1. Overview
This policy explains what information the operator of Bomb Dodge (the "App") processes, why, how long it is kept, and your rights. The operator complies with applicable law where you live, including the Korean Personal Information Protection Act and the EU GDPR.
2. Information we do not collect
- Location — The App does not request location permission.
- Contacts, photos, microphone, camera — The App does not request these permissions or access them.
- Payment details — Card and other payment details are handled by Google and Apple; the App and the operator never receive them.
3. Information stored only on your device
- Campaign progress (clears, best records, attempts, stars), settings (language, audio, vibration, joystick, notification toggles) and equipped appearance.
- The "hearts refilled" reminder is scheduled on your device and sends nothing to the server.
- On-device data is deleted when you uninstall the App or clear its data.
4. Optional sign-in
You can sign in with Google or Apple through Firebase Authentication (processed by Google). Firebase holds your sign-in email. You can play without signing in; signing in is required to buy items and lets your progress follow you across devices.
The operator's server stores only:
- A one-way hash of your Firebase user ID and the sign-in provider (Google or Apple).
- Your display name — the nickname you set (2–12 characters), shown on rankings. If you set none, a server-generated alias such as
Pilot-1a2bis used.
5. Rankings and records
When you submit a record, the following is sent to the operator's server (Cloudflare Workers, bomb-dodge-rankings.developerkhy.workers.dev) for these boards: campaign stages, Section Relay, weekly challenge, the "Today's bomb" daily challenge and the overall ranking.
- Device identifier — A random value generated on your device. It is not the advertising ID.
- Play records — Survival time, near misses, whether you cleared, assistance used, and stage or section number.
- Control inputs — The run's control inputs, used to validate the record.
Other players can see your display name and records on the boards.
6. Game economy
The following is stored on the server, tied to your device identifier or account: hearts, shields, parts (in-game currency), owned cosmetics, daily missions and attendance, stars and milestone rewards, and weekly reward claims.
7. In-app purchases
Through Google Play Billing and the App Store we offer a monthly supply subscription, removal of automatic ads, and shield packs. The operator's server verifies purchases with Google Play and stores a hash of the purchase token, the product and its status. Payment card details are handled by Google and Apple, never by the App.
8. Notifications (optional)
Only after you allow notifications, the server stores: your Firebase Cloud Messaging registration token, platform, app language, time-zone offset, notification category preferences (hearts refilled / missions and events / ranking changes), app version, and a delivery log (sent/opened).
- The delivery log is used to limit frequency: at most 3 per day, and random reminders only between 10:00 and 21:00 local time.
- You can turn categories off in Settings > Notifications, or disable notifications in your device settings.
- Device tokens are deleted after 60 days without using the App, when a token becomes invalid, or on request. The delivery log is kept for 30 days.
9. Usage statistics
The server records, per pseudonymous wallet ID, your first day and the days you used the App, to compute aggregate retention (for example, the share of players returning after 1, 7 or 30 days). Raw per-day rows are kept for up to 400 days; the aggregates do not identify anyone.
10. Feedback (optional)
If you use Settings > Send feedback, the category, the text you write, app version, platform and language are sent to the operator's feedback server.
11. Advertising
The App shows Google AdMob banner, interstitial and rewarded ads. AdMob may process device information such as the advertising ID to serve and measure ads. Users in the EEA and UK are asked for consent through Google's User Messaging Platform (UMP), and you can change your consent in the App at any time. On iOS, the App asks for App Tracking Transparency permission. The App uses Firebase Analytics to measure app installs from ads (first_open) and to collect app usage events such as first-launch progress and game starts and ends, for ad measurement and service improvement; in the EEA and UK, what is collected follows your consent choices above.
For details on how Google processes data, see Google's partner sites policy.
12. Purposes
- Computing and showing rankings, and blocking cheated records
- Correctly granting currency, rewards and purchases, and syncing progress across devices
- Sending notifications you have allowed
- Aggregate statistics and handling feedback to improve the service
- Showing ads and measuring their performance
13. Retention
- Ranking records, economy state, purchase records, display name and account link are kept as long as needed to provide the service and deleted on request.
- Notification tokens are deleted after 60 days of non-use, when invalid, or on request; the delivery log is kept 30 days and raw usage rows up to 400 days.
- On-device data is deleted when you uninstall the App.
14. Third parties and processors
We do not sell personal data or share it with third parties except to provide the service through the following:
- Google — AdMob (ads), Firebase Authentication (sign-in), Firebase Cloud Messaging (notifications), Firebase Analytics (install measurement and usage statistics), Google Play Billing.
- Apple — Sign in with Apple, App Store purchases, push notification service.
- Cloudflare — Server infrastructure.
15. Children
The App is not directed at children. The operator does not knowingly collect children's personal information and will delete it without delay if such collection is discovered.
16. Your rights
You can request access to or deletion of your information. Email us with the device identifier shown in the App's Settings, or, if you signed in, the sign-in provider and the email you used. Within 30 days we delete your ranking records, input logs, economy state, purchase records (except transaction records we must keep by law), notification tokens and logs, usage statistics rows, display name and account link.
Signing out alone does not delete server data. You can remove on-device data by uninstalling the App or clearing its data. The advertising ID is handled by Google and can be reset or deleted in your device settings. See the Data Deletion Request page for the full procedure.
17. Security
All communication with the server is encrypted with HTTPS. The operator keeps access rights to a minimum.
18. Changes
If this policy changes, we will post the changes and the effective date on this page.
19. Contact
Please send privacy inquiries to the address below.