LAST UPDATED OCTOBER 2026
Privacy
Sunk Cost keeps your pile on your phone and backs it up to our server so it survives a new phone. There is no account to create, and nothing that identifies you is sent anywhere.
What the app stores
Your games, their status, hours played, ratings, reviews and any links you have shared into the app are written to a database on your device, which is what the app reads from. A copy is kept on our server so your pile can be restored or used on another device — see backup and sync below.
What leaves your device
Four things. The fourth only if you ask for it.
When you search for a game to add, the search text is sent to our lookup service, which forwards it to the IGDB games database and returns the matches. That request carries the words you typed and nothing else — no account, no device identifier, no advertising ID, and no record of what is already in your pile.
Our service keeps recent search results in memory for a short time so that repeating a common search does not hit IGDB again. That cache holds the search text and the result, not who asked. Server logs may record the fact that a request occurred, in the ordinary way any web server does.
The app works without this. With no network, search is unavailable and everything else — your pile, tonight's picks, finishing and rating games — continues to work.
Your pile is backed up to our server, automatically — see backup and sync.
Separately, the app checks for its own updates when it starts. That request carries the version numbers of the build you are running and nothing from your pile — see app updates below.
What we do not do
- No analytics in the app, and nothing that follows you between apps or across the web. Two features need an address or an identifier to work at all — notifications and updates — and those two, described below, are the whole of it
- No advertising, and no advertising identifiers
- No selling or sharing of personal data — there is none to sell
- No accounts, email collection or profiles
- No location, contacts, photos or files
Backup and sync
The app copies your pile to our server in the background, and keeps the copy up to date as you use it. This is on for everyone and needs no account.
What travels: everything in your pile — the games and their details, status, hours, play sessions, ratings, reviews, finish dates, and the links, notes and recommendations you have saved into the app. Unlike sharing, which leaves your reviews and notes out, a backup has to hold all of it to be a backup.
How it is tied to you: it is not. Your phone makes a long random sync code the first time it backs up, and your pile is stored under that code alone — no name, no email, no account, no device identifier. We keep only a scrambled form of the code (a hash), so we cannot read it back. Anyone who has your code can see and change the pile, which is why the app only shows it when you ask for it in Settings, to use your pile on another device.
Where: our server runs on Serverpod Cloud, in Europe, and every transfer is encrypted in transit. As with any web service, the server logs that a request happened, including the IP address it came from; the address is also held briefly in memory to limit how often new sync codes can be made.
Removing it: Settings → Delete synced data deletes the copy on our server at once and stops backing up until you choose to sync again. The pile on your phone stays. Reset sync code makes your old code useless, if you think someone else has it. If you no longer have the app, write to hello@thebeastapplications.com with your sync code and we will delete the copy; without the code we have no way to tell which pile is yours.
Sharing a pile
Tapping Share my pile in Settings uploads a copy of your pile to us and gives you a link. Anyone holding that link can read it, in a browser or in the app. Nothing is shared until you tap it, and it never happens on its own.
What travels: each game's identifier in the IGDB database, its status, the hours you have logged, the rating you gave it, and the dates you added and finished it — plus the summary figures the app shows you. Dates go as days, not timestamps.
What does not: your reviews, your notes, and who recommended a game to you are never part of a shared pile, whatever you share. They are in your private backup, which no link can reach. Neither does anything identifying you — there is no account, no email, no device identifier. A shared pile is addressed only by a random code, and it is not listed, linked or indexed anywhere.
Stop sharing, in the same place you started, deletes the copy and its key from our server. The link stops working immediately, for everyone. If you have uninstalled the app and want a shared pile removed, write to hello@thebeastapplications.com with the link.
Share cards
Images of your stats are drawn on your device and handed to your phone's share sheet, along with a short caption repeating the card's own figure and a link to our website. Whatever you then send them to — a messaging app, a social network — is governed by that app's own privacy policy, not this one. We never see the image or the caption.
Purchases
If in-app purchases are offered, they are processed by Google Play. We never see your payment details. Purchase status may be handled by RevenueCat on our behalf solely to tell the app whether a subscription is active; see Google's and RevenueCat's policies for how they handle that.
App updates
Some fixes reach you as a patch rather than as a new download from the store. That is handled by Shorebird, an update service acting for us. When the app starts, it asks Shorebird whether a newer patch exists for the version you are running, and downloads it in the background if one does.
What that request carries: the app's identifier, the release version and patch number already on your device, your platform and processor type, and an install identifier — a random number the updater generates the first time the app runs and keeps in the app's own storage. It is not your advertising ID, your device ID, or anything derived from your phone; Shorebird never reads those. It is not shared with anyone, and it is used to count how many installs exist, which is how we are billed. Uninstalling the app, or clearing its data, destroys it.
Nothing from your pile is ever sent with an update check — no game, no hours, no rating, no review. Shorebird states that it does not process, transmit or store personal information about the users of apps like ours, and it has no way to tell one of you from another or to send a patch to a particular person. As with any web service, its servers log that a request happened, including the IP address it came from.
This check runs at startup, before you are asked anything, for the same reason the push token is created then: an app that only updated after you went looking for a settings switch would not get fixes to the people who hit the bug. It is how the app repairs itself, not a way of watching you use it.
Notifications
Reminders are delivered by OneSignal, a push service acting for us. To reach your phone at all, a push service needs an address for it: your device asks Google — or Apple, on an iPhone — for a push token, and OneSignal stores that token so it can send to it.
That token identifies a device, not you. No account is attached to it, and nothing from your pile — no game, no number, no review — is ever sent with a notification or stored against it.
The token is created when the app starts, which is before you are asked about notifications: registering with the push service and being allowed to show you something are two separate things. Declining the prompt means nothing is ever shown to you, but it does not delete the token. Uninstalling does.
At most one reminder a week, and never to sell you anything. Each kind has its own switch in Settings.
The waitlist
The waitlist is on our website, not in the app. It is the one place we ask for an email address, and it is entirely optional — the app has never needed one and still does not.
If you join it we store what you typed: your email address, your name if you chose to give one, the platform you picked, and the date. Nothing else is collected — no cookie is set, no analytics script runs on that page, and the form is not shared with an advertising network or any other third party.
It is used for one thing: to write to you when there is a release to install. That is one email, from waitlist@sunkcost.app. We do not sell the list, and nothing else is ever sent to it.
Ask us to remove you at any time — one line to waitlist@sunkcost.app and the entry is deleted, with no reason needed. The whole list is deleted once the releases it exists for have gone out.
Children
The app is not directed at children under 13 and collects no personal data from anyone.
Your rights
Because your data stays on your device unless you share it, you already hold all of it. Deleting the app deletes everything. There is no copy of it for us to export, correct or erase on request — if that changes, this page changes first.
Changes
Material changes will be reflected here with a new date above. Continued use after a change means you accept it.