Privacy Policy

Last updated 10 September 2026

Questions about anything on this page go to support@raylight-voyagertracking.com. A person reads that mailbox; see Support.

1. Who we are §

Octant (the “app”) is made by Raylight Limited Liability Company, a limited liability company formed in California, United States (“Raylight”, “we”, “us”). Our address is 6296 Magnolia Ave, Riverside, CA 92506, United States. For anything about privacy, write to support@raylight-voyagertracking.com.

For people in the European Economic Area and the United Kingdom, Raylight is the “controller” of the small amount of personal data described below.

This policy covers the Octant app on iOS and Android and this website. It does not cover Voyager, our shipment-tracking product, which is a separate service with its own terms.

2. The short version §

• There is no account. You never give us your name, email address or a password to play. Nothing in the app identifies you.
• There are no ads, no analytics, no tracking, no advertising identifiers and no cookies in the app.
• Your results, streak and hints are stored on your device. We never receive them.
• The app makes no network requests at all. It works with the network switched off. One puzzle, Tell, would need a server; it is deliberately held out of the app until that server exists, and §4 says exactly what will happen when it ships.
• If you buy something in the app, Apple or Google takes the payment and knows who you are. We do not. A service called RevenueCat checks the purchase for us using an anonymous ID.
• The app is for a general audience and is not directed to children under 13. We do not knowingly collect personal information from anyone.
• Because we do not track you, the app will never show you Apple's tracking permission prompt.

The rest of this policy is the detail behind those sentences.

3. What the app stores on your device (and never sends to us) §

The app keeps its state in your device's local app storage — on this website, your browser's local storage — under the key prefix hub.v1.. We cannot read this storage. It exists only so the app works. It contains:

• Your results. For each puzzle and each day: a score, a short label, the share text, and how many hints you used. Some puzzles keep a little more so they can show you what you did — Crease, for example, keeps your fold count, the par, the paper-left steps, the list of folds you made and a compression figure derived from them.
• Days played. A list of day numbers you played on, used to show your streak.
• Your hint wallet. How many purchased hints you have left, the day you last used the free daily hint, and how many hints you used on each puzzle each day.
• Today's scratch. Per-puzzle working state for the current day — a half-finished board, a hint you have already paid for — so a reload does not cost you anything. It is replaced when the day rolls over.

None of this identifies you to us, and none of it reaches us. It is deleted when you delete the app or clear its data — see §15 for exactly how.

Two honest caveats:

1. Your phone's own backup service (iCloud Backup, Google backup) may include this app data under your Apple or Google account. We have no access to those backups.
2. Mobile operating systems can clear an app's web storage when a device runs very low on space, and browsers can clear a website's local storage on their own schedule. If that happens, results and any unused hints stored there go with it. We cannot restore them because we never had a copy — but see Terms §5.5 for what we will do about purchased hints.

4. What the app sends over the internet §

Today: nothing. The build of Octant that goes to the stores makes no network requests while you play. Boards are generated on your device from the day's number. The fonts are bundled inside the app as data rather than fetched. There is no analytics call, no crash reporter, no ad request, no font request, no “check for content” ping. The app runs identically with the network switched off, and you can verify that by turning it off.

4.1 What will change when Tell ships

One puzzle is written but not shipping. In Tell you can see the day's word and a language model — the “machine” — cannot; you write the shortest clue that makes it guess. That needs a server. Until we run one, Tell is held out of the app build entirely. It is not in the app you can install today, and nothing about it sends anything anywhere.

We are describing it here anyway, because it is the only thing that would change this section and we would rather you read it now than be surprised later. When Tell ships:

• What would be sent. The clue you type — lowercase letters and spaces, at most four words and 40 characters — and how many guesses to send back. Nothing else from your device: no name, no email, no device identifier, no advertising ID, no cookie, no login. Not the day number, not your score, not your streak, not your other results, not your hint wallet. As with any internet request, your device would also transmit its IP address, a user-agent string and the time.
• What would happen to it. The clue would be checked, ranked by a model running inside our own container, and discarded. It would not be written to a log and not stored. The result is a game score, not a decision about you.
• The “Shelf” hint would send one more request, carrying the day's target word — the word the game is already showing you — and not your clue.
• Our hosting provider would keep ordinary HTTP access logs (IP address, path, status, time, user-agent — not the clue, which travels in the request body) for a period fixed by our plan. We will state that period here before Tell ships.

