Joystick privacy notice

Joystick is a phone controller for games on a screen. This notice covers the paid Joystick apps for iPhone, iPad and Android that Epona Solutions Ltd publishes. It is short because the apps collect very little.

Last updated 23 October 2026

Who is responsible

Epona Solutions Ltd is the data controller for the apps and for any enquiry you send us. Registered in England and Wales, company number 07763561. Registered office: 2b Gaol Street, Oakham, Rutland, LE15 6AQ. Company details are also on Companies House. For anything on this page, email info@epona-solutions.ltd.uk. There is no account to create and no sign-in.

What the apps do

You pair the app with a game screen by scanning a QR code or typing a short code. While you play, the app sends your controller inputs (button presses, stick and tilt values) and your three-letter initials to the game screen through a controller relay. The game can send layouts, haptic feedback and scores back to your phone.

The relay is a small server that passes controller messages between your phone and the game screen. Pairing uses the relay at controller.pallasite.app. It is run by ForgeSworn, an open-source project, not by Epona. The relay checks every message against a fixed list of what a controller may send, so it carries inputs and game state and nothing else: no typed messages, no images, no files.

What is processed, and where

• On your device only. The camera is used to read the pairing QR code, and the motion sensors are used to turn tilt into game input. Neither camera images nor raw motion readings leave your phone. Your initials and your running tournament totals are saved on the device.
• Secure storage on your device. So that a dropped connection can resume, the app keeps a short-lived resume credential in the iOS Keychain or Android Keystore.
• Sent to the relay and game screen. Your inputs, your three letters, your tournament total, the session code, and the resume credential. The relay also sees your network (IP) address, as any server you connect to does, and uses it for abuse limits.
• Sent to us. Nothing, unless you email us. Then we receive your email address and whatever you write.

There are no adverts, no analytics, no tracking, no accounts, and no sale or sharing of data for marketing. Nothing is used to profile you or make automated decisions about you. Initials are not checked for meaning, so please pick ones you are happy for other players on the same game to see.

Why, and the lawful basis

• Pairing, inputs, initials and scores: performance of the contract you enter by installing and using the app. The app cannot work as a controller without them.
• Network address and abuse limits on the relay: legitimate interests in keeping the service secure and available.
• Answering your email: legitimate interests in replying to people who ask us for help.

Who else receives it

• The relay operator (ForgeSworn) receives the session data above while you are connected. It acts as a controller for what the relay processes.
• Apple or Google handle your purchase, payment, receipts and refunds under their own terms and privacy notices. We do not receive your payment details.
• Our email provider carries any enquiry you send us.

Nobody else. Epona does not transfer personal data outside the UK for these apps.

How long it is kept

• On your device, until you remove it. Use Leave to remove the current pairing's resume credential. From the lobby, use Reset saved name and scores to clear your initials, totals and all saved credentials. Deleting the app removes everything it stored.
• On the relay, session state is held in memory only and cleared within minutes of a session ending or the relay restarting. Short-lived address counters for abuse limits expire after about a minute of inactivity. The relay does not keep a log of what you played.
• Emails to us, while the conversation is live and for up to 24 months afterwards, then deleted.

Children

The apps are for people aged 13 and over and are not aimed at children under 13. They do not ask for a name, date of birth or any other personal detail, and the app does not verify age. Apple's and Google's own family settings still apply to purchases.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct or delete it, restrict or object to our using it, or ask for it in a portable form. Email info@epona-solutions.ltd.uk and we will reply within a month. Most of what the apps handle is on your own device, where you can clear it yourself as described above. We cannot look up a relay session from its code alone, and relay session data is gone within minutes, so for most requests there will be nothing further to find.

If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

If the apps start handling data differently, we will update this page and the date above before the change reaches the stores. For help using the apps, see Joystick support. The notice for this company website is at /privacy/.