Scope of this policy
This policy applies to the Brassline Salvage app for Android
(package com.thecoffeelayer.brassline) and to the online services it
uses for accounts, the optional purchase and ranked runs. The app is made by Islam
Mahmoud, trading as The Coffee Layer (“we”, “us”). The
Coffee Layer website has its own privacy policy.
Playing as a guest
You can play the offline campaign as a guest, without an account. When you do, the app itself collects nothing. Your campaign save and your settings stay on your device and are not sent to us. They are removed when you clear the app’s storage or uninstall the app.
Brassline Salvage has no ads. It contains no advertising SDK and no analytics SDK.
If you create an account
An account is optional. You need one only to buy the optional Foundry Upgrade Pack or to play ranked runs. You can sign in with a one-time code that we email to you, or with Google sign-in.
For an account, our servers store:
- your email address (for email sign-in, or the email address of your Google account if you use Google sign-in);
- your Google account identifier (the “sub” id), if you use Google sign-in;
- a display name, which you can change (by default it looks like “Salvager-1234”);
- a random account id;
- session records: when each session was created, and hashes of the rotating refresh tokens that keep you signed in;
- timestamps.
Sign-in emails are sent through Resend (resend.com), which therefore processes your email address.
On your device, the session tokens that keep you signed in are stored encrypted with the Android Keystore.
The Foundry Upgrade Pack
The game offers one optional, one-time in-app product, the Foundry Upgrade Pack. It is sold and charged by Google Play. We never see your card or other payment details.
To confirm a purchase, our server receives the Google Play purchase token from the app and purchase notifications from Google Play, and verifies them with Google Play. We store:
- a keyed hash (a fingerprint) of the purchase token;
- the product id and the purchase state;
- order-related timestamps;
- whether it was a test purchase;
- which account the purchase belongs to.
Raw purchase tokens are kept only in encrypted form, and only while a verification or refund check is outstanding.
Ranked runs and leaderboards
When you play a ranked run, our server records the run so it can verify the result: the collect, deposit, buy and build steps you take, with timestamps, and your result time. It records no location and no device sensor data.
Public leaderboards show only your display name, your placement, your time and the date you finished. Anyone can see them, so choose a display name you are happy to show publicly.
At the start and end of a ranked run, the app may use Play Integrity, a Google Play service, to check that the app and the device are genuine. Google returns a verdict to our server, and we store the verdict with the run.
How we use this information
- to sign you in and keep you signed in;
- to verify the Foundry Upgrade Pack, unlock it on your account and handle refunds;
- to verify ranked runs, publish leaderboards and settle disputes;
- to prevent abuse: we use IP addresses and account ids for rate limiting and abuse prevention.
Who we share it with
We do not sell your data. We use these service providers to run the game’s online features, and they process data on our behalf:
- Cloudflare, for hosting (Workers, D1 database, Durable Objects and Queues);
- Resend, to send sign-in emails;
- Google, for Play Billing, Play Integrity and Google sign-in.
What the platforms record
The game’s servers run on Cloudflare. Cloudflare processes every request to them, including your IP address, and keeps its own logs. This website is also served by Cloudflare, which logs requests for its pages, as described in the website privacy policy.
Google Play records installs and purchases of the app and, from users who have opted in on their device, crash and performance data.
Security
Data sent between the app and our servers is encrypted in transit (HTTPS). Session tokens on your device are stored encrypted with the Android Keystore.
Deleting your account and data
You can delete your account in the app (Menu, then Account, then Delete account), through the web deletion form, or by email. Deleting it signs you out everywhere, removes your display name and results from public leaderboards, and erases your email address, Google identifier and display name.
A few records are kept after deletion, for limited periods, so that a Google Play purchase cannot be claimed by another account, refunds can still be processed and disputes can be settled. The account deletion page lists the steps, exactly what is kept and for how long.
Guest data lives only on your device. To remove it, clear the app’s storage or uninstall the app.
Children
Brassline Salvage is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes to this policy
We may update this policy from time to time. When we do, we will change the “last updated” date at the top of this page.
Contact
Questions about this policy can be sent to [email protected].