IOCODO Back to site

BombaDuel

Privacy policy

Effective date:

In brief: To play BombaDuel you tap Play as Guest or sign in with an email address, Google or Apple. A guest gets a random user identifier and can play against the computer and unranked online matches; a signed-in player also picks a public username and gets a rating. Your opponent sees your username during an online match, the leaderboard lists the best-rated players with their username, rating and record, and you can report or block players from the leaderboard. Signed-in players with a username see who is online now and can challenge each other to a duel, and a player you blocked cannot challenge you. You can delete your account at any time in Settings › Delete account. Usage statistics and crash reports can be turned on or off at any time in Settings › Privacy choices. In the European Economic Area (which includes the European Union) and in Brazil, both stay off until you allow them on a page the app shows first, and in Brazil an Allow counts only when your app store tells the app that you are 18 or older. In Türkiye and Canada, both stay off until you turn them on in Privacy choices. In the United Kingdom, usage statistics stay off until you turn them on there, and crash reports are on unless you turn them off (on an iPhone or iPad, from the moment you tap OK on a notice the app shows once). Elsewhere on an iPhone or iPad, and on any device in Switzerland, both start when you tap OK on a notice the app shows once, the first time it opens; on Android in other countries, both are on unless you turn them off. If your app store country is Russia or mainland China, the app connects to none of these services, has no online play and works only on your phone.

In Brazil: processing some of your data is a condition for using the features of BombaDuel that rely on it, because they cannot work without it. That data is listed in What we use data for, under each use whose legal basis is performance of our contract with you. To use your rights under article 18 of the LGPD (Lei 13.709/2018), write to support@iocodo.com, as described in Your rights.

1. Who we are

BombaDuel is made by IOCODO LLC, a limited liability company registered in Wyoming, United States. We decide why and how the data described on this page is used, so under European data protection law we are its controller.

Postal address: 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Email: support@iocodo.com
Report criminal or illegal content: iocodo.com/report/

Use this email for anything about your data, including the requests described in Your rights.

2. What this policy covers

This policy covers the BombaDuel app on iOS and Android, and this page. BombaDuel is a 1v1 minesweeper flags duel you can play against the computer or online against another player, with a rating and a leaderboard.

Here, "personal data" means any information about you as a person who can be identified, directly or indirectly. That includes identifiers such as a user ID, an installation ID, an App Check token or a device token, even when they do not contain your name.

3. Data kept on your device

BombaDuel keeps the following on your device, in the app's own storage:

  • your account as the app last saw it: your user identifier, your username, the email address you signed in with, how you signed in and whether you play as a guest
  • your settings: language, sound effects, vibration, the computer's difficulty, the move timer and the board size you chose
  • the list of your recent matches: your opponent's name and user identifier, the mode, the score, the result, how long the match lasted and when you played it
  • the players you blocked, with the name each had when you blocked them
  • your privacy choices, with a record of each answer you gave: the choice, its date, the version of the words you saw, the app's version and the region it was asked for
  • which version of the community rules you accepted on the screen that comes before online play
  • an invite code that brought you to the app, until the app has linked it to your account, and whether it has done so
  • when the app last asked you to rate it, to turn notifications on or to look at our other apps, which announcements you have already seen and whether it has told you about duel challenges

We do not receive any of this, unless another section of this policy says otherwise. If you back up your device with iCloud or Google, the backup can include a copy of this data, under Apple's or Google's terms. Uninstalling the app deletes this data from your device.

To know which privacy rules apply, the app reads on your phone the country your phone is set to, its time zone and the country of your app store, and keeps only the region it worked out, with your privacy choices.

If you do not allow crash reports, the app deletes the crash reports it has kept on your phone, and never sends them.

On Android, the first time the app opens after you install it from Google Play, it asks Google Play, through the Google Play Install Referrer API, for the invite code in the link that led to the install. The code stays on your phone until the app links it to your account, as described under What we use data for.

When you share an invite, the app passes the text and the link to your phone's share menu, and the app you pick receives them under its own terms.

When the app asks you to rate it, the rating sheet is Apple's or Google's, and what you write goes to them under their own terms.

When you contact us from the app, the app opens your own email app with a message to us that already contains the app's version, your platform and your operating system version; nothing is sent until you send it.

4. Accounts and sign-in

BombaDuel uses Firebase Authentication, a Google service, to recognise your account.

