Case & Cocoa — Privacy Policy

Last updated: April 18, 2026

Case & Cocoa is operated by Blackhole Software, LLC doing business as CrashBytes ("we", "our", or "us"). This privacy policy explains what information we collect, how we use it, and the choices you have. Case & Cocoa is a daily cozy mystery puzzle app for iOS, distributed via the Apple App Store.

Short version: We collect the minimum we need to run the app. We never show ads, never sell your data, never track you across other apps, and we have no chat or user-generated content features. Your journal notes stay on your device.

Information We Collect

Sign in with Apple

You sign in with Apple. We receive your unique Apple user identifier (a stable, opaque string) and — optionally — the name you choose to share with us. We do not receive your Apple email address unless you explicitly choose to share it, and Case & Cocoa never asks for it. We use the identifier to associate your gameplay progress with your account, and the name (if provided) as your in-app display name.

Gameplay data

The following information is stored on our server (Cloudflare Workers + D1) so your streak, friend list, and progress are consistent across your devices:

  • Your chosen display name and a randomly generated 6-character handle
  • Your selected companion species and cosmetic choices
  • Daily solve records (which case you attempted, on what date, whether you solved it correctly, and how long it took)
  • Streak state (current streak, longest streak, total solved)
  • Friend connections (pairwise handles of users who have accepted each other's invites)
  • Entitlement tier (free, Cozy Pass, or Forever)

Your journal notes are private and never transmitted. They remain on your device in SwiftData, and — if you subscribe to Cozy Pass and opt into iCloud sync — they also sync to your personal iCloud private database under Apple's control.

iCloud (Cozy Pass subscribers only)

If you subscribe to Cozy Pass and enable iCloud sync, your journal entries, companion customization, and local state are backed up to your personal iCloud account via Apple's CloudKit. This data is stored in your private iCloud container and is not accessible to us. When you delete your Case & Cocoa account, the app explicitly purges its CloudKit zone so this data is removed from iCloud as well.

Analytics (Firebase Analytics)

We use Google Firebase Analytics to understand aggregate app usage. This includes:

  • Gameplay events (case opened, clues revealed, deduction submitted, solved correctly or not)
  • Feature usage (paywall viewed, companion outfit changed, widget installed)
  • App performance metrics (session duration, screen transitions)
  • Device type and operating system version
  • Streak milestones (reaching 7, 14, 30, 60, 90, 180, 365 days)

Analytics events do not contain your journal notes, display name, case content, or friend handles. We take explicit care to strip any text that could identify you from any analytics parameter. Analytics data is collected in aggregate and is not linked to advertising identifiers. You can opt out of analytics by limiting ad tracking in iOS Settings > Privacy & Security > Tracking.

Crash reporting (Firebase Crashlytics)

We use Firebase Crashlytics to detect and fix app crashes. When a crash occurs, Crashlytics collects:

  • Device state at the time of the crash
  • Device model and OS version
  • Stack trace information

Crash reports do not contain personally identifying information, your journal notes, or the specifics of cases you were playing.

In-app purchases

Cozy Pass subscriptions and other in-app purchases are processed entirely by Apple through the App Store. We do not collect, process, or store any payment information, credit card numbers, or billing details. We receive only an anonymous entitlement signal from StoreKit that tells the app you're entitled to Cozy Pass features.

Friend invites and nudges

If you create a friend invite, we generate a random 10-character token and the corresponding URL https://caseandcocoa.app/i/<token>. When a friend opens that link, we associate the two accounts. Nudges and emoji reactions sent between friends are recorded only long enough to deliver them as notifications; no open chat, text, or media is ever involved.

Push notifications

Push notifications are requested only after you solve your first case, so you've established that Case & Cocoa is something you want reminders from. If you grant permission, we schedule a local daily notification at the hour you pick in Settings (8am by default). We also send push notifications when a friend nudges you.

Information We Do NOT Collect

  • Your email address or phone number
  • Location data — Case & Cocoa never requests location permission
  • Contacts or address book
  • Photos, camera, or microphone
  • Health, fitness, or biometric data
  • Browsing history or other app usage
  • Advertising identifiers — we do not serve ads and do not track you across apps
  • Payment details — purchases are handled entirely by Apple
  • Your journal notes — those remain private on your device (and, optionally, in your iCloud account)

Data Storage and Security

Server data (user accounts, streaks, friend graph, daily case catalog) is stored on Cloudflare's infrastructure in the United States. Analytics and crash data are stored on Google Firebase servers and are subject to Google's Privacy Policy. iCloud data (Cozy Pass subscribers only) is stored in your personal iCloud container and is subject to Apple's Privacy Policy. Authentication tokens are stored on your device in iOS Keychain with device-local-only access.

Children's Privacy

Case & Cocoa is rated 12+ on the App Store and is not directed at children under 13. Sign in with Apple requires users to be at least 13 years old under Apple's terms, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us using the address below and we will promptly delete the account.

Third-Party Services

  • Apple — Sign in with Apple, App Store (purchases), iCloud (private sync for Cozy Pass subscribers), APNs (push notifications)
  • Cloudflare — Workers, D1, and R2, used to deliver daily cases, store the friend graph and streak state, and rate-limit abusive requests
  • Google Firebase — Analytics and Crashlytics only (no Firebase Auth, no Firestore, no ads)

Your Rights

You can, at any time:

  • View and change your display name in Settings
  • Change when you receive the daily notification, or disable notifications entirely in iOS Settings
  • Remove friends you no longer wish to share streaks with
  • Delete your account — Settings > Delete Account removes your data from our servers, purges your iCloud CloudKit zone, wipes the app's local data, and signs you out. This is permanent and cannot be undone.
  • Opt out of analytics by limiting ad tracking in iOS Settings > Privacy & Security > Tracking

GDPR / UK GDPR (European and UK users)

If you are in the European Economic Area or the United Kingdom, you have additional rights including access, rectification, deletion, restriction, portability, and the right to object to processing. To exercise any of these rights, contact us using the address below. Data transfers to the United States (for Cloudflare and Firebase) are protected by Standard Contractual Clauses.

CCPA (California users)

California residents have the right to know what personal information we collect, request deletion, and not be discriminated against for exercising these rights. We do not sell personal information. You can exercise your rights by contacting us using the address below.

Changes to This Policy

We may update this privacy policy from time to time. Material changes will be announced in-app and via the version history on this page. The "Last updated" date at the top of this page reflects the most recent revision.

Contact Us

If you have questions about this privacy policy or want to exercise any of your rights:

Email: [email protected]
Website: crashbytes.com