Untitled Cube Rotator Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how Heapforge Ltd. (“Heapforge”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you play Untitled Cube Rotator (the “game”), whether you obtained it from Steam, Google Play or the Apple App Store, or when you otherwise contact us about it. It also explains the rights you have and how to exercise them.

The heapforge.com website is covered by a separate privacy policy.

1. Who we are

The data controller responsible for your personal data is:

• Heapforge Ltd., registered in England and Wales
• Company number: 17418393
• Registered office: 82A James Carter Road, Mildenhall, Bury St. Edmunds, Suffolk, England, IP28 7DE, United Kingdom

Privacy contact: privacy@heapforge.com

2. Scope

This policy applies to personal data processed through the game on every platform it is available on, as well as when you communicate with us. It does not apply to third-party websites or services that we link to, which have their own privacy policies.

The game uses features provided by Steam, Google Play, Google Play Games Services, the Apple App Store and Game Center. Those platforms process some of your data under their own terms and privacy policies, as described in section 5.3.

3. Personal data we collect

We try to collect only what we need. We do not operate any servers for the game, so most of the information below is handled on your device and exchanged only between the game and the platform you play on. Depending on how you interact with us and the game, this may include:

• Contact information - such as your name and email address, when you email us or otherwise get in touch.
• Communications - the content of messages you send us, including any attachments, and our replies.
• Gaming platform information - such as your platform account identifier, display name and avatar, friends list and online presence, achievements, leaderboard scores, cloud save data and the purchase status of your copy of the game. The game uses this information on your device to provide its features, and exchanges it only with the platform you play on (Steam, Google Play Games or Game Center). It is not sent to Heapforge.
• Technical and usage information - such as your IP address, browser type, device information, the pages you request, and the date and time of your visit, when you visit our website. This is processed automatically, mainly for security and to deliver the site to you. The game itself does not send technical or usage information to us.
• Account and transaction information - information needed to provide the game you have purchased (for example, purchase confirmations from the store). Purchases are handled by the store you buy from, and we do not directly collect or store full payment card details.
• Any other information you choose to provide to us.

We do not intentionally collect special category data (such as health, religious or biometric data). Please do not send us such information unless we have specifically asked for it.

4. How we use personal data and our lawful bases

Under the UK and EU GDPR, we must have a lawful basis for each use of your personal data.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can contact us for more information about this balancing.

We do not sell your personal data.

5. Third-party service providers

We use a number of trusted service providers to run our business. They process personal data on our behalf and under our instructions, and are bound by contractual obligations to protect it. Our main providers are listed below.

5.1 Cloudflare

We use services provided by Cloudflare, Inc. to host, deliver and protect our website, including this policy:

• Security and bot protection - Cloudflare screens traffic to our website to protect it against denial-of-service attacks, automated bots and other malicious activity. To do this, it analyses information such as IP addresses, browser and device characteristics and request details, and may set a strictly necessary security cookie.
• Website hosting - our website is served using Cloudflare’s hosting and edge computing services (Cloudflare Pages and Workers), which process web requests and other technical information in order to deliver pages to you.
• Content delivery - static files such as images, scripts and stylesheets are stored and delivered using Cloudflare’s storage and content delivery network (Cloudflare R2).

Cloudflare operates a global network, so your data may be processed in data centres close to your location, including outside the UK and EU. For more information, see Cloudflare’s Privacy Policy: https://www.cloudflare.com/privacypolicy/

5.2 Google Workspace

We use Google Workspace, provided by Google, as our email provider. When you email us, for example for support with the game, your message - including your name, email address, message content, attachments and related metadata - is received, stored and processed on Google’s systems. Google processes this data on our behalf under its business data processing terms and does not use Workspace customer data for advertising.

For more information, see Google’s Privacy Policy (https://policies.google.com/privacy) and Google Cloud Privacy Notice (https://cloud.google.com/terms/cloud-privacy-notice).

5.3 Gaming platforms

The game is distributed through, and integrates with, the gaming platforms listed below. They provide purchase verification, achievements, leaderboards, cloud saves and social features such as friends lists and online presence.

Unlike the providers above, these platforms are not our processors. Each one processes your data as an independent controller, under its own terms and privacy policy, in connection with the account you hold with it. The game talks to these platforms directly from your device; nothing passes through Heapforge.

