Privacy Policy

Who we are

This policy describes how Manu Games LLC ("Manu Games", "we", "us") handles personal data across two surfaces: Tideward (the "App") and the website at tideward.app (the "Website").

For privacy questions, write to privacy@manugames.com. We aim to respond within 30 days, faster where statute requires.

Scope of this policy

The two surfaces have different audiences, different data flows, and different geographic availability. This matters; please don't read them as one thing.

• The App: Tideward on iPhone, iPad, Mac, Apple TV, Apple Vision Pro, and Apple Watch. The App is offered only through Apple's App Store, in the countries and regions listed on its App Store product page, which is the authoritative list. As of the Last Updated date above it spans the Americas, Australia and New Zealand, parts of Asia-Pacific, Israel, parts of the Middle East and Africa, and parts of Europe outside the European Union and the EEA, including Switzerland, and does not yet include the EU, the EEA, or the UK. App-specific sections of this policy are written around U.S. law and apply wherever the App is offered; the jurisdiction-specific sections near the end add what applies where you live. Before we open the App in a region that needs its own disclosures, this policy is updated first.
• The Website: tideward.app. Globally accessible, hosted on Cloudflare Pages. The Website uses Cloudflare Web Analytics, a cookieless, privacy-first service that measures aggregate traffic (such as page views, referrers, and aggregate device and country breakdowns) at the edge without setting cookies or building a per-visitor profile. Beyond that the Website runs no advertising scripts, no ad networks, and no cross-site tracking or fingerprinting, and it sets no cookies. Because the analytics is cookieless, there is still no "Accept cookies" banner.

Each section below carries one or more surface tags so you know which surface its disclosures apply to. Where a section says App, it is written around U.S. law and applies wherever the App is offered, with the jurisdiction-specific sections adding to it. Where it says Website, the disclosure is written for a global audience.

The Manu Games newsletter (The Assembly Line) and the publisher-level website at manugames.com have their own privacy policy at manugames.com/privacy.

What we collect, and what we don't

The short version, in plain language. The strongest single statement is this:

The App does not embed any third-party SDK. No analytics, no advertising, no attribution, no crash reporting, no fingerprinting library, no anything that could phone home about you. Nothing you do while playing is sent anywhere in the background. Every network call the App makes on its own reaches Apple's frameworks only: CloudKit, Game Center, StoreKit, and MetricKit.

Two things fall outside "Apple only", and you have to tap both of them first:

• If you choose to subscribe to our newsletter from inside the App, the App hands the signup off to your web browser. See Newsletter signup from inside the App below.
• If you choose to send us a bug report or a feature request from inside the App, what you typed is posted to our community Discord, publicly. See Bug reports and feature requests from inside the App below.

Neither happens in the background, and neither happens unless you fill in a form and press the button.

Across the surfaces:

• App: only Apple-mediated identifiers and the gameplay content you create. Never sent to Manu Games beyond what Apple's frameworks provide.
• Website: aside from Cloudflare Web Analytics (the cookieless, aggregate measurement described above), no scripts profile you, no first- or third-party cookies are set, and there is no advertising network. The only embedded third party is the YouTube video player, which loads with the page in privacy-enhanced mode: it sets no cookies and records no viewing data unless you press play. The one piece of personal data the Website can hold is an email address you voluntarily submit to the Tideward Updates list (see Email updates); if you never subscribe, we hold nothing about you.

Data flows in the App

Four discrete flows touch personal data inside the App on their own. There are no others. Two further flows exist that only ever run when you start them: the newsletter signup and the in-App report form, each described in its own section below.

• Save state, Apple iCloud / CloudKit private database. Your character, inventory, skill XP, settings, and other in-game state are stored in your private iCloud container. Apple is the service provider. We do not have access to the contents of that container; we cannot read your save.
• Game Center. If you have Game Center enabled and choose to use leaderboards, achievements, or Challenges, Apple displays your Game Center alias and score to other Game Center users. Apple is the controller for Game Center; we render Apple-supplied leaderboard and Challenge data inside the App. Challenge definitions are configured by us in App Store Connect and delivered to the App by Apple; your participation and results are held by Apple, not by us.
• StoreKit 2, in-app purchase. When you make a purchase, Apple is the merchant of record. The App reads your entitlements (which of the App's products you own: the full-version unlock, and any optional cosmetic items you bought) via Apple's StoreKit framework. Refunds, disputes, and billing are handled at reportaproblem.apple.com.
• MetricKit, and it runs in the opposite direction. MetricKit is Apple's own diagnostics framework, and it is how the App has crash and performance reporting without embedding a third-party crash reporter. Apple's operating system gathers the data on your device and hands it to the App on a later launch. The App stores what it receives on your device and sends none of it anywhere. See On-device-only telemetry below.