Firebase Authentication gives your installation a random user ID when you tap Play as Guest on the first screen. It does not contain your name or email address, but it is a pseudonymous identifier: it links the data the app keeps on our servers to your installation.

If you sign in with Google, we receive from Google your email address, the name and profile picture of your Google account and a Google user ID, and Firebase Authentication stores them to keep you signed in.

If you sign in with Apple, we receive an Apple user ID and, the first time only, the name and email address you choose to share. If you choose to hide your email address, Apple gives us a private address that forwards to yours.

If you create an account with an email address and a password, Firebase Authentication stores your email address and a hashed form of your password. We cannot see your password.

5. What we use data for, and on what legal basis

European data protection law (the GDPR and the UK GDPR) requires a legal basis for each use of personal data. For each use, here is the data involved and the basis we rely on.

  • Running your account and the game: signing you in, keeping your username, rating and record, pairing you with other players online and passing on duel challenges between players

    Data: a random user identifier; if you sign in with them, your email address and the name of your Google or Apple account; the username you choose and when you last changed it; your rating, wins, losses, draws, games played, streaks and when you last played a ranked match; while you wait for a match, the board sizes you asked for; the moves of a match while it is played; whether you are online; the players you blocked; the duel challenges you send and receive (the two players, when it was sent and the board size), whether other players can challenge you, and a record of the challenges you sent in the last day (to whom and when); and the IP address of your requests, which Firebase Authentication logs.

    Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

  • Showing your username to your opponent in an online match, and your username, rating and record to other players on the leaderboard, in the list of players who are online at the time (while you are signed in, have a username and the app is open), and in the notification of a challenge you send

    Data: your username, your avatar, your rating, your wins, losses and draws, your streaks and your rank.

    Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

  • Sending the emails that verify your email address or reset your password

    Data: your email address and the link in the message.

    Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

  • Keeping the app configured and protecting the online game from modified apps

    Data: installation identifiers and their tokens, the app's version, the operating system version, your device's language, country setting and time zone, and the integrity checks the app asks Apple and Google for.

    Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

  • Sending notifications about events and big changes in BombaDuel, and the duel challenges other players send you

    Data: a device token linked to your user identifier, the platform of your device, the language of the app, and the topics the app subscribes it to.

    Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

  • Running invites: linking an invite code to the player who shared it, and counting the players who joined through each invite

    Data: the invite code you share, linked to your user identifier; and, if you came in through an invite, that code, the user identifier of the player who invited you and the date.

    Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

  • Counting how the app is used

    Data: usage events, device model, operating system version, the app's language and version, an approximate location that Google derives from your IP address (the app has no access to your phone's location), the app-instance identifier and installation identifiers.

    Legal basis: Your consent, which the app asks for before this starts in the European Economic Area and Brazil (in the European Union and the European Economic Area, GDPR art. 6(1)(a)). In Türkiye and Canada, it stays off until you turn it on in the app (Settings › Privacy choices). In other countries it is on unless you turn it off, except in these cases: in the United Kingdom, it stays off until you turn it on in the app; on an iPhone or iPad, and on any device in Switzerland, it starts when you tap OK on the notice the app shows once, the first time it opens; if your app store country is Russia or mainland China, it does not run at all. In Thailand and Saudi Arabia, the legal basis is our legitimate interests (section 24(5) of Thailand's Personal Data Protection Act; article 6(4) of Saudi Arabia's Personal Data Protection Law). Everywhere, you can turn it off at any time in the app (Settings › Privacy choices).

  • Fixing crashes

    Data: crash reports with their diagnostics, a record of each app session start, device model, operating system and app version, and installation identifiers.

    Legal basis: Your consent, which the app asks for before this starts in the European Economic Area and Brazil (in the European Union and the European Economic Area, GDPR art. 6(1)(a)). In Türkiye and Canada, it stays off until you turn it on in the app (Settings › Privacy choices). In other countries it is on unless you turn it off, except in these cases: on an iPhone or iPad, and on any device in Switzerland, it starts when you tap OK on the notice the app shows once, the first time it opens; if your app store country is Russia or mainland China, it does not run at all; in the United Kingdom, the next row applies. In Thailand and Saudi Arabia, the legal basis is our legitimate interests (section 24(5) of Thailand's Personal Data Protection Act; article 6(4) of Saudi Arabia's Personal Data Protection Law). Everywhere, you can turn it off at any time in the app (Settings › Privacy choices).