We will publish an updated version of this policy, and update both stores' privacy declarations, before Tell appears in the app — not after.

5. Purchases in the apps §

Octant is not on the App Store or Google Play yet, so nothing described here is on sale today, and the app as it stands makes no purchase-related network call of any kind. This section sets out how purchases will work when it ships, so the arrangement is on the record before the first sale rather than after it.

Apple and Google are the sellers. Hint packs and the Octant Plus subscription are bought through the App Store or Google Play. Apple or Google takes the payment, issues the receipt, and handles refunds under its own terms and privacy policy. They are the merchant of record for those sales. We never receive your name, email address, postal address or payment details from a store purchase. To see or delete what Apple or Google holds about your purchases, use their own tools: Apple at privacy.apple.com, Google at myaccount.google.com.

RevenueCat checks purchases for us. We use RevenueCat, Inc. (USA) as a processor to confirm with Apple or Google that a purchase is genuine and to credit the right thing. RevenueCat receives from the app:

• the purchase receipt or purchase token, what was bought, and when;
• an anonymous app user ID generated on your device — a random string, not linked to your name or email;
• your device type, operating system version and app version;
• the time the app last contacted it, and an approximate country.

We do not send RevenueCat your name, email address, advertising identifier (IDFA or GAID) or any custom identifier, and we have not turned on any of its integrations with analytics or advertising companies. RevenueCat stores this data in the United States. We see aggregate purchase statistics in its dashboard.

Hints live on your device. Purchased hints are credited to the wallet on the device you bought them on (see §3). We do not keep a copy of your balance. If you lose it — a reinstall, a new phone, cleared data — write to support@raylight-voyagertracking.com with your store receipt or order ID and we will look the purchase up and help.

Deleting purchase records. To have the RevenueCat record of your purchases deleted, write to us with your store receipt or order ID. Deleting the app does not delete it, because RevenueCat holds it, not your device.

6. Purchases on this website §

The web version of Octant is not published yet. When it is, and when anything is sold on it, this is how it works — and this section is here now so the arrangement is on the record before the first sale rather than after it.

On the website, Raylight is the seller — not Apple, not Google. Payment is processed by Stripe, Inc. (USA) on Stripe's own hosted checkout page. Stripe collects your email address and card details on its own pages under its own privacy policy. We never see your card number. After a successful payment, Stripe tells us the payment ID, what was bought, the amount and your email address. We keep that record for seven years, because tax and refund rules require it, and then delete it. We use your email address only to send the receipt and to answer refund or restore requests. Never for marketing.

Stripe's checkout page sets cookies on Stripe's own domain, described in Stripe's cookie policy. Our game page sets none, and Stripe's script would be loaded only on the purchase step, never while you are playing.

Anything bought on the website is stored in that browser and is separate from anything bought in the app.

7. Things that send nothing §

• Fonts. The app's fonts are bundled inside it as data, under the SIL Open Font License 1.1. The app never loads fonts, scripts, images or anything else from Google Fonts or any other third-party server. This website does the same thing, with your device's own system fonts.
• Notifications. The app uses no push notifications. No push token is created and nothing is registered with Apple's or Google's notification services.
• Sharing a result. When you copy or share your result, the text goes only where you choose to send it. We do not see it and we do not see who you send it to.
• Backups. See §3 — your own device backup may include app data. We cannot access it.

8. Age signals from the app stores §

In some places — currently certain US states — the law requires app stores to be able to tell an app the age category of the account holder and whether a parent has given consent. Octant does not currently request or use such a signal. If we ever do:

• we would use it only to apply a legally required restriction;
• we would not keep it beyond the current session;
• we would not use it for anything else, and never for advertising or profiling.

Octant has no age-restricted content or features, so in practice there is nothing for such a signal to restrict.

9. Children §

Octant is a general-audience puzzle app. It is not directed to children under 13. It contains no ads, no chat and no accounts, and it does not ask for a birthday. We do not knowingly collect personal information from any user, including children.

Children are welcome to play — the app is rated for all ages. “Not directed to children” is a legal description of who the app is made for, not a rule about who may use it. We do not use an age gate, because asking for a birthday would collect more information about you, not less.

Because we hold no profile of anyone, the protections that matter most for children are already the default for every player: we do not profile you, we do not use your data to advertise to you, we show no behavioural advertising of any kind, and we use no nudges, countdowns or streak-loss warnings to push you towards a purchase.