On-device-only telemetry

The App keeps two kinds of telemetry, both only on your device. Neither is ever transmitted to Manu Games. Neither has an upload path in the App at all.

• Engagement metrics. To make balance and pacing decisions in future updates, the App generates lightweight engagement metrics (session lengths, return gaps between sessions, and Day-N retention markers) and stores them in the App's own local settings store. They are read only by the App on your device.
• Apple diagnostics, via MetricKit. Because the App embeds no third-party crash reporter, it uses Apple's own MetricKit framework instead. Your operating system gathers daily aggregate measurements (launch time, hang rate, memory use, exit reasons) and event-triggered diagnostics (crashes, hangs, CPU and disk-write exceptions) and delivers them to the App on a later launch. The App writes them to its own store on your device, separate from everything above, and drops anything older than 30 days automatically. Apple aggregates these payloads with no per-user attribution, and the App adds no identifier of its own. You can read them yourself inside the App at Settings → Diagnostics.

Neither store is ever attached to a bug report or a feature request. Those carry a separate diagnostic log, described in its own section above, and the two are deliberately kept apart.

You can clear both at any time using Settings → Delete Local Data inside the App; both are also removed when you uninstall the App. Each has an optional export you start by hand, so you can read it before sending and share it with us voluntarily. Without your explicit, voluntary export, we have no path to any of this data.

Newsletter signup from inside the App

The App can offer you a card inviting you to subscribe to The Assembly Line, our newsletter. It is optional and it is never pre-checked. Here is exactly what happens if you tap it:

• The App mints a random, opaque token on your device. It is not derived from your name, your email, your Apple ID, your device, or anything else about you, it is just a random string.
• That token is stored in your private iCloud container (so the App does not re-ask you on your other devices) and is attached to the signup link as a campaign tag.
• The App then opens that link in your web browser. It does not send your email address anywhere; it does not handle your email at all. You type your address into Ghost's signup page, on the newsletter's own site, under Ghost's privacy policy.
• If you subscribe, that campaign tag travels with your signup and may be stored alongside your subscription by Ghost. Its only purpose is to let us tell "subscribed from inside the game" apart from "subscribed from the website" so we stop prompting people who already said yes.

If you never tap the card, no token is ever handed to anyone. If you dismiss it, the App records only that you dismissed it. You can unsubscribe from any newsletter issue at any time, and you can ask us to delete the association by writing to privacy@manugames.com.

Bug reports and feature requests from inside the App

The App has a form under Settings → Support for reporting a bug or requesting a feature. It is optional, it never runs on its own, and it sends nothing until you fill it in and press the button. What you send is published publicly. Here is exactly what happens:

• Your report is sent over HTTPS to a small intake service we run on Cloudflare Workers. This is the one server Manu Games operates that the App talks to. It keeps no copy of your report: it validates it, passes it straight to Discord, and forgets it.
• The intake service opens a thread in our public Discord, in #bug-reports or #suggestions. Anyone who can see that Discord server can read your report, including other players. Treat the form as posting in public, because it is.
• You choose how much of that rides along, on the form, before you send. The Include control offers three levels, and it starts at Everything:
  • Everything. Your device and app version, plus the diagnostic log described below.
  • Device only. Your device and app version, and nothing else. No log, which means none of your gameplay history and none of the system-log tail described below, because both travel inside the log file.
  • Nothing. Your message alone: no device, no app version, no log, not even the random install ID.
• A bug report carries what you typed, plus four fields so you never have to describe your setup: app version, operating system version, device model (for example iPhone17,1), and platform. The random install ID described below is sent alongside them.
• It also attaches a diagnostic log, and that log has exactly three parts. First, a short header: the install ID in full, a per-launch session ID, your app version, operating system version, device model, the time the file was written, and how many milliseconds the App's data store took to open. Second, the App's own event log, up to 8,000 entries, which is where screens opened, actions started and finished, saves, and errors appear. Third, up to 10 KB of the App process's own system log from the last 15 minutes, each line tagged with the Apple subsystem that emitted it. Your character's name is deliberately not included.
• What the log does not contain. No display or accessibility settings, no language, no battery or Low Power Mode state, no device temperature, no free-storage figure, and no measure of how long the App had been open. The App never reads any of those for reporting, so none of them can be sent.
• A feature request carries only what you typed and the same app and device fields. No log is attached.
• No name, no email address, no Apple ID, no Game Center alias, and no account information is included, ever. The only identifier attached is a random install ID the App generates for itself: the post shows its first eight characters, and the attached log carries it in full so we can tell two reports from the same device apart. It is not derived from you or your device and cannot be traced back to you.
• We use that random ID for one thing: rate-limiting, so a malfunctioning device cannot flood the channel.

