Your water. Your privacy.

Effective date: September 13, 2026. This notice covers the Liquid Horizon beta and its websites. Liquid Horizon's developer is responsible for the data handling described here.

Contact support@liquidhorizongame.com.

Accounts and access

We collect your email address, account identifier, sign-in session, invitation status, access request and chosen device platform to provide and manage beta access. Our account authentication and database service processes this information. If you use password sign-in, your password is sent to the authentication service; it is not included in your game save or saved sign-in session. Our email delivery service sends verification messages. Requesting access does not subscribe you to marketing.

The beta requires a verified account and active beta access. Eligible new accounts are admitted automatically while places are available; when the beta is full, new applicants wait for a place. Public information and support pages remain available without signing in.

If Sign in with Apple is available and you choose it, we store your Apple account identifiers, email-forwarding preference and encrypted refresh token while Apple remains linked to your game account. If Apple reports revoked access, we erase the stored Apple refresh token and sign out affected sessions without deleting your game account or progress. We keep the Apple sign-in association so you can reconnect. If Apple reports a permanently deleted Apple account, we delete game accounts whose only sign-in method is Apple; accounts with another linked sign-in method keep their game account and progress, and Apple is disconnected.

Game account deletion does not wait for Apple. The encrypted refresh token and identifiers used to finish disconnecting Apple expire after seven days and are removed at the next cleanup, or sooner when disconnection completes. Limited records used to avoid processing Apple account-change notices twice expire after 30 days.

Security checks and website requests

Our website hosting, content delivery and network security providers process requests, IP addresses, browser and device information, and operational or security logs to deliver the site and detect abuse. Network information may indicate approximate location; the game does not request precise location permission.

Cloudflare Turnstile checks for automated abuse before we send a code or accept a password login. It processes browser, device and network signals to protect this service and improve bot detection. On phones, the check can open in a system browser sheet. We do not send your email address, password or game progress to the challenge page. See the Turnstile Privacy Addendum.

Website activity totals

We count page opens and clicks on the homepage's Play and beta-access links as daily totals. These totals contain no visitor identifiers, cookies, IP addresses, referrers or full URLs. Repeat opens count again; they do not tell us how many different people visited. These website counts are separate from optional gameplay measurement and from our hosting providers' security logs.

We group new website totals by the approximate country supplied by our hosting provider. Only the country code is stored with daily counts; we do not save IP addresses or precise location in these totals. Country information can be unavailable or inaccurate, including when a visitor uses a VPN.

Website reports cover the last 90 days. Older totals are removed when the next page count or report is processed. We cannot link these totals to an account or reconstruct an individual visitor's history.

Game progress and device storage

After sign-in and beta admission, your ordinary sea is saved online with your account so you can continue on another device. This includes your progress, collection, cosmetics and saved settings. Cloud saving works whether optional gameplay measurement is on or off. Earlier separate ranked progress also remains linked to your account.

The game also keeps account-specific saves, recovery copies and changes waiting to sync on your device. Signing out keeps these recovery copies. If an earlier sea exists only on the device, we ask before importing it into your account; its original copy is kept for recovery. Another account does not automatically inherit your sea.

Local storage also holds settings and cached game files. Browser versions store sign-in tokens locally; the account website uses session storage, and the native app uses protected device storage for its sign-in tokens. Security checks may use storage needed to verify a request. Clearing device storage can sign you out and remove unsynced progress and recovery copies; it does not delete progress already saved to your account online. Let your sea finish syncing and export a recovery save before clearing storage or changing devices. Exported saves are independent copies under your control.

Player profiles and leaderboard

Creating an account creates a player profile. Other admitted players can see your assigned public alias or approved player name, equipped crab appearance, leaderboard position and lifetime water total from your ordinary cloud save. These totals are not independently verified. Your email address, account identifier and full save are not shown.

Your bio is optional. If you add one, other admitted players can read it on your profile. You can edit or clear it there. Profile and leaderboard visibility do not require joining the optional community. Do not include personal information in your name or bio.

Optional community features

If you join the community, we store your agreement to the community rules, chat messages, clan membership and role, friendships and friend requests, and your blocked-player list. World and Server messages are visible to admitted community members; Clan messages are available to current clan members. Private messages are available to the two accepted friends, subject to blocking. Email addresses are not included in public profiles. These records provide the features you choose; they are separate from optional gameplay measurement.

When you ask to share a drawn hat publicly, we retain that drawing for review by the owner. Only an approved version can appear to other players. Edits require a new review. You can keep your drawing private or withdraw it from public sharing; your private drawing can remain in your own cloud save.

Reports of abuse and moderation actions are restricted to authorized operators. Messages may be filtered or removed and community access may be paused after review. Blocking hides the two players' messages from each other and prevents new friend interactions; it does not automatically remove either person from a shared clan. Leaving the community stops your access, but does not erase earlier public messages. Account deletion immediately removes your public messages, friendships, requests, blocks and clan membership. Restricted report evidence and moderation records follow the separate retention periods below.

When you choose machine translation, the selected public message and chosen languages are sent to Cloudflare's translation service. We do not send your email, sign-in token or private game save to the translation provider. The original remains visible; translations can be inaccurate. Translation may be unavailable when its service or allowance is not ready.

Ranked fair-play records

For earlier app versions that offer separate ranked play, we keep account-linked minute totals of requested and credited taps and accepted tap batches, using the time requests reach the server. These help enforce the same ranked reward rules for everyone and review unusually sustained activity. They are security records, separate from optional gameplay measurement. They do not include tap positions, raw input timings or device fingerprints, and activity patterns alone do not cause automatic bans or penalties. Only authorized operators can see these reports. Records expire after 30 days, with removal on the next daily cleanup, and are removed when the account is deleted.