We do not rely on consent as a legal basis for anything (see §11), so the question of a child's age of digital consent — 13 to 16 depending on the country — does not arise for us.

If you are a parent or guardian and believe we hold personal information about your child, write to support@raylight-voyagertracking.com and we will delete it. If a message to us shows that a particular player is under 13, we delete anything we hold that is tied to them and reply to say we have.

10. Cookies and similar technologies §

The app uses no cookies. This website sets no cookies and loads no third-party scripts — there is no analytics tag, no tag manager, no embedded font, no CDN. The web version of the game will use your browser's local storage only for the items in §3, which are strictly necessary to run the game you opened.

That is why you are not looking at a cookie banner: there is nothing to consent to. The one exception, when web purchases go live, is Stripe's own checkout page, described in §6.

11. Legal bases and purposes (EEA, UK and similar laws) §

Three things this table does not contain, deliberately:

• We never rely on consent. So there is nothing for you to withdraw, and no consent banner.
• We do not process special categories of data (health, beliefs, biometrics and so on) and never ask for them.
• We make no automated decisions with legal or similarly significant effects, and we do not profile you.

You are not required by any law or contract to give us data. Everything we hold comes from you or from a purchase you made — we buy no data and receive none from data brokers.

12. Who receives data, and international transfers §

We are a US company and our service providers are in the United States, so the limited data described above is transferred to the US from the EEA, the UK and Switzerland.

We share nothing with advertisers, data brokers or analytics companies, and we do not sell personal information.

We may disclose data if the law requires it — for example to answer a valid legal request — and we would tell you unless we are prohibited from doing so. You can ask us for a copy of the relevant transfer safeguards.

13. How long we keep things §

14. Security §

The strongest security property this app has is that it barely handles anything. It has no account to break into, no server holding your play history, and — today — no network connection at all. There is no database of players because there are no players on record.

The app contains no API keys, passwords or other secrets. Anything embedded in software that ships to phones is readable by anyone who wants to read it, so we design as though it is public, and it is.

When the app does start making requests (see §4.1), they will go over TLS to an https:// address only. Our build refuses to produce a release that contains a plain http:// address at all, and we ask for no exception to iOS App Transport Security or Android's cleartext block.

Our practice is to require two-factor authentication on every administrative account this app depends on — the developer store accounts, the payment dashboards and the code repository — and to turn it on as each account is created.

No system is perfectly secure. If we ever learn of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires.

15. How to delete your data §

Everything the app knows about you is on your device, so deleting it is entirely in your hands and needs no request to us.

On iPhone or iPad. Settings → General → iPhone Storage → Octant → Delete App. Or press and hold the app icon → Remove App → Delete App. This deletes your results, streak and hint balance permanently.

On Android. To clear the data but keep the app: Settings → Apps → Daily Yard → Storage & cache → Clear storage. To remove everything: Settings → Apps → Octant → Uninstall.

On the website.

• Safari on iPhone or iPad: Settings → Apps → Safari → Advanced → Website Data → find our site → swipe left to delete.
• Safari on Mac: Safari → Settings → Privacy → Manage Website Data → select our site → Remove.
• Chrome: click the icon at the left of the address bar → Cookies and site data → Manage on-device site data → delete our entry.
• Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data → select our site → Remove.

(Menu names move between operating-system versions. If yours differs, search your settings for “storage” or “site data”.)

Purchase records held by RevenueCat are not on your device. Email us with your store receipt or order ID and we will delete the record.

Purchase records held by Apple or Google belong to them, not to us. Use privacy.apple.com or myaccount.google.com.

16. Your rights §

If you are in the EEA, the UK, or another place with similar laws, you have all of these rights:

• Access — to be told whether we hold personal data about you and to get a copy of it (Art. 15).
• Rectification — to have anything inaccurate corrected or completed (Art. 16).
• Erasure — to have it deleted, the “right to be forgotten” (Art. 17).
• Restriction — to have us stop using it while a dispute about it is sorted out (Art. 18).
• Portability — to receive it in a common, machine-readable format and to have it sent to someone else where that is technically possible (Art. 20).
• Objection — to object to any processing we base on our legitimate interests (Art. 21). We do no direct marketing, so there is no marketing to object to.
• Not to be subject to automated decisions that have a legal or similarly significant effect on you (Art. 22). We make none — see §11.
• To complain to a supervisory authority, and to a judicial remedy.