If you would rather not post in public, email us instead at support@manugames.com; the App's Contact Support row does exactly that. To have a report you sent taken down, write to privacy@manugames.com and we will delete the thread.

Once your report is on Discord, Discord's own privacy policy governs that copy of it. See Third-party links below.

AI-generated artwork

Tideward's artwork, including the creature portraits and the item and equipment icons, has been produced with AI image-generation tools since the project's first day, directed, curated, edited, and assembled by a person. We think you should know that, so we are saying it plainly here rather than burying it.

What this does not involve is any processing of your data:

• The artwork was generated before release, on our own machines and accounts, as part of making the game. It ships as ordinary image files inside the App.
• The App does not run any AI model, and does not generate anything at runtime. Nothing you do in Tideward is sent to an AI service. No prompt, no image, no gameplay data, no text, nothing.
• We do not share your personal data with any AI provider, and we do not use your data to train anything.

Tideward's design, systems, and balance are human decisions. Its code and writing are produced with AI assistance under human direction and reviewed by a person before release. The art was generated with AI tools, and the selection, correction, colour work, cropping, and final integration were done by a person.

Game Center

Game Center is Apple's gaming social layer. If you choose to use it, your Game Center alias may be visible to other Game Center users on Apple-hosted leaderboards and in Challenges, and the App will render Apple-supplied leaderboard rows and Challenge state inside its own UI. Challenges are Apple-hosted: we define them in App Store Connect, and Apple holds who joined one and how they did. We receive no per-player record of either.

You can disable Game Center system-wide in iOS Settings → Game Center, or per-game on iOS 17+ in Settings → Game Center → Per-Game Profile. When Game Center is disabled, the App cannot read your alias or post scores, and it does not retain a shadow copy of either.

Apple as processor

Apple Inc. processes save-state and entitlement data on Manu Games's behalf, in its capacity as a service provider under the Apple Developer Program License Agreement and Apple's published iCloud and Game Center processing terms. We rely on those documents as the operative service-provider agreement; we do not separately negotiate processor terms with Apple, and we do not represent otherwise.

App Privacy Nutrition Label

Apple's "App Privacy" disclosure framework on the App Store excludes data that is "processed only on device" from a developer's collection-and-disclosure obligations. That is the basis on which the on-device-only telemetry described above is not declared as data collection in App Store Connect, even though it is described in this policy. We surface it here for transparency; it does not appear on the App Store privacy nutrition label because it does not leave your device.

What you type into the in-App report form, and the diagnostic log attached to a bug report, do leave your device, so they are declared: as User Content and Diagnostics, both not linked to your identity, both used only for app functionality, and neither used for tracking.

Apple itself collects and discloses information related to its own services (Game Center alias display, App Store purchase history). Those disclosures are Apple's responsibility; consult Apple's privacy policy.

The website

The Tideward website at tideward.app hosts this policy, the dev blog, the FAQ, the roadmap, and a press kit. It uses cookieless Cloudflare Web Analytics for aggregate traffic measurement, and otherwise runs no advertising, no fingerprinting, and no cross-site tracking. The site sets no cookies. Because the analytics is cookieless, there is no "Accept cookies" banner.

One embedded third-party element loads on the pages that show a video (the homepage and the press page):

• YouTube: videos are embedded in YouTube's privacy-enhanced mode. Your browser contacts YouTube to display the player when the page loads, but in this mode YouTube sets no cookies and stores no viewing information unless you press play. YouTube's behavior is governed by Google's privacy policy.

Until you press play, the embed stays in its no-cookie state, so YouTube records no viewing data about you.

