Privacy Policy

1. Information we handle and why

Game settings and saved games

The app stores preferences such as your display name, language, sound, haptics, and theme on your device. It also saves completed-game replays and a recent-opponents list. Replays contain game setup, display names, moves, results, and game timing information. Recent-opponent records contain the opponent's display name, Unity player ID, and when you played, so you can find or invite them again.

Online multiplayer

Online play uses Unity Authentication, Lobby, and Relay. Unity creates an anonymous sign-in with a player ID; you do not need to provide an email address or password to play. "Anonymous" means no named registration is required; the ID can still distinguish your player profile. These services process player IDs, room and connection information, IP addresses, and gameplay traffic to connect players and run matches.

Your chosen display name and player ID are exchanged with your opponent and can be saved in their recent-opponents list. Room listings expose the host's display name and player ID, room status, and, for invitations, the invited player's ID to other users querying the directory. Use a nickname and avoid entering personal or sensitive information in your display name.

A Cloudflare-hosted room-code service also processes room codes and network request information to help players join matches using shorter codes.

Advertising

The app displays ads through Google AdMob. Google's advertising SDK may collect or receive IP addresses (which can indicate approximate location), advertising and other device identifiers, app and ad interactions, and diagnostic or performance information. Google uses this information to serve and measure ads, operate its services, and detect fraud and abuse. Ad personalization and the information used depend on your choices, region, device settings, and the ads served.

Google's User Messaging Platform presents consent messages where configured and required. Ads that are not personalized may still involve data processing for delivery, measurement, security, or fraud prevention. See Google's Privacy Policy and how Google uses information from apps and sites that use its services.

Game analytics

We use Unity Analytics to understand online play and improve matchmaking and game reliability. Events include matchmaking attempts, waiting times, cancellations, failures, room creation and joining, match mode, host or joining role, match duration, move count, and outcomes such as winning, losing, or leaving.

Unity Analytics also processes SDK information such as IP address, approximate location, installation and user identifiers, an authentication player ID when available, and device and session information. Our custom online-play events do not include player display names or email addresses. Collection is enabled through the app's consent flow; available choices depend on your region and the messages presented.

Replay sharing and website visits

Replays stay on your device unless you choose Share. Sharing uploads the replay and, when available, an image of the final board to our Cloudflare-hosted service. The upload includes player display names, game setup, moves, results, and replay timing and summary information. The shared copy removes the field identifying which seat the uploading device played.

Anyone with the replay link can view, copy, or forward the replay and its player names. Another participant may also share their copy of an online game. Do not share a replay if it contains information you do not want others to see.

The sharing service processes IP addresses to limit excessive uploads. It counts replay shares, repeat shares, viewer-page requests, and replay opens to understand service use. Hosting providers receive normal request information, such as IP address and browser or device request headers, to deliver and protect the website. The replay homepage and viewer load fonts from Google Fonts, which sends requests to Google. This privacy-policy page uses system fonts and has no analytics scripts, advertising scripts, or cookies of its own.

Support messages

If you email us, we receive your email address, message, and any attachments you choose to send. We use them to respond, investigate issues, and handle privacy requests. Please avoid sending passwords or unnecessary sensitive information.

2. Who receives information

Information is processed by the following providers for the features described above:

• Google: advertising, consent messages, and website fonts. See Google's Privacy Policy.
• Unity: anonymous authentication, multiplayer matchmaking and relay, and analytics. See Unity's Game Player and App User Privacy Policy.
• Cloudflare: room-code and replay hosting, content delivery, and service protection. See Cloudflare's Privacy Policy.

Other players receive multiplayer information, and recipients of shared replay links receive the replay content. Email providers process support correspondence. We may also disclose information where required by law or necessary to protect people, investigate abuse, or defend legal rights. Providers' roles and their own uses of information depend on the service and their applicable terms and privacy policies.

3. Storage, retention, and security

• On your device: the app keeps up to 30 saved replays and 10 recent opponents, replacing older entries as new ones are added. Preferences remain until cleared or replaced. Android's Clear storage option removes local app data, including settings and locally stored sign-in information.
• Shared replays: links expire seven days after the first upload. Expired replays are no longer served by the replay API; stored records are removed during cleanup triggered by later uploads. Images or copies already downloaded or cached by browsers, message services, or other recipients can remain after expiry. Sharing the same game again while its link is active does not extend its expiry.
• Replay service statistics: aggregate daily counts are retained separately from replay content. The upload rate limiter temporarily holds IP addresses in server memory for rate-limit checks.
• Analytics and other provider records: retention depends on the service and configured settings. Unity documents a default retention period of 13 months for Analytics personal data; shorter settings or deletion requests may apply. Advertising, authentication, hosting, and operational records follow the relevant provider's applicable retention practices.
• Support correspondence: messages are kept as needed to handle the request, follow-up issues, and applicable legal obligations.

Our providers may process information outside your country, including where they operate their infrastructure. Applicable transfer protections depend on the provider, service, and law. The replay service uses HTTPS, and Google and Unity document encryption in transit for their advertising and analytics services. No online service or storage system can guarantee absolute security.

4. Your choices and privacy requests

• Advertising choices: use the options presented in Google's consent messages. You can also manage or delete your advertising ID in Android settings where supported. These device controls do not necessarily stop all advertising-related processing.
• Online visibility: choose a nickname, use local game modes if you do not want to use multiplayer, and avoid sharing replay links containing personal information.
• Local data: clear the app's storage using Android settings to remove local preferences, saved replays, and recent opponents. This does not delete information already received by providers, other players, or replay recipients. Clearing anonymous sign-in information may prevent access to the same player profile.
• Access, correction, deletion, or consent withdrawal: email xtrastudio2013@outlook.com with the subject "Quoridor.II privacy request". Include the replay link or other relevant details you already have so we can identify the information. Contact us before clearing app storage if you need help identifying an anonymous profile.

Depending on your location and applicable law, you may have rights to access, correct, delete, obtain a copy of, restrict, or object to processing of your information, withdraw consent, or complain to your local data protection authority. We may need to verify a request and coordinate with a provider. Some information may need to be retained for legal or security reasons, and we cannot remove independent copies held by other users.

Where applicable law requires a legal basis, processing may rely on consent for activities that require it, providing the service you request, legitimate interests in operating and securing the service and responding to support, or legal obligations. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Children's privacy

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the service, contact us with the relevant details so we can investigate and take appropriate action, including working with providers to delete information where required. Additional age and parental-consent requirements may apply under local law.

6. Links and policy changes

Ads and other links may lead to services operated by others. Their privacy policies apply when you use those services. We may update this policy as the app or our practices change. We will post the revised policy here, update the date above, and provide additional notice or request consent when required.

7. Contact us

For privacy questions or requests about Quoridor.II, contact YSquare Studio at xtrastudio2013@outlook.com.