Privacy Policy

01Who we are and what this policy covers

Canyon Peak Holdings Inc. is a Utah corporation headquartered in Heber City, Utah. It is the parent company of Canyon Peak Technologies, LLC, which develops and operates our software products, and Canyon Peak, LLC, our operating and services company. Canyon Peak, LLC in turn owns FinishAtlas, LLC, which operates the Finish Atlas storefront. Unless a product-specific section says otherwise, the Canyon Peak company that publishes or operates a product is the party responsible for your personal information, and Canyon Peak Holdings Inc. sets group-wide privacy policy.

This policy applies to:

• our corporate website at canyonpeak.co and any other website that links to this policy;
• PremLogix, our property-operations platform for property managers and their residents (web);
• Finish Atlas, the route-art print storefront at finishatlas.com operated by FinishAtlas, LLC (web);
• Duskbloom, our puzzle game for iPhone and iPad;
• Emberfall: Realm of Legends, our fantasy adventure for iPhone and iPad (in development);
• MyFitness Journal:Tracker, our training planner for iPhone; and
• any future app or service that displays or links to this policy.

Some products publish additional terms (for example, Finish Atlas has its own Terms of Use and Shipping & Returns pages, and PremLogix client organizations may publish their own privacy notices to their residents). Where a product-specific notice conflicts with this policy, the product-specific notice controls for that product.

02Product-by-product summary

We design our products to collect as little as they can. The table below is a plain summary; the sections that follow give the detail.

Emberfall: Realm of Legends

Emberfall is in development for the United States market only. The following describes its offline game and the connected, purchase, and advertising features when available in the version you use. Public online play has not launched.

Offline adventures

Your character, encounters, settings, and daily bonus claims are stored on your device. Offline characters are not uploaded to the realm service or Game Center. You can export or replace offline progress in Settings. Device backups and exported save files may retain copies under your control.

Connected play and Game Center

If you connect to a realm, we store an account identifier, a hash of your recovery key, game progress, and action records to operate the game, synchronize progress, and prevent duplicate actions. Your assigned traveler name, level, dragon victories, and authored achievement notices are visible to other realm players. The recovery key is stored in your device’s Keychain and sent to the configured realm over HTTPS. Network addresses are used to limit abusive requests; Render, our realm hosting provider, may retain operational access logs.

When you use Game Center, Apple authenticates your player account. The realm links your verified Game Center identifier to your online character and stores expiring device sessions. Confirmed online progress is submitted to Game Center leaderboards and achievements. Apple handles Game Center invitations, friends, and multiplayer matches under Apple’s privacy policy. We do not receive your Apple account password.

Optional ads and purchases

When advertising is enabled, Emberfall uses Google AdMob for an optional rewarded video granting three bonus turns and a Town banner. Ad-free ownership suppresses these ads. We request non-personalized ads and do not request App Tracking Transparency permission. Non-personalized ads still involve data processing: Google’s SDK may process IP addresses and approximate location derived from them, device or app identifiers, diagnostics, and ad interactions for ad delivery, measurement, and fraud prevention. See Google’s explanation of partner-app data use.

Google’s User Messaging Platform manages required consent before ads are requested. Where required, you can revisit choices through Settings → Ad privacy choices. Optional purchases are processed by Apple; Emberfall verifies purchase entitlements to unlock and restore benefits. We do not receive your payment card details.

Retention, deletion, and support

Offline saves remain on your device until replaced or removed; deleting the app removes its local save, but does not remove exported files or device backups. Connected account and gameplay records are kept while the realm account exists. Delete realm account in Settings removes the active server account and associated gameplay records, including linked identities and sessions. This does not delete your Apple Game Center profile, achievements, or Apple purchase records. Manage those through Apple.

The online service is pre-release; its backup and operational-log retention schedule will be published before public online launch. For help, access requests, or deletion questions, email info@canyonpeak.co. Include the product name and a description of your request; do not send your recovery key or Apple password.

03Information we collect

Information you give us

• Contact and account information. Name, email address, phone number, mailing address, password (stored only as a salted hash), passkey public keys, multi-factor authentication settings, and language preference when you create or are invited to a PremLogix account or contact us.
• Communications. The contents of emails, support requests, and other messages you send us, and your communication preferences (for example, whether you want notices by email or text).
• Newsletter sign-up (Finish Atlas). Your email address and, optionally, first name, if you choose to join the Finish Atlas mailing list through our email provider, Kit.
• Content you create in a product. In MyFitness Journal:Tracker, workouts, notes, and goals you enter. In Finish Atlas, the title, date, and style choices you make for a print. In PremLogix, records you create as an authorized user.