We never rely on consent for anything (§11), so there is no consent for you to withdraw.

Email support@raylight-voyagertracking.com to use any of these. We answer within one month — extendable by two further months where the law allows for complex or numerous requests, and we will tell you if we extend — and free of charge. We will not refuse a request or charge for it unless it is manifestly unfounded or excessive, and we would explain why.

A practical note, and it is the honest one. Because there are no accounts, we usually cannot tell which data, if any, relates to you — in most cases the answer is that we hold nothing at all. The only lasting record is a purchase record, and the way to let us find it is to send us the store receipt or order ID for the purchase. We will not ask you for more personal information than we need to handle a request. If you cannot give us anything that lets us identify your data, the law recognises that position too (GDPR Art. 11(2) and Art. 12(2)): we are not required to collect extra information about you just to find a record, and we will tell you plainly that we hold nothing. If we genuinely hold nothing about you, that is itself the answer to the request.

You also have the right to complain to a supervisory authority: in the EEA, the authority of the country where you live; in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to answer your concern first.

17. Notices for United States residents §

California (CalOPPA). This policy lists the categories of information we collect (§3–§6), the third parties we share it with (§12), how you can review or request changes to it (§16), how we notify you of changes (§20), and its effective date. We do not respond to browser “Do Not Track” or Global Privacy Control signals, because we do not track users across sites or apps and do not sell or share personal information. There is nothing for such a signal to switch off.

CCPA/CPRA. Raylight Limited Liability Company is not currently a “business” under the California Consumer Privacy Act. Our annual revenue is far below the statutory threshold; we do not buy, sell or share the personal information of 100,000 or more California consumers or households; and we derive no revenue from selling or sharing personal information. We nevertheless honour the substance of the rights in §16 for everyone. We do not sell or share personal information, do not use sensitive personal information, and have not done either in the preceding 12 months. Under California's “Shine the Light” law: we disclose no personal information to third parties for their direct marketing.

Comprehensive state privacy laws (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and similar). We do not sell personal data, do not use it for targeted advertising, and do not profile you. Raylight Limited Liability Company is below the thresholds at which those laws apply to a business. If that changes, we will update this policy and say so. The rights those laws give — to know, to correct, to delete, to opt out — we honour for anyone who asks, on the same terms as §16, and we do not discriminate against anyone for asking.

Nevada. We do not sell personal information as Nevada law defines it, so there is nothing to opt out of. You may still write to us.

Delaware, Oregon and other states with online privacy notice laws. Those laws require a notice of this kind, and this document is it. They apply because residents of those states use the app, not because of where the company is formed.

Age signals (Texas, Utah, Louisiana, California and others). See §8.

18. What we do not collect §

To be explicit, the app does not collect or access:

• your name, phone number, or email address — except the email address Stripe would pass us for a website purchase, §6;
• your precise or coarse location;
• your contacts, photos, camera, microphone or files;
• the advertising identifier (IDFA or GAID), or any device fingerprint;
• usage analytics or crash reports;
• your browsing history;
• health, financial or biometric data.

There is no tracking within the meaning of Apple's App Tracking Transparency framework, so the app will never show you a tracking permission prompt. If we ever add an analytics, advertising or crash-reporting tool, this policy, both stores' privacy forms and the app's privacy manifest all have to be redone first — and we would tell you before the change took effect.

19. The 💡 mark §

Any result that used a hint is marked 💡 with the number of hints used, in the app and in the share text. This is a game-integrity feature, not personal data. It is computed on your device from your own hint wallet and is shown only to you and to anyone you choose to share your result with.

20. Changes to this policy §

When we change this policy we publish the new version on this site with a new “last updated” date, and the app links to the current version.

If a change matters to you — for example if Tell ships, if we ever start storing clues, or if we add accounts or leaderboards — we will say so in the app before the change takes effect. Where the law requires it, we will also notify the app stores of the change, so that they can re-obtain any parental consent that applies. We keep a dated record of versions and earlier ones are available on request.

21. Which law governs this policy §

This policy is governed by the law of the State of California, United States — the same state named in the Terms.

What that choice means, in one line: it decides which state's law is used to read this document. It does not take away the data-protection or consumer rights the law of your own country gives you, and for people in the EEA and the UK those rights apply in full regardless.

22. Contact §

Raylight Limited Liability Company
6296 Magnolia Ave, Riverside, CA 92506, United States
support@raylight-voyagertracking.com