Neural Tactic
1. Who is responsible for your information
Neural Tactic — an independent game studio based in Australia — is responsible for the information described here. In data protection law we are the controller.
You can reach us about anything in this policy at hello@neuraltactic.com. There is no separate privacy department; that address reaches a person who can act on it.
2. What this policy covers
This policy covers two things:
- the game — CISO: Cyber Defense Extraordinaire on iOS and Android; and
- this website — neuraltactic.com.
The game is not released yet. This policy describes how it behaves in the build we are preparing to release, and how the website behaves today. If anything changes before release, we will update this policy and say so in section 20 rather than quietly editing the text.
It does not cover the App Store or Google Play themselves. When you download the game, Apple or Google handles that transaction under their own privacy policies, and we never see your payment details.
3. The only identifier the game uses
The game has no accounts. Instead, the first time it runs it generates a random number on your device — 128 bits from your operating system's secure random generator — and writes it down as a player ID.
Three things are worth understanding about it:
- It is not derived from anything about you or your device. It is not your advertising ID, your device serial, your phone number or a hash of any of them. It is a random number, and two installs on the same phone produce two unrelated IDs.
- It does not identify you to us. On its own it tells us nothing beyond "the same install as last time". We cannot turn it into your name.
- It is what makes erasure possible. It is the key we use to find and delete anything you have sent us — which is why the game keeps it rather than generating a fresh one each time.
It is stored only on your device, and deleting the app deletes it. Data protection law still treats it as personal information — it distinguishes one person from another — and we treat it that way too.
4. Everything the game collects
This is the complete list. If something is not in this table, the game does not collect it.
| What | When | What it contains | Where it goes |
|---|---|---|---|
| Your saved game | Always | Missions completed, scores, ratings, career progress, settings, and your player ID | Your device only. Never uploaded |
| Usage analytics | Only if you switch it on | A handful of technical events — a purchase being started, a glossary link being tapped, and two internal errors that tell us content is misconfigured. No player ID is attached | Google (Firebase Analytics) |
| Crash reports | Only if you switch it on | The error, where in the code it happened, and the device model and OS version needed to reproduce it | Google (Firebase Crashlytics) |
| Performance data | Only if you switch it on | How long screens and network requests take | Google (Firebase Performance) |
| Feedback you send | Only when you send it | What you typed (up to 2,000 characters), the category you chose, the mission you were on if any, and your player ID | Our server (Amazon Web Services) |
| Mission feedback | Only when you answer the prompt after a mission | Your star rating and any comment, plus how the mission went: time taken, turns, actions taken, win or loss, difficulty, and which map and theme you were using. Keyed to your player ID | Our server (Amazon Web Services) |
| Purchase records | Not currently — the game is free and there is nothing to buy | If we sell content later: the store receipt, the product bought and when. Never your card details | Our server, to confirm the purchase is genuine |
Two things this table deliberately does not contain. The game does not send us any record of how you play — no session logs, no telemetry stream, no gameplay analytics of our own. And it does not submit high scores anywhere; there is no leaderboard. The only gameplay information that ever reaches us is what you attach to a piece of feedback you chose to send.
5. What we never collect
We do not collect, and the game never asks for: your name; your email address; a password; your date of birth; your location, at any precision; your contacts; your photos, camera or microphone; your advertising identifier; your device's serial number or phone number; your health or fitness data; or anything from other apps on your device.
There is no advertising in the game and no advertising SDK in it. Nothing about you is used for advertising, profiling or automated decision-making, and we do not sell, rent or share your information with anyone for their own purposes. We have never done this and the business does not depend on it.
6. The two switches, and what each one controls
There are two separate settings, they control different things, and it is worth knowing which is which.
Share Analytics & Crash Reports — off unless you turn it on
In Settings, under PRIVACY. It is off by default and nothing is collected while it is off — the game switches all three Google services off before anything else happens at start-up, and only turns them on if you have said yes. Turning it off again stops collection immediately, not at the next launch.
This one switch controls all three: analytics, crash reporting and performance.
Mission feedback prompt — on unless you turn it off
After you finish a mission, the game may ask how it played. This prompt is on by default, and you can switch it off in Settings.
Being asked is not the same as sending. Nothing leaves your device unless you actually answer the prompt and submit it — dismissing it sends nothing. But if you do answer, the play details listed in the table above are attached, so if you would rather not be asked at all, turn the prompt off.
These two switches are independent. Declining analytics does not switch off the mission prompt, and turning off the prompt does not affect analytics.
