Cyber Sleuth App Privacy Policy
Last updated: 11 October 2026
This policy covers the Cyber Sleuth mobile game for iOS and Android, published by NoordWell B.V. (Netherlands). It does not cover the noordwell.com shop — that is covered by our store privacy policy.
The short version: you sign in so your case file has somewhere to live. What you say on a call is turned into text, used to write the character's reply, and dropped when the call ends. The app records no audio, shows no adverts, carries no analytics or tracking, and we do not sell your data.
Your account
You sign in with Sign in with Apple (iPhone) or Google (iPhone and Android). From that, Firebase Authentication — our sign-in provider — holds your email address and the name Apple or Google shares with us. If you use Apple's "Hide My Email", we only ever see the relay address. The app shows the address in its menu so you can tell which account you are on. The game itself never reads your name or email: every case file is filed under a random account identifier, and that identifier is all our game server uses.
We never see or store a password.
Your case file
Each case you open is stored in Google Cloud Firestore under your account identifier, so it survives reinstalling the app and follows you to another phone: the custody clock, who you have called and how often, the evidence you hold, the notebook of what the characters told you, and any charge you filed. Only you can read it. Our security rules allow reads only where the account identifier matches the signed-in account, and the engine's working notes on a case are not readable from the app at all.
What you say on a call
- Your voice stays with your phone's speech recognition. When you hold the mic, the app passes the sound to your phone's built-in speech recognition and receives text back. It never records audio, never saves it and never sends it to us. On iPhone, recognition runs on the device wherever your language supports it; where it does not, Apple's speech service processes it under Apple's privacy policy. On Android, the phone's speech recognition service (usually Google's) handles it under its own policy.
- The text of your questions, spoken or typed, is sent to our game server and kept with the call while it is open, alongside the character's replies. When the call ends — you hang up, the character does, or their counsel picks up — the transcript is deleted. What stays in your case file is the notebook: the claims the characters made, not your questions.
- How the characters reply. The characters are performed by Google's Gemini models on Vertex AI. To write a reply, the call's transcript (your questions and the character's answers so far) is sent to Gemini together with the case material. No account identifier, name or email goes with it. Google processes it as our service provider under the Google Cloud data processing terms, and does not use it to train its models.
- Their voices. The characters' lines are turned into speech by ElevenLabs, as our service provider. Only the characters' lines are sent to it — never your questions, your account identifier or anything else about you. Because a character's line is written live, it can repeat something you said.
Reporting a line
The characters' replies are written live, so one can come out wrong. Hold a character's line during a call and choose REPORT THIS LINE, and we receive: that line, the question you asked just before it (if the call is still open), which case file and call it came from, and your account identifier. We use reports only to review what the character said and to improve how the characters behave. Deleting your account deletes your reports.
What we do not do
- No adverts, and no ad SDK.
- No analytics, crash-reporting or session-recording SDK.
- No tracking: nothing reads your device's advertising identifier, and there is no tracking prompt on iPhone.
- No selling or sharing of personal data.
- No in-app purchases. Case 001 is free.
Server logs
Our game server keeps operational logs in Google Cloud Logging: which case file and character a request was for, how long each step took, and errors. They do not record what you say. In the rare case that the referee model returns something our server cannot read, the error it logs can include a fragment of that model's output, which may quote a question. Cloud Logging deletes these logs after 30 days. When you delete your account, the log notes your account identifier and how many case files were removed.
Deleting your account and data
In the app: open the menu (☰, top-left), then DELETE ACCOUNT, then confirm.
That permanently erases, with no recovery:
- every case file on the account, including any call left open;
- any lines you reported;
- your sign-in record in Firebase Authentication, with the email address and name it held.
We keep one record: a note that the account identifier was closed and when, so that a request still in flight from another phone cannot reopen a case on the deleted account. It holds nothing else. Your phone keeps a short list of which evidence you have already looked at until you delete the app.
If you would rather we did it, or no longer have the app, email info@noordwell.com from the address on the account and we will delete it within 30 days. See also Delete your Cyber Sleuth account.
Where your data is held, and for how long
Case files and the game server are in Google Cloud's London region (europe-west2). Firebase Authentication may hold your sign-in record, and Gemini on Vertex AI and ElevenLabs may process call text, outside the European Economic Area; those transfers rely on the European Commission's Standard Contractual Clauses in our agreements with Google and ElevenLabs.
Case files and reports are kept for as long as your account exists. Call transcripts are kept only while the call is open.
Your rights
If you are in the EEA or the UK, you have the right to access, correct, export or erase your personal data, to restrict or object to processing, and to complain to a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens. Our legal basis is performance of a contract: everything above is what it takes to run the game you asked to play. Email us to exercise any of these rights.
Similar rights apply under California and other US state privacy laws. We do not sell or share personal information.
Children
Cyber Sleuth is a murder mystery written for teenagers and adults. It is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has given us data, email us and we will remove it.
Changes
If we change this policy in a way that materially affects you, we will say so on this page before the change takes effect. The date at the top always shows the current version.
Contact
NoordWell B.V.
Email: info@noordwell.com
Support (WhatsApp): +31 20 214 6660