Information client organizations enter into PremLogix

PremLogix is used by property managers, landlords, and community operators ("client organizations") to run their properties. A client organization may enter information about its residents, applicants, occupants, owners, vendors, and staff, including: names, contact details, emergency contacts, physical and mailing addresses, dates of birth and driver's license or state ID numbers (used only to prevent duplicate identity records), photographs, vehicle details, lease and account history, payment and ledger records, maintenance and inspection records (including photos and documents), and legal-case records. We process this information on behalf of the client organization. See Section 16.

Information collected automatically

• Server and security logs. IP address, browser type, device type, requested pages, timestamps, and (for signed-in PremLogix users) an audit trail of significant actions. PremLogix encrypts stored IP addresses in audit records.
• Session data. Cookies or tokens strictly necessary to keep you signed in to PremLogix and to protect against fraud (for example, Cloudflare Turnstile bot protection on sign-in forms).
• Operational telemetry. PremLogix uses Azure Application Insights for performance and error monitoring. Telemetry uses pseudonymous identifiers and does not include request bodies or record contents.
• Photo metadata. Photos uploaded to PremLogix (for example, inspection evidence) may contain metadata such as capture time and GPS coordinates embedded by the camera. This metadata is treated as untrusted context and is not used to track you.

Our corporate website and Finish Atlas do not use analytics, advertising pixels, or tracking cookies. Duskbloom and MyFitness Journal:Tracker do not contain analytics or tracking software of any kind.

Information from third parties

• App stores. When you purchase the full version of Duskbloom, Apple processes the transaction and gives us a purchase receipt that does not identify you personally.
• Payment processors. When a client organization or resident pays through PremLogix, Stripe provides us with transaction status and a token. We never receive or store full card numbers, CVV codes, or bank account and routing numbers.
• Sign-in providers. If PremLogix offers and you choose Sign in with Apple or Google, we receive the identifier and email address those services share with us.

Information we do not collect

• We do not collect precise location from any app. Finish Atlas reads the coordinates in the GPX file you choose, entirely in your browser, and does not send them to us.
• We do not access your contacts, photo library, camera, or microphone in Duskbloom or MyFitness Journal:Tracker. MyFitness Journal:Tracker's HealthKit access is described in Section 7.
• We do not use device advertising identifiers for tracking and do not request App Tracking Transparency permission in any app.
• We do not collect Social Security numbers, and PremLogix is designed to reject them.

04How we use information

We use personal information to:

• provide, operate, secure, and support our products and websites;
• create and manage accounts, authenticate you, and send security notices such as password-reset links and credential-change alerts;
• process payments and purchases, issue receipts, and prevent fraud;
• send the transactional and service messages described in Section 6 and in our SMS & Email Messaging Policy;
• respond to your questions and requests;
• monitor performance, diagnose problems, and improve our products using aggregated or pseudonymous data;
• comply with law, enforce our terms, and protect the rights, safety, and property of our users, our clients, and Canyon Peak; and
• for Finish Atlas newsletter subscribers only, send the marketing emails you asked for.

We do not sell personal information, and we do not use personal information for behavioral advertising. We do not use health data, financial data, or resident data from PremLogix to train artificial-intelligence models or for any purpose other than providing the service.

05How we share information

We share personal information only in the following circumstances:

• Service providers. Companies that host, secure, deliver, or support our products under contracts that restrict their use of your information to providing services to us. Our current providers by function are listed below.
• Client organizations (PremLogix). Information about a resident or account is available to the client organization that manages that property, as described in Section 16.
• Payment and fulfillment partners you transact with directly. Stripe (payments), Printify (Finish Atlas print fulfillment), and Apple (App Store purchases) collect information directly from you under their own privacy policies.
• Legal and safety. When required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of any person or to enforce our agreements.
• Business transfers. As part of a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction. When you ask us to share information or consent to sharing.

Our service providers

06Text messages and email

We send two kinds of messages: transactional and service messages (such as password resets, security alerts, payment receipts, rent and maintenance notices, and urgent safety notices) and, only where you have separately opted in, marketing messages (currently limited to the Finish Atlas email newsletter). We do not send marketing text messages.

