Privacy Policy — Damage Control

Last updated: 24 September 2026

Damage Control is a texting game for iPhone made by Andreas Skyum Paulsen ("we", "I"). This policy explains exactly what the app does with information. It is the same explanation you can read inside the app under Settings → What leaves your phone.

The short version: the game is designed to work without sending anything anywhere. One optional feature — live replies — sends what you type to a server so a language model can write the other person's answer. It is off until you say yes, and you can turn it off again at any time.

1. What stays on your phone

All of this is stored on the device and is never uploaded:

• the name, age and gender you enter when you first open the app
• your progress: which situations you have played, finished or bought
• your ranks, personal bests, streak and endings
• the conversations themselves — every message in every run
• your settings, including whether live replies are on

Deleting the app deletes all of it. There is no account, no sign-in and no backup on our side, so there is nothing for us to delete on your behalf.

2. Live replies (off by default)

The app asks before it is ever switched on, and you can change your answer in Settings at any time.

With live replies off

Nothing leaves the device. Every reply comes from a script written into the app. The app makes no network request for gameplay at all.

With live replies on

Each turn sends the following to our server, which passes it to Anthropic:

Your age, gender, progress, ranks, streak, history, purchases and endings are never sent, whether live replies are on or off.

What we keep. The server keeps no conversation logs. It records how many tokens each turn used and which situation it belonged to, with no message text and no identifier attached, so that running costs can be measured.

Live replies cost us money per message, so each device gets a fixed number of them free. Enforcing that means the server keeps one number — how many live replies this identifier has used — for as long as you have the app. The hourly and daily rate-limit counters expire on their own within 48 hours, and the counter holding your network address expires within 2 hours. None of these records contain anything you typed.

The random identifier is stored in your device's keychain, which means it survives deleting and reinstalling the app. That is so the free allowance is not reset by a reinstall. It is still a random value created on your phone; it is not your Apple Account, your name or your advertising identifier, and it cannot be used to look you up anywhere else.

Who processes it. Two companies act as processors on our behalf:

• Cloudflare, Inc. hosts the server that receives the request. https://www.cloudflare.com/privacypolicy/
• Anthropic PBC runs the model that writes the reply, and the check that screens a rehearsal before it starts. Requests are sent through the commercial API, under which Anthropic does not use the content to train its models. Anthropic keeps request content for a limited period under its own retention terms (at the time of writing, up to 30 days) to run the service and detect misuse, and then deletes it. It never receives the random identifier. https://www.anthropic.com/legal/privacy

Both may process data outside the EU/EEA. Transfers rely on those companies' Standard Contractual Clauses.

2a. Rehearsals

A rehearsal is a conversation you describe yourself, so it sends more than a live reply does. With live replies on, starting one sends what you wrote about the other person — what you call them, what they are to you, what happened, what you want out of the conversation, how they behave under pressure and what you are dreading they will say — along with each message you then type.

Two things about that are worth being plain about, because they involve somebody who is not you:

• You are describing a real person who has not agreed to it. Write as little as you need to. We do not ask for their full name, and we would rather you did not give it.
• It is screened once before it starts. The setup is checked automatically to catch the cases where playing the other person would be the wrong thing to do. If it is declined you are told why, nothing further is sent, and no record of the setup is kept.

With live replies off, none of this applies: a rehearsal runs entirely on your phone.

The conversation is stored only on your phone. Each message you type is sent the same way a live reply is, to get the answer, but no copy is kept on our side. It is never ranked or added to your history, and there is no way to share or export it from the app.

3. Purchases

Paid situations and rehearsal credits are sold through Apple's In-App Purchase. Apple handles the payment; we never see your card, your Apple Account or your billing address. The app only learns which situations you own and how many rehearsals you have left, and that information stays on the device. The number of rehearsals you have bought is sent with a rehearsal request, so the server can size your allowance; nothing else about your purchases is. Apple's own handling of the transaction is covered by Apple's privacy policy: https://www.apple.com/legal/privacy/

4. Usage data

There is none. The app contains no analytics and sends nothing about how you play. Your history, ranks and endings are recorded only on your phone.

5. Tracking and advertising

There is none. The app shows no ads, contains no advertising or analytics SDKs, does not use the Advertising Identifier, does not track you across other companies' apps or websites, and does not sell or share personal information.

6. Children

Damage Control is written for a general audience and is not directed at children under 13. It does not knowingly collect personal information from children under 13. If you believe a child has used live replies and you would like the associated rate-limiting records removed early, write to the address below.

7. Your rights

Because the game stores its data on your device and keeps no account, most rights are exercised directly: you can view everything the app holds inside the app, reset your progress in Settings, and delete everything by deleting the app.

If you are in the EU/EEA or the UK, the GDPR gives you the right to access, correct, erase, restrict or object to processing, and to data portability, for the limited data our server handles. The lawful basis for processing the content of a live reply is your consent (Article 6(1)(a)), which you give in the app and can withdraw in Settings at any time; the lawful basis for the short-lived rate-limiting records is our legitimate interest in preventing abuse of a paid API (Article 6(1)(f)). You also have the right to complain to your local supervisory authority — in Denmark, Datatilsynet.

To make a request, write to the address below. The only record our server holds against a device is the allowance count described in section 2 — no messages, no names. If you send us the identifier (Settings shows it at the bottom of What leaves your phone) we can delete that count for you; deleting it resets the free allowance, so we will simply do it and say so.

8. Changes

If this policy changes in a way that affects what is sent, the app will ask again before sending anything under the new terms. The date at the top of this page always reflects the current version.

9. Contact

Andreas Skyum — andreasskyum123@gmail.com

Write for anything at all: privacy questions, data requests, or a bug.