Who we are and what this policy covers
Cipher Streaks is provided by ALKA INNOVATIONS INC. (“we”, “us” or “our”). This policy covers the Cipher Streaks mobile app, its hosted learning interface, its website and its connected learning services. It does not describe every other app or product published by ALKA Innovations.
The public information pages do not require an account. The learning app creates an account identifier to associate progress with your profile, even when you start without entering an email address.
For privacy questions or requests concerning access, correction or deletion, email info@alkainnovations.ca with the subject “Cipher Streaks privacy request”.
Account and learning information
We process information used to provide your profile and learning experience, including:
- An account identifier, your chosen callsign, learning preferences and saved time zone.
- Lesson completions, recorded attempts and hints, XP, streaks, badges and practice dates used to save progress and calculate rewards.
- Daily Cipher command drafts, submitted commands, results and completion records used to resume and evaluate the daily challenge.
- An email address if you choose email linking or recovery, and identifiers from Apple or Google if you choose an available provider sign-in option.
- Authentication sessions, device credentials and temporary verification information used to recognize your session and protect account access.
Linking an available recovery method lets you return to the same profile. Email linking uses verification codes; Apple and Google sign-in use the respective provider’s authorization process. Availability depends on the enabled options.
Your callsign and practice commands
Leaderboard entries can show your callsign, weekly XP, rank and an account identifier to other users. Choose a callsign you are comfortable making public. It does not need to be your real name.
The practice terminal is a simulation. Lesson commands do not execute on your device or scan real networks. Online exercises may send commands to our service for evaluation and saving. Do not paste passwords, access tokens, private files or other sensitive information into an exercise.
Purchases and course access
When purchases are available, Apple or Google processes purchases made through its store. RevenueCat helps associate store purchases with an app-specific identifier, verify access and restore purchases. Our service stores course-access status and relevant expiry information.
We do not receive your full payment-card details from these store purchases. The store and RevenueCat process purchase and transaction information needed for their functions. Restoring a purchase and recovering your learning profile are separate processes.
Optional practice reminders
When supported reminders are enabled and you allow notifications, Firebase Cloud Messaging processes a push token and installation information. Our service associates registration and notification preferences with your account, including language, platform, reminder time and the activity information used to decide whether a reminder is due.
You can change reminder preferences in the app where available and manage notification permission in your device settings. Delivery depends on the enabled service, an eligible registered device and operating-system behavior.
Analytics and technical information
Where app analytics is enabled, PostHog processes account identifiers, page visits, device and browser information, and interaction events to help us understand usage and improve Cipher Streaks. Depending on the active recording settings, it may also process session replay, a reconstruction of how the app interface is used.
Replay is configured to mask input fields and selected areas containing terminal commands, profile identity and account details. The integration also excludes request and response bodies and headers from replay. Analytics can still be associated with your account identifier; masking does not make analytics fully anonymous.
Analytics may use cookies or local storage to distinguish sessions or installations. Clearing local data can reset stored identifiers but does not erase information already received. Contact us about analytics information or a privacy request.
Connecting to our services exposes network information, such as an IP address, to the services handling the request. We and our hosting providers use request and technical information to deliver the service, investigate faults, maintain security and prevent abuse.
Cookies and information on your device
The app uses authentication cookies, browser storage and native secure storage where available to maintain sessions, remember preferences, save local progress and resume lessons. Preferences can include language, onboarding and sound settings. Analytics may use its own identifiers when enabled.
Clearing browser storage or uninstalling the app can remove local information and affect account recovery, especially if you have not linked a recovery method. Operating-system backup and restoration behavior can vary.
Clearing local data does not delete your server account, synced progress, purchase records, analytics or correspondence held by us or our providers. Use the account-deletion request instructions to contact us about server-held information.
How information is used and processed
We use the information described here to deliver lessons, maintain accounts and progress, verify course access, provide requested reminders and account messages, respond to support, protect the service and understand its use.
Depending on the features you use and those enabled in the app, providers include:
- Apple and Google for store purchases and available sign-in options.
- RevenueCat for purchase verification, course access and restoration.
- Firebase Cloud Messaging for supported push notifications.
- SendGrid for account verification and recovery email.
- PostHog for enabled analytics and session replay.
- Hosting and communications providers for operating the service and handling support correspondence.
These providers receive information needed for their functions. If you contact us, we receive your email address, message and any attachments you choose to send, and use them to handle your enquiry. External reference websites and app stores have their own privacy practices.
Information may also be disclosed when needed to meet a legal obligation, protect rights or service security, or handle a business reorganization subject to applicable privacy requirements. Providers may process information outside Canada or your country, where privacy rules can differ.
Retention and deletion
Account and learning records are retained while needed to maintain your profile and provide the service. Retention for authentication, notification, analytics, technical and support records depends on their purpose, service settings, security needs and applicable legal obligations. There is no single retention period covering every record and provider.
You can request deletion of your account and associated information by following the account-deletion instructions or emailing info@alkainnovations.ca. We may need to verify ownership before acting.
Some records may need to be retained for legal obligations, accounting, security, fraud prevention or resolving a dispute. We will explain relevant limits when responding to a request. Where backups exist, removal from active systems may not immediately remove backup copies. Independent app-store records follow the store’s retention processes.
The current in-app Delete account control removes the profile and local data from that device and signs it out; a synced account remains recoverable. It does not submit a request to delete your server account. Account-deletion requests also do not automatically cancel a store subscription. Manage any active subscription through the store separately.
Your choices and privacy requests
You can choose whether to link an available recovery method, change reminder preferences and notification permission, or stop using the app. You can ask us about access, correction, deletion or other privacy choices by emailing info@alkainnovations.ca.
For an account-deletion request, use the subject “Cipher Streaks account deletion request”. Include your callsign and the recovery method you used, and write from a linked email address if possible. If no email is linked, explain that so we can identify appropriate verification steps. Do not send passwords, sign-in codes, authentication tokens or full payment-card details.
Email links open a draft in your mail application. You must send the message to submit the request. We review requests by email and may ask for proportionate information to confirm your identity or authority before disclosing or changing records. A callsign alone may not establish ownership. We will explain if information cannot be identified or removed and any relevant limitation.
Depending on applicable law, you may also have rights to withdraw consent, object to or restrict processing, receive a copy of information or complain to a privacy authority. Contact us to exercise a right or raise a concern.
Security and children
The app uses protected device credentials and signed, expiring authentication sessions. Use official HTTPS addresses, keep your device secure and do not send sign-in codes or credentials to support. No online service can guarantee absolute security.
Cipher Streaks provides educational command-line practice. Parents or guardians can contact us about a child’s use of the service or information associated with a child so that we can review the concern.
Policy updates and contact
We may update this policy as the service changes. The date above identifies the current version. Where a change requires additional notice or consent under applicable law, we will provide that notice or seek consent.
Privacy enquiries: ALKA INNOVATIONS INC.
info@alkainnovations.ca
For help using the app, visit Cipher Streaks Support.