Text messaging from PremLogix is offered only where a resident or user has affirmatively opted in to receive notices by text from a specific client organization. Providing a phone number on a lease or application is not consent to receive text messages. You can opt out at any time by replying STOP, get help by replying HELP, or change your preference in your PremLogix profile. Message frequency varies; message and data rates may apply. Security notices required to protect your account, and urgent safety notices required by law or a lease, may still be sent by email or shown in-app after you opt out of text messages.

Full terms, including sample messages and how consent is recorded, are in our SMS & Email Messaging Policy.

07Health and fitness data (MyFitness Journal:Tracker)

MyFitness Journal:Tracker can read data from Apple Health only after you grant permission for each data type in the iOS permission dialog. Depending on what you allow, this may include workouts, resting heart rate, heart-rate variability, VO₂ max, active energy, step count, body mass, sleep analysis, and dietary energy and macronutrients. With your permission it can also write completed workouts and active energy back to Apple Health.

• Health data is processed and stored only on your device. MyFitness Journal:Tracker has no server component and does not transmit health data to Canyon Peak or anyone else.
• We never use health data for advertising, marketing, or data brokering, never sell it, and never share it with third parties. Health data is never used for use-based data mining beyond improving your own experience in the app.
• You can change or revoke HealthKit permissions at any time in the iOS Settings app under Privacy & Security > Health. Deleting the app deletes all app data on your device; data you chose to write to Apple Health remains in Apple Health under your control.
• If a future version offers analysis that requires sending data off your device, we will ask for your explicit, separate consent first, minimize the data sent, and update this policy before that feature is released.
• MyFitness Journal:Tracker is a wellness tool. It does not diagnose, treat, or replace medical care.

08Advertising in Duskbloom

The free version of Duskbloom shows occasional interstitial advertisements served by Google AdMob. The one-time purchase of the full game removes them. Because Duskbloom does not collect your age, every ad request is configured for the strictest treatment: non-personalized ads only, tagged for users under the age of consent, with a general-audience content rating, and with publisher first-party identifiers disabled. Duskbloom does not request App Tracking Transparency permission and does not share your advertising identifier for tracking.

To serve and measure ads, Google may receive your device's IP address, coarse location derived from it, device and app information, and ad-interaction events. Google's use of this information is described in How Google uses information from sites or apps that use our services. Where consent regulations apply, Duskbloom shows Google's consent form at first launch, and you can revisit your choices at any time from the "Advertising privacy options" button in the app's Settings.

Duskbloom has no accounts, leaderboards, chat, push notifications, or analytics, and stores your level progress and settings only on your device.

09Payments and purchases

• Duskbloom and Emberfall purchases are processed by Apple through the App Store under Apple's terms. We receive a receipt confirming the purchase, not your payment details.
• Finish Atlas orders are placed and paid for on Printify's checkout, with Stripe handling payment. Printify receives the artwork you upload plus your name, shipping address, and contact and payment information. FinishAtlas, LLC is the seller of record but does not receive your card details.
• PremLogix payments are processed by Stripe. Rent, deposits, and fees are collected by the client organization through its own connected Stripe account; Canyon Peak Technologies is not the merchant of record for those payments. PremLogix stores only Stripe tokens and transaction status, never card or bank account numbers. Where you enroll in automatic payments, we store the exact authorization text you agreed to and when you agreed.

10Cookies and similar technologies

Our corporate website sets no cookies. Finish Atlas sets no cookies of its own and keeps your route data in browser memory only, which is cleared when you close or refresh the page. PremLogix uses strictly necessary cookies to keep you signed in, protect against cross-site request forgery, remember your language, and support bot protection; these cannot be disabled without breaking the service. Our hosting and payment providers may set their own necessary cookies. We do not use advertising or cross-site tracking cookies on any site.

11How long we keep information

We keep personal information only as long as needed for the purposes described above. Our defaults:

12Your choices and rights

Regardless of where you live, you can:

• Access and correct the personal information we hold about you;
• Delete your personal information, subject to legal retention requirements (see Section 13);
• Receive a copy of your information in a portable format;
• Opt out of marketing by using the unsubscribe link in any marketing email or replying STOP to any text message;
• Withdraw consent for optional processing at any time, without affecting processing that already occurred; and
• Control app permissions (such as Health access) in your device settings.