Email updates (Tideward Updates)

The Website offers an optional, low-volume email list called Tideward Updates. It is entirely opt-in: you join only if you type your email into the signup form and submit it. If you never do, we hold no personal data about you from the Website.

• What we collect: the email address you submit, plus the date and which page you submitted it from. Nothing else, and no name is required.
• What we use it for: sending you a small number of Tideward milestone emails (for example, when the beta opens, when it ships, and when the game launches). Never more than one a month, and usually far less.
• Where it is stored: in a Cloudflare Workers KV store on Manu Games' own Cloudflare account. We do not use a third-party newsletter platform for this list, and the list is never shared, sold, or rented.
• How we send: messages are sent by us directly, with recipients hidden from one another, and each message includes a way to unsubscribe.
• Unsubscribing: use the link in any email, the unsubscribe page, or simply reply asking to be removed. We remove you promptly, and your address is deleted from the store.

This list is separate from The Assembly Line, the Manu Games newsletter, which runs on Ghost and has its own signup and its own disclosures at manugames.com/privacy.

Server logs

The Website is hosted on Cloudflare Pages and served through Cloudflare, which proxies the domain. Two sets of logs exist as a structural matter, and neither is something we build a profile from:

• Cloudflare Pages origin logs. The Website's static files are served from Cloudflare Pages, whose servers record standard HTTP access logs containing IP address, user agent, requested path, response code, and timestamp. We do not have access to these logs, do not retrieve them, and do not maintain any parallel copy. Cloudflare's handling of them is governed by its published data-processing terms.
• Cloudflare edge logs. Because the domain is proxied, Cloudflare's network also processes each request at the edge, including the connecting IP address, in order to route it, cache it, and filter abusive traffic. Our Cloudflare account surfaces this only as aggregate traffic dashboards; we do not have raw per-visitor request logs, do not download them, and do not join them to anything. Cloudflare acts as our service provider for this, under its published data-processing terms.

Neither log set is used for advertising, profiling, or building any picture of an individual visitor.

Retention

• CloudKit data is retained until you delete it. Inside the App, Settings → Delete iCloud Data for Tideward removes your save slots (every character) and the snapshots the Apple Watch and the Mac widget read from them. It does not remove the other, smaller records Tideward keeps in the same private iCloud database, such as the account-wide ledger of monsters defeated and items found, your ship's stores, and the newsletter campaign token described below. To remove everything Tideward keeps in your iCloud, open your device's Settings → [your name] → iCloud → Storage (on some versions, Manage Account Storage); if Tideward is listed, tap it, then tap Delete Data from iCloud. On a Mac: System Settings → [your name] → iCloud → Manage. This data sits in your own private iCloud database, so we cannot see it or delete it for you.
• On-device engagement metrics are retained until you tap Settings → Delete Local Data in the App or uninstall the App.
• On-device Apple diagnostics (MetricKit) are dropped automatically once they are 30 days old, and are also cleared by Settings → Delete Local Data or by uninstalling the App.
• Game Center data is retained per Apple's Game Center policies; you can disable Game Center system-wide or per-game in iOS Settings (iOS 17+).
• StoreKit purchase history is retained by Apple per its policies; we hold no parallel copy.
• Server logs at Cloudflare Pages and at Cloudflare's edge are retained per Cloudflare's published policies; we do not retrieve or retain them ourselves.
• The newsletter campaign token, if you used the in-App signup, is held in your own private iCloud container and alongside your Ghost subscription; unsubscribing from the newsletter removes the Ghost side. The copy in your iCloud is not removed by the in-App Delete iCloud Data button; remove it through your device's iCloud storage settings, as described under CloudKit data above.
• Tideward Updates email is retained until you unsubscribe or ask to be removed, at which point your address is deleted from our Cloudflare KV store.
• A bug report or feature request you sent from inside the App stays in the Discord thread it created for as long as that thread exists. The intake service that posts it keeps no copy. Write to privacy@manugames.com to have a thread deleted.

Your rights

The specific rights you have depend on where you live and which surface is involved. To exercise any of them, write to privacy@manugames.com. We will respond within the timeframe applicable law requires (commonly 45 days, sometimes extendable).

