Privacy Policy
Caratozzolo Development LLC makes software: apps, games, dashboards, developer tools, and the services behind them (together, our "products"). Some of them let you sign in with a Caratozzolo Development account, one account that works across our products. This policy explains what information that account involves, where it goes, and how to delete it. A product can also have its own privacy policy for what happens inside it; for Deckhand, see the Deckhand Privacy Policy.
Your account
You can create an account with an email address and password, or sign in with Google or Apple. Your account holds:
- Your email address, and whether you have verified it.
- Your password, if you chose one. It is stored only as a one-way hash by our sign-in provider; we never see it.
- What Google or Apple shares, if you sign in with them: your email address and, where they provide it, your name and profile picture. If you use Apple's Hide My Email, we only receive the relay address Apple gives us. When you sign in with Apple, our sign-in provider also keeps a token from Apple so that we can cancel your Apple sign-in when you delete your account.
- Two-factor authentication, if you turn it on: the authenticator app you set up and a recovery code, stored so they can be checked when you sign in.
- Sign-in history: when you signed in, how, from which IP address and browser.
Accounts are run on our behalf by an authentication provider, which you see at
accounts.caratozzolo.dev.
Your data in each product
Each product that uses your account can keep a small profile for you, such as the username you
pick in it. Every product's profile is kept separately, and a product cannot read another's
profile. Profiles are stored on our own service at profiles.caratozzolo.dev,
together with your account's ID and when the profile was created and last changed.
We send email only for your account: verifying your address and resetting your password. These
are sent from accounts@mail.caratozzolo.dev through an email delivery
provider, which receives your address and the message to deliver it. We do not send marketing
email.
Operational logs
Our profile service writes technical logs to keep it running and to investigate faults. Each request records the time, what was requested and whether it worked, your account's ID, which product made the request, and your IP address and browser or app version. Logs never contain your password, your sign-in tokens, or your email address. They are kept for 3 days and then deleted automatically. We may keep counts derived from them, such as how many requests the service handled in a day, with no identifiers in them, for up to 30 days.
Our sign-in provider keeps its own sign-in logs, which include your email address, for a limited period set by our plan with them.
Who processes your information
We do not sell your information or share it for advertising. These providers handle it on our behalf, only to run the service:
- An authentication provider: accounts, sign-in, and two-factor authentication.
- A cloud hosting provider: hosts the profile service and its database, in the United States.
- An email delivery provider: delivers account email.
- A log management provider: holds the operational logs described above, in the European Union.
- Google Analytics: measures visits to our website pages, as described above.
- Google and Apple, only if you choose to sign in with them. Their own privacy policies apply to your Google or Apple account.
Advertising and purchases inside a product are covered by that product's privacy policy. We may also disclose information when the law requires it.
Cookies and browser storage
Signing in sets cookies on accounts.caratozzolo.dev that keep you signed in and
protect the sign-in from tampering. The account page at
profiles.caratozzolo.dev/myaccount keeps your sign-in tokens only in the open tab.
It sets a cookie that records whether you are signed in (not who you are), a short-lived
cookie while a sign-in is in progress, and briefly notes in the tab that an account was just
deleted so it can confirm that to you. We use no advertising cookies. Our public
website pages use Google Analytics, described in the next section.
Website analytics
The pages of caratozzolo.dev, including this policy, the terms, and the Deckhand
pages, use Google Analytics. When you visit, Google sets cookies in your browser and receives
your IP address, browser and device details, and which pages you view and click. We use the
resulting reports to see how many people visit and which pages they use. Google processes
this information for us under its own privacy policy; see
how Google uses information
from sites that use its services. You can block it with your browser's cookie settings or
Google's browser add-on. Analytics
is not tied to your account.
Managing and deleting your data
Go to profiles.caratozzolo.dev/myaccount and sign in. There you can:
- see your account and the data each product keeps for you;
- turn two-factor authentication on or off;
- delete your data in one app while keeping your account;
- delete your account. Apps that use it also offer this inside the app.
Deleting your account immediately removes every app's profile, cancels your Sign in with Apple if you used it, and deletes your account from our sign-in provider. We keep a record that the account was deleted, with its ID and the time but not your email address, for 2 days so that sign-ins from before the deletion stop working. Operational logs expire on their normal schedule. You can also email us to ask for a copy of your data or for a correction.
Security
All connections use HTTPS. Passwords are hashed by our sign-in provider, and two-factor authentication is available to every account.
Children's privacy
Accounts are not for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If this policy changes, the update will be posted on this page with a revised effective date.
Contact
Questions and requests about your data can be sent to support@caratozzolo.dev. See also the Terms of Service.