1. What this covers
This Privacy Policy explains what information Neo Tomes Inc, operating as SPH Studios (“we,” “us”) collects when you play Circle Back (the “Game”), how we use it, and the choices you have. It applies to the Game at our website and as an installed web app. Consolidated Monolith Dynamics is a fictional company inside the Game; it does not collect anything. We do.
2. Information we collect
Account information. If you create an account, we collect your email address and, if you sign in with Google, the basic profile information Google shares (name, email, avatar). Authentication is handled by Google Firebase.
Gameplay data. We store your game state: the choices you make, scenes you are shown, in-game stats, character relationship values, and short computer-generated summaries of your playthrough. This is the save file; the Game does not work without it.
Purchase information. Payments are processed by Stripe. We receive and store a Stripe customer identifier, what you bought, and your subscription status. We never receive or store your full card number. Stripe’s handling of your payment details is governed by Stripe’s own privacy policy.
Usage and device data. We record how many scenes you play per day (to operate the free tier), and our hosting providers (Vercel, Google) automatically log standard technical data such as IP address, browser type, and request timestamps to run and secure the service.
Guest play. If you play without an account, your game state is stored only in your browser’s local storage on your device. It reaches our servers only if you later create an account and your guest progress is migrated.
Advertising measurement. We advertise the Game on Meta platforms (Facebook and Instagram). To learn which ads work, we tell Meta when someone visits this website, clicks through to the Game, creates an account, opens a checkout, or completes a purchase. Section 6 says exactly what is sent and how to opt out.
3. AI-generated content
Scenes in the Game are generated by an artificial-intelligence model provided by Anthropic. To generate each scene, we send the model the relevant parts of your game state, which can include your recent choices and the summary of your playthrough. This is sent server-side under our commercial agreement with the provider. We do not send your email address, name, or payment details to the AI provider as part of scene generation.
4. How we use information
- To operate the Game: save your progress, generate scenes, enforce the daily free meter, and deliver purchases.
- To process payments, manage subscriptions, prevent duplicate charges, and respond to billing issues.
- To secure the service, debug problems, and measure aggregate things like average scenes per session.
- To respond when you contact us.
- To measure our own advertising: which ads led to visits, accounts, and purchases, so we can spend less on the ones that do not.
We do not sell your personal information. We do not show third-party advertising in the Game. Sharing measurement data with Meta as described in Section 6 may count as a “sale” or “sharing” under some state privacy laws, and Section 8 explains how to opt out.
5. Who we share it with
Service providers only, and only to run the Game: Google (Firebase authentication and database), Stripe (payments), Anthropic (scene generation), and Vercel (hosting). Each processes data under its own terms and our agreements with them. Separately, Meta receives the advertising measurement data described in Section 6, which it uses under its own privacy policy, including to improve its advertising systems. We may also disclose information if the law requires it, or as part of a business transfer such as an acquisition, in which case this policy continues to apply to previously collected data.
6. Cookies, analytics, and advertising measurement
Necessary storage. We use the cookies and local-storage entries needed to keep you signed in and to store guest progress and settings (such as sound preferences).
Vercel Web Analytics. We use it to count visits and see broad patterns — which pages are opened, roughly which country they are opened from, and what kind of device, operating system and browser. It is cookieless and aggregate: it sets no persistent identifier, it is not joined to your account or your game, and it cannot follow you between sites.
Meta Pixel and Conversions API. To measure our advertising on Facebook and Instagram, we use Meta’s Pixel on this website and on the Game, and its Conversions API from our servers. The Pixel sets Meta cookies in your browser and reports page views, a click through to the Game, account creation, opening a checkout, and completing a purchase. Our servers report the same events, so that they are counted even where the browser blocks the Pixel. With those events we send Meta a one-way hashed (SHA-256) version of your email address and of your account identifier, your IP address, your browser type, the amount and currency of a purchase, and the Meta cookie values. We never send Meta your name, your password, your card details, or anything about what happens inside your game. Meta uses this data to match events to its users and to report on and improve advertising, under its own privacy policy. This is the one thing we run that can connect your activity here to your activity on another company’s service, and it only ever does so through Meta.
Opting out. Blocking third-party cookies or using a content blocker stops the Pixel; our servers then send only what they see themselves. Meta lets you control how data from other websites is used for ads in your Facebook or Instagram settings under “Your activity off Meta technologies.” Section 8 explains your rights under privacy law, including the right to ask us not to share.
If we add anything beyond this — other advertising networks, or analytics tied to your identity — we will update this policy first.
7. Retention and deletion
We keep your account and gameplay data while your account exists. You can delete your account yourself at any time from Settings inside the Game, which takes effect immediately; see how to delete your account. If you cannot sign in, contact our support address and we will delete it within 30 days. Either way we keep records we are legally required to keep (for example, transaction records for tax purposes). Guest data lives in your browser and is deleted when you clear your browser storage.
8. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Contact us at our support address and we will honor applicable requests. If you are in the EEA or UK, our legal bases are performance of contract (running the Game you asked for), legitimate interests (security, debugging), and consent where required, including for the advertising measurement in Section 6. If you are in California or another US state with a right to opt out of the sale or sharing of personal information or of targeted advertising, you can exercise it by contacting us at our support address; we will stop sending measurement events tied to your account. We honor Global Privacy Control signals where the law requires it.
9. Children
The Game is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.
10. Changes
If we change this policy in a way that matters, we will post the new version here and update the effective date, and for significant changes we will tell you in the Game or by email.
EFFECTIVE: September 12, 2026 · QUESTIONS: our support address