• Right to know / access: confirmation of whether we process personal information about you and a copy of what we hold. For the App, our response will describe categories rather than produce stored content (we hold no off-device data); for the actual data your devices and iCloud hold, use Apple's Data and Privacy portal or the in-app export.
• Right to correct: to correct inaccurate personal information we hold.
• Right to delete: for App data, use Settings → Delete Local Data and Settings → Delete iCloud Data for Tideward in the App, and your device's iCloud storage settings for the Tideward records that button does not remove (see Retention above). For the Tideward Updates email list, unsubscribe here or email us. For anything else, email us.
• Right to opt out of "sale" or "sharing" for cross-context behavioral advertising. We do not sell or share. There is nothing to opt out of.
• Right to portability: receive your personal information in a structured, machine-readable format. For the App, use the in-app export and Apple's Data and Privacy portal.
• Right to limit use of sensitive personal information. We do not process sensitive personal information.
• Right to non-discrimination: we will not deny service, charge different prices, or provide different quality because you exercised a privacy right.
• Right to appeal: if we deny a rights request you submit, you may appeal by replying to our response email within 60 days; we will respond to the appeal within 60 days and explain our reasoning.

Children

Tideward is rated 12+ in Apple's age-rating system but is not directed to children within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312) or the New York Child Data Protection Act. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and become aware that a child under 13 has used the App, contact privacy@manugames.com. We will delete personal information consistent with COPPA, document the deletion, and confirm in writing.

The App applies child-protective defaults to all users (no profiling, no targeted advertising, data minimization, sensible privacy defaults) regardless of age.

International transfers

One flow leaves your home jurisdiction in any meaningful sense:

• Apple infrastructure (App). Apple operates iCloud and Game Center infrastructure in the United States and other jurisdictions. Apple's transfer protections (including its Standard Contractual Clauses and certifications) apply to those flows. We do not separately re-transfer data; we rely on Apple's processor terms.

Apple's privacy policy is at apple.com/legal/privacy.

Security

We rely on infrastructure-level security from our service providers. CloudKit data is encrypted in transit and at rest; on-device data is protected by iOS data protection. The Website is a static site with no server-side logic, no database, and no authentication system. The only server-side code we operate is the Cloudflare Workers infrastructure behind the Tideward Updates email list and the in-App report form; neither holds a database of personal information beyond the subscriber list described above, and the report form keeps no copy of a report at all. Beyond those, our attack surface is reduced to the App binary itself, distributed and signed through Apple. We follow Apple's secure-development practices and review every dependency we add.

Breach notification

If a personal-information breach occurs that is likely to affect you, we will notify you and, where required, the applicable state attorney general or enforcement authority within the timeframes the applicable law requires, generally "without unreasonable delay" under most U.S. state breach-notification statutes, with specific deadlines in some states.

Where a breach occurs on Apple's infrastructure, Apple as processor is required to notify Manu Games without undue delay; the same notification clocks then run for us as data controller.

US state-specific notices

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Iowa, Indiana, Tennessee, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, or Rhode Island (or another state with a substantially similar comprehensive privacy law) the following apply to your interactions with the App:

• Categories of personal information processed: Apple-mediated identifiers (Apple ID, Game Center player ID, StoreKit entitlement) and gameplay content stored in your iCloud private database.
• Purposes: delivering the App, syncing your save through Apple's CloudKit, and granting your in-app purchase entitlement.
• Categories of third parties with whom personal information is shared: Apple Inc. as service provider for CloudKit, Game Center, and StoreKit; Cloudflare, Inc. hosts the Website on Cloudflare Pages, proxies it, logs standard HTTP access requests at the edge, provides cookieless aggregate analytics, and runs the in-App report form's intake service; Ghost Foundation Ltd receives your email address only if you choose to subscribe to the newsletter, whether from the Website or from the in-App signup card; Discord, Inc. receives a bug report or feature request, publicly, only if you choose to send one from the in-App form.
• We do not sell personal information. We have not sold personal information in the prior 12 months and do not intend to.
• We do not "share" personal information for cross-context behavioral advertising. We do not engage in advertising at all.
• We do not engage in profiling for legal or similarly significant decisions.
• Sensitive personal information: we do not process sensitive personal information as defined by these statutes.
• Universal opt-out signals (GPC): because we do not engage in selling, sharing, or targeted advertising, there is no such processing for a Global Privacy Control or equivalent signal to opt out of. We honor any signal we are required by law to honor.
• Right to appeal: if we deny a rights request you submit, you may appeal by replying to our response email within 60 days; we will respond within 60 days and explain our reasoning.

