Privacy Policy
Cages — by Abaxoft Kft.
Last updated 3 September 2026
The short version
- You can play Cages without an account and without giving us your name or email.
- If you sign in with Apple or Google, we store your user identifier and email so your progress, streak and purchases follow you across devices.
- We never see your card details — Apple, Google or Stripe handle payment.
- We use analytics and crash reporting to fix bugs and see which features get used, and Google ads (AdMob in the apps, AdSense on the web) for players who have not bought Remove Ads or an Adventure Pass.
- We do not sell your personal data, and we do not build advertising profiles ourselves.
- You can delete your account and all its data from Settings, in the app or on the web, at any time.
Who we are
Cages is made and operated by Abaxoft Kft., a company registered in Hungary. For anything in this policy we are the data controller under the GDPR.
Contact: support@abaxoft.com
What we collect, and why
Account data — only if you sign in
Signing in with Apple or Google gives us the user identifier issued by that provider and the email address attached to it (with Sign in with Apple this may be a private relay address, which is fine). Your leaderboard nickname is stored too: a generated one, or your first name once you sign in — there is no free-text name to enter. Without signing in, your progress is held on your device under an anonymous identifier.
Game data
Puzzle progress, solved puzzles, daily streak and its dates, flame and adventure-coin balances, unlocked worlds, and your entitlements (Remove Ads, Adventure Pass). If you join the leaderboard, your nickname and score are visible to other players — nothing else about you is.
Purchases
When you buy something, the store sends us a transaction receipt, which we verify with Apple's App Store Server API or Google Play so we can unlock what you paid for. We store the transaction identifier, the product, and the status. Payment details — card numbers, billing address — go to Apple or Google and never reach us.
On the web, purchases go through Stripe. Stripe collects your card details and, for a subscription, your email address for receipts; we store only the Stripe customer id, the checkout session or subscription id, and what it unlocked. Stripe's handling of payment data is described in its own privacy policy.
Analytics
We use PostHog (EU cloud, hosted in Frankfurt) to understand how the game is used: events such as starting or solving a puzzle, opening a screen, using a hint, plus app version and device type, tied to your Cages user identifier. We do not send your email address to PostHog.
Crash reports
We use Sentry to record crashes and errors. A report contains the technical stack trace, device model, operating system version, app version and your Cages user identifier, so we can tell whether a fix worked for the person who reported it.
Notifications
The daily reminder is scheduled by your own device and tells us nothing. If you turn on Settings → Streak alerts, we also store a push registration token for that device, issued by Apple, Google or your browser, together with the device platform, app version, time zone and language — the time zone so an alert arrives in your evening rather than ours. The token is an address, not a name: it identifies a copy of the app on one device, and it is stored against your account so we know which alerts to send. Turning the setting off, signing out or deleting your account removes it.
Advertising
Ads are served by Google AdMob to players without Remove Ads or an active Adventure Pass. Google may use your device's advertising identifier and similar data to select and measure ads. In the EEA, the UK and Switzerland we show Google's consent dialog before any personalised advertising, and you can change that choice at any time in the app under Settings → Ad privacy options. If you decline, you still see ads, but non-personalised ones. On the web, ads come from Google AdSense (H5 Games Ads) and are only loaded after you accept the consent banner; Settings → Ad privacy options lets you change that answer, and "Essential only" means no ad script is loaded at all. Google's own handling of ad data is described in Google's privacy documentation.
On the web
The browser version at cages.abaxoft.com keeps your progress, settings, session and your consent answer in the browser's local storage. That is what lets you close the tab and come back to the same game; it is not used to track you across sites. We set no advertising or analytics cookies of our own. If you accept ads, Google may set cookies and use local storage as described in its policy; if you choose "Essential only", nothing of Google's is loaded.
The site is served by Cloudflare, which processes the IP address and request details of every visit in order to deliver the page and defend against abuse, and keeps short-lived access logs for that purpose.
Browser alerts, if you turn them on, work the same way as the app's streak alerts: a push address issued by your browser is stored against your account and deleted when you turn the setting off.
Legal bases
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account and game data | Run the game, sync and restore your progress | Performance of a contract, Art. 6(1)(b) |
| Purchases | Deliver and restore what you bought; tax and accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Crash reports | Keep the app working | Legitimate interests, Art. 6(1)(f) |
| Analytics | Understand which features are used and improve them | Legitimate interests, Art. 6(1)(f) |
| Personalised ads | Fund the free version | Consent, Art. 6(1)(a) |
| Push registration | Send the alerts you asked for | Consent, Art. 6(1)(a) |
Who processes data for us
- Supabase — accounts, game data and purchase records, hosted in the European Union.
- PostHog — product analytics, EU cloud (Frankfurt).
- Stripe — payments and subscription billing for the web version.
- Cloudflare — hosting and delivery of the web version at cages.abaxoft.com.
- Sentry — crash and error reporting.
- Google — AdMob advertising in the apps, AdSense advertising on the web, Firebase Cloud Messaging for the alerts you opt into, and Google Play for sign-in and purchases on Android.
- Apple — Sign in with Apple and App Store purchases on iOS and iPadOS.
Some of these providers may process data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or another approved safeguard.
We do not sell personal data, and we do not share it with anyone else for their own marketing.
How long we keep it
Account and game data are kept for as long as your account exists. Deleting your account removes your profile and its game data from our servers immediately and permanently. Crash reports and analytics events are kept for a limited retention window at each provider (currently up to 90 days for crash reports and 12 months for analytics) and then deleted or aggregated. A push registration is kept only while alerts are switched on, and is deleted when you turn them off. Purchase records may be retained longer where accounting law requires it.
Deleting your data
In the app or on the web: Settings → Delete account. This is permanent and cannot be undone. It does not cancel a subscription — subscriptions live with the App Store, Google Play or Stripe, so cancel there as well.
If you would rather we did it for you, email support@abaxoft.com from the address you signed in with. What deletion removes, and what it keeps.
Your rights
If you are in the EEA or the UK you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Where we rely on consent — personalised ads — you can withdraw it at any time without affecting what came before.
Write to support@abaxoft.com and we will answer within one month. You also have the right to complain to a supervisory authority; in Hungary that is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Children
Cages is a general-audience game and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle data, we will update this page and move the date at the top. Significant changes will also be announced in the app.