The Scariest App — Privacy Policy

Last updated: 4 July 2026 · Pre-release / closed testing

Who this applies to

This policy covers The Scariest App (com.rlyehtech.scariestthings), the official native Android companion app for The Scariest Things (scariesthings.com), a horror-genre reviews website and podcast. The app is developed by R'lyeh Technologies in collaboration with The Scariest Things. Note: the app is in closed testing and not yet publicly available; this policy is published in advance and will be kept current through release.

Information the app handles

The Scariest App is designed around a simple rule: collect nothing, hold nothing off-device. In normal use the app handles only the following, and all of it stays on your device:

• Reading & listening activityWhich articles you've opened, podcast progress and completion, and similar in-app activity — used for "continue where you left off," your viewing diary, and on-device features. Stored locally; never transmitted to us.
• Your ratings & listsYour personal film ratings, watchlist and seen-log. These are yours, kept on the device.
• Settings & downloadsYour preferences (reading layout, audio EQ, storage rules) and any episodes you download for offline listening.
• WordPress.com sign-in (optional)Only if you choose to read or post comments. The app holds a revocable access token issued by WordPress.com — never your username or password.

The app does not request or store payment-card numbers, precise location, contacts, photos, messages, your date of birth, or your home address, and it has no user accounts of its own.

How sign-in works (WordPress.com OAuth)

Comments on The Scariest Things require a logged-in account, so reading and posting comments in the app is gated behind sign-in. That sign-in is handled entirely by WordPress.com's own OAuth2 flow:

1. 1
   You sign in on WordPress.com

   Authentication happens on WordPress.com's own page, opened in a secure browser tab. Your password and any two-factor codes are entered there — never in the app's own UI.

2. 2
   The app gets a token, not your password

   The app receives only a revocable access token, stored in Android's hardware-backed Keystore — encrypted, and never leaving secure storage.

3. 3
   Used only for your comments

   The token reads and posts your comments through the site's official API. It is never sent to R'lyeh, and you can revoke it at any time (see below).

Signing in is entirely optional — every other part of the app works without it.

Where the app gets its content

Article and podcast content comes from publicly available sources: The Scariest Things' WordPress REST API and its public podcast feed. Fetching public content does not identify you to us — there is no R'lyeh server in the middle, and the app makes these requests directly from your device over encrypted HTTPS connections.

Where your information is stored

All of your information is stored locally on your device. App data is held in encrypted on-device storage (a SQLCipher-encrypted database), and the WordPress.com token is held in Android's encrypted Keystore, protected by a hardware-backed key. Your data is excluded from Android cloud backup and device-to-device transfer, so it stays on the one device where it was created.

Who your information is shared with

The Scariest App has no backend server. The developer never receives, stores, or has access to your reading history, ratings, downloads, settings, or sign-in token.

The app communicates directly and only with: The Scariest Things (scariesthings.com) and its podcast media host for public content; and WordPress.com (public-api.wordpress.com) — and only if you sign in — to read and post your comments. All traffic uses encrypted HTTPS. The app contains no third-party advertising, analytics, or crash-reporting services, and does not sell or share your information with anyone.

Data security

• All network traffic uses encrypted HTTPS connections.
• App data is encrypted at rest on the device; the sign-in token is held in the hardware-backed Android Keystore.
• Cloud backup of the app's data is disabled, so nothing is silently copied off the device.

How to delete your data

Because The Scariest App stores everything locally and keeps no server-side copy, you are always in full control and can remove all of it at any time:

• Sign outSigning out of WordPress.com in the app discards the stored token. You can also revoke the app's access from your WordPress.com account's Connected Applications settings at any time.
• In the appUse Settings → Clear all data to erase your history, ratings, downloads and preferences from the device.
• Or uninstall the appRemoving The Scariest App from your device deletes all of its stored data.

Since the developer holds no copy of your information, there is nothing further to request — deleting it on your device deletes it completely.

Children's privacy

The Scariest App presents horror content intended for adult audiences. It is not directed to children and does not knowingly handle data from children.

Changes to this policy

The app is in active development, and this policy may be updated as features are finalized. The current version will always be posted at this page with a revised "Last updated" date.

Contact

Questions about this policy or your data can be sent to: scariesthings@rlyehtech.com.