Posted Privacy Policy
Effective August 28, 2026
Publisher and data controller: Kirk Philip Dickey Jr
Privacy contact: kaperboybusiness@gmail.com
Summary
Posted can be played offline without creating an online account. Online accounts add cloud saves, shared worlds, chat, whispers, player trading, and cross-device play. The free iOS app shows Google Mobile Ads interstitials after gameplay transitions. Posted Supporter is an optional, non-consumable Apple purchase that unlocks the cosmetic Closet/transmog feature and removes automatic ads. Posted does not request precise Location Services, contacts, camera, microphone, or App Tracking Transparency permission, and does not intentionally use data for cross-app tracking.
Data kept on the device
Offline accounts, campaign progress, inventory, settings, and cached online saves are stored in the app container or browser storage. The signed iOS app may also keep a recovery copy of the current session in iOS secure storage. This on-device information is not sent to the publisher unless an online feature described below is used. Removing the app or clearing its storage may remove local-only progress.
Online account and gameplay data
If a player creates or uses an online account, the Posted service processes the chosen account name, an internal account identifier, salted and hashed password data, a one-way token hash, a one-way network-address-derived abuse-prevention hash, account creation and recent-login times, the cloud save, world and approximate in-game position, multiplayer appearance and status, short chat messages, whispers, trade messages, public ground-item state, block choices, reports, and moderation status. Plaintext passwords are not stored.
This information is used only to authenticate accounts, synchronize saves, operate shared worlds and player interactions, prevent fraud and abuse, enforce the Community Standards, answer support and privacy requests, and keep the service reliable. It is not used for advertising or tracking and is not sold.
Advertising and consent
On iOS, Google Mobile Ads and Google’s User Messaging Platform may process an approximate location inferred from network information, device or advertising-related identifiers, ad impressions and interactions, app interaction signals, crash logs, and performance data. These data may be used to deliver and measure third-party advertising, provide analytics, prevent fraud, and keep the advertising service functional. Google processes this information under its own privacy terms. The publisher does not receive payment-card or bank details through advertising.
Posted requests non-personalized ads and does not request App Tracking Transparency permission. Where required, Google’s consent message is shown before ads can be requested. Available privacy choices can be reopened from Options → Advertising → Ad Privacy. A current Posted Supporter entitlement disables automatic ads. Players can report an inappropriate ad from Options → Advertising → Report an Ad.
Public and private fields
A chosen account name, character appearance, combat level, current in-game position, short chat message, and multiplayer status may be visible to nearby players in the same world. Whispers, trade messages, block choices, reports, passwords, authentication tokens, saves, and moderation records are not public. Players should not put real names, contact details, addresses, or other personal information in an account name or chat.
Filtering, reports, blocks, and moderation
The online service filters common objectionable terms from names and messages. Players can report or block another player from that player’s in-game menu. Blocking removes direct communication and hides the blocked relationship from shared-world results. Reports may include the selected category, the reported name, an optional explanation, and the most recent relevant message so the publisher can investigate. The publisher may warn, mute, suspend, rename, or ban accounts that violate the Community Standards or Terms.
Service providers and international processing
Cloudflare provides the Worker, database, network security, and hosting infrastructure used by the Posted online service. Apple distributes the iOS app and processes the Posted Supporter purchase, restoration, entitlement, refund, and related App Store information under Apple’s own terms. Google provides the Mobile Ads SDK and User Messaging Platform for ad delivery, measurement, consent choices, fraud prevention, and related diagnostics. The publisher does not receive payment-card or bank details. Data may be processed where these providers operate.
Retention
Online account and save data are kept while the account exists. Presence records expire after a short inactivity window, undelivered player-to-player messages expire after about five minutes, and failed-login rate-limit records expire after about ten minutes. Block records remain until removed or an account is deleted. Reports and moderation records may be kept for up to 12 months, or longer only while reasonably needed for an active safety, fraud, appeal, or legal matter. Provider security and recovery copies may persist for a limited period under the provider’s retention schedule.
Choices, access, and deletion
Players can choose offline mode before signing in, reopen available Google ad privacy choices from Options → Advertising, block or unblock players, and delete an online account from Options → Data & Privacy. Online account deletion removes the account, cloud save, presence, queued messages, trades, ground items, blocks, and associated reports from the active Posted database and signs the device out. Local-only data can be removed with New Character or by removing the app. A player may contact the publisher to request access, correction, or other rights available in their location. The publisher may need a privacy-preserving way to verify account control and will never ask for an account password or secret token by email.
Children
Posted contains mature crime and combat themes and is not directed to children. A person under 13, or below the digital-consent age in their location, must not create or use an online account. If the publisher learns that a child’s personal information was collected contrary to this restriction, it will be deleted.
Security and changes
No service can promise absolute security. Posted uses encrypted HTTPS transport, salted password hashing, hashed rotating tokens, rate limits, server-stamped identity, and bounded inputs. Material policy changes will update the effective date and be published with the app’s support pages.