apple or Google, they confirm to us that the account is yours and pass us the email address it is registered to — and with Apple, only a relay address if you ask it to hide the real one. That is everything we receive: no name, no profile picture, no contacts, and no access to anything else in that account. If you sign in that way there is no password on our side at all.
Username — a display name you choose, shown to you and on leaderboards.
Gameplay data — per-game results and totals (for example Neon XO win/loss/draw counts and Neon Comet high scores) so your progress is saved and can appear on leaderboards.
Purchase records — if you buy something in a game: which item, when, in which game, the store it came from, and the amount. This is what lets us unlock the content you paid for and show your Supporter badge. See In-app purchases below.
How you arrived — if you played without an account before making one, we keep three numbers with your account: which game it was, how long you had played first (in whole minutes, rounded down) and how many times you had opened it. It tells us whether playing without an account leads anywhere, which is the only reason the no-account version is worth maintaining. It is never shown in the games or to other players, it holds no pointer to the anonymous record described below, and it is deleted when you delete your account.
Which version you are running — for each of our games you open while signed in: the game, the version number of that build, whether it is iOS or Android, and when you last opened it. It is what tells us whether a problem you report comes from a build we have already fixed, and whether an update has actually reached the people it was for. It says nothing about your device beyond those two words — no model, no operating system version, no identifier of any kind — it is never shown in the games or to other players, and it is deleted when you delete your account.
Messages from us, and which ones you have opened — the games have an inbox that we write to. Most of what goes into it is an announcement to everyone playing a given game; sometimes it is a message addressed to your account alone, which is how we answer you if you write to us about a purchase or a score that went missing. A message addressed to you can be read by you and by nobody else. We keep a record of which messages you have opened and when, so that the unread mark is right on every device you play on. The inbox only runs one way — there is no reply, and nothing you write anywhere goes into it. Our games have no chat, no comments and no way to send a message to another player. Both the messages addressed to you and your record of what you have opened are deleted when you delete your account.

That is the complete list for an account. The games contain no advertising, no advertising or analytics SDKs, and collect no location, contacts, photos, device identifiers, advertising IDs or contact lists. We do not track you across other apps or websites, and nothing we hold is combined with data from anyone else. (Ariadne, our way-back app, uses your locationon the phone and sends it nowhere — see Ariadne and your location.)

Playing without an account

Every one of our games can be played in full without an account, with no time limit. When you do, we keep one small anonymous record so that we know the games are being played at all — otherwise the only players we can see are the ones who signed up. Specifically, per installed game:

A random identifier — generated by our database, not by your device, and stored only in that app's private storage. It is not your device's ID: we neither collect nor have access to the IDFA, the Android advertising ID, or any hardware or fingerprint identifier. Uninstalling the game destroys it, and a fresh install starts a new one.
Which game, platform and interface language — so we know what to build and which language to write next.
When the app was first and last opened, how many times it was opened, and how long it was in the foreground — the total time in the app, not what you did in it.
Whether that install later created an account — recorded as a fact and a date only. Which account it became is deliberately not stored, so there is nothing here to follow to you. If you did make an account, the rounded summary underHow you arrived is kept with that account instead — it carries no pointer back to this record, and this record carries none to it, so the two cannot be matched up.

That is the complete list, and it is all we ever see: no IP address is stored with it, no name, no email, no game results, and no behaviour inside the game. We cannot identify you from it, we cannot single you out across our own games, and it is never shared with anyone, used for advertising or combined with data from third parties. Under Apple's App Tracking Transparency rules this is not tracking, which is why our games can honestly say they do none.

Playing without an account still gets you the inbox described underMessages from us, because an announcement from the studio is not account data. Only the announcements, though: a message addressed to one account can be read only by that account, and without an account there is nobody to address. Which announcements you have opened is kept in that app's private storage and never reaches us — there is no account to record it against, and we deliberately do not create one for it. Uninstalling the game destroys that record along with the identifier above.

The legal basis is our legitimate interest in knowing whether the games we publish are being used and whether they work (GDPR Art. 6(1)(f)). Because the record contains nothing that identifies a person, we are generally unable to link it to you or to act on an access or erasure request for it (GDPR Art. 11) — deleting the app removes the identifier from your side, and you are welcome to write to us about it.

Ariadne and your location

Ariadne (Ariadna in Polish) is our find-your-way-back app: it shows you on a map, remembers where you pressed START and leads you back there along the path you walked. To do that it needs your location — and it is the only thing we publish that does. Here is exactly what happens with it.

