Privacy Policy
Only Fashion Files
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Only Fashion Files stores fictional case progress on your iPhone: discovered clues, proof links, verdict choices, completed cases and investigation tool settings. Language, hint, sound and backup preferences are stored locally. A random installation secret is generated automatically and held in this device's Keychain. There is no account, registration, contact form, advertising or analytics SDK. With automatic backup enabled, saved progress and its update time are sent to our backend. The server stores an encrypted progress document, a hash derived from the installation secret, and activity and expiry timestamps in PostgreSQL. The secret is sent over HTTPS to authorize requests and is not stored as plaintext by the application server. Hosting infrastructure necessarily receives network information such as IP address, request time, URL and technical connection metadata when the app or a browser contacts it. The application logs route, method, response status, request identifier and timing, and diagnostic error types, without recording authorization headers or progress bodies.
How we use information
Local data lets you play all six cases offline and resume investigations. Server processing provides a backup, restoration for this installation while its secret remains available, and deletion of that installation's backup. Network metadata and limited operational logs support request delivery, service reliability, abuse limits and fault diagnosis. Optional notifications are scheduled locally on your iPhone to remind you to return tomorrow; no push token or remote notification service is used.
Service providers and sharing
The backend and PostgreSQL database are hosted on Railway, which processes data as infrastructure provider and may receive connection information and infrastructure logs. The app uses Apple's iOS services for Keychain storage and local notifications; any device backup you choose is governed by your device and Apple settings. There are no advertising, analytics, social login or email delivery integrations. We do not sell progress or use it for advertising. Authorized service administrators can operate the backend and its server encryption key. Information may also be disclosed where required by applicable law.
Data retention
Progress and preferences remain locally until reset, removed with the app where iOS removes its files, or otherwise deleted through device settings. Keychain items may persist beyond app removal according to iOS behavior. Server progress expires after 180 days without a successful save or retrieval. Expired records cannot be restored; physical cleanup runs at service startup and hourly while the service is running. Deletion removes the active database row. Hosting logs and any infrastructure backups follow the provider's applicable configuration and policies; no fixed retention duration or immediate backup erasure is promised. Copies in infrastructure backups, if any, may remain until those backups are replaced or expire.
Deleting your information
Use Settings, Delete server data to remove all active server progress associated with this installation secret and disable automatic backup. This leaves your local game intact. You can separately restart all cases to remove local progress. A later explicit backup or re-enabling automatic backup creates a new server copy. Server deletion cannot be requested for an old installation if its secret is lost, because we cannot establish ownership through an account. Unretrieved copies then expire under the inactivity rule. Data already in infrastructure backups, if any, is subject to the provider's backup lifecycle rather than immediate selective removal.
Permissions and your choices
Notifications are optional and requested only when you turn on the reminder in Settings. You can turn the reminder off in the app, or withdraw notification permission in iPhone Settings. The game does not request location, contacts, photos, camera, microphone or tracking permissions. Turning off automatic backup prevents future scheduled uploads; a manual backup or restore contacts the server when you choose it. All cases remain playable without network access or notification permission.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, or to complain to your local privacy authority. You can review and reset local progress and retrieve or delete your installation's active server backup from Settings. Contact kenelm.merriton@icloud.com about privacy. This email is a privacy contact only; the app does not send email. Do not send your installation secret by email. With no account or identity directory, we may be unable to associate a privacy request with encrypted progress if the installation secret is unavailable.
Security
The client uses HTTPS, a cryptographically random per-installation secret in Keychain, and iOS file protection for the local progress file. Server requests require that installation's secret; different secrets authorize different records. Progress is encrypted with AES-256-GCM using a server-held key and is stored under a SHA-256 owner hash. Input limits, bounded database connections and request rate limits reduce misuse. No shared client credential is used. Anyone with the installation secret could access that installation's backup, so it should remain private. These measures reduce risk but cannot guarantee absolute security. Loss of the secret or server encryption key can make a backup unrecoverable.
Children’s privacy
Only Fashion Files is a fictional fashion investigation game intended for adults and older audiences interested in mystery stories, rather than a service directed to children. We do not ask for a date of birth or knowingly solicit children's personal information. If you believe a child has provided personal information through the service, contact kenelm.merriton@icloud.com so the concern can be reviewed using the information available to us.
Changes to this policy
This policy describes the current application and backend. We may update it when processing or functionality changes. The effective date on this page identifies the current version. Updated versions will be available through the Privacy Policy link in the app and at this public page. Material changes will be explained in the policy or relevant application notice.