Privacy · Updated September 17, 2026

Local progress. Optional online play.

This policy covers Ferry Busy, this website, and support. The app offers optional guest multiplayer and expansion purchases through Apple. Ferry Busy is developed by Sunny Nagra.

Solo play

Solo play does not require an account and does not send gameplay, saved progress, identifiers, or settings to a developer-operated server. It includes no advertising, analytics SDK or tracking. It does not request camera, microphone, location, contacts, photo-library, or tracking access.

Progress, scores, the active watch, and sound/haptic preferences are stored locally using Apple’s app storage. Removing the app removes its on-device data. Device backups and any restoration of that data are managed through your Apple settings.

Expansion purchases

Northern Reaches is an optional permanent expansion purchased through Apple’s StoreKit, available when the app and purchase are released on the App Store. Development and TestFlight builds may use Apple’s test environment. The app checks signed Apple app and purchase transactions on the device to determine the purchase environment, ownership and revocation. Product details and purchase/restore requests use Apple’s services. Apple handles payment information; our room service does not receive payment-card details, purchase receipts or transaction identifiers.

The app uses verified ownership to unlock expansion content. In a multiplayer match it shares a temporary expansion-access flag with the other player, as described below; this does not grant that player a purchase. Apple may provide developer sales or transaction reporting under its App Store privacy information. Beta test purchases do not transfer to a future public release.

TestFlight and Apple services

If you install a development build through TestFlight, Apple may collect crash, usage, and feedback information through its testing service. Feedback you choose to submit may include screenshots, comments, and contact information. See Apple’s TestFlight privacy information.

Website

Cloudflare hosts and protects this website. Requests necessarily include technical information such as IP address, user agent, and requested URL. Cloudflare may process this information for delivery and security under its privacy policy. We have not added advertising or analytics scripts to this website.

Support

If you contact support, we receive the address, message, and attachments you provide. We use them to answer your request and investigate problems, retain them only as needed for that purpose or legal obligations, and do not sell them or use them for advertising. Google processes correspondence sent to our Gmail support inbox.

Optional online multiplayer

Ferry Busy offers guest harbor rooms, invitation links and Quick Match through a Ferry Busy service hosted by Cloudflare. Older versions offer Game Center matches only. Guest access uses a signing key stored in this app’s device Keychain; the service receives its public key and derives an installation-scoped player identifier. Game Center remains optional. If you use your Game Center identity with the room service, Apple identity verification establishes your player identifier and display name. These identities and rooms are separate from our other games.

The room service retains your player identifier, display name, public verification key, game compatibility version, room membership, selected invitations and presence times so you can reconnect and play again with the same person. Other members see your display name and availability. Rooms expire after 24 hours without activity; inactive profiles and recent invitees after 30 days; invitation links after ten minutes; session credentials after one hour. Expired records are cleaned hourly, which can add up to an hour. The server stores hashes of session tokens, not the tokens themselves. Request limits use one-minute counters keyed by a hash of your player identifier or network address. These are linked security data, not anonymous analytics; expired request counters are removed during regular requests or the hourly cleanup. Network-address hashes used to limit guest account creation expire after two hours plus cleanup time. We do not use them to derive location.

Live commands, harbor selection, readiness, session identifiers, simulation checksums and a temporary expansion-access flag pass through a signed WebSocket relay. The relay forwards these packets to your opponent without storing or logging their contents. Your opponent sees your match progress. We do not store your purchase receipt, payment details, solo progress or a global leaderboard on this service. Relay connections expire within an hour. Cloudflare processes ordinary network metadata for delivery and security.

In Multiplayer, leave your room and choose “Delete online room data” to remove the current identity’s server profile, memberships and invitations. This also removes the current identity’s request counter. Network-wide abuse counters expire on the schedule above. This does not delete your local campaign or purchases. Joining online play again creates a new server profile for your device identity. Contact support if you need help. No advertising, analytics SDK, cross-app tracking, chat, voice, friend-list upload or push notifications are included in this flow.

Game Center

Native Game Center invitations and matchmaking remain available as a separate option. Those matches exchange display names, game-scoped identifiers and the same gameplay commands through Apple’s service. Apple processes information under its Game Center privacy information. You can manage Game Center and multiplayer restrictions in your device settings.

Questions and requests

Contact rxv2dev@gmail.com to ask about this policy or request deletion of support correspondence. The developer cannot access or erase a local save on your device.