  • Fixing crashes in the United Kingdom

    Data: crash reports with their diagnostics, a record of each app session start, device model, operating system and app version, and installation identifiers.

    Legal basis: Our legitimate interests (UK GDPR art. 6(1)(f)): finding and fixing the crashes you hit. The app does not ask first in the United Kingdom, because the Privacy and Electronic Communications Regulations (PECR) allow storing and reading this data on your device without consent when it is needed only to find and fix technical faults. On Android, crash reports are on unless you turn them off in the app (Settings › Privacy choices); on an iPhone or iPad, they start when you tap OK on a notice the app shows once, and you can turn them off the same way. You can object at any time by writing to us.

  • Reading the age range your app store shares, where a law requires it

    Data: the age range, which stays in your phone's memory and is never logged or sent.

    Legal basis: Compliance with a legal obligation (GDPR art. 6(1)(c)).

  • Handling your reports about other players, and answering you when you write to us

    Data: for a report: your user identifier, the username and user identifier of the player you report, the reason you chose and the app's version; for an email: your email address, your message and anything you attach, and the app's version, platform and operating system version that the app writes at the end of the email.

    Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): acting on reports of players who break the Terms of Use, answering your requests, and keeping a record of how we handled them. You can object at any time by writing to us.

6. Who receives data

We use these service providers to run BombaDuel. Each one receives only the data listed, for the purpose listed:

  • Firebase Authentication (Google LLC)

    What for: signs you in and gives your account its random user identifier, and sends the emails that verify your email address or reset your password.

    Data: a random user identifier; if you sign in with them, your email address and, for Google or Apple sign-in, the name and identifier of that account; and the IP address of the request, which Firebase Authentication keeps for a few weeks.

    Google LLC processes this data on our behalf, under its data processing terms. Firebase Authentication privacy information

  • Cloud Firestore (Google LLC)

    What for: stores your profile, the leaderboard, the invite codes, the reports about players and the players you blocked.

    Data: your profile: your user identifier, your username and when you last changed it, your rating, wins, losses, draws, games played, current and best streak and when you last played a ranked match, a number derived from your user identifier that picks your avatar, whether a notification token is registered and whether other players can challenge you to a duel. Any signed-in player can read a profile through the app; the leaderboard shows the top 100 players by rating with their username, rating and record. Also stored: your notification tokens, which only you can read; the invite code you shared, linked to your user identifier; if you came in through an invite, that code, the user identifier of the player who invited you and the date, which only that player can read; the reports you send, which no player can read; and the players you blocked (their user identifier, the name they had and when you blocked them), which only you can read, so that a player you blocked cannot challenge you on any of your devices.

    Google LLC processes this data on our behalf, under its data processing terms. Cloud Firestore privacy information

  • Firebase Realtime Database (Google LLC)

    What for: runs an online match while it is played (the queue, the pairing and the moves), the count of players online, the list of players online and duel challenges.

    Data: while you wait for a match, your user identifier, the name your opponent will see and the board sizes you asked for; when you are paired, the match identifier, the identifiers and names of the two players and the board's seed; during the match, each move with the identifier of the player who made it and its time; for a signed-in player, whether you are online or playing; for a signed-in player with a username, while the app is open, your user identifier and the time, which put you in the list of players online that other players in the app see; and a duel challenge: the two players' user identifiers, when it was sent and the board size.

    Google LLC processes this data on our behalf, under its data processing terms. Firebase Realtime Database privacy information

  • Cloud Functions for Firebase (Google LLC)

    What for: keeps the count of players online, deletes the data of finished and abandoned matches, passes each report about a player to our support inbox, works out the result of a ranked match from its moves, and passes a duel challenge on as a notification unless the player you challenge blocked you or you sent too many.

    Data: your user identifier, whether you are online, the match data listed above, the reports you send, the record of a ranked match (the two players, the result and the ratings), the duel challenges and the players you blocked.

    Google LLC processes this data on our behalf, under its data processing terms. Cloud Functions for Firebase privacy information

  • Firebase Remote Config and Firebase Installations (Google LLC)

    What for: keeps the app configured, for example switching a feature off remotely, announcing maintenance or inviting you to update.