Maryland (MODPA). We limit collection of personal data to what is reasonably necessary and proportionate to the specific service you have requested. We do not sell personal data of any consumer we know to be under 18, and we do not process minor data for targeted advertising.

California (CCPA / CPRA). California residents have specific rights described above (right to know, delete, correct, opt out of sale/sharing, limit use of sensitive PI, non-discrimination, appeal). Retention windows are described in Retention. Our designated method for submitting rights requests is the email address in Contact.

Washington and Nevada, consumer health data

Tideward is a game. It is not framed as wellness, mindfulness, mental-health support, fitness, sleep tracking, or any health-related service.

We do not collect or process "consumer health data" as defined in Washington's My Health My Data Act (RCW 19.373.020(8)) or Nevada SB 370. Session-length, return-gap, and engagement telemetry are stored only on your device, are not transmitted to Manu Games, and are not used to identify any past, present, or future physical or mental health status.

New York minors (CDPA)

Tideward is a general-audience service and is not "primarily directed to minors" within the meaning of the New York Child Data Protection Act. We do not knowingly process personal data of New York minors under 13 except as permitted by COPPA, and we do not process personal data of New York minors aged 13–17 except as strictly necessary to provide the service the user has requested.

EU, EEA and UK visitors

The Website and the Tideward Updates list are globally accessible today, so if you are reading from the EU, the EEA, or the UK, this section applies to you now. The App is not yet offered in the EU, the EEA, or the UK; when App availability opens in your region, everything below applies to the App's data flows too, and the stamps above will move.

Who is responsible. Manu Games LLC is the controller for the processing described in this policy. We have no establishment in the EU or UK. We have not appointed an EU or UK representative under Article 27, because our processing is occasional, involves no special categories of data, and is unlikely to result in a risk to your rights and freedoms (Article 27(2)(a)); we keep a dated record of that analysis and will appoint a representative if the analysis changes.

Lawful bases (Article 6). We keep this exact, because there are only three:

• Tideward Updates emails: your consent (Art. 6(1)(a)), given when you submit the signup form. Withdraw it at any time by unsubscribing; withdrawal doesn't affect processing that happened before it.
• The App's data flows (save sync through your own iCloud, Game Center you opt into, your purchase entitlement): performance of a contract (Art. 6(1)(b)): they are how the game you asked for is delivered.
• Answering your emails and operating the Website (including transient edge processing of IP addresses for routing and abuse filtering): our legitimate interests (Art. 6(1)(f)) in responding to people who contact us and keeping a website online. Nothing in this category involves profiling.

Your rights (Articles 15–21). Access, rectification, erasure, restriction, portability, and objection, plus withdrawal of consent where consent is the basis. The rights listed in Your rights above are these rights; the mechanics are identical. Write to privacy@manugames.com and we will respond within one month.

Complaints. You may lodge a complaint with your local supervisory authority, the EDPB members list has every EU authority, and UK residents can complain to the ICO. We'd appreciate the chance to resolve it first, but that is your right, not a precondition.

International transfers (Chapter V). App-related data stays inside Apple's infrastructure under Apple's own transfer safeguards, including its standard contractual clauses; we initiate no separate transfer of it. Tideward Updates addresses are stored on Cloudflare infrastructure under Cloudflare's data-processing terms. The Website's hosting (Cloudflare Pages) and proxy (Cloudflare) process requests under Cloudflare's transfer mechanisms.

Children (Article 8 / UK Children's Code). We do not use consent as the lawful basis for any App data flow, so the varying digital ages of consent across Member States (13–16) do not gate the App. The Tideward Updates list is not directed at children; if you are under 16, please don't subscribe without a parent's agreement. For UK users: we have assessed Tideward against the ICO's Age Appropriate Design Code and keep a data protection impact assessment on file, the substance is simple, because the App has no profiling, no advertising, no geolocation, no nudging, and privacy-protective defaults for every user regardless of age. A plain-language version of this policy is at tideward.app/privacy/simple.

Automated decision-making (Article 22). None. No decision with legal or similarly significant effect is made about you, automated or otherwise.

Indonesia

The Website and the Tideward Updates list are globally accessible today, so if you are reading from Indonesia, this section applies to you now. When the App is available on the Indonesian App Store, everything below applies to the App's data flows too.

