Legal · Casebound

Privacy Policy

The short version: we keep what the game needs to run, we don't sell it, and analytics never sees your name, your email, your premises or your case notes.

Effective: 26 October 2026 · Last updated: 27 October 2026

---

01Who we are

Casebound is made by Malleus Tech, based in Sweden. For the purposes of the EU General Data Protection Regulation (GDPR), Malleus Tech is the data controller for the personal data described here. You can reach us at joakim@malleus-tech.com.

02What we collect

• Account data. Your email address and, if you set one, a display name ("detective name"). Sign-in is handled by Firebase Authentication — we never see or store your password.
• The stories you write. The premise you type, the choices you make with it (number of suspects, language), and the case the writer builds from it. Your premise is sent to our writing provider (Google Cloud Vertex AI) to check it before you pay and then to author the story — a premise that is refused at the check is not kept; we keep it on the story so we can show it back to you, print it in the case file and write the story again if the first attempt fails. Please don't put anything in a premise you wouldn't want stored — it is free text and we have no way to find what you didn't tell us is sensitive.
• Game progress. Which cases you have started, your flagged prime suspects, your accusations and their verdicts, your private case notes, how many stories you have paid for and not yet written, and your language preference.
• Purchase records. What you bought, when, and the transaction identifiers we receive from Stripe and RevenueCat. Your payment card details go directly to the payment provider — they never touch or get stored on our servers.
• Analytics. We use Amplitude to understand how the game is played: event names (like case started or accusation made) and content identifiers, tied to your account id, plus the page views, session information and basic device and technical properties the analytics SDK collects automatically. Analytics never receives your name, email, premises, case notes or any other free text.
• Technical logs. Standard server logs (IP address, browser/app identifier, timestamps) kept briefly for security and debugging.

03Cookies & local storage

We keep cookies to the minimum the game needs: on the web, a strictly necessary session cookie holding your sign-in token and a cookie remembering your language choice. The analytics SDK also stores a random device id in your browser so play sessions can be counted. We use no advertising or cross-site tracking cookies, so there is nothing to opt in or out of.

Your browser also keeps two small things of its own, which never reach us on their own: the premise you are part-way through writing, so a trip to the checkout and back doesn't lose it, and a note that a particular payment has already been handed in, so reloading the page after paying cannot hand it in twice. Both live only in that browser, and clearing your site data clears them.

04How we use it

To write the stories you order and run the game; to sync your progress across your devices; to process and credit your purchases, and to return your story credit when we can't finish a story; to answer support requests; to understand aggregate play patterns and improve the writing; and to meet legal obligations such as bookkeeping. Your premises are used to write your story and to support you — they are not used to train anyone's model, not published, and not shown to other players. We do not sell your personal data and we do not use it for third-party advertising.

05Legal bases

We process account, premise, progress and purchase data because it is necessary to provide the service you signed up for (contract). Analytics and security logging rest on our legitimate interest in improving and protecting the game. Where the law requires consent, we ask for it. Purchase records are additionally kept to satisfy legal (accounting) obligations.

06Where your data lives

Your data is stored in Google Cloud Firestore in the europe-west1 region (Belgium, EU), and your case files (PDFs) in Google Cloud Storage in the same region. Some of our processors may handle data outside the EEA; where they do, transfers are covered by recognised safeguards such as the EU Standard Contractual Clauses.

07Who we share it with

Only processors that help us run Casebound, each receiving no more than their job needs:

• Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Run) — accounts, storage and hosting.
• Google Cloud Vertex AI — writes your story, and the images and narration in it, from your premise. It receives the premise and the case text, never your email, your name or your notes.
• Stripe — payment processing.
• RevenueCat — purchase validation and crediting your account.
• Amplitude — product analytics, identifiers and event names only.

We may also disclose data where the law requires it.

08Retention & deletion

We keep your data for as long as your account exists. Email us to delete your account and we will remove your personal data, including your premises, progress and notes, and the case files generated for you. Purchase records may be retained longer where bookkeeping law requires it.

09Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing, a portable copy, and you can object to processing based on legitimate interest. Write to us and we will sort it out. You also have the right to complain to a supervisory authority — in Sweden that is IMY (Integritetsskyddsmyndigheten), or the authority where you live.

10Children

Casebound tells fictional crime stories and is not directed at children under 13. We do not knowingly collect personal data from children under 13; if you believe a child has created an account, contact us and we will delete it.

11Changes to this policy

These pages are working documents and may be updated as Casebound evolves. We will post changes here and update the date at the top; material changes will be flagged more loudly.

See also: The Detective's Code — Terms of Service