    Data: an installation identifier and its token, the app's version, the operating system version, and the language, country setting and time zone of your device; while usage statistics are on, also when you first opened the app, as Google Analytics recorded it.

    Google LLC processes this data on our behalf, under its data processing terms. Firebase Remote Config and Firebase Installations privacy information

  • Firebase App Check (Google LLC)

    What for: checks that requests to the online game come from the real app.

    Data: an attestation that Apple (App Attest) or Google (Play Integrity) gives the app, and an App Check token.

    Google LLC processes this data on our behalf, under its data processing terms. Firebase App Check privacy information

  • Firebase Cloud Messaging (Google LLC)

    What for: delivers notifications about events and big changes in BombaDuel, and the duel challenges other players send you.

    Data: a device token, stored with your user identifier, the platform of your device and the language of the app, and the topics the app subscribes it to: one for everyone, one for your platform and one for the language of the app. The app creates the token only after you turn notifications on in the app. Signing out and deleting the account delete the token.

    Google LLC processes this data on our behalf, under its data processing terms. Firebase Cloud Messaging privacy information

  • Google Analytics for Firebase (Google LLC)

    What for: counts how the app is used.

    Data: the events Firebase records by itself (first open, app opens, sessions and app updates), the screens you open, the matches you start and finish with their mode, score and result, your searches for an online match and how they end, rematches, how you sign in or sign up, when you choose a username or accept the community rules, the settings you change, when you share an invite or use one, and which prompts the app shows you; the app's language and version, an app-instance identifier, the installation identifier, device model, operating system version and an approximate location that Google derives from your IP address (the app has no access to your phone's location). It never receives your user identifier or your username.

    Google LLC processes this data on our behalf, under its data processing terms. Google Analytics for Firebase privacy information

  • Firebase Crashlytics (Google LLC)

    What for: reports crashes so we can fix them.

    Data: crash reports and diagnostics (device model, operating system, app version), a record of each app session start, and installation identifiers. It never receives your user identifier or your username.

    Google LLC processes this data on our behalf, under its data processing terms. Firebase Crashlytics privacy information

  • Resend (Resend, Inc.)

    What for: sends us by email each report you make about a player.

    Data: the report: the username and user identifier of the player you report, the reason you chose, your user identifier and the app's version.

    Resend, Inc. processes this data on our behalf, under its data processing terms. Resend privacy information

  • Sign in with Google (Google LLC)

    What for: lets you sign in with your Google account.

    Data: your Google account's email address, name and identifier, under Google's terms.

    Google LLC decides for itself how it uses this data, under its own privacy policy. Sign in with Google privacy information

  • Sign in with Apple (Apple Inc.)

    What for: lets you sign in with your Apple Account.

    Data: your Apple Account's identifier and, if you share them, its name and email address, under Apple's terms.

    Apple Inc. decides for itself how it uses this data, under its own privacy policy. Sign in with Apple privacy information

  • GoDaddy Professional Email (GoDaddy Operating Company, LLC)

    What for: receives and keeps the emails you send to support@iocodo.com, the emails that bring us your reports about players, and our replies.

    Data: your email address, your message and anything you attach, the reports about players, and our replies.

    GoDaddy Operating Company, LLC processes this data on our behalf, under its data processing terms. GoDaddy Professional Email privacy information

  • IT service providers (United States)

    What for: tools we may use to read the emails you send us and your reports about players, and to draft our replies.

    Data: the text of your email and your email address, or the report, when we use these tools for it.

    These providers handle this data under their own terms.

Apple (App Store) and Google (Google Play) also handle your download, any purchase and the integrity and age checks the app asks them for, under their own privacy policies.

We do not sell your personal data.

7. Notifications

Firebase Cloud Messaging (a Google service) gives your device a token, and the app stores it with your account so that we can send you the notifications you asked for. The app does this only after you turn notifications on in the app, and it also subscribes the token to three topics: one for everyone, one for your platform and one for the language of the app. If you have a username, another player can challenge you to a duel: the notification shows their username, and a player you blocked cannot challenge you. We delete the token when you turn notifications off in the app, sign out or delete your account.

You can turn notifications off at any time in your device settings.

8. Where data is processed

IOCODO LLC is registered in the United States. Our service providers may process your personal data in the United States and other countries where Google, Resend, GoDaddy or their subcontractors have facilities.

