Privacy Policy

1. Scope and important distinctions

You can play the solo mode without creating an online account. An account is required for online multiplayer, profiles, rankings, match history, player reports, and related connected features.

This policy covers information handled by Block battle. Store operators, authentication providers, and websites linked from player profiles process information under their own privacy policies. We do not control third-party websites that you choose to open.

2. Information we collect

Account and authentication information

• Email address, username, display name, internal user and profile IDs, email verification status, and account status.
• If you use email and password, your password is transmitted for authentication and stored only as a one-way password hash. Verification codes and session tokens are also stored as hashes.
• If you choose an enabled social sign-in method, we receive an authentication identifier and available basic account information, such as email address and display name, from Firebase Authentication and the selected provider (for example Google, Facebook, or X).
• Sign-in timestamps, session expiry, IP address, and user-agent information used to secure and operate sessions.

Profile and public game information

• Nickname, selected country, locale, built-in avatar, optional profile biography, and optional external profile links.
• Wins, losses, rating, leaderboard position, and game-mode statistics.
• Your nickname, country, avatar, profile text, links, statistics, and current lobby or match status may be visible to other players. Your email address is not part of your public profile.

Gameplay and multiplayer information

• Lobby and room information, ready status, match participants, game state needed for real-time play, and a hash of a private-room password when one is used.
• Match results, opponent, time played, duration, and line counts. The service keeps a limited recent match history for each game mode and aggregate statistics for rankings.
• Solo gameplay that remains only on your device is not collected. Results submitted to your online profile are collected.

Notifications and device information

• If you allow push notifications while signed in, we collect a Firebase Cloud Messaging token and platform type so we can send match-related notifications.
• Firebase may use an installation identifier and technical request information to deliver notifications and provide authentication.

Safety reports and communications

• If you report another player, we collect the selected reason, your description, reporter and reported-player identifiers, timestamp, IP address, and user agent.
• If you contact us, we receive the information in your message and the contact details you use.

This website

The landing page stores your language choice in local storage. It does not include advertising or analytics code. The web host may process standard request information such as IP address, browser type, requested page, and time for security and delivery of the site.

3. How we use information

We use the information described above to:

• create and authenticate accounts, verify email addresses, and keep sessions secure;
• operate solo result syncing, profiles, leaderboards, lobbies, real-time matches, match history, and push notifications;
• display the public profile information and game statistics you choose to make available through the service;
• detect abuse, investigate reports, enforce the rules, prevent fraud, and protect players and the service;
• respond to support, privacy, and account-deletion requests;
• maintain reliability, troubleshoot failures, and comply with legal obligations.

Where applicable law requires a legal basis, we process information as needed to provide the service you request, based on your consent for optional features, for our legitimate interests in security and service operation, and to comply with law. You may withdraw consent for an optional feature, but this does not affect processing already performed lawfully.

4. How information is disclosed

We do not sell personal information and do not use it for third-party advertising or cross-app advertising tracking.

We may disclose information in the following limited situations:

• Other players: public profile fields, statistics, leaderboard entries, lobby information, and match information are shared as part of multiplayer functionality.
• Service providers: hosting, database, network, email delivery, support, and security providers process information on our behalf under appropriate obligations.
• Firebase and authentication providers: Google Firebase provides authentication and push delivery. If you choose social sign-in, the selected provider also processes the login request.
• Legal and safety: we may disclose information when reasonably necessary to comply with law, respond to valid legal process, investigate abuse, or protect rights, safety, and service integrity.
• Business changes: information may be transferred as part of a merger, acquisition, financing, reorganization, or sale of assets, subject to this policy and applicable law.

Our processors may handle information in countries other than your own. Where required, we use legally recognized transfer safeguards. Firebase services may process information on Google's global infrastructure; Firebase Authentication is operated from the United States.

5. Security

Production app traffic uses HTTPS or secure WebSockets in transit. Passwords, verification codes, private-room passwords, and server session tokens are stored as hashes rather than readable values. Access to production data is limited to people and providers who need it to operate or secure the service.

No system is completely secure. Keep your password confidential, use a unique password, and contact us if you believe your account has been compromised.

6. Retention and deletion

• Account, profile, identity, and aggregate game statistics are generally kept while your account is active.
• Authentication sessions expire after 30 days. Email verification codes expire after 15 minutes, although security records may remain until routine cleanup or account deletion.
• Live match-room records are normally removed after seven days. Match history is limited to the most recent records retained by the service for each mode.
• Push tokens are removed when you unregister the device, sign out through the supported flow, or delete the account.
• Reports, support records, and security records are kept only as long as reasonably needed to resolve the issue, prevent repeated abuse, establish legal claims, or meet legal obligations.

You can schedule account deletion in the app under My account → Delete account. A seven-day recovery period follows. After that period, the active account and directly associated profile data are deleted. Limited records may remain where necessary for security, legal compliance, fraud prevention, or multiplayer record integrity. For example, a non-public deleted-profile marker and an opponent's historical match outcome may remain while the deleted public profile is no longer shown.

Information held by a third-party authentication provider may also be subject to that provider's retention rules. Deleting Block battle does not delete your separate Google, Facebook, or X account.

Read the account and data deletion instructions.

7. Your choices and rights

• Edit your nickname, country, locale, avatar, biography, and links from your profile.
• Decline or disable push notifications in device settings. Core gameplay remains available without notification permission.
• Play solo without creating an online account.
• Request access, correction, deletion, restriction, objection, or portability where provided by applicable law.
• Withdraw consent for optional processing and complain to your local data-protection authority where that right applies.

To exercise a privacy right, email block-battle-feedback@proton.me. We may ask you to verify control of the account before acting on a request.

8. Children

Block battle is not directed to children under 13. If local law requires a higher minimum age to consent to online services, a parent or legal guardian must authorize use below that age. We do not knowingly collect personal information from a child in violation of applicable law. A parent or guardian who believes a child provided information improperly should contact us so we can investigate and delete it.

9. Changes to this policy

We may update this policy when the service, legal requirements, or data practices change. We will post the revised version here, change the “last updated” date, and provide additional notice when required by law.

10. Contact

Privacy questions and requests:
block-battle-feedback@proton.me
Product: Block battle
Website: Block battle landing page