It stays on the phone. Your position, the remembered place and the path you walk are processed on the device and stored in one file in the app's private storage. None of it is sent to us, and we run no server that could receive it. Pressing "I'm here" deletes the file; uninstalling the app deletes it too.
"While using the app" is all it asks for. The app never requests "always" location. Between START and "I'm here" it keeps recording your path while the phone is in your pocket, and both Android and iOS show that it is doing so — a persistent notification on Android, the location indicator on iOS. Outside a walk it records nothing.
The map comes from Google or Apple. To draw the streets around you, the app asks Google Maps (on Android) or Apple Maps (on iOS) for the map tiles of your area. That request goes to Google or Apple, not to us, under their own privacy policies; it is the one way your rough location leaves the device, and it is the same thing any map app does.
Spoken directions are generated on the phone by the system's own text-to-speech. Nothing you hear has been sent anywhere to be said.
The no-account record applies here too. Ariadne has no account at all, so every install is counted the way Playing without an account describes — one anonymous identifier, how often the app is opened and for how long. It contains no location.

Because your location never reaches us, we hold no location data about you and there is nothing for us to export, correct or erase; the phone's own settings let you withdraw the permission at any time, and the app then simply cannot show where you are.

In-app purchases

Some games sell optional extras. We never receive your payment details. Your card or payment method is handled entirely by Apple or Google, who take the payment and issue the receipt. We are only told that a purchase happened.

To do that we use RevenueCat, a purchase-validation service that checks the receipt with Apple or Google and tells us which content to unlock. RevenueCat receives yourNeon Network account identifier — a random ID, not your email or name — together with the store's own purchase and device data.

On our side we store the purchase record listed above, linked to your account. We keep it because we have to: it is both the proof of what you are entitled to and a record we are required to keep for accounting and tax purposes (GDPR Art. 6(1)(b) and 6(1)(c)).

One consequence worth spelling out: because purchase records support a legal obligation, the record of a transaction may be retained after you delete your account, for as long as Polish accounting law requires. When your account goes, the link to it is severed — what remains is the transaction itself and an identifier that no longer corresponds to any account we hold.

Why we may process this data (legal basis)

To provide the service — creating your account, saving progress and showing leaderboards (performance of a contract, GDPR Art. 6(1)(b)).
To keep the service secure and prevent abuse (our legitimate interest, GDPR Art. 6(1)(f)).
To comply with the law where we are legally required to (GDPR Art. 6(1)(c)).

Who else processes data for us

We keep the list of processors short and only use them to run the service:

Supabase — hosts our authentication, database and account data. Your account information and gameplay data are stored on their infrastructure, as is the anonymous no-account record described above.
Our email provider — delivers the account-confirmation email to the address you sign up with.
RevenueCat — validates in-app purchase receipts with Apple and Google and tells us what to unlock. Receives your account identifier and the store's purchase data; never your payment details, name or email.
Apple App Store & Google Play — distribute the apps, and act as the seller for any in-app purchase. They handle payment and any technical data under their own privacy policies when you download, update or buy.
Google Maps and Apple Maps — draw the map in Ariadne. They receive the location of the area being displayed in order to serve it, under their own privacy policies (see Ariadne and your location). They are not given your account, your path or anything else.

Signing in with Apple or Google is not on that list, and deliberately so: neither of them is working for us when you do it. They confirm who you are and hand us an email address, under their own privacy policies rather than this one. Nothing about how you play, what you score or what you buy goes back to them.

We do not sell or rent your personal data, and we do not share it with advertisers or data brokers.

How long we keep it

Your account data is kept for as long as your account exists. You can delete your account at any time from inside the game (Profile → Delete Account), which permanently erases your login, email, username and gameplay data. Confirmation emails are retained only briefly by our email provider. Purchase records are the one exception, for the accounting reason described above.

The anonymous no-account record described underPlaying without an account is kept while it is useful as a count and is not tied to your account, so deleting an account does not delete it — there is no link between the two to follow. The How you arrived summary is the other way round: it belongs to the account and is destroyed with it.

Your rights

Under the GDPR you have the right to access, correct, export, restrict, or erase your personal data, and to object to certain processing. You can exercise the erasure right yourself with the in-app account deletion above, or contact us athello@neonlabs.pl for anything else. You also have the right to lodge a complaint with your supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

International transfers

Our providers may process data on servers outside your country. Where data leaves the European Economic Area, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Children

Our games and this site are family-friendly and are not directed at children. We do not knowingly collect personal data from children who are below the age of digital consent in their country without verifiable parental consent. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If this policy changes we will update the date at the top of this page. Continued use of the site or games after a change means you accept the current version.

Contact

Questions about privacy? Email hello@neonlabs.pl and a human will reply.