Where European, UK or Swiss data protection law requires a safeguard for this, we rely on:

  • the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, for providers certified under them (you can check a provider on dataprivacyframework.gov)
  • the Standard Contractual Clauses approved by the European Commission, with the UK Addendum and the Swiss adjustments, which are part of our providers' data processing terms

The IT service providers listed in Who receives data are in the United States and are not covered by these safeguards, by an adequacy decision or by UK adequacy regulations.

You can ask us for a copy of these safeguards at support@iocodo.com.

9. How long we keep data

Here is how long we keep each kind of personal data. Items marked automatic are deleted on a fixed schedule, without anyone having to ask.

  • Your account, username, profile with your rating and record, invite code and notification tokens

    Until you delete the account in Settings › Delete account, which removes them at once; a guest account stays until you delete it in the same way. The reports you sent stay, as described below, and the invite record of a player who joined through your invite keeps your user identifier until that player deletes their account.

  • The data of an online match (the moves, the pairing and the match record)

    Deleted by a clean-up that runs every 30 minutes, once the match has had no move for one hour. automatic

  • Your place in the matchmaking queue and whether you are online

    Removed when you leave the queue or the app, or when your connection drops. automatic

  • Your entry in the list of players online

    Removed when you leave the app or your connection drops, or else by a clean-up that runs every 30 minutes, once the entry has not been updated for 30 minutes. automatic

  • A duel challenge

    Deleted when it is answered, taken back or refused, or else by a clean-up that runs every 30 minutes, once the challenge is 10 minutes old. automatic

  • The record of the challenges you sent

    Deleted by a clean-up that runs every 30 minutes, once a day has passed without a new challenge. automatic

  • The record of a ranked match

    7 days. automatic

  • The players you blocked, on our servers

    Until you unblock them or delete your account.

  • Usage events in Google Analytics

    2 months. automatic

  • Identifiers linked to your usage statistics in Google Analytics (the app-instance and installation identifiers)

    Up to 14 months after the app last sent usage statistics. automatic

  • Crash reports

    90 days. automatic

  • The IP address logged by Firebase Authentication

    A few weeks. automatic

  • Installation identifiers

    Until they have gone 270 days without use, when Firebase deletes them on its own (its current rule), or sooner if you ask us to delete them; Firebase then removes them within 180 days.

  • Your reports about players, and the copies that reach our support inbox

    Until you ask us to delete them, also after you delete your account. We set no fixed end date: we keep them as the record of how we handled a report. If a law or a legal claim requires us to keep a report, we keep it until that ends.

  • Emails you send us, and our replies to you

    Until you ask us to delete them. We set no fixed end date: we keep them as the record of our support, to answer you if you write again and to show how we handled your request. If you are in Korea, we keep them for 3 years after our last message about your request and then delete them, or sooner if you ask us to, on the basis of article 15(1)(vi) of the Personal Information Protection Act (our legitimate interest in showing how we handled your request). If a law or a legal claim requires us to keep an email, we keep it until that ends.

  • What the app keeps on your phone

    Until you uninstall the app; deleting your account also clears your account from the phone.

When you delete your account or ask us to delete your data, we delete it as described here, unless the law requires us to keep part of it.

10. How we protect data

Data travels between the app and our service providers over encrypted connections (HTTPS).

Our providers encrypt the data they store for us, and the access rules of our database limit what each user can read and change. Access to our systems is limited to the people who run BombaDuel, and only to run and support it.

If a security incident puts your personal data at risk, we tell you and the competent authorities when the law requires it.

11. Your rights

Wherever you live, you can ask us to:

  • tell you what personal data we have about you, and give you a copy
  • send that copy to you, or to another company, in a machine-readable format
  • correct data that is wrong or incomplete
  • delete your data
  • stop or limit a use of your data, including any use based on our legitimate interests

To ask, write to support@iocodo.com. It is free. We reply within one month, and we may ask you to confirm that the data is yours before we act.

You can also withdraw any consent you gave, at any time, in the app (Settings › Privacy choices). What we did with your consent before you withdrew it stays lawful.

Deleting your data

You can delete your account and its data:

  • in the app, for your account and its sign-in, your username, your profile with your rating and record, your invite code, your notification tokens, your place in the matchmaking queue, your online status and the players you blocked: Settings › Delete account
  • by email: write to support@iocodo.com with the subject "Delete my data"

Usage statistics and crash reports that were already sent are deleted on their own, within the periods in How long we keep data.

