Please Invade Later Privacy Policy

Please Invade Later is a game I make for phones, tablets and computers. It has no accounts of its own, advertising or tracking. With your permission it can send an anonymous play report: a copy of how a game went, with nothing in it that identifies you or your device. When you play with someone on another device, the two devices exchange your game and the nickname you chose, and if you report that player's memos, the report is kept for 90 days so I can deal with abuse. The details are below.

What the game does not do

It has no accounts of its own. Signing in to Game Center is optional and is Apple's sign-in, not mine.
It shows no advertising.
It contains no analytics or advertising SDKs, no crash reporting and no tracking.
Its online features download the Daily Memo, send play reports if you agree, find and connect online matches, send memo reports you file, and upload and render replays when you request a video. On iPhone and iPad, optional Game Center and iCloud features use Apple's services.
It does not ask for access to your camera, microphone, contacts or location, and has no live voice or video chat. On Apple devices, it asks for Local Network access when you use nearby play. On iPhone and iPad, it asks to add to your photo library only when you choose Save Image on an incident photo, and never reads your photos. The Android version does not ask for phone or broad storage access.

What stays on your device

The game saves your settings (such as volume and text size), your progress (such as stars earned on maps), a snapshot of a game in progress so it can resume, and recordings (the moves you made, so a game can be replayed). Recordings stay in Replay Library until you delete them. On phones and tablets, photos and replays you choose to share go through the system share sheet, only where you send them. On computers, exported files go to Downloads, or the game's local shares folder if Downloads is unavailable. These files stay on your device unless you choose to share them, make a video or turn on play reports. On iPhone and iPad, your progress can also sync through your own iCloud (below). Uninstalling the mobile app removes its local game data. On computers, local game data can remain after the application is removed; delete that data separately if you want to remove it.

The AI Colleague's My playstyle setting learns from summaries of games played on this device. Forget my style removes those summaries after confirmation. A separate match profile estimates your pace from completed competitive online games, to help find suitable opponents. It stays on the device and can be reset in Settings without changing your campaign progress. Neither profile syncs through iCloud. The anonymous matcher's temporary hint is described below; Game Center does not receive your match profile.

iCloud sync

On iPhone and iPad, if your device is signed in to iCloud, the game keeps your progress (stars, Audit and Overtime bests, unlocks, Daily Memo days) and a few settings (volumes, subtitles, text size) in your own iCloud storage, so your other devices signed in to the same Apple Account pick them up. Apple stores this under its own privacy policy; I cannot see it, and it never reaches my server. Turn it off for a device in Settings → Privacy and data → iCloud sync. The Android and desktop versions do not use iCloud or Game Center.

Sharing replays and videos

Send replay opens the system share sheet on phones and tablets, or saves a replay file on computers. It goes where you send it, and another copy of Please Invade Later can play it on the recipient's device.

Make video uploads the replay to my service on Cloudflare. A renderer I run downloads it to make an MP4. The replay contains the map, moves and outcome needed to play the game again; it includes a drawn Map Office layout, but never its typed name, player nicknames, memos or device details. Making a video is a separate choice from play reports. Turning play reports off does not cancel a video you requested.

The finished link expires seven days after the request. The service removes the replay when the video finishes or you cancel the request, and automatically deletes remaining replay and video files after seven days. Replay Library on the title page lists recordings kept on your device and the progress or finished links for videos you requested. Uploading and checking a requested video can continue while you use the game. The library does not upload your other recordings automatically. Anyone with the finished link can watch the video without the game. Once the link expires, a copy someone already downloaded can still be kept or shared by them.

Each video request keeps its own replay copy on your device, a random request number and a private key for checking, cancelling or deleting it. The local copy stays after a video finishes, expires or is cancelled, so it can be retried. Delete video removes the finished video from the service and stops its shared link from working. Copies already downloaded by someone else remain theirs. Remove request removes a failed, cancelled or expired request and its saved replay copy. Neither action deletes the original recording in Replay Library. Deleting a Library recording does not delete a separate video request; deleting the game's local data removes those local copies.

On iPhone and iPad, Notify me when ready is optional for each video. If you allow notifications, the game sends Apple’s notification token for this app to the video service. That token identifies this app installation for delivery and is associated only with the requested video, not a game account or player profile. The service deletes it after delivery, a permanent delivery failure, a failed render, cancellation, deletion or expiry, and never keeps it beyond the request’s seven-day lifetime. A notification says the video is ready and contains a random request number to open it in your Library; it contains no replay, score, nickname or memo text. Apple delivers it under its own privacy policy. You can turn off notifications in your device’s Settings. The Android and desktop versions do not register for these push notifications; you can check a requested video in Replay Library.

