Privacy policy

This English text is a courtesy translation. The French version governs.

Légarius makes mobile games. This policy describes everything our games and our website may collect, including features we plan to add. Each section says in its first sentence whether the feature exists today, so you know both what is happening now and what is coming.

This policy covers both of our applications, Arrow Puzzle (com.gamearrow.puzzle) and our second game, not yet announced (com.gamematch.digsite), as well as this website.

At a glance

What our games send us	Today: nothing about you. No accounts, no analytics, no crash reports.
What is coming	Error and progress reporting, and a profile identifier for online features. See §3 and §4.
How it will be turned on	Off by default. We will ask for your consent separately, for each purpose, before anything is sent.
Where your progress lives	On your device. It will stay there even once online features exist.
Purchases	Optional, handled by Google Play. We never see your payment details.
How to delete everything	Reset in-game, or uninstall. For anything we would hold: write to us and we delete it.
Who to contact	Privacy Officer, support@legarius.games

1. How to read this policy

Some of the features described below do not exist yet. Nothing is collected under those headings today, and the section concerned says so in its first sentence.

The table below follows the same categories as Google Play's "Data safety" form. The "Today" column is the one that matches the form; the "Planned" column describes the state once the feature is turned on.

Category	Today	Planned	Shared with third parties	Purpose
Personal information (name, email)	No	No	No	—
Profile identifier (randomly generated)	No	Yes, §4	No	Online features
Gameplay activity and progress	No	Yes, §3	No	Improving the games
Crash and performance data	No	Yes, §3	No	Fixing bugs
Precise device location (GPS)	No	Never	No	—
Approximate area derived from IP address	No	Possible	No	Advertising, §17
Contacts, photos, files, microphone, address book	No	Never	No	—
Advertising and ad profiling	No	Possible, §17	No	—

The "Never" entries above are commitments. If we ever revisited them it would be a substantial change: we would publish notice and ask for your consent again.

2. What our games do today

Our games do not send any information about you to us or to anyone else. There are no accounts, no analytics and no crash reporting. All of your progress and settings are stored on your own device (arrow.save.v1 for Arrow Puzzle; the save, settings and tutorial keys for the second game).

If you choose to buy an optional item, the purchase is handled entirely by Google Play's billing service; we receive only the order information Google shows us in the Play Console, and Google's privacy policy governs that transaction.

3. Error and progress reporting

This feature is not present in any published version of our games. Here is what it will do when it exists.

What would be sent. When a game crashes or misbehaves: the type of error and where in the code it happened, the device model, the Android version, the game version and the language. For progress: the level number reached, whether it was completed or abandoned, how long it took and how many attempts.

What would never be sent under this heading. Your name, your email, your Google account, your location, your address book, your files, or the contents of your device.

Why. To fix bugs we cannot reproduce ourselves, and to spot badly designed levels: too hard, impossible, or abandoned by almost everyone. Those are the only reasons.

Linkage. These reports would carry the profile identifier described in section 4, so that several crashes from the same device can be grouped. The protections in that section therefore apply here too.

How it will be turned on. Off by default. We will ask you explicitly, separately from other features, and you can decline without losing anything in the game itself: declining costs you the online features described here, and nothing else. You can change your mind at any time in the settings; withdrawal applies going forward and we will delete what we hold on request.

Retention. 12 months from receipt, then deleted.

4. Online features and profile identifier

This feature is not present in any published version of our games.

What the identifier would be. An identifier generated at random on your device on first launch, not linked to your name, your email, your phone number, your Google account, or any Android advertising identifier. It lets us recognise the same device from one time to the next without knowing who you are.

We treat this identifier as personal information, and every right described in section 15 applies to it.

What it would be for. Features that cannot work any other way: saving your progress on our servers, moving a game to a new device, shared leaderboards or challenges. It will not be shared with any third party.

How it will be turned on. Off by default. Consent asked separately, refusable, withdrawable at any time. If you withdraw it, we delete the identifier and everything attached to it, and the game keeps working locally.

Retention. For as long as the online feature is used, then 12 months after your last use, or immediately on request.

Hosting. See section 11: if those servers are outside Québec, we will carry out the assessment the law requires before they go live, and we will name the country here.

5. This website

We run this website on our own server, and we have turned request logging off: we do not create or keep a record of the pages you visit, of your IP address, or of your browser, and we use no analytics of any kind.

To be precise about what that means: Sending you a page still requires your device and our server to exchange connection information. Your IP address is necessarily used to route the page back to you, and the encrypted connection exists in our server's memory for the duration of your visit. Our operating system may briefly hold ordinary system and error records, and the network providers between you and us handle your traffic under their own practices, which we do not control. What we do not do is write your visits to a file and keep it.

When you open our address without a language prefix, our server reads the language preference your browser sends with the request so it can send you to the French or the English version. That preference is used for that single redirect. It is not stored and it is not used to build any profile of you.

This website sets no cookies, stores nothing in your browser, runs no JavaScript, and loads no resources from any other website.

If we ever turn request logging on, we will update this policy and publish notice of the change before we do.

6. If you email us

Whatever you send us by email (your address and the content of your message) is kept by Zoho Mail for 12 months, then deleted. We use it only to answer you.

7. Consent

No in-app consent is needed today, because nothing about you is transmitted.

For each feature described in sections 3 and 4, we commit to the following, and these are not negotiable on our side:

• the feature is off by default;
• consent is asked separately for each purpose: accepting error reporting does not turn on online features, and the reverse is also true;
• the request is made in plain language, with no pre-ticked box and no button designed to get you to accept by accident;
• declining takes nothing out of the game itself: no level, no difficulty, no daily challenge and no gameplay feature is reserved for people who accept, and the game is playable in full without ever connecting. Online features do need the identifier — backing up your progress, moving it to another device, and what depends on them — because they cannot exist without it;
• you can withdraw your consent at any time in the game's settings, and we then delete what we hold.