What the app keeps on your device is deleted when you uninstall the app.

Complaints

You also have the right to complain to an authority:

If you are in Brazil, you have the rights listed in article 18 of the LGPD (Lei 13.709/2018), and you can use them as described above. If you ask us for your data, we send a complete answer within 15 days, not one month.

12. Privacy rights in US states

Several US states, including California, Colorado, Connecticut, Oregon, Texas and Virginia, give their residents privacy rights. We give the same rights to everyone in the United States:

  • to know what personal information we collect, use and disclose, and to get a copy of it
  • to correct it
  • to delete it
  • to opt out of the sale of your personal information, of its use for targeted advertising and of profiling that has legal or similarly significant effects
  • to appeal if we turn down your request
  • not to be treated differently for using any of these rights

The personal information we collect comes from you and from the app on your device. Why we use it and who receives it are described in What we use data for and Who receives data. We do not sell your personal information. In the current version of BombaDuel, we do not use or share it for targeted advertising.

To use these rights, write to support@iocodo.com, or have someone you authorise write for you. We reply within one month (these state laws allow up to 45 days). If we turn your request down, you can appeal by replying with the word "Appeal" in the subject. We answer an appeal within 45 days, and if you still disagree you can contact the attorney general of your state.

13. Notices for some countries

Canada

The service providers listed in Who receives data collect and keep data for us. They may process it outside Canada, in the United States and other countries where Google, Resend, GoDaddy or their subcontractors have facilities. The courts and authorities of those countries can have access to it under their laws.

Japan: information the app sends to other companies

When you use BombaDuel, the app sends this information from your device to other companies:

  • Firebase Authentication (Google LLC)

    Information sent: a random user identifier; if you sign in with them, your email address and, for Google or Apple sign-in, the name and identifier of that account; and the IP address of the request, which Firebase Authentication keeps for a few weeks.

    Our purpose: to sign you in, to give your account its random user identifier and to send the emails that verify your email address or reset your password.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Cloud Firestore (Google LLC)

    Information sent: your profile: your user identifier, your username and when you last changed it, your rating, wins, losses, draws, games played, current and best streak and when you last played a ranked match, a number derived from your user identifier that picks your avatar, whether a notification token is registered and whether other players can challenge you to a duel. Any signed-in player can read a profile through the app; the leaderboard shows the top 100 players by rating with their username, rating and record. Also stored: your notification tokens, which only you can read; the invite code you shared, linked to your user identifier; if you came in through an invite, that code, the user identifier of the player who invited you and the date, which only that player can read; the reports you send, which no player can read; and the players you blocked (their user identifier, the name they had and when you blocked them), which only you can read, so that a player you blocked cannot challenge you on any of your devices.

    Our purpose: to store your profile, the leaderboard, the invite codes, the reports about players and the players you blocked.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Firebase Realtime Database (Google LLC)

    Information sent: while you wait for a match, your user identifier, the name your opponent will see and the board sizes you asked for; when you are paired, the match identifier, the identifiers and names of the two players and the board's seed; during the match, each move with the identifier of the player who made it and its time; for a signed-in player, whether you are online or playing; for a signed-in player with a username, while the app is open, your user identifier and the time, which put you in the list of players online that other players in the app see; and a duel challenge: the two players' user identifiers, when it was sent and the board size.

    Our purpose: to run an online match while it is played (the queue, the pairing and the moves), the count of players online, the list of players online and duel challenges.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Firebase Remote Config and Firebase Installations (Google LLC)

    Information sent: an installation identifier and its token, the app's version, the operating system version, and the language, country setting and time zone of your device; while usage statistics are on, also when you first opened the app, as Google Analytics recorded it.

    Our purpose: to keep the app configured, for example switching a feature off remotely, announcing maintenance or inviting you to update.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Firebase App Check (Google LLC)

    Information sent: an attestation that Apple (App Attest) or Google (Play Integrity) gives the app, and an App Check token.

    Our purpose: to check that requests to the online game come from the real app.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Firebase Cloud Messaging (Google LLC)

    Information sent: a device token, stored with your user identifier, the platform of your device and the language of the app, and the topics the app subscribes it to: one for everyone, one for your platform and one for the language of the app. The app creates the token only after you turn notifications on in the app. Signing out and deleting the account delete the token.