5.3.1 Steam (Valve Corporation)

If you play the game on Steam, it uses the Steamworks platform provided by Valve Corporation for:

• Purchase verification - the game checks with Steam that your Steam account owns a licence for the game.
• Achievements and stats - your achievement progress is recorded against your Steam account and shown on your Steam profile.
• Leaderboards - your scores are submitted to Steam Leaderboards, where they are shown to other players alongside your Steam profile name and avatar.
• Steam Cloud - your save data may be stored in your Steam account so that it can be synchronised between your devices.
• Friends and presence - the game may show your Steam friends, display what you are doing in the game to them (“rich presence”), let you send and accept invites, and use the Steam overlay.

Valve processes your Steam account identifier, profile information and the data above under its own terms. For more information, see the Valve Privacy Policy: https://store.steampowered.com/privacy_agreement/

5.3.2 Google Play and Google Play Games Services

If you play the game on Android, it uses services provided by Google for:

• Purchase verification - the game uses Google Play Services and the Google Play Billing Library to confirm that your Google account is entitled to the game.
• Achievements and leaderboards - through Google Play Games Services, your achievements and scores are recorded against your Play Games profile and may be shown to other players together with your gamer name and avatar.
• Saved games - your save data may be stored in your Google account so that you can continue playing on another device.
• Friends and presence - the game may show players you follow or who follow you on Play Games, where you have allowed games to access that list.

In carrying out these services, Google processes data including your Google account identifier, your Play Games profile, the purchase token for your order, and information about your device and the installed app. For more information, see the Google Privacy Policy (https://policies.google.com/privacy) and the Google Play Terms of Service (https://play.google.com/intl/en/about/play-terms/).

5.3.3 Apple App Store and Game Center

If you play the game on an Apple device, it uses services provided by Apple for:

• Purchase verification - the game uses StoreKit and App Store receipt validation to confirm that your Apple Account is entitled to the game.
• Achievements and leaderboards - through Game Center, your achievements and scores are recorded against your Game Center profile. On leaderboards, other players can see your nickname, avatar and scores.
• Saved games - your save data may be stored in iCloud so that you can continue playing on your other Apple devices.
• Friends and presence - the game may show your Game Center friends and let you invite them to play.

Apple processes the associated account, purchase, Game Center and device information as described in the Apple Privacy Policy (https://www.apple.com/legal/privacy/) and Game Center & Privacy (https://www.apple.com/legal/privacy/data/en/game-center/).

5.3.4 What we can see

From Valve, Google and Apple, Heapforge receives only the aggregated, non-identifying sales and usage reporting that every developer sees in Steamworks, the Google Play Console and App Store Connect - for example unit counts, revenue, refunds, achievement completion rates, and broad country and device breakdowns. We do not receive, and cannot request, the identity of an individual purchaser.

Leaderboard entries are visible to us in the same way they are visible to any player, and through the platforms’ own moderation tools, which we use only to remove cheated, fraudulent or abusive entries. We cannot access the contents of your cloud saves or your friends list.

5.4 Other recipients

We may also share some personal data with:

• professional advisers such as accountants, lawyers and insurers, where necessary;
• law enforcement, regulators, courts or other authorities, where required by law or to protect our rights, users or the public;
• a buyer, successor or investor in connection with a merger, acquisition, restructuring or sale of all or part of our business, subject to appropriate confidentiality protections.

6. What the game does not do

The game contains:

• no analytics or usage telemetry sent to us or to any third-party service;
• no crash or diagnostic reporting sent to us or to any third-party service;
• no advertising, ad SDKs or advertising identifiers, and no tracking across other apps or websites;
• no Heapforge accounts or sign-in, and no Heapforge servers - all online features are provided by your gaming platform;
• no sale or sharing of personal data by Heapforge.

7. Store privacy disclosures

This policy is the privacy policy referenced by the game’s store listings on Steam, Google Play and the App Store. Our Google Play Data safety declaration and Apple App Store privacy labels reflect the processing described in this policy.

8. Cookies and similar technologies

The game does not use cookies.

On our website, we only use cookies and similar technologies that are strictly necessary for it to function securely, such as security cookies to distinguish genuine visitors from automated bots. These do not require your consent under UK and EU law, and we do not use them to track you across other websites.

If we introduce non-essential cookies (for example, for analytics or advertising), we will update this policy and, where required by law, ask for your consent before setting them.

9. International data transfers

We are based in the United Kingdom, and some of our service providers process data in other countries, including the United States.

