Privacy Policy

This policy explains what personal data Horizech collects, what we do with it, and what you can ask us to do about it. It covers our websites, our apps and our games.

Last updated: 31 August 2026

What we collect

How much we hold depends entirely on what you use.

• Our websites.Most are brochures — no accounts, no sign-in, no forms. Our hosting provider keeps short-lived server logs including your IP address, the page requested and your browser's user-agent string, so the site can be delivered and protected from abuse. Some sites additionally load analytics, but only if you accept — see our Cookie Policy.
• A Horizech Account. If you sign in, we hold the email address, username and name you registered with, and records of your sessions so we can keep you signed in and secure the account.
• What you put into our apps. Entries you save to a Captain Password vault, workspaces and projects you create in Horizech Workspace, algorithms you convert in AlgoGraphia. This is your content; we store it so the product works.
• Our games. Nothing, unless a grown-up buys something. There is no account, no sign-in and no analytics in them — see Children, which covers this in full, because most of the people playing them are children.
• When you contact us. Your message, your address, and our reply.

Where a third party sees what you type

AlgoGraphia turns a written algorithm into a flowchart by sending what you wrote to a third-party AI model provider, which returns a structure we then draw. That text leaves our systems to be processed. Do not put personal or confidential information into it.

A specific note about Captain Password

The password generator on our websites runs entirely in your browser and transmits nothing — what it produces never reaches us.

A saved vault is different. Vault entries are stored on our servers so they can sync between your devices, and they are not end-to-end encrypted. We are telling you this plainly because the opposite is widely assumed: we could technically access what is in a vault, so treat it as data you have given us rather than data only you can read.

Why we are allowed to use it

• Contract — to give you the product you signed up for.
• Legitimate interests — keeping our services available and secure, replying to you, and running the business. We have weighed these against your rights.
• Consent — analytics cookies, and nothing else. You can withdraw it whenever you like.
• Legal obligation — records we are required to keep, such as for tax.

Who else sees it

We do not sell personal data and we do not share it for advertising. We use a small number of providers who process data on our instructions — hosting, email, analytics where you have accepted it, the AI provider described above, and RevenueCat, which records app purchases for us so that what you bought stays unlocked. Our own engineering team in Pakistan works on these products as our processor, under contract.

Sending data outside the UK

Some of those recipients are outside the United Kingdom — in particular Pakistan, and the United States. Neither is covered by UK adequacy regulations for these purposes, so where personal data leaves the UK we rely on appropriate safeguards: the UK International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses, together with an assessment of the transfer. Ask us and we will tell you which applies.

How long we keep it

Account and product data lasts as long as your account does; delete the account and it goes, apart from anything we must keep for legal reasons. Enquiries are deleted once they are clearly finished. Server logs are short-lived.

Your rights

Under the UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it, where there is no continuing reason for us to keep it;
• stop or restrict a particular use, including anything based on our legitimate interests;
• hand it over in a portable form, where you gave it to us.

Email [email protected]. We aim to answer within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you came to us first.

Security

Access to production data is limited to the people who need it, connections are encrypted in transit, and credentials are held in a managed secret store rather than in application code. No service can promise perfect security, and we will not pretend otherwise.

Children

Our websites, accounts and developer products are not intended for children under 13, and we do not knowingly collect their data.

Some of our games are made for children — Moon Kids is for ages 2 to 11 — and they are built so that a child playing one tells us nothing about themselves.

• No account and no sign-in. There is nothing to register and nothing to remember. We never ask a child for their name, email address, phone number or photograph, and there is no way for them to type one in.
• No analytics and no crash reporting. We do not measure what a child taps, how long they play, which games they choose or how well they do. None of it leaves the device, because none of it is collected.
• No advertising, and no advertising identifier. There are no adverts of any kind. The apps do not request the Android advertising ID, so nothing inside them can read it.
• No location, contacts, microphone or camera. None of these are requested and none are used.
• Progress stays on the device. Scores and how far a child has got are saved on the phone or tablet itself, not sent to us.

When a grown-up buys something

The one thing we do process is a purchase. Extra content is bought once, from behind a gate a small child is not expected to pass, and Google Play takes the payment — we never see card or bank details.

So that the content stays unlocked afterwards, our provider RevenueCat keeps a record that the purchase happened. That record is tied to a random identifier generated on the device, not to a name, an email address or a person, because there is no account for it to be attached to. We use it to work out what is unlocked and for nothing else — not to profile anyone, not to advertise, and never to build a picture of the child using the app.

Parents in the United States

Our children's games are designed to comply with the Children's Online Privacy Protection Act (COPPA). We do not collect personal information from children, so no verifiable parental consent is required for them to play. If you believe we hold anything about your child regardless, contact us using the section below and we will delete it.

Deleting a child's data

You can ask us to delete the purchase record described above at any time. Email [email protected] from any address and include the Google Play order number from your receipt — that is what lets us find the record, since there is no account or email address attached to it. We will confirm when it is gone.

Deleting the record does not take the content away from the device it is already on, and it does not undo the purchase. Ask Google Play for a refund if that is what you want.

To remove everything a game has saved on the device itself, uninstall it, or clear the app's storage in Android settings.

Changes

If we change how we handle personal data we will update this page and the date at the top of it. Material changes affecting people with accounts will be told to them directly.

About this policy

This Privacy Policy applies to the services offered by Horizech LTD, which is the data controller for the personal data described here, for everyone who uses those services wherever they are.Horizech LTD is established in the United Kingdom, so no representative is required under Article 27 of the UK GDPR — write to us directly.

Our registered details are on the Company details page.