7. The one thing that happens whatever you choose
We would rather tell you this than have you discover it. It is the one place where something leaves your device before you have chosen anything.
The game uses a Google service called Firebase Remote Config to fetch its own configuration when it starts — including the key it needs to talk to our server, so that the key is not permanently baked into the app. To do that, the Firebase library registers the installation with Google and receives an installation identifier.
This means that Google receives a random installation identifier and your device's IP address when the game starts, whether or not you have turned analytics on. The analytics switch does not cover this, because the game cannot reach our server without it. It is a random identifier, not a name and not an advertising ID, it is not used to build a profile of you, and it is reset if you delete and reinstall the app. Google processes it under Firebase's privacy terms.
If you would rather that did not happen, the answer is to not install the game. We are not going to pretend there is a setting for it when there is not.
8. This website
neuraltactic.com sets no cookies of any kind — not analytics cookies, not "essential" cookies, none. It runs no JavaScript. It loads no fonts, images, stylesheets or scripts from anyone else's servers, so no third party learns that you visited. There is no analytics package, no tag manager, no pixel, no embedded video, no comment system and no advertising.
The site is served from Amazon CloudFront, which handles the request in order to deliver the page. We do not switch on CloudFront's access logging, so we do not receive or keep a log of who visited, what they read, or from where. We genuinely do not know how many people read this page.
The only way to give us personal information through this website is to email us.
9. When you email us
We keep your message and your email address so that we can reply, so that we have a record of what was agreed, and — if you wrote about a job — so that we can come back to you if a role opens up.
We do not add you to a mailing list, we do not share your address, and we do not sell it. Ask us to delete your message and we will, unless we are required to keep it. Our email is hosted by a commercial email provider, which means your message sits on their servers as well as ours.
10. Why we are allowed to do this
If you are in the United Kingdom, the European Economic Area or Switzerland, the law requires us to tell you our legal basis for each use. Here it is.
| What | Why we do it | Legal basis |
|---|---|---|
| Analytics, crash and performance data | To find out what breaks and fix it | Your consent — the Settings switch. You can withdraw it at any time by switching it off, and that does not affect anything already collected |
| Feedback and mission feedback | To fix bugs and balance missions | Your consent — you choose to send each one |
| The player ID, and the configuration fetch | To make the game work at all, and to be able to find and erase your data when you ask | Our legitimate interests in delivering and securing a game you asked to use — a narrow interest that does not override your rights, since the identifier is random and reveals nothing about you |
| Purchase records, if we sell content later | To confirm a purchase is genuine and give you what you paid for | Performance of our contract with you |
| Emails you send us | To reply to you | Our legitimate interests in answering people who contact us |
You never have to give us anything. The game is fully playable with every switch off, and nothing is withheld from you for declining.
11. Who else sees it
A very short list. Each of these is a supplier acting on our instructions, or a platform we have no choice about.
- Google (Firebase) — analytics, crash reporting, performance monitoring and remote configuration. Sees what section 4 says it sees, and the installation identifier and IP described in section 7.
- Amazon Web Services — hosts our server and stores the feedback you send. AWS holds the data; it does not use it.
- Apple and Google, as app stores — they distribute the game and handle any purchase. What they collect is governed by their own privacy policies, not this one.
- Our email provider — for messages you send us.
That is the whole list. There is no advertising network, no analytics broker, no data enrichment service and no marketing platform.
We would also disclose information if the law genuinely required it — a court order or a valid legal demand — or to protect someone's safety. We would tell you unless we were legally barred from doing so. This has never happened.
If the studio were ever sold or merged, your information could transfer to the buyer, who would be bound by this policy until they told you otherwise.
12. Where your information is kept
We are in Australia. Our server runs on Amazon Web Services and, at release, the production environment is hosted in the United States. Google's Firebase services process data in the United States and in other countries where Google operates.
If you are in the UK or the EEA, this means your information is transferred outside your country. Neither Australia nor the United States has an adequacy decision covering this transfer, so we rely on the safeguards required by law — the UK and EU Standard Contractual Clauses, which are built into Amazon's and Google's data processing terms and which we have accepted. You can ask us for details of those safeguards, and we will send them.
The amount of information involved is small, and none of it identifies you by name.
