Last Updated: October 14, 2026
This policy covers one app: Covert Mail: Morse & Ciphers, on Android, iPhone and iPad. It teaches Morse code, tap code and classical ciphers through short missions, and has a cipher desk for writing a coded message and sending it to a friend. Our other apps are covered by the general Illumination Development privacy policy, which does not apply here. That policy describes reward balances and redemption records that this app does not have.
The short version
There is no account and no sign-in. Your training record is stored on the phone and nowhere else. We never receive it.
Messages you write on the cipher desk never leave the phone unless you share one yourself, and then they go only where you send them. We never see them.
The app does not use the microphone, the camera, your location or your contacts, and there is nothing to buy. It can switch on the phone's flashlight to send Morse by light, and only when you tap Flash the torch.
What does leave the phone is advertising, usage analytics and crash reports, described in full below. Every advertisement request is marked as child-directed, rated G and not personalized, and there is never an advertisement during a mission or on the cipher desk.
What stays on the phone
Your training record: the stars earned on each mission, how well you know each character of each code, the messages filed in your archive, your best score on today's intercept, your options (Morse character speed, Farnsworth speed, tone pitch, and whether sound, the on-screen lamp and vibration are on), your day streak, and counts of the missions you have played and the characters you have named. It is kept in one database in the app's private storage, and it is removed if you use Delete my data or uninstall the app.
The cipher desk
Everything you type on the cipher desk is encoded or decoded on the phone. It is not saved: close the desk and the message is gone. It is never sent to us or to anyone else by the app.
- Share hands the coded message, and its key if you choose to include it, to your phone's own share sheet. Where it goes from there is up to you and the app you pick; we do not receive a copy.
- Copy puts the result on your phone's clipboard.
- Paste a message, under Got a message?, reads the clipboard once, when you tap it, to open a message a friend sent you. The app does not read the clipboard at any other time.
- Play sounds the message as Morse, Flash the torch flashes it on the phone's flashlight, and missions can buzz it on the vibration motor. The flashlight is switched on as a light only; the camera is never opened, and the app does not ask for camera permission.
The ciphers are classical ones for learning and fun, such as Caesar shifts and Vigenère. They are not encryption and do not protect a message from anyone who knows how to break them, so do not use them for anything that really needs to stay secret.
What the app sends
None of what follows includes a name, an email address or anything you type.
Usage analytics
The app reports a small set of events to Google Analytics, each with only the details listed here:
- which screen is open (the splash screen, the desk, a mission, practice, today's intercept, or the cipher desk);
- how long the app took to start, in milliseconds;
- that a mission was finished, with which mission it was (a name such as morse-3, practice or daily), the stars it earned (0 to 3) and its best run of correct answers in a row, rounded into a range (0–4, 5–9, 10–19 or 20 and over);
- that a mission was cleared for the first time, and which mission;
- that a mission was left before the end, and which mission;
- that the first-launch briefing was finished;
- that an option was changed, which one (character speed, Farnsworth speed, tone pitch, sound, lamp or vibration) and its new value;
- that the privacy policy was opened.
The app also records which kind of build it is (for example, a release build) as a property. Nothing typed on the cipher desk, and nothing about which codes you write in or share, is reported. Alongside those, Google Analytics collects its own app-instance identifier, coarse device information such as the model, the operating system version and the app version, and an approximate location that Google derives from the IP address. The app itself never asks for location. We use analytics to see which parts of the app are used, and for nothing else.
Crash and diagnostic reports
If the app crashes or hits a handled error, Google Crashlytics sends a report: the stack trace, the app version, the device model and operating system, and Crashlytics' own installation identifier. This is how bugs get found. Analytics and crash reporting are both switched off in development builds.
Advertising
The app is free and carries advertising from Google AdMob and no one else. There is one placement: a banner at the foot of the desk, the app's home screen. There is never an advertisement during a mission or on the cipher desk, there are no full-screen or rewarded advertisements, and there is nothing to buy.
Covert Mail is for all ages and younger players enjoy secret codes, so every advertisement request is marked as child-directed (Google's treatment for child-directed content), limited to content rated G, and not personalized. The app does not show Apple's tracking prompt and does not request Apple's Identifier for Advertisers. To serve a banner, the Google Mobile Ads SDK contacts Google and may collect device information, an approximate location derived from the IP address, and the request, impression and click themselves, under Google's own privacy policy. We never see any of it, and none of it is connected to your training record.
On Android, the app removes the advertising-ID permission, so neither the Google Mobile Ads SDK nor Google Analytics can read your advertising ID. On both platforms, Google Analytics is set not to allow ad personalization, and on Android it is also set not to collect the advertising ID.
In the EEA, the UK and Switzerland
Where a consent regime applies, Google's consent message is shown before any advertisement is requested, and the app asks as if the user may be under the age of consent. Ad privacy options, under Help, privacy and your data in the app's options, reopens the same choices at any time; that entry appears only where a consent regime applies.
Rating prompt
Because the app is set up for younger players, it never asks you to rate it.
Contacting support
Contact support, under Help, privacy and your data in the app's options, opens your own email app, addressed to support@illuminationdevelopment.com. The app attaches nothing: what we receive is exactly what you write, from the address you send it from, and we use that address only to reply.
Delete my data
Delete my data, under Help, privacy and your data in the app's options, immediately erases your training record from the phone (every star, every filed message, how well you know each character, your options, your streak and your counts) and resets the Google Analytics identifiers held on the phone. The app then starts again as if it had just been installed. There is nothing on a server for us to delete.
Analytics events and crash reports already sent to Google before you pressed it are kept by Google under its own retention periods, keyed to identifiers that no longer lead back to this installation. To ask about those, write to privacy@illuminationdevelopment.com.
What the app does not do
- No account, no sign-in, and no upload of your training record.
- No upload of anything written on the cipher desk; a message leaves the phone only when you share it yourself.
- No in-app purchases, no rewards and nothing for sale.
- No microphone and no camera (the flashlight is used as a light only).
- No location permission, and no access to contacts.
- No chat, no friends list, and no way to reach another person through the app other than the share sheet you choose to open.
- No advertising during a mission or on the cipher desk, no advertising network other than Google AdMob, and no personalized advertising.
- We do not sell personal information.
Children
Covert Mail is for a general audience and is usable by children. It is not in the App Store's Kids Category, and because children may play it, every advertisement in it is child-directed, rated G and non-personalized as described above. The app asks for no name or other personal information, and the only information that leaves the phone is the advertising, analytics and crash reporting described here, plus any message you choose to share. If you believe a child has sent us personal information, for example in an email, write to privacy@illuminationdevelopment.com and we will delete it.
Your rights
Under the GDPR, the UK GDPR, the CCPA and CPRA, and comparable laws elsewhere, you have rights to access, correct, port and delete personal information held about you. Your training record is on your phone, where you can erase it with Delete my data. For anything else, including a support email or data Google holds from analytics, crash reports or advertising, write to privacy@illuminationdevelopment.com. Information Google holds from running those services is subject to Google's privacy policy.
A note about this web page
The app does not display this page; tapping Privacy policy in the app's options opens it in the phone's browser, and this website uses Google Analytics to see which pages people find useful. That is described in the general policy and applies to your visit to this page, not to your use of the app. The app and this policy are in English.
Changes to this policy
If any of this stops being true, this page changes before the version that changes it reaches either store, and the App Store privacy label and Google Play Data safety form change with it. Revisions are posted here with an updated date.
Contact
Email: privacy@illuminationdevelopment.com
You can also reach us through our contact and support page.