Cloudflare sees your IP address to deliver the connection and limit floods of requests; my service does not store it or keep request logs. Cloudflare handles the connection under its own privacy policy.

Playing and watching online

Two players can share one screen, which involves no connection at all, or play on two devices through Interoffice. You choose how to connect.

Nearby. On supported devices, nearby offices can be discovered on your local network; the devices connect with no server in between. Apple devices can also use Apple's peer-to-peer Wi-Fi. While you have an office open, your device announces your nickname and a random install number to devices on the same network so a nearby player can find you. A direct line (typing the other device's address) works the same way, with no announcement.
Office code. Over the internet, the game goes through a small relay I run on Cloudflare (the beta relay at goose-pending-beta.vocti.workers.dev). The relay passes game messages between the two devices; it does not parse or store the game's binary messages or memo text. Those messages can include nicknames and installation numbers, so the relay can technically see those bytes. To let a dropped player rejoin, it keeps the room's code, the two nicknames, a scrambled (hashed) copy of each seat's rejoin key, a short rules version number and the times. The pair can use the same room across rounds. If either player disconnects, a fixed 10-minute recovery window begins; both returning cancels it. Expiry closes any remaining connections and deletes the room. Both players choosing Leave deletes it immediately. An office nobody joins expires 30 minutes after it is opened, even if its host is still connected. The host choosing Leave closes that empty office immediately. Cloudflare necessarily sees your IP address to deliver the connection. The relay uses it only for a moment to slow down floods of new rooms, keeps no request logs and does not store it. Cloudflare handles the connection itself under its own privacy policy.
Game Center (iPhone and iPad). If you sign in, you can invite a friend or ask Apple to find a competitive or co-op match. Automatic requests group players by game mode and compatible rules. The game uses your Game Center name and game-specific player identifier to connect the match; my server does not receive them. Apple handles its account, matching requests and connection under its Game Center privacy notice. Your device-local match profile is not sent to Apple.

Finding an online colleague

Office matching uses the same relay service, without a game account. A search sends your game mode and rules version, a coarse ability band and whether enough matches have been played to use it, and the time a request takes to reach the relay. Cloudflare supplies the connection's continent to prefer a closer region. The game also sends random tags, valid only for the current app session, to avoid immediately pairing the same players again.

Search details stay in memory and expire after 90 seconds; the cleanup alarm or next request removes expired searches, and a service restart loses them. Cancelling or completing a search ends their use for matching. The queue receives no nickname, account, installation identifier, precise location or past results. An automatic room uses generic Colleague labels and random reservation credentials; an unconfirmed reservation expires within the search window. Once both players connect, the room follows the ordinary expiry described above. The other player receives only a coarse ability hint, not your estimate or past results. Cloudflare sees the connection's IP address for delivery and request limits, but my service does not store it or keep request logs.

What the other player sees

The other device receives your nickname, a random install number made by the game the first time you play on two devices, the game's version and your operating system category (such as iOS, Android, macOS, Windows or Linux), and then the game itself: your moves and your board, so it can show your office beside theirs. The install number identifies this installation for reconnecting and blocking; it is not your hardware identifier or Apple Account, and deleting the game's local data removes it. Memos you send go to the other player. The game holds recent memos during the session so you can report them; the relay does not store memo text.

Watching an office

Anyone with an office code can choose Watch an office to view the two boards without taking a player seat. Watching uses a separate gameplay feed with generic office labels. It does not send the watcher player nicknames, installation numbers, private rejoin keys, memos, chat or player audio. The watcher cannot send messages or control the game.

The relay checks the feed against a fixed gameplay format and forwards it without storing board snapshots or moves. It keeps a numeric stream counter in the room and small connection acknowledgements while the watcher is connected, to recover from a player rejoining and disconnect a watcher that cannot keep up. These are not account or device identifiers. Watchers do not extend a room's recovery deadline; expiry or both players choosing Leave closes their connections too. Watching does not replace a saved local shift or award progress.