8. We sell nothing

We do not sell, rent, trade or share personal information. We have no advertisers, no data brokers and no ad-analytics providers. This is true today and remains true for the features described in sections 3 and 4.

9. Third parties

• Google (Play): an independent party acting under its own policy. Google collects install, device, crash and purchase information, and handles any purchase. We see aggregated Play Console statistics that we did not collect ourselves.
• Zoho Mail: processes support mail on our behalf under a written agreement.

We have no advertisers, no data brokers, no analytics providers and no content delivery network. This website loads nothing from any other company's servers. If the features in sections 3 and 4 ever require an infrastructure provider, it will be named here before it goes live.

10. Retention and deletion

• Games: uninstalling the app deletes everything on the device. You can also reset everything from the in-game settings.
• Error and progress reports (section 3): 12 months.
• Profile identifier and online data (section 4): 12 months after last use, or immediately on request.
• Website: we keep no visit records, so there is nothing to retain or delete.
• Email: 12 months.

One address for any deletion request: support@legarius.games.

11. Communication outside Québec

This website runs on a server located in Québec, which we operate ourselves. Information relating to your visit does not leave Québec because of our hosting.

If you write to us, your message is stored by Zoho Mail, whose servers are in Canada. Before using that service we assessed the protection your information would receive there, and we hold a written agreement with the provider. You may ask us for a summary of that assessment.

For the features in sections 3 and 4: the threshold set by the law is communication outside Québec, not outside Canada: a server in Toronto is caught. Before a single report leaves your device, we will name here where that information will be processed and, if it is outside Québec, we will have carried out the required assessment and concluded the required written agreement.

12. Security

No studio server holds your game data; your progress and settings never leave your device.

This website is served over HTTPS only, plain HTTP is redirected, and security headers prevent it from loading external resources or being embedded by other sites. The server is administered only by the person in charge of the protection of personal information; access requires a cryptographic key and password logins are disabled. Access to the server is protected against automated login attempts by a standard blocking tool, which temporarily records the IP addresses of hosts making failed administrative logins. This concerns access to the machine, never your use of the website. Every account that can reach our infrastructure, our domain, our source code or our support mailbox has two-factor authentication. Security updates are applied promptly.

On your device, your save is protected by the operating system's application sandbox and by device encryption where the device provides it.

We do not claim that any system cannot be breached.

13. Confidentiality incidents

If a confidentiality incident affecting your personal information occurs and presents a risk of serious injury, we will promptly notify you and the Commission d'accès à l'information du Québec, and we will tell you what measures we are taking. We keep a register of all confidentiality incidents.

14. Minors

Our games are not designed for children; they are aimed at a general audience of 13 and over. If a minor under 14 were to use a feature described in sections 3 or 4, consent would be given by the person having parental authority or by the tutor.

15. Your rights

You may ask us for:

• access to the personal information we hold about you;
• its correction if it is inaccurate, incomplete or ambiguous;
• withdrawal of your consent, where a processing activity rests on it;
• cessation of dissemination of information concerning you, or its de-indexing, in the cases provided for by law;
• communication of your information in a structured, commonly used technological format (portability).

Send any request in writing to the person in charge, at support@legarius.games. We answer within 30 days.

Today, we hold nothing tied to your use of our games: an access request will generally return only the emails you have sent us, and your save is already in your hands, on your device. Once the features in sections 3 and 4 exist, an access request will also return whatever is attached to your profile identifier; tell us so in your request and we will explain how to find it in the game's settings.

If we refuse a request, we will give you the reasons, the provision of the law the refusal rests on, and the remedies available to you together with the time limit for exercising them.

16. Automated decisions

We make no decision about you based exclusively on automated processing. The progress data described in section 3 is used to evaluate levels, never people.

17. Identification, location or profiling technology

Our games contain no identification, location or profiling technology today. The identifier described in section 4 will be one once it exists; it will be off by default. We will never use your device's precise location (GPS).

If we ever add advertising to a game, this section will describe how it works and what it uses before it is turned on. Adverts can be personalised, meaning chosen using information such as the approximate area inferred from your IP address, or what you have played. The game's settings will let you turn that personalisation off. You will still see adverts; they will simply stop being chosen for you.

Inferring an approximate area from an IP address is what any website you visit already does. It does not require access to your device's location and does not give access to it.

18. Governance and complaints

We maintain policies and practices governing the retention and destruction of information, roles and responsibilities, the handling of requests and complaints, and the management of confidentiality incidents. Absent a written delegation, the person exercising the highest authority in the enterprise acts as the person in charge of the protection of personal information.

Step 1: write to the person in charge, at support@legarius.games. We answer within 30 days.

Step 2: if you are in Québec, you may file a complaint with the Commission d'accès à l'information du Québec. If you are elsewhere in Canada, you may file with the Office of the Privacy Commissioner of Canada.

19. Person in charge of the protection of personal information

Privacy Officer / Responsable de la protection des renseignements personnels support@legarius.games

20. Applicable law

This policy is governed by the Act respecting the protection of personal information in the private sector (Québec) and by the Personal Information Protection and Electronic Documents Act (Canada).

21. Language

This document is drawn up in French. This English text is a courtesy translation provided for information only; in case of any discrepancy, the French version prevails.

22. Changes

When a feature described as "not active yet" becomes active, we publish a new version of this policy before or at the same time as the version of the game that contains it, we update the Google Play "Data safety" information in the same release, and the corresponding row appears below.

Version	In effect	What changed
0.1 (draft)	2026-08-01	Initial version.