13. How long we keep it
| What | How long |
|---|---|
| Your saved game and settings | Until you delete them, or delete the app. They are on your device, not ours |
| Feedback and mission feedback | Up to 24 months, or until you ask us to erase it — whichever comes first |
| Crash reports | Up to 90 days, then Google deletes them |
| Analytics events | Up to 14 months, on the retention period we set in Firebase |
| Purchase records, if we sell content later | As long as we must keep them for tax and accounting law — generally 7 years in Australia |
| Emails you send us | Up to 3 years after our last exchange, or until you ask us to delete them |
| A record that you asked for erasure | Kept, deliberately — a short note that an erasure happened and when, so we can prove we honoured it. It contains no other information about you |
14. Your rights
Wherever you live, you can ask us to do any of the following, and we will not charge you or treat you differently for asking:
- See it — get a copy of what we hold about you;
- Correct it — if something is wrong;
- Erase it — you can do this yourself, immediately, in the game. See section 15;
- Take it with you — get it in a machine-readable form;
- Restrict or object — tell us to stop a particular use, including anything we do on the basis of legitimate interests; and
- Withdraw consent — the analytics switch, at any time, in Settings.
To exercise any of them, email hello@neuraltactic.com. Include your player ID if the request is about the game — Settings shows it, and without it we genuinely cannot find your data, because we hold nothing else that points to you. We will respond within 30 days.
If you are in the UK or EEA, these are your rights under the UK GDPR and the GDPR, and you may complain to your data protection authority — in the UK, the Information Commissioner's Office. If you are in Australia, the Australian Privacy Principles apply and you may complain to the Office of the Australian Information Commissioner. If you are in California or another US state with a privacy law, you have rights to know, delete and opt out of sale or sharing; we do not sell or share personal information as those laws define it, and never have.
Please give us a chance to fix it first. We would rather hear from you than from a regulator.
15. Deleting your data
Settings → DELETE MY DATA. It asks you to confirm twice, because it cannot be undone. It then:
- asks our server to erase everything held under your player ID, and tells you honestly if that request failed rather than pretending it worked; and
- erases everything on your device — your save, all mission progress, scores, ratings, career history, and every setting — returning the game to a fresh install.
On our side the request is queued and then carried out, and in any case no later than 25 days after you ask. Once your ID is marked for erasure, our server refuses any further data under it. You do not need to email us and you do not need to wait for us to approve anything.
One honest limitation. If you had turned analytics on, the data already held by Google under its own separate identifier is not reached by this process — we cannot map your player ID onto Google's identifier, because we deliberately never link the two. That data is not tied to anything identifying you, and it expires on the retention periods in section 13. Switching the setting off stops any more of it being created. If you want us to try to have it removed sooner, email us and we will make the request on your behalf.
Deleting the app also removes everything stored on your device, but it does not send the erasure request to our server — so if you have ever sent us feedback, use DELETE MY DATA before you uninstall.
16. Children
The game is made for adults. It will be released with a 17+ rating on the App Store and for an adult audience on Google Play, and it is not directed at children.
We do not knowingly collect personal information from a child. We could not easily identify one if we tried — we do not ask anyone's age, because asking would mean collecting more about everyone, not less. If you are a parent or guardian and believe your child has sent us something, email us and we will erase it.
17. How we protect it
The blunt honest version: the best protection is that there is very little to protect. We do not hold your name, your email address or your location, so a breach of our systems could not expose them.
Beyond that:
- everything travels over HTTPS;
- our storage is private, blocked from public access, and encrypted where it sits;
- our server strips out name, email and device-identifier fields before storing anything, in case a future version of the app ever sent one by mistake;
- administrative access is restricted, requires credentials, and every action taken on player data is logged; and
- your saved game never leaves your phone, so it is protected by your phone.
No system is perfectly secure. If a breach ever affected you, we would tell you and the relevant regulators as the law requires — under the Australian Notifiable Data Breaches scheme, and within 72 hours under the UK and EU GDPR.
18. Changes to this policy
We will change this policy when the game changes — most obviously when paid content arrives, or if a feature described here as switched off is switched on.
When we do, we will change the version number and the effective date at the top, and record what changed in section 20. If a change materially affects how we use information about you, we will tell you inside the game before it takes effect, and where the law requires consent for the new use, we will ask for it rather than assume it. We do not apply changes retrospectively.
19. Contact and complaints
Neural Tactic
Independent game studio, Australia
hello@neuraltactic.com
Put "Privacy" in the subject line and it will get to the right place faster. If you are asking about data in the game, include your player ID from Settings.
If we have not sorted something out to your satisfaction, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority in your own country. We would much rather you told us first.
20. Change history
- Version 1.0 — 3 September 2026. First publication, before the game's release.