Blockbout Privacy Policy
Summary: Blockbout shows no ads, sells nothing, embeds no third-party SDKs in the app, and has no accounts — no email, no phone number, no sign-up. It handles a random player ID generated on your device, an optional nickname you pick (or skip for a generated one), and anonymous gameplay telemetry used to run and improve the game. Our web pages additionally use Cloudflare's cookieless Web Analytics for page metrics — no cookies, no fingerprinting, no cross-site tracking.
1. What we collect
- Anonymous player identifier. On first launch the app generates a random UUID (your "guest ID") and stores it on your device. It is not derived from your hardware, phone number, or any account, and we cannot link it to your real identity.
- Display nickname. On first launch you may type a nickname or skip to get a generated one. It is stored on your device, sent to our server when you enter a bout, and shown to your opponent. Pick anything — it does not need to be (and should not be) your real name. Nicknames are deliberately excluded from our analytics and are cleared from the bout's server-side record the moment a bout ends (bouts finished before 24 July 2026 may retain the nicknames used then; deletion requests cover those records too).
- Session and gameplay data. Session IDs, bout results (scores, winner, duration, room code), gameplay events (screens viewed, buttons tapped, pieces placed, combos), connection quality, app version, coarse platform (Android / iOS / web), and the country your connection reached our servers from — a two-letter country code our host resolves at the network edge, used only in aggregate (for example a public "countries played from" count). Never GPS, never your precise location.
- Web page metrics. Our websites (blockbout.com and subdomains) and the browser version of the game use Cloudflare Web Analytics, a cookieless page-metrics service run by our hosting processor: page views, load performance, and coarse browser/device/country breakdowns. It sets no cookies, stores nothing on your device, does not fingerprint you, and cannot follow you across other sites. The Android app contains none of this.
- What we do not collect: no real identity is required — the display name is free-form and works fine as a made-up handle (if you type your real name, it is treated exactly like any other nickname); no email or phone number; no contacts; no precise location (no GPS — the only geography we keep is the coarse country code described above); no advertising identifiers; no device fingerprinting; no photos, camera, or microphone; no advertising SDKs; no tracking cookies and no cross-site tracking of any kind (the cookieless page metrics above cannot follow you anywhere). In-game display names are shown to your opponent during a bout and are deliberately excluded from our stored analytics.
- Reports. If you report an opponent's nickname in-game, we store the report — the room code, the nickname as our server saw it, and the anonymous player IDs involved — so we can review it and act on repeat offenders.
- IP addresses. Our host, Cloudflare, processes IP addresses transiently to route and protect traffic. Blockbout's application database stores no IP addresses; transient infrastructure logs expire automatically within days.
2. How we use it
- Run the game — matchmaking, live bouts, reconnects, progression (necessary to provide the service you request).
- Improve the game — aggregate telemetry to fix bugs, balance gameplay, and understand which features are used (our legitimate interest in maintaining a good free game).
- Protect the service — abuse and cheat prevention (legitimate interest).
No profiling, no advertising, and no sale or sharing of data. Ever.
3. Who we share it with
Your opponent sees your nickname and your live board, score, and combo during a bout — that is the game. Beyond that: no one, with one infrastructure exception: Cloudflare, Inc. hosts Blockbout's servers and stores its data (Cloudflare D1 database, Workers Analytics Engine, and the cookieless Web Analytics page metrics) as our processor, acting on our instructions under Cloudflare's privacy policy and GDPR data processing addendum. We may disclose data if legally compelled to do so.
4. Data retention
- Analytics Engine telemetry expires automatically after three months.
- Web Analytics page metrics are retained by Cloudflare: unsampled data for 7 days, then aggregated (≈10% sample), with up to six months accessible — per Cloudflare's Web Analytics documentation. We cannot identify or delete an individual visitor within it because it contains no identifiers to match against.
- Match records and anonymous identity records (guest ID, first-seen date, platform, app version) are retained while the service operates so cross-device statistics stay exact; we periodically review and may delete long-inactive records.
- A finished bout's room record (final boards and scores; nicknames are cleared when the bout ends, though records from before 24 July 2026 may still include them) is retained in room storage until deleted; deletion requests via the contact address cover these records too.
- Deleting the app (or clearing site data on web) removes the guest ID from your device, and a reinstall normally starts fresh with a new one. Exception: a device backup (for example Android cloud backup) may restore the old ID with the app's data.
5. Your rights and choices
Depending on where you live (for example under the GDPR), you may have rights to access, correct, delete, restrict, or object to processing of your data, and to complain to a supervisory authority. Because we cannot identify you, requests must reference your guest ID. Email us and we will respond within 30 days; if you cannot retrieve your guest ID, contact us anyway and we will make reasonable efforts to assist. We do not "sell" or "share" personal information as defined by the CCPA/CPRA, so no opt-out mechanism is needed.
6. Children
Blockbout is a general-audience game. It does not knowingly collect information that reveals anyone's real-world identity — from any player, child or adult: no real names required, no email, no photos, no contact information. The identifiers and nicknames described in section 1 are handled the same way for every player. If you believe a child has shared identifying information (for example by using their real name as a nickname, or via the support email), contact us and we will delete it.
7. Security
All traffic is encrypted in transit (TLS). Access to stored data is limited to the developer. Our primary safeguard is data minimization: we cannot lose what we never collect.
8. International transfers
Data is processed on Cloudflare's global edge network and stored in Cloudflare's APAC region. The anonymous, minimal data involved carries low transfer risk; transfers from the EEA/UK are covered by Cloudflare's standard contractual clauses via its data processing addendum.
9. Changes to this policy
Material changes will be announced on this page with an updated date. Continued play after a change means you accept the updated policy.