CASCADE HEIST: BUS RIVALS / INSTADYN LLC
Privacy Policy
This policy explains what happens to information when you play Cascade Heist: Bus Rivals on Android, when you play it in the web player, or when you visit this website. Solo play stays on your device; online friend matches use a small guest record on our server, and this site sets no cookies of its own.
Scope and operator
INSTADYN LLC makes the game Cascade Heist: Bus Rivals for Android, iPhone and the web player, and operates the website at cascadeheist.com. The Android app is the first version; the iPhone app and the web player are not released yet. This policy covers all of them, and INSTADYN LLC is the controller of the data it describes.
Playing on your own
Solo levels and matches against the bot run on your device, and nothing leaves it. In VS, your opponent may be another player or a computer-controlled one. Progress, scores, gold, gems, items and settings are saved only on the device, and we cannot see or restore them. On a phone the save and the sign-in credential sit in the app’s own storage; uninstalling the game or clearing its data removes them. On iPhone, Apple’s backup includes them by default, so restoring a backup onto a new iPhone brings back the same guest. In the web player they sit in your browser’s storage for the game’s site, and no cookies are set; the storage only does what you asked for, saving progress and keeping you signed in, clearing the site’s data removes it, and private windows and some browsers clear it sooner, so the next online game starts a new guest. Playing online is optional; the rest of the game works without it.
Online friend matches: the guest identity
The first time a player opens online play, our server creates a guest identity. There is no sign-up anywhere in the game: no email address, no password and no account list. We collect a random guest ID made by our server. It is not tied to an email address, phone number, Google account, device identifier or advertising ID. Along with it we hold a generated display name such as “Brave Fox 42”, which the player cannot type or change and which the friend sees; a sign-in credential, kept on the device, with only a one-way hash stored on the server; and account times, such as when the guest was created and when it last signed in.
Online friend matches: rooms and matches
When a player creates or joins a friend room with a code, we hold the room code, the two guests in the room (their IDs and generated names), and when the room was created and joined. In the web player the code also travels in the invite link, so anyone who receives that link can see it. During a match we record the boards, every move and power used, timings, scores and the result. Match records are stored under the seats “P1” and “P2” and are linked to guests only through the friend room.
What the game does not collect
No real name, email address, phone number, contacts, location, photos, files, device identifiers or advertising ID. No free-text chat, and no names typed by players. No ads, analytics or tracking SDKs, and no purchases in this version.
IP addresses
Our server reads the connecting IP address only to limit how many guests can be created from one address (ten a minute). Our code does not store it. Cloudflare, which hosts the server, processes it as part of delivering requests.
Why we hold this data
Only to run online friend matches: to identify the guest, keep them signed in, connect two friends with a room code, run and settle the match fairly, and limit abuse.
Sharing
We do not sell or share this data. Cloudflare, Inc. hosts the server and processes the data for us as our service provider. A friend sees the player’s generated display name, and the player chooses who to send a room code or invite link to. On the web player the invite is a link containing the room code, so the code also appears in the recipient’s browser history and in link previews of the app that carries the message. Nobody else receives it.
Where the data is processed
Cloudflare runs the server in its global network, including in the United States. For transfers of data out of the EEA, Switzerland and the UK, Cloudflare says it relies on the EU standard contractual clauses, and for transfers to the United States it is also certified under the EU-U.S. Data Privacy Framework and its UK extension.
Security
All traffic between the game and our server is encrypted in transit, over HTTPS only. The sign-in credential is stored on the server only as a one-way hash.
How long we keep it
Guest, room and match records are kept until the player asks us to delete them. Automatic expiry is planned before the full release. See the data deletion page for how to ask.
The website: what it does not do
This site describes a game in development. It has no accounts, no sign-up, no contact form, no uploads and no payments. The platform buttons open a status note rather than a store listing. There is nothing here to submit, and we do not build profiles of visitors.
Information you send us
If you write to support@instadyn.com, we receive your email address and whatever you choose to include, such as your name, your message and any screenshot. We use it to answer you and to keep a record of the request. Please do not send passwords, card details or private documents. Delivery passes through our email providers.
Hosting and technical records
This site is a static build served by Cloudflare Pages, the hosting platform of Cloudflare, Inc., on Cloudflare’s global network. Like any web host, Cloudflare processes request information such as IP addresses, browser and device details, the pages requested, timestamps and security events in order to deliver the site and protect it from abuse. That processing takes place on servers in various countries, which may include countries other than your own.
Cookies and tracking on the website
The site sets no cookies and runs no advertising, analytics, session-replay or third-party embed code. Fonts and images are served from this site, so loading a page does not call out to a font or image service. We do not sell or share personal information for advertising. Links to other sites, including instadyn.com and any store listing added later, lead to services with their own policies.
Retention and deletion of correspondence
We keep support correspondence for as long as it takes to handle the request and to meet our business and legal obligations. We keep no request logs for the site itself; Cloudflare holds the operational data it processes for the site under its own retention practices, described in Cloudflare’s privacy policy. Ask us to delete a conversation and we will do so, unless we are required to keep a record.
Your choices and rights
Write to support@instadyn.com for any request: to ask what we hold about you, to have it corrected or deleted, or to ask for a copy of it. Players in the EU and the UK can also ask us to restrict processing or to object to it, and can complain to their data-protection authority. We answer requests within one month, and deletions are done within 30 days.
Children
The game and this site are made for a general audience of players aged 13 and over, not for children, and we do not knowingly collect information from children. If a parent tells us a child under 13 played online, we delete that guest. If a child has emailed us and you would like that correspondence removed, write to us and we will delete it.
Changes and contact
We update this policy when the game or the site changes; for example, purchases are planned for a later version. For any privacy question, write to support@instadyn.com. Effective 10 October 2026.
Deleting the server record
The data deletion page explains how to ask us to delete the guest, room and match records our server holds. Clearing the game’s data on your device removes the local progress and the sign-in credential, but not the server record.