Privacy Policy — Bones & Relics

The account the game creates for you

The first time you go online, the game signs you in anonymously using Google Firebase Authentication. This creates a random account identifier for your device. It is not linked to your email address or your real identity, and there is no password.

If you choose to sign in with Google Play Games, your account is linked to your Play Games identity so it can be restored on a new device, and the game can sign you back in with it if its sign-in is ever lost. The game asks Google only for a sign-in token — never your email address or contacts.

Two consequences are worth knowing:

• Because there is no password, an anonymous account is tied to the app on this device. If the app's data is cleared, or the device is lost or reset, that account may not be recoverable.
• The game keeps a private key on your device so it can prove ownership of your account if its sign-in is ever lost. Only a one-way hash of that key is sent to us — never the key itself.

What stays on your device

• Your saved game, settings, preferences, unlocked content and match history.
• Everything you type, unless it is a display name or handle you choose to use online.

If you never go online, that is where all of it stays.

What is sent when you play online

• Account identifier — the anonymous ID described above.
• Profile — the display name and handle you choose, and your chosen cosmetics (avatar, frame, title, dice and glove).
• Game statistics — games played and won, high scores, streaks and similar counters.
• Match data — the moves, scores and outcome of online matches you take part in, and the names of the players at that table.
• Friends and requests — the accounts you add, and requests sent to or from you.
• Online status — whether you are currently in the app, and when you were last seen.
• Notification token — an identifier from Google Firebase Cloud Messaging, so the game can tell you when it is your turn. You can stop this at any time in your device notification settings.
• Cloud backup — a copy of your progress (in-game coins, statistics, unlocked content and settings) so it can be restored if your account is recovered. It also records your device model and the app version, which helps us diagnose faults.
• Purchases — if you buy the Founder's Pack, Google Play sends us a receipt so the game can confirm the purchase, give you its items, and handle a refund. We never see your card or payment details.

What other players can see

This is the part most people want to know, so it gets its own section. Any signed-in player can see:

• Your handle and display name — including through handle search, which is how friends find you.
• Your cosmetics, your public game statistics, and your online status.
• Your name and scores in any match you played with them, and your head-to-head record against them.

Choose a handle and display name you are happy to be public. They are not private, and a handle is permanent once claimed.

Analytics and crash reporting

The game uses two Google Firebase services to help us find and fix problems:

• Firebase Analytics — anonymous, aggregate usage: how often and how long the game is played, and non-identifying counters such as games played and won, turns, farkles, difficulty and outcome. It is tied to a Google-generated app-instance identifier, not to you.
• Firebase Crashlytics — if the game crashes, an automatic technical report (device model, Android version and a trace of the crash) is sent so we can fix it.

Google acts as our data processor for all of the above. Data it handles is also governed by Google's privacy policy.

Reports when something goes wrong

The game keeps a technical log on your device of what it is doing: screens opened, moves sent and received, scores as your device worked them out, sign-in steps and error messages. For online matches it also keeps a separate log for each of your most recent matches (up to 12), so that a problem can still be looked into days later.

These logs stay on your device unless one of the following happens:

• You send a report. When you use Report a problem in the game, your description, the log, your device model and app version, and a screenshot if you choose to attach one, are sent to us.
• The game finds a fault in an online match. If your device and another player's disagree about the scores, or our server finds that a match you took part in cannot finish, your device sends us its log of that match automatically.
• The game finds a fault with your account or your coins. If signing in takes unusually long, or the game's own check finds Tavern Coins lost or created by mistake, your device sends us its log automatically.

An automatic report is sent at most once for each problem. You can switch automatic reports off at any time in Settings → Help → Privacy & your data → Send automatic problem reports; a report you send yourself is not affected.

What a log contains: your anonymous account identifier, the display names and handles of the players in your matches, the moves and scores of those matches, your device model, Android version and app version, and the game's own technical messages. It does not contain anything you typed other than your display name and handle, and never your location, contacts, photos or anything outside the game.

What we use it for: only to find and fix faults — for example a match that will not finish, or scores that differ between players' devices. Reports are read by the developer and stored in our Google Firebase database; they are not public and other players cannot see them. Reports are deleted automatically 12 months after they are sent.

What we never collect

• No real name, email address, password, phone number or contacts.
• No precise location, files or microphone access, and no access to your photos — except a single image you choose yourself to attach to a problem report.
• No advertising identifiers. The game contains no advertising, and advertising-ID collection is switched off in the app so the analytics above cannot be tied to one.
• No payment details. Any purchase is handled entirely by Google Play; we never see your card.
• We do not sell your data, and we share it with nobody but Google as our processor.

In-game currency and simulated gambling

Bones & Relics includes wagering of Tavern Coins, a fictional in-game currency, on multiplayer matches. This is simulated gambling. Tavern Coins have no real-world value, cannot be exchanged for money or for anything outside the game, and cannot be cashed out. No real-money gambling takes place in the game.

Coins that come with a purchase can never be wagered. Tavern Coins included in anything bought with real money (such as the Founder's Pack) can be spent only on cosmetic items in the Tavern Shop. Only coins earned by playing — in the Tavern Circuit and won in multiplayer matches — can be staked on a match. Your coin purse shows the two amounts separately.

Children

Because the game contains simulated gambling, it is not directed at children, and we do not knowingly collect information from anyone below the age required in their country to use it.

Deleting your account and your data

You can ask us to delete your account and the data associated with it at any time.

• How to ask: in the game, Settings → Help → Delete my account and data; or email kb.jansen@gmail.com from any address, giving your in-game handle. We do not need any other personal information.
• What is deleted: your profile, display name, statistics, friends and requests, online status, notification tokens, cloud backup, and any reports and logs your device has sent us. Your handle is released.
• What may remain: matches you have already played may keep the name you used at that table, because they form part of the other players' own match history.
• How long it takes: we aim to complete deletion within 30 days of your request.

Deleting the app from your device removes everything stored locally, but does not by itself delete the online account — please use the request above if you want that removed as well.

How long we keep data

Account and profile data is kept for as long as your account exists. Reports and logs sent when something goes wrong are deleted automatically 12 months after they are sent. Analytics and crash data are retained according to Google Firebase's own retention periods. If you ask us to delete your account, see above.

Taking part in testing

If you join our testing programme through Google Play testing tracks or Firebase App Distribution, we hold the email address you gave us so we can send you builds. We use it only to distribute the game and to contact you about testing, we never use it for marketing, and we will remove it on request. Feedback you send us voluntarily is used solely to improve the game.

Your rights

Depending on where you live, you may have the right to access, correct or delete the personal information we hold about you, or to object to our processing of it. Write to kb.jansen@gmail.com and we will help.

Changes to this policy

If the game changes in a way that affects any of the above, we will update this policy and revise the effective date before that change reaches players.

Contact

Questions, requests, or anything here that looks wrong: kb.jansen@gmail.com