Curve2gether — Privacy Policy
Last updated: 2026-09-03 · Applies to: Curve2gether for Android and iOS, the browser version at app.curve2gether.com, and this website
The short version
Curve2gether does not ask who you are and has no way of finding out. There is no account, no sign-in, and nothing to type. It does not contain advertising, analytics that follow you between apps, or any third-party tracking.
To play online it needs a network connection and a way to tell one player from another. That is all it uses.
Since the hall of fame was added, the server keeps a little more than it used to: a generated name, and how long your rounds lasted. Both are described below, and there is a button in the app that deletes them.
The website and the browser version
www.curve2gether.com and app.curve2gether.com load nothing from anybody else. No fonts from a font service, no scripts from a CDN, no analytics, no embedded video player, no social buttons, no cookie banner — because there are no cookies to warn you about. Everything either page needs is served from these domains, on the same server described below.
There is no cookie set by either site, and no visitor is counted or profiled.
The browser version of the game is the same game, and everything in the rest of this policy applies to it. Where the sections below say "on your device", the browser stores it in that browser's own storage for this site instead: clearing site data for app.curve2gether.com has the same effect as uninstalling the app, including generating a new identifier the next time you play. Nothing is copied between the browser version and an installed app; they are separate installs and get separate identifiers.
What the app stores on your device
| Data | Why | How long |
|---|---|---|
| Your settings — steering, theme, sound, language, quality | So the game is how you left it | Until you change them or uninstall |
| A random identifier generated on first launch | So a dropped connection can rejoin the match you were in, and so your results are yours | Until you uninstall, or you tap Delete my data |
| Your best survival times against each AI level, and today's daily round | So the game remembers what you managed | Until you uninstall, or you tap Delete my data |
| The two numbers that make up your generated name | So the app can show who you are before it connects | Until you uninstall, or you tap Delete my data |
The identifier is a random number created on your device. It is not derived from your hardware, your phone number, your advertising ID or anything else about you or your device. It is never shown to other players, and it is not used to build a profile.
Neither of these is included in device backups or transferred to a new phone, by design: restoring the identifier onto a second device would give two installs the same identity and they would compete for one seat in a match. Reinstalling gives you a new one, which is what you want — it is not an account.
What the server receives when you play online
While you are connected to a match, the server holds:
- the random identifier described above, so you can rejoin if your connection drops
- your IP address, unavoidably, because that is how internet connections work
- your steering input and your position in the match, for the length of the match
Your IP address and your steering are discarded when the match ends. Neither is written to the database.
### What the server keeps between sessions
For the hall of fame, and only for it:
| Data | Why |
|---|---|
| The random identifier from your device | So your results are yours and nobody else's |
| A generated name, stored as two numbers | So the board has something to call you |
| Per round: how long you survived, whether you won it, whether you won the match, how many people were in it, and the week it happened in | So there is a board at all |
That is the whole of it. No IP address, no device model, no timestamps beyond the round's own week, and nothing you typed — because there is nothing you can type.
The name is drawn, not entered. The server picks one adjective and one noun from a fixed list of 128 each and stores the two positions in that list. The app renders the name from its own copy of the same list, so a name never travels as text and nobody — including you — writes one. New name in the app draws a different pair.
Server access logs, which include IP addresses, are rotated after 7 days and are not part of the database above. Requests to the website and to the browser version reach the same server and the same logs.
What the app does not do
- No display names you write, no chat, no messages, no user profiles. There is nothing you can type that another player can see. The generated name is not an exception: you cannot author it, only ask for a different draw.
- No advertising, and no advertising identifier is read.
- No analytics SDK, no attribution SDK, no social login. Crash reporting is the one thing that leaves the device besides gameplay, and it is described above.
- No location, contacts, photos, microphone, camera or files. The browser version asks for none of these either, and the page tells your browser to refuse them on its behalf.
- No tracking across apps or websites. Nothing that would trigger an App Tracking Transparency prompt on iOS.
- Nothing is sold or shared with anyone.
The Android build requests exactly one permission, INTERNET. The iOS build requests none. The browser version asks for no permission at all.
Crash reports
Builds from the store use Sentry (Functional Software, Inc.) to report crashes. When the app crashes it sends the stack trace, the app version, the operating system version and the device model.
It does not send your IP address, your settings, the random identifier, a screenshot, or a record of what you did in the app before the crash. Those are switched off explicitly rather than left at their defaults, and the identifier is stripped a second time on the way out — it exists so a dropped connection can rejoin a match, and attaching it to a crash report would tie it to a device's history, which is not what this policy describes.
Crash reporting is compiled in only when a build is configured for it. A build made from the published source code reports nothing at all, and the browser version is built without it — it sends no crash reports to anyone.
Children
Curve2gether is not directed at children and is not distributed in a children's category. Because it collects nothing that identifies anybody, there is no personal data of a child for it to hold.
Your rights
Under the GDPR you have the right to access, correct, delete and export your personal data, and to object to its processing.
Deletion is a button. You → Delete my data in the app removes your identifier, your generated name and every round result from the server, and clears your records from your device at the same time. It takes effect immediately and cannot be undone. Nothing is left behind: the results are removed with the identity rather than orphaned.
Correction is the same button, or New name if it is only the name you want changed.
Access and export: what is held is exactly the table above, and the app shows you all of it — your name, your records, and your rows on the board. There is nothing further to disclose.
Uninstalling the app removes everything held on your device, including the identifier. It does not by itself remove the server-side rows, because after uninstalling there is no longer a device to prove they were yours — so if that matters to you, use Delete my data first, or write to the contact below.
We answer within 30 days.
Where the data is processed
The game server runs in the European Union, at a provider with which a data processing agreement is in place. Playing from outside the EU means your connection reaches an EU server. The database described above lives on that same server and is not copied anywhere else, apart from backups held on the same host.
Changes
Material changes will be noted here with a new date, and in the app's release notes.
Contact
Data controller:
Beserved Software GmbH
St. Marien 21, 4502 St. Marien, Austria
Commercial register: FN 670196h, Landesgericht Linz · VAT ID: ATU82913304
Managing directors: Stefan Ritt, Micha Taitl
Email: office@beserved-software.com
This is the registered address of the company, which is what the GDPR asks for and what both stores check.