Built for play, not tracking.

Who is responsible

Core Cutter, Android package com.garrykrey.corecutter, is developed and operated by Garry Krey. Privacy questions may be sent to garrykrey@gmail.com.

Data kept on your device

The game stores your high score, best wave, audio and accessibility settings, a locally derived age category, and any required parent-or-guardian PIN verifier or online-safety acknowledgment. The birth date entered at the neutral age screen is used only on the device to determine a category, then discarded. The birth date, age category, and parent PIN are never sent to Garry Krey, the leaderboard, or this support site.

For adult players who choose global rankings, the device may also store cached leaderboard pages, a chosen leaderboard name, an authentication token, locally hidden player identifiers, and a score submission waiting to retry. This information remains on the device unless described below.

Age check and family-safe mode

On first use, Core Cutter asks for month, day, and year without a preselected answer. The app calculates only one of four local categories: Junior (0–8), Child (9–12), Teen (13–17), or Adult (18 or older). It immediately discards the entered birth date and does not transmit either the date or derived category.

Until the age check is complete, online rankings remain unavailable. For any under-18 category, a parent or guardian creates a local four-digit PIN. Only a salted PBKDF2-SHA256 verifier is stored on the device, not the raw PIN. Under-18 mode does not display public names or the global leaderboard, create a leaderboard identity, or upload gameplay or ranked scores. The parent PIN is required for any profile change.

If an Adult installation receives a new date result in any under-18 category, adult online eligibility is cleared immediately to a pending local state before parent-PIN setup. Rankings are aborted and hidden during that setup. Any existing online identity is preserved separately but paused and inaccessible. The app makes no leaderboard requests in under-18 mode, and changing modes does not automatically delete the server record. A parent or guardian may use the PIN to return the installation to its accurate Adult profile and use the authenticated deletion control, or submit a request through the public deletion page.

Adults in the 18-and-older band see an online-safety reminder before they can open rankings. They may then choose whether to enter a public Name and join; declining leaves the full local game available.

Data collected for the global leaderboard

The leaderboard is unavailable to all three under-18 categories, so Core Cutter does not collect a public name, player identifier, gameplay, report, or ranking data from a minor profile. If an adult age 18 or older chooses to save a name and join, Core Cutter processes:

• the public name you enter and an internal player identifier;
• score, wave, verified active duration, ruleset, run seed, and relevant timestamps;
• the timing of accepted cut and Pulse actions, transmitted for replay verification; the raw trace is not retained after verification, but a cryptographic hash and result are retained;
• reports submitted through the leaderboard, including the reporting and reported player identifiers, selected report reason, and moderation status and timestamps;
• the connection IP long enough to derive a secret-keyed, one-way pseudonymous abuse-limit key; the application database does not store the raw IP, and the derived key is retained for approximately two days; and
• security and operational information that Cloudflare may process while delivering the leaderboard service.

For Google Play Data Safety, the IP-derived pseudonymous abuse-limit key is conservatively disclosed as Device or other IDs: collected only when an adult chooses the leaderboard, not shared under the Cloudflare service-provider treatment, not ephemeral because the key lasts about two days, and used for fraud prevention, security, and compliance. The leaderboard does not infer location from the IP.

The Name field is for a public player name. Do not enter a legal name, age, school, location, contact details, or other sensitive personal information.

Junior gameplay

The Junior category uses the same local-only privacy boundary plus a simplified play design for ages 0–8: one large eight-segment ring on one layer, a 60-second uncut window, slow 18-degree-per-second ring motion, fast core tracking, tap or swipe input, and a successful cut that resolves in about 0.8 seconds. Junior play has no armor, lock guards, extra layers, pickups, Pulse mechanic, damage, game-over state, or energy penalty.

Junior Mode plays no background music and does not use the imported swipe/tap sound bank; it uses only soft built-in interface and success sounds. Child, Teen, and Adult profiles use the shipped family-safe music catalog.