To exercise these rights, email info@canyonpeak.co with the subject line "Privacy request" and tell us which product your request concerns. We will verify your identity using the contact information already on file, respond within 45 days (extendable once by 45 days where the law allows), and will not discriminate against you for exercising your rights. You may designate an authorized agent to act for you where the law permits.

United States state privacy rights

Residents of Utah, California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with comprehensive privacy laws have the rights above. We do not "sell" or "share" personal information as those terms are defined under the California Consumer Privacy Act, do not engage in targeted advertising, and do not use personal information for profiling that produces legal or similarly significant effects. We have not sold personal information in the preceding twelve months. Because we do not sell or share personal information, we do not currently process opt-out preference signals, though we honor the requests above directly. If we deny a request, you may appeal by replying to our decision, and we will respond within 45 days.

Outside the United States

Our products are designed for and offered in the United States. If you use them from the European Economic Area, the United Kingdom, or another jurisdiction with comparable law, you have the rights described above, plus the right to object to or restrict processing and to lodge a complaint with your local supervisory authority. Our legal bases are performance of a contract (providing the product you use), legitimate interests (security, product improvement, and running our business), consent (marketing and optional features), and compliance with legal obligations.

13Account and data deletion

• Emberfall: use Settings to delete your realm account or manage offline saves. See Emberfall privacy details for backups and Apple-held records.
• Duskbloom and MyFitness Journal:Tracker: there is no account. Deleting the app from your device permanently removes all data the app stored. MyFitness Journal:Tracker data you chose to write to Apple Health stays in Apple Health, where you can delete it.
• Finish Atlas: the site stores nothing about you. To delete order records, contact Printify support using the details in your order confirmation, or email privacy@finishatlas.com and we will coordinate with our providers. To leave the newsletter, use the unsubscribe link in any email.
• PremLogix resident (portal) accounts: your portal login is created by invitation from a client organization. You may request deletion of your login and personal profile at any time through your PremLogix profile or by emailing us. We will deactivate your login promptly and delete or anonymize your profile after any legal hold, lease, or financial-retention obligation has ended. Lease, ledger, and legal records maintained by your property manager are controlled by that client organization; we will forward your request to them and help them fulfill it.
• PremLogix client-organization staff accounts: your organization's administrator can deactivate your account at any time. Contact us if you need a deletion request escalated.

14Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. For PremLogix these include encryption in transit (TLS) and at rest, field-level encryption of restricted personal data such as dates of birth, ID numbers, and contact details, secrets held in Azure Key Vault, multi-factor authentication and passkeys, invitation-only account creation, tenant isolation enforced in every database query, private file storage, append-only audit logs, and time-boxed, ticketed, audited access by our support staff. No system is perfectly secure; if we learn of a breach affecting your information we will notify you and regulators as the law requires.

15Children

Our websites and services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Duskbloom is designed to be suitable for a general audience and collects no personal information; because it does not ask your age, it treats every player as if they may be under the age of digital consent for advertising purposes. PremLogix client organizations may record minors as household occupants on a lease; that information is entered and controlled by the client organization, is used only to administer the tenancy, and is never used for marketing. If you believe a child has provided us personal information, contact us and we will delete it.

16PremLogix: our role for client data

PremLogix is a multi-tenant platform. Each client organization decides what information to collect about its residents, applicants, occupants, owners, and vendors, and how to use it. For that information, the client organization is the controller (or "business") and Canyon Peak Technologies, LLC acts as its processor (or "service provider"), handling the data only on the organization's documented instructions, under a written agreement, and never for our own marketing.

For the global sign-in identity a resident uses to access one or more organizations (email address, credentials, MFA settings, language, and profile photo), and for security and audit logs, Canyon Peak Technologies is the controller. One login can be used across several unrelated client organizations, and no organization can see your relationship with another.

Client organizations may present PremLogix under their own branding and domain and may publish their own privacy notice. If you are a resident with questions about how your property manager uses your information, contact them first; we will help them respond. Our staff access client data only through time-limited, ticketed support sessions that are logged and auditable by the client organization.

17Where information is processed

We are based in the United States and process and store information in the United States, primarily in Microsoft Azure regions in the western United States and on Cloudflare's global network. If you use our products from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

18Changes to this policy

We will update this policy when our practices change. The "Last updated" date at the top tells you when. For material changes, such as sending a new category of message or collecting a new category of data, we will give notice in the affected product or by email before the change takes effect, and we will not begin a materially new use of previously collected information without your consent where the law requires it. Earlier versions are available on request.

19Contact us