    Our purpose: to deliver notifications about events and big changes in BombaDuel, and the duel challenges other players send you.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Google Analytics for Firebase (Google LLC)

    Information sent: the events Firebase records by itself (first open, app opens, sessions and app updates), the screens you open, the matches you start and finish with their mode, score and result, your searches for an online match and how they end, rematches, how you sign in or sign up, when you choose a username or accept the community rules, the settings you change, when you share an invite or use one, and which prompts the app shows you; the app's language and version, an app-instance identifier, the installation identifier, device model, operating system version and an approximate location that Google derives from your IP address (the app has no access to your phone's location). It never receives your user identifier or your username.

    Our purpose: to count how the app is used.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Firebase Crashlytics (Google LLC)

    Information sent: crash reports and diagnostics (device model, operating system, app version), a record of each app session start, and installation identifiers. It never receives your user identifier or your username.

    Our purpose: to report crashes so we can fix them.

    Purpose of Google LLC: it uses the information only to provide this service to us.

  • Sign in with Google (Google LLC)

    Information sent: your Google account's email address, name and identifier, under Google's terms.

    Our purpose: to let you sign in with your Google account.

    Purpose of Google LLC: its own purposes too, described in its privacy information.

  • Sign in with Apple (Apple Inc.)

    Information sent: your Apple Account's identifier and, if you share them, its name and email address, under Apple's terms.

    Our purpose: to let you sign in with your Apple Account.

    Purpose of Apple Inc.: its own purposes too, described in its privacy information.

In Settings › Privacy choices, you can turn off usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics). The other transmissions cannot be turned off in the app; Firebase Cloud Messaging receives data only when you turn notifications on in the app; Sign in with Google receives data only when you choose to sign in with Google; Sign in with Apple receives data only when you choose to sign in with Apple.

Korea: personal information, entrustment and transfer abroad

Personal information: under Korea's Personal Information Protection Act (the Act), the personal information we process is your account (the random user identifier and, if you sign in with them, your email address and the name of your Google or Apple account), the username you choose, your rating and record, the reports you send, and the emails you send to support@iocodo.com, with what you write in them. The app-instance identifier, usage events, crash reports and the device information listed in Who receives data cannot be linked to you with anything we hold or could lawfully obtain at reasonable cost in time, money and technology, so under the Act they are not personal information (the definition in What this policy covers is broader), and we handle them without identifying you.

Processed without your consent: we process your account, your username, your rating and record, the moves of your online matches, your reports and your emails to us without asking for your consent, on the basis of article 15(1)(iv) of the Act, which covers what is needed to carry out our contract with you (our terms of use) or, in the process of concluding a contract, to act on your request. Once we have handled your request, we keep your emails to us and our replies, with your email address, as the record of how we handled it, in case you write to us again about it or a dispute arises, on the basis of article 15(1)(vi) of the Act (our legitimate interests, where they clearly outweigh your rights and stay within a reasonable scope). If you are in Korea, we keep them for 3 years after our last message about that request, then delete them; we delete them sooner if you ask us to.

Entrustment and transfer abroad: we entrust the work below to these companies, which receive the personal information outside Korea. The legal basis for the transfer is article 28-8(1)(iii) of the Act: we entrust this work to them to carry out our contract with you, and this policy discloses the details the Act lists. Each company uses the information only to do this work for us, and keeps it for the periods in How long we keep data.

  • Google LLC

    Work entrusted: running the Firebase services the app uses: your account, the online matches, the leaderboard, the invites, the reports and the notifications.

    Personal information transferred: your random user identifier, your email address and the name of your Google or Apple account if you sign in with them, your username, your rating and record, the moves of your matches, whether you are online, your notification token, the invite codes, your reports, and the IP address of your requests.

    Countries: the United States, Australia, Belgium, Brazil, Canada, Chile, Denmark, Finland, France, Germany, Hong Kong, India, Indonesia, Ireland, Israel, Italy, Japan, Mexico, the Netherlands, Poland, Qatar, Saudi Arabia, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, the United Kingdom and Uruguay.

    When and how: when the app connects to Firebase, over an encrypted connection (HTTPS).

    Contact: 1600 Amphitheatre Parkway, Mountain View, California 94043, United States, privacy contact form.

    How to refuse: delete your account in Settings › Delete account.

