Pairlilt Privacy Policy

Implementation disclosure updated: 2026-10-20 App: Pairlilt (com.servenzo.pairlilt) Publisher/developer: Servenzo Privacy contact: [email protected] Public policy address: https://servenzo.com/apps/pairlilt/privacy-policy

This disclosure describes Pairlilt R1 offline matching play and its separately labelled previous demo snapshot with optional shared platform controls. Cloud availability depends on the publisher’s configured deployment. A build without a backend URL works locally. No sign-in or upload is performed automatically.

Operator, hosting and internal testing

Servenzo operates this app and its optional cloud service. Contact [email protected] for privacy questions or requests. The app service is hosted on a Servenzo-operated VPS in the United Kingdom at https://apps-api.servenzo.com. The shared sign-in service is operated there using Keycloak; app accounts and access tokens remain scoped to their own app. Quizlilt child cloud accounts remain disabled.

Cloudflare provides DNS and the traffic proxy for the public website and API. It processes network addresses, request timing and security information through its global infrastructure. Choosing an online service sends the selected information over the network; core local features do not upload your records automatically. Google Play separately handles app distribution, tester accounts and any authorized store purchases.

Account and synchronized information is retained while you keep the app cloud account, subject to the app's export and deletion controls. Requesting account deletion blocks app access and queues scoped cleanup. The shared identity-provider profile has separate controls; contact [email protected] to request its removal, with identity verification where needed. Files expire at the time you select; expiry blocks access before background cleanup removes stored versions. Independent exports and copies are outside that cleanup.

API access logs contain network address, request path without query parameters, status and timing. They rotate daily with fourteen retained rotations; service diagnostic logs rotate by size. The internal-testing service has no automated off-server backup or guaranteed recovery. Keep independent copies of information you need. Optional cloud files use private encrypted storage that the server operator can read. This test deployment uses a locally held encryption key and is not end-to-end encrypted; a maintained key-management service is required before public cloud use.

Local information and use

Seeded boards, shuffled card positions, revealed/matched positions, pending turns, per-turn reveal durations, generation tokens, measured foreground-time checkpoints, pause/recovery state, completed moves/pair counts and deck/rule/shuffle/assistance versions are stored in this app’s transactional local database (native private file; IndexedDB on web). Preferences cover selected deck/size, reveal duration, language, contrast/card size, reduced motion, optional sound/haptics and optional time display. Atomic operation receipts and last-good recovery snapshots support retry and corrupt-save recovery.

Three original icon decks are bundled offline; no camera, photo library, microphone, contacts, location or advertising identifier is needed for the base game. No personal-photo deck, custom-content upload or multiplayer account is included in this local release. The tutorial is optional; no account or sensitive permission prompt is required to play.

Original bestMoves/completedGames preferences remain as a separate migration/recovery source with unknown deck/rules/assistance context. They never become invented board records or comparable personal bests. Current results retain their original declared context; active time is measured foreground checkpoints, not verified attention. Covered/absent time is not added. After process recovery, timing is conservatively labelled incomplete rather than guessed from wall clock.

Optional account and snapshot sync

You may use the local demo without creating an account. If you choose sign-in, the configured identity provider processes authentication in your browser. The backend verifies a provider subject and app-specific access token, and stores a separate app account and workspace. Native session tokens use platform secure storage; the web session token is kept in memory. Connection drafts and revision metadata may be stored locally to preserve retries, without saving the access token in ordinary preferences.

Snapshot data eligible for explicit upload from Previous demo snapshot & cloud controls: only the original best completed-game move count and completed-game count. Typed R1 boards, face identities/positions, seeds, pending turns, completed result rows, preferences and recovery copies are excluded from that endpoint. Replacing the old recovery snapshot does not rewrite the current local game/history.

You choose whether to upload the allowed local fields or replace them from cloud state. A conflict requires an explicit choice rather than silently overwriting newer work. Shared infrastructure does not give one app’s account access to another app’s private workspace. Operational requests necessarily reach the configured server/provider and can expose network information such as IP address and request timing to that infrastructure.

Other optional platform controls

Cloud file controls transfer only files you deliberately select, together with bounded filename/type/size, checksum and expiry metadata. These server-readable files are not end-to-end encrypted vault storage. Expiry and deletion block future authorized access before eventual physical cleanup; previously downloaded copies cannot be recalled.