Where personal data is transferred outside the UK or the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• transfers to countries recognised as providing an adequate level of protection (adequacy regulations/decisions);
• transfers to organisations certified under the EU-U.S. Data Privacy Framework and its UK Extension (the “UK-US data bridge”)
• Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum or UK International Data Transfer Agreement, where applicable.

Valve, Google and Apple may also transfer data internationally when providing their platform features. They do so under the safeguards described in their own privacy policies.

You can contact us for more information about the safeguards we use.

10. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting or reporting requirements. As a general guide:

• Email correspondence - kept for 24 months after our last contact, unless it relates to an ongoing matter or we need to keep it longer for legal reasons.
• Security and technical logs - kept for short periods only, as needed for security and troubleshooting.
• Business and transaction records - kept for as long as required by law (in the UK, typically up to six years after the end of the relevant financial year).
• Game data on your device - kept until you delete it, clear the game’s data or uninstall the game.
• Data held by gaming platforms - cloud saves, achievements, leaderboard scores and purchase records are kept by Valve, Google or Apple under their own policies. Heapforge does not hold a copy.

When data is no longer needed, we delete or anonymise it securely.

11. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include encryption in transit, access controls and choosing reputable providers with strong security practices. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.

12. Your rights (UK, EU, EEA and Switzerland)

If you are in the UK, EU, EEA or Switzerland, you have the following rights, subject to certain conditions and exceptions:

• Access - to request a copy of the personal data we hold about you.
• Rectification - to ask us to correct inaccurate or incomplete data.
• Erasure - to ask us to delete your data in certain circumstances.
• Restriction - to ask us to limit how we use your data in certain circumstances.
• Data portability - to receive data you provided to us in a structured, commonly used format, or have it transferred to another organisation.
• Objection - to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Withdraw consent - where we rely on consent, you may withdraw it at any time without affecting earlier processing.
• Not to be subject to solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, email us at privacy@heapforge.com. We will respond within one month, which may be extended by up to two further months for complex requests. We may need to verify your identity before responding. Exercising your rights is usually free of charge.

12.1 Data held by the gaming platforms

Because Valve, Google and Apple are independent controllers of the data they process for the game, requests about that data are best made to them directly:

• Steam - through Steam Support (https://help.steampowered.com/wizard/HelpAccountDataQuestion) or the contact details in the Valve Privacy Policy. You can control who sees your profile, game details and friends list in your Steam profile privacy settings.
• Google Play and Google Play Games - through Google’s privacy tools (https://myaccount.google.com/privacy). You can control your Play Games profile visibility and whether games can access your friends list in your Play Games profile settings (https://support.google.com/googleplay/answer/3129346).
• Apple App Store and Game Center - through Apple’s Data and Privacy portal (https://privacy.apple.com/). You can control your Game Center profile privacy, friend requests and nearby players, or sign out of Game Center, in your device’s Game Center settings.

You are still welcome to contact us, and we will help where we can.

13. Other countries

If you live in another country with privacy laws that give you rights over your personal data, please contact us and we will respond in accordance with the law that applies to you.

14. Children’s privacy

Our website and services are not directed at children under the minimal age for data processing consent, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

Each gaming platform applies its own age requirements and parental controls to its accounts and features, for example Steam’s minimum account age and Family View, Google Family Link, and Apple Screen Time and Family Sharing. Parents and guardians can use these controls to restrict purchases, friends, leaderboards and other social features in the game.

15. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Automated anti-cheat tools provided by the gaming platforms may flag or remove leaderboard scores that appear to be invalid; if you believe a score has been removed in error, please contact us.

16. Links to other websites

The game and our website may contain links to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

17. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last revised. If we make significant changes, we will take reasonable steps to let you know, for example by a notice on our website or in the game’s release notes.

18. Contact us and complaints

If you have any questions about this policy or how we handle your personal data, please contact us:

1. E-mail: privacy@heapforge.com
2. Post: Heapforge Ltd., 82A James Carter Road, Mildenhall, Bury St. Edmunds, Suffolk, England, IP28 7DE, United Kingdom

We would appreciate the chance to address your concerns first, but you have the right to complain to a data protection authority:

• United Kingdom: Information Commissioner’s Office (ICO) - https://ico.org.uk/make-a-complaint/
• EU/EEA: the supervisory authority in the country where you live, work or where the alleged infringement took place - a list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en
• Other regions: your local data protection or privacy regulator.

Complaints about Valve’s, Google’s or Apple’s own processing should be directed to them, though you may also complain to your supervisory authority about it.