Memos, blocking and reports

Automatic matches use only the game's preset memos. Players cannot send or receive typed messages in those matches.
Free text from the other player is checked against a word list on your device, and listed words are blacked out before you see them.
Tap one of their memos to mute them for the rest of the game, to block them, which keeps a list of blocked install numbers on your device so they cannot join you again, or to report their memos.
You can report the other player's memos. A report goes to my server over the internet, for nearby games too, and holds: the most recent memos you received from them, as they sent them (at most 20 lines), their nickname, both players' install numbers, which seat each of you had, and the room code (or, for a nearby game, a code made from the two install numbers). It holds nothing else about you, and not your IP address. Reports are kept for 90 days so I can read them and act on them, then deleted automatically. To ask for a report about you to be deleted sooner, email me with your nickname and roughly when the game was played.

The Daily Memo

Each day there is one new Daily Memo map, the same for everyone. To get it, the game asks my server for that day's memo. On iPhone and iPad, the optional Daily Memo widget uses the app’s saved copy when it is current and may download the memo when WidgetKit refreshes it. iOS decides when widget refreshes run. The request is a plain download: it carries no identifier, account, cookie or anything about your games, and it sends nothing else. The server keeps no record of it and no request logs. Playing the memo needs no further contact. If today’s memo has already downloaded, you can play it offline; otherwise it is unavailable until a connection is restored.

Anonymous play reports

Play reports help me see where levels are too hard or too easy. If you agree, the game sends me a copy of each game over the internet when the game ends, and also when you leave a game early. A play report contains:

the level, the game mode and the random seed that set the level up;
for a random, Overtime or Map Office level, the level itself: the shape of its map and its waves. If you draw a map in the Map Office, the drawn layout is included, but never the name you gave it;
each move made and when: towers built, upgraded or sold, Red Tape lines, desk stamps, calling the next wave early, and the expedite, misfile, transfer, clock out and stay late moves;
when you changed the game speed and when you left a game early;
how the game ended: the result, waves reached, geese lost, stars and score;
the game's version number;
a broad device category (iPad, iPhone, Mac, Linux or other) and the main version of its operating system, such as 18;
a random code made fresh for each report, so a report that is sent twice is stored once.

A play report never contains your name, Apple Account, Game Center details, device or advertising identifiers, location, contacts, or anything you typed, such as the names of maps you make. Each report gets its own random code and each game its own random seed, so I have no way to tie one report to another or to you. The one thing two reports can share is a map layout you drew yourself, and that layout is not linked to you either.

Your choice

Play reports are off until you agree. The game asks once, in plain words, after your first finished level. This is the same across platforms and in test versions.
You can change your answer any time in Settings → Privacy and data → Play reports, where this page is also linked. Turning reports off deletes any that are still waiting to be sent, and nothing played while they are off is ever sent.
Debug builds that I run on a computer while making the game never send reports.

Where reports go and how long they are kept

Reports go to a small server I run on Cloudflare (a Worker at goose-pending.vocti.workers.dev, with R2 storage). The server checks that a report holds only the fields above, and stores that and nothing else: not your IP address, your device's name or any header your device sent. It keeps no request logs. An address is used only for a moment to slow down floods of reports, then forgotten. The storage records when each report arrived, and nothing else about the sender. As the network provider, Cloudflare handles the connection itself under its own privacy policy.

Reports are deleted automatically after 90 days. Because reports are anonymous and stored under their random codes, I cannot find the reports that came from you, so I cannot look yours up to delete early; this is also why they expire on their own. I use reports only to balance and fix the game; they are never sold, shared or used for advertising.

Apple services on iPhone and iPad

On iPhone and iPad, while signed in to Game Center, the game sends earned achievements and eligible scores to Apple's achievements and leaderboards, including Audit, Daily Memo, Quick Shift and lifetime geese-kept results. An open office can also appear as a joinable activity in Apple's Games app. Apple associates these features with your Game Center account. They are separate from the private match profile used by the anonymous matcher.

If you install the game through the App Store or TestFlight, Apple handles the download and, depending on your Apple settings, may share aggregate usage or crash information with developers. That is governed by Apple's own privacy policy. I do not receive personal information from it.

Children

Play reports are off unless someone agrees to them, and a parent can turn them off in Settings. Online matchmaking can connect players who do not know each other; automatic matches allow preset memos only. Games arranged with a friend, code or nearby device can allow typed memos, which are filtered on the device. Players can mute, block or report the other player. A report contains the nickname, install numbers and recent memos described above and is kept for 90 days. Game Center multiplayer also follows the restrictions Apple provides for the signed-in account.

Changes

Please Invade Later is still in development. If a future version changes any of this, I will update this page and the date above before that version is released.

Contact

Send questions about this policy to [email protected].

Please Invade Later privacy policy