Which law, and who is responsible. Indonesia's Law No. 27 of 2022 on Personal Data Protection (the "PDP Law") and its implementing regulation, Government Regulation No. 33 of 2026, apply to how we handle personal data about people in Indonesia. Manu Games LLC is the personal data controller. We have no establishment in Indonesia and have not appointed a representative there or a data protection officer: our processing is not for public services, involves no large-scale regular and systematic monitoring, and involves no large-scale processing of specific personal data, which are the conditions in Article 53 that require one. We keep a dated record of that analysis and will appoint one if it changes.

Lawful bases (Article 20). The same three as in the EU section, because the flows are the same:

• Tideward Updates emails: your consent (Art. 20(2)(a)), given when you submit the signup form. Withdraw it at any time by unsubscribing; withdrawal doesn't affect processing that happened before it. The Email updates and Retention sections above are the information Article 21 requires you to have before you consent: what we store (your address, the date, and the page you used), why, for how long, and your rights.
• The App's data flows (save sync through your own iCloud, Game Center you opt into, your purchase entitlement): performance of a contract (Art. 20(2)(b)): they are how the game you asked for is delivered.
• Answering your emails and operating the Website (including transient edge processing of IP addresses for routing and abuse filtering): our legitimate interests (Art. 20(2)(f)) in responding to people who contact us and keeping a website online. Nothing in this category involves profiling.

Your rights (Articles 5 to 13). To know who is processing your data and why, to access it and get a copy, to correct it, to erase it, to withdraw consent, to object to a decision made solely by automated processing, and to delay or restrict processing, plus the right to complain and to seek compensation for a violation. The rights listed in Your rights above are these rights; the mechanics are identical. Write to privacy@manugames.com. For the requests the PDP Law puts on a 3 x 24 hour clock (correction, stopping processing after you withdraw consent, and restricting processing) we act within that window once we can verify the request is yours; the self-service controls (unsubscribing, Delete Local Data, and Delete iCloud Data for Tideward) take effect immediately.

Children (Article 25). Under Indonesian law a child is anyone under 18. We do not use consent as the lawful basis for any App data flow and the App sends nothing about you on its own (a bug report or feature request goes out only when you fill in the form and press the button), so there is no parental consent step inside the App and none is needed. The Tideward Updates list is not directed at children; if you are under 18, please don't subscribe without a parent's or guardian's consent, and a parent or guardian can have a child's address removed by writing to privacy@manugames.com. The child-protective defaults described in Children above apply to every user in Indonesia regardless of age.

Breach notification (Article 46). If a failure of personal data protection affects your personal data, we will notify you and the competent authority in writing within 3 x 24 hours of establishing it, stating which data was compromised, when and how, and what we are doing to handle and recover it.

International transfers (Article 56). Your data is processed outside Indonesia. App-related data stays inside Apple's infrastructure under Apple's own binding data-protection terms and transfer safeguards; we initiate no separate transfer of it. Tideward Updates addresses are stored on Cloudflare infrastructure under Cloudflare's binding data-processing terms, and by subscribing you also consent to that storage. The Website's hosting and proxy (Cloudflare) process requests under the same terms.

Complaints. You may complain to the personal data protection authority the PDP Law establishes; until it is operating, the Ministry of Communication and Digital Affairs (Komdigi) handles personal data matters. We'd appreciate the chance to resolve it first, but that is your right, not a precondition.

Automated decision-making (Article 10). None. No decision with legal or similarly significant effect is made about you, automated or otherwise.

Third-party links

The App and the Website link to third-party services we don't control: Apple's TestFlight and App Store, Discord, X, YouTube (for our videos), Ghost (the newsletter platform, reached from the in-App signup card or the website), and our personal portfolio link. Once you click through, you're governed by their privacy practices, not ours. We've chosen partners we believe handle data responsibly, but please review their policies for the parts we can't speak to.

Updates to this policy

We may update this policy when our data practices change, when statute requires, when we expand to new regions, or when we improve the wording. When we make a material change, we will update the Last Updated date at the top of this page. The EU, EEA and UK disclosures and the Indonesia disclosures above are already in place for the Website; before App availability opens in a new region, we confirm the jurisdiction-specific sections cover it, and that expansion is itself a material change.

Contact

Three channels, each scoped to a specific kind of question:

• Privacy questions, rights requests, deletion requests, complaints: privacy@manugames.com
• Refund-rights inquiries and other legal notices: legal@manugames.com
• General support and product questions: support@manugames.com

Manu Games LLC
89 Waynesville Plaza #1028
Waynesville, NC 28786
United States