    If you refuse: without an account the app cannot run online matches or the leaderboard; if your app store country is Russia or mainland China, the app works without these services and offers only matches against the computer.

    Sub-processors: the list published by Google LLC

  • Resend, Inc.

    Work entrusted: sending us by email each report you make about a player.

    Personal information transferred: the username and user identifier of the player you report, the reason, your user identifier and the app's version.

    Countries: the United States.

    When and how: when you report a player, over an encrypted connection.

    Contact: 2261 Market Street #5039, San Francisco, CA 94114, United States, privacy@resend.com.

    How to refuse: do not report players from the app; you can write to us by email instead.

    If you refuse: your report reaches us only if you send it by email, and the app works the same.

    Sub-processors: the list published by Resend, Inc.

  • GoDaddy Operating Company, LLC

    Work entrusted: receiving and keeping the emails you send to support@iocodo.com, the emails that bring us your reports, and our replies.

    Personal information transferred: your email address, your message and anything you attach, your reports about players, and our replies.

    Countries: the United States and the Cayman Islands.

    When and how: when you send us an email, when you report a player, or when we reply to you, over the internet.

    Contact: Office of the Data Privacy Officer, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, United States, privacy@godaddy.com.

    How to refuse: do not write to us by email and do not report players from the app; to remove the emails you already sent, ask us to delete them.

    If you refuse: we cannot answer you by email or act on a report, and the app works the same.

    Sub-processors: the list published by GoDaddy Operating Company, LLC

Where we process it: we have no servers of our own: the companies above store this personal information for us, in the countries named for each.

Destruction: when the period in How long we keep data ends, or when you ask us, we delete the personal information without delay, permanently and so that it cannot be recovered. We keep none of it on paper.

Automatic collection: the app collects information automatically through the software development kits (SDKs) of these services. What each one collects is listed in Who receives data, and how long it is kept in How long we keep data.

  • Firebase Authentication
  • Cloud Firestore
  • Firebase Realtime Database
  • Firebase Remote Config and Firebase Installations
  • Firebase App Check
  • Google Analytics for Firebase
  • Firebase Crashlytics

Firebase Cloud Messaging receives data only when you turn notifications on in the app; Sign in with Google receives data only when you choose to sign in with Google; Sign in with Apple receives data only when you choose to sign in with Apple: that is not automatic collection.

How to refuse: on Android, usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics) are on by default in Korea; on iPhone and iPad they start when you tap OK on the notice the app shows once, the first time it opens. You can turn them off at any time in Settings › Privacy choices. The other services in this list are needed for the app to work: to refuse them, stop using the app and delete it. You can also write to us at support@iocodo.com.

Your requests: you can make the requests described in Your rights. If you are in Korea, we answer within 10 days, not one month. A legal guardian of a child under 14 can make the same requests for the child.

Privacy officer: IOCODO LLC, Privacy team, support@iocodo.com. You can also send complaints about how we handle personal information to this address.

Aviso de privacidad para México

Aviso de privacidad simplificado: en IOCODO LLC, con domicilio en 30 N Gould St Ste N, Sheridan, WY 82801-6317, Estados Unidos, tratamos los datos de tu cuenta (un identificador aleatorio y, si inicias sesión con Google o Apple, tu correo electrónico y el nombre de esa cuenta), el nombre de usuario que eliges, tu puntaje y tu historial de partidas clasificatorias, las jugadas de tus partidas en línea, los desafíos a duelo que envías y recibes, los jugadores que bloqueas, los datos de tu dispositivo, los datos sobre cómo usas la app, los reportes que envías sobre otros jugadores y, si nos escribes, tu mensaje y tu correo electrónico. Los usamos para que BombaDuel funcione y para responderte, que son finalidades primarias, y también para las estadísticas de uso y los informes de errores, que son finalidades secundarias, en las condiciones que se indican abajo. Puedes limitar el uso de tus datos en Ajustes › Opciones de privacidad o escribiéndonos a support@iocodo.com. Puedes consultar el aviso de privacidad integral en esta página.

Si usas BombaDuel en México, esta página es nuestro aviso de privacidad integral. Esto es lo que la ley mexicana nos pide decirte:

Responsable: IOCODO LLC, con domicilio en 30 N Gould St Ste N, Sheridan, WY 82801-6317, Estados Unidos. Puedes escribirnos a support@iocodo.com.

Datos personales que tratamos