How the information is used

• Operate the global rankings and mark the current player.
• Replay runs to reject impossible or altered scores.
• Prevent spam, abuse, and attacks.
• Receive reports, provide on-device hiding, and enforce the leaderboard name rules.
• Respond to support, privacy, and deletion requests.

Core Cutter does not sell personal information and contains no advertising, behavioral analytics, advertising ID collection, or third-party advertising SDK.

What becomes public

Leaderboard participants make their chosen name, score, wave, verified run duration, and achievement day public. Authentication tokens, network information, precise timestamps, seeds, action traces, report details, and internal identifiers are not shown publicly.

Service provider and transfer

Cloudflare provides the hosted API, database, network delivery, and security controls needed for the leaderboard and delivers this support site. When you visit the support site, Cloudflare may process operational request data such as your network address, browser and device details, requested URL, timestamps, and security signals to deliver or cache pages and prevent abuse. Cloudflare may set strictly necessary operational or security cookies when needed, including cookies used for bot detection or a security challenge. Core Cutter does not use those cookies for advertising or cross-site profiling and does not set its own analytics or advertising cookies on this site.

Data may be processed where Cloudflare operates its infrastructure, subject to its service terms and privacy safeguards.

Google Play may process installation and app-version information when a Play-installed copy checks for an update. This is a Google Play platform service; Core Cutter does not send the local birth date, age category, parent PIN, name, or gameplay through the update check.

Under-18 gameplay and leaderboard code make no network request. If a player or parent explicitly opens Privacy, Families, or Support—including from the pre-age screen—Android opens this public site in the system browser. Cloudflare may then process the browser request and transient IP/security information as described above, but Core Cutter does not attach the birth date, age category, parent PIN, local progress, Name, or gameplay to the link. Terms and deletion instructions are available from the public site.

Security

Production leaderboard traffic uses HTTPS. Player and run tokens are high-entropy secrets; the server stores only one-way hashes. The Android app restricts network requests to the configured Core Cutter API and does not permit arbitrary web navigation.

Retention and deletion

Verified leaderboard identity, chosen name, and results remain until you delete the leaderboard account or they must be removed for safety, legal, or operational reasons. Pending and reviewed name reports remain while needed for investigation and enforcement; dismissed or actioned reports are removed after 90 days. Abandoned and rejected runs are removed after approximately seven days. Short-lived rate-limit records are removed after approximately two days. Raw action traces are evaluated during score verification and are not retained.

Use the in-app deletion control for immediate authenticated deletion, or visit the account deletion page to submit an external request. Account deletion removes the chosen name, player identity, linked runs and rankings, authentication credentials, and player-linked report records. Entering under-18 mode, deleting the app, or clearing local storage alone does not delete a leaderboard identity that was created earlier.

Leaderboard controls and moderation

Names are checked against length, character, reserved-name, and objectionable-language rules. Automated checks can make mistakes and do not replace review. In the leaderboard, use Report name to send a name to the developer for review and Hide player to remove that player’s rows from your device immediately. Hiding is local and is not sent to the service.

The developer may mask, rename, suspend, or delete names, identities, scores, or reports when reasonably necessary to enforce the Terms of Use and player-name rules, protect players, or comply with law.

Support and deletion correspondence

If you email the developer, the message, reply address, and case details are used only to respond, verify requests, protect the service, and document completion. Routine correspondence is deleted within 24 months after the case closes, unless a longer period is required by law or needed for an active security dispute.

Children and families

Core Cutter is designed for a mixed, all-ages audience. All three under-18 categories keep gameplay local and block the only public, user-generated-content feature. Garry Krey does not knowingly collect personal information from minor profiles through the game. Read the Family Safety Guide for Junior gameplay, under-18 privacy, and parent-control details.

If a parent or guardian believes a minor used an adult profile to submit information, contact garrykrey@gmail.com or use the deletion instructions.

Changes and contact

Material changes will be reflected here with a new effective date. Questions or requests may be sent to garrykrey@gmail.com.