Optional gameplay measurement

Sharing gameplay events is off by default. After email verification and beta approval, players who have not chosen yet can use an unchecked, optional sharing checkbox before entering the game. Beta access and rewards are the same whether sharing is on or off. You can also change your choice in Settings. If you choose the expanded beta measurement option, we store account-linked progression, foreground play time, selected currency gains and purchases, reward activity, coarse music and sound volume settings, game version and platform. These help us understand pacing, returns and usability. We do not include email addresses, tap coordinates, advertising IDs, drawings or microphone recordings in these events. An earlier choice to share basic progress does not automatically enable the additional details.

Up to 80 events waiting to upload may stay on your device until sent, sharing is turned off, or that storage is cleared. New-format events record when play occurred and can upload for up to seven days; raw server events expire 90 days after receipt. To measure returning players accurately, a small record of your first consenting observation and its game version, platform and mode stays until you withdraw sharing or delete your account. Turning sharing off requests deletion of both events and this record. If offline, deletion is retried when the same account is next online and signed in.

Optional test advertisements

The native beta includes Google Mobile Ads with test rewarded ads only. It checks the availability of advertising privacy choices when the app starts. Ads are loaded or shown only when you choose an optional ad action, after any required privacy choices. Google may process your IP address, approximate location, app or device identifiers, ad interactions, and diagnostic or performance information during that process. A test ad is not a promise of zero data collection. See Google's privacy policy. Advertising privacy controls and a way to report an ad are available in account settings.

Android advertising ID access is disabled in this beta; other SDK identifiers may still be used. We do not request tracking permission or enable personalized advertising in this beta. Production ad placements and real-money purchases are disabled. You can play and receive free encounter rewards without watching an ad. Where offered, the game's ad privacy controls let you review your choices.

Support and other disclosures

Signed-in support messages are stored with your verified account so we can investigate and respond. Email sent to our support address passes through email forwarding and mailbox providers. Email correspondence is separate from in-game support records and is not automatically removed when a game account is deleted; contact us to request its deletion. Please do not send passwords, sign-in codes, payment details or private logs.

Providers receive the information needed for their roles described above. We may also disclose limited information when required by law or necessary to investigate abuse and protect accounts or the service. We do not sell personal information. Contact us for information about the recipients of your data and where it is processed, including processing outside your country.

How long information is kept

World, Server and Clan messages disappear from chat after 25 minutes. During beta, the owner can review a private log of these shared messages, their authors and send times for up to seven days for moderation purposes. The log holds at most 10,000 recent messages; older entries may be removed sooner. Deleting your account removes your entries from this log. Private messages are not copied to this log and disappear after 10 days. Expired chat and log entries are removed from active storage by the next successful cleanup, scheduled every minute.

A separate private copy of reported content is kept until the report is resolved and for 30 days afterward, including if its author deletes their account. This lets the owner investigate a report after the original message expires. Restricted moderation audit records expire after 365 days.

Public hat drawings remain while pending or approved, until replaced, withdrawn or the account is deleted. Rejected drawing data is cleared 30 days after review; a fingerprint and review result can remain with the account to recognize the same rejected design. Limited fingerprints and identifiers used to prevent duplicate message and hat submissions expire after 30 days. These records do not retain the original message text or drawing.

Authorized operators can review accounts and support requests and manage beta access and public-name visibility. Administrative changes produce restricted security records containing the operator and target account identifiers, action, reason and time. These records and retry receipts are retained for up to 365 days, with removal on the next daily cleanup after expiry, including when the target account has been deleted. They are separate from optional gameplay measurement.

Our configured daily cleanup removes optional gameplay events, signed-in support messages, pending access requests and legacy progress-review submissions after 90 days. Expired invitation records are removed after 90 days from expiry; invitation-attempt records are removed after two days. Removal occurs on the next cleanup run after the relevant period.

Accounts and account-linked ordinary and ranked progress remain until you delete the account. Hosting, email and other service logs and backups have separate retention schedules; removing active account records does not immediately erase every backup. Information needed to meet a legal requirement may be retained for that purpose. Local recovery copies and independent exports may remain as described below.

Your choices and privacy requests

You can withdraw optional measurement consent in the game, choose not to load ads, export an ordinary save, or delete your account online or through the game's account settings. Account deletion removes your player profile and bio, ordinary cloud sea, ranked progress and account-linked access, measurement and in-game support records. Private report evidence and restricted administrative security records follow the separate retention periods above.

Deleting through the updated game also removes that account's save and recovery copies from the device where you delete it, including an earlier device save you explicitly imported. It leaves other accounts' saves alone. Website deletion cannot clear the game's device storage, and deletion cannot remotely erase copies on other devices. Clear any remaining local app or browser data yourself. Independent exported saves and support email correspondence are not automatically erased.

Depending on the law that applies to you, you may have rights to access, correct, delete or receive a copy of your information, restrict or object to processing, withdraw consent, or complain to a privacy regulator. Withdrawal does not change the lawfulness of earlier consent-based processing. Contact us to make a request; we may verify your identity before disclosing or changing account data. You do not need beta access to contact us about privacy.

Children

This beta is intended for players aged 13 and older. Do not request an account if you are under 13. If you believe a child has submitted personal information, contact us so we can investigate and remove it. Additional age or parental-permission requirements may apply where you live.

Security and changes

We use encrypted connections, account verification and access controls to help protect information. No service or device can be guaranteed completely secure. Report a suspected security issue privately through Support.

Material changes will be explained here and in relevant app disclosures before changed features are enabled; we will obtain consent where required. This notice does not authorize unrelated new uses of information already collected. The beta does not take charitable donations or promise money or real-world water savings for playing.