Blockbout Privacy Policy
Summary: Blockbout shows no ads, sells nothing, embeds no third-party SDKs, and has no accounts — no email, no phone number, no sign-up. It handles a random player ID generated on your device, an optional nickname you pick (or skip for a generated one), and anonymous gameplay telemetry used to run and improve the game.
1. What we collect
- Anonymous player identifier. On first launch the app generates a random UUID (your "guest ID") and stores it on your device. It is not derived from your hardware, phone number, or any account, and we cannot link it to your real identity.
- Display nickname. On first launch you may type a nickname or skip to get a generated one. It is stored on your device, sent to our server when you enter a bout, and shown to your opponent. Pick anything — it does not need to be (and should not be) your real name. Nicknames are deliberately excluded from our analytics; the final record of a finished bout, held in that bout's room storage, is currently the only place a nickname persists on our side.
- Session and gameplay data. Session IDs, bout results (scores, winner, duration, room code), gameplay events (screens viewed, buttons tapped, pieces placed, combos), connection quality, app version, coarse platform (Android / iOS / web), and the country your connection reached our servers from — a two-letter country code our host resolves at the network edge, used only in aggregate (for example a public "countries played from" count). Never GPS, never your precise location.
- What we do not collect: no real identity is required — the display name is free-form and works fine as a made-up handle (if you type your real name, it is treated exactly like any other nickname); no email or phone number; no contacts; no precise location (no GPS — the only geography we keep is the coarse country code described above); no advertising identifiers; no device fingerprinting; no photos, camera, or microphone; no third-party analytics or advertising SDKs; no tracking cookies. In-game display names are shown to your opponent during a bout and are deliberately excluded from our stored analytics.
- IP addresses. Our host, Cloudflare, processes IP addresses transiently to route and protect traffic. Blockbout's application database stores no IP addresses; transient infrastructure logs expire automatically within days.
2. How we use it
- Run the game — matchmaking, live bouts, reconnects, progression (necessary to provide the service you request).
- Improve the game — aggregate telemetry to fix bugs, balance gameplay, and understand which features are used (our legitimate interest in maintaining a good free game).
- Protect the service — abuse and cheat prevention (legitimate interest).
No profiling, no advertising, and no sale or sharing of data. Ever.
3. Who we share it with
Your opponent sees your nickname and your live board, score, and combo during a bout — that is the game. Beyond that: no one, with one infrastructure exception: Cloudflare, Inc. hosts Blockbout's servers and stores its data (Cloudflare D1 database and Workers Analytics Engine) as our processor, acting on our instructions under Cloudflare's privacy policy and GDPR data processing addendum. We may disclose data if legally compelled to do so.
4. Data retention
- Analytics Engine telemetry expires automatically after three months.
- Match records and anonymous identity records (guest ID, first-seen date, platform, app version) are retained while the service operates so cross-device statistics stay exact; we periodically review and may delete long-inactive records.
- A finished bout's room record (final boards, scores, and the nicknames used in that bout) is retained in room storage until deleted; deletion requests via the contact address cover these records too.
- Deleting the app (or clearing site data on web) removes the guest ID from your device, and a reinstall normally starts fresh with a new one. Exception: a device backup (for example Android cloud backup) may restore the old ID with the app's data.
5. Your rights and choices
Depending on where you live (for example under the GDPR), you may have rights to access, correct, delete, restrict, or object to processing of your data, and to complain to a supervisory authority. Because we cannot identify you, requests must reference your guest ID. Email us and we will respond within 30 days; if you cannot retrieve your guest ID, contact us anyway and we will make reasonable efforts to assist. We do not "sell" or "share" personal information as defined by the CCPA/CPRA, so no opt-out mechanism is needed.
6. Children
Blockbout is a general-audience game. It does not knowingly collect information that reveals anyone's real-world identity — from any player, child or adult: no real names required, no email, no photos, no contact information. The identifiers and nicknames described in section 1 are handled the same way for every player. If you believe a child has shared identifying information (for example by using their real name as a nickname, or via the support email), contact us and we will delete it.
7. Security
All traffic is encrypted in transit (TLS). Access to stored data is limited to the developer. Our primary safeguard is data minimization: we cannot lose what we never collect.
8. International transfers
Data is processed on Cloudflare's global edge network and stored in Cloudflare's APAC region. The anonymous, minimal data involved carries low transfer risk; transfers from the EEA/UK are covered by Cloudflare's standard contractual clauses via its data processing addendum.
9. Changes to this policy
Material changes will be announced on this page with an updated date. Continued play after a change means you accept the updated policy.