Notification controls store the schedule, message and inbox record you submit. If push delivery is configured and you register a device, the service stores its app-scoped push token and sends the message through the configured push provider. Provider acceptance does not establish that the device displayed it. In-app inbox delivery and local phone reminder scheduling have different behavior.

Google Play billing controls, where configured, send the selected product and purchase token for server verification and store verification/entitlement status. Payment details are handled by Google Play rather than entered into this app. No paid entitlement is granted just because a device claims a purchase. Development adapters are identified as development features; they do not establish a paid purchase.

Optional Android feedback uses short generated tones and device touch feedback; it does not record audio or require microphone access. Sound and haptics have separate preferences, default off. Muting, pausing, starting another board and disposal cancel pending feedback generations. Unsupported platforms keep a labelled in-app fallback.

The app covers an unfinished board when focus is lost. On Android it requests secure-window/recent-app screenshot protection while an unfinished board exists, including the covered state. This can block screenshots and task previews where the OS honors the request; source configuration is not proof of every device’s behavior. Other platforms retain in-app covering without claiming OS screenshot protection. Card coordinates stay fixed through menu language changes; face-down semantics contain position/state only and do not expose identity.

No advertising or analytics uploader is enabled in this implementation. Optional content-free local events default off, retain only bounded categories/revisions and contain no card identities, seeds, scores or raw source content. Ordinary diagnostics provide anonymous support/status codes and counts. Withdrawing consent clears queued optional events. Future SDKs, advertisements or additional data processing require revised disclosure and review before release.

Storage, retention and deletion

The active database, previous preferences, JSON and CSV exports are not app-encrypted. Android automatic app backup is disabled. Browser storage belongs to its origin/profile and may be evicted; independent device/provider copies have separate lifecycles.

Free completed-history JSON/CSV includes schema, deck/rule/shuffle versions, original record identities, assistance and measured-time qualification. Active-board and recovery JSON may reveal shuffled face-down solutions and private/corrupt source bytes; preparing these requires an explicit spoiler/private-data warning. Exports are independent unencrypted copies and remain outside later local deletion. This R1 export does not imply an import or encrypted-backup feature.

Active-board and completed-history clearing are independent actions. Clearing completed history recomputes comparisons and leaves the active board/settings/owned purchases intact; clearing the active board leaves completed results intact. Original raw migration recovery may remain until the deliberate full play-data clear. Full play-data clear removes active boards, results, legacy/recovery content and local optional events while preserving settings/setup preferences and owned-purchase records. It does not recall exported files, erase OS/provider copies, cancel a purchase or delete an optional cloud account. Tombstone/operation metadata may remain to prevent deleted results from being recreated by stale checkpoints.

Cloud account export/deletion are separate account controls and require recent sign-in. Account deletion applies to this app’s account and workspace, rather than silently deleting all Servenzo app accounts. It ends access and initiates scoped cleanup; a queued or partially completed cleanup is not a claim of immediate forensic erasure. Identity-provider accounts, Google Play purchase records, mandatory provider retention and independent external copies have separate controls. See the operator and hosting section of this policy for the current deployment and retention settings.

Device access

The base game does not request camera, microphone, contacts, location, notifications or advertising-ID access. INTERNET permits an explicitly configured optional HTTPS platform connection. Native browser sign-in uses this app’s unique callback scheme. Optional tones/haptics do not capture user audio or request sensitive runtime access.

Children and audience

The publisher intends this app for users aged 13 and older. The app does not ask for a date of birth or build an account-based age profile.

Contact

Contact [email protected] for privacy questions. Do not include private files, child information, habit details or financial records in an initial support message. Sending support email uses your chosen email provider and is separate from this app’s feature data. No support message is sent automatically.

Current local R2 increment — 20 October 2026

The local R2 puzzle workspace keeps selected rule/deck versions, optional timed and move-budget categories, confirmed hint/study assistance, deterministic UTC-day challenge identities, finite trail/branch progress, covered/mirrored/rotated/anchor/mistake-budget state, attempts and explicit relaxed continuations. Hidden-card semantics never intentionally publish identity. Assistance and interrupted/failure cohorts remain distinct from relaxed results. Results are device-local, not globally verified rankings; no paid retry or random commercial reward is added.

The new feature state remains app-scoped and local. Explicit JSON/file/clipboard exports are independent private copies; recovery can contain active or captured unacknowledged inputs. Deleting local feature data does not erase exports, OS/provider originals, separate app accounts or another product. Provider, installed-device, signed-release and store/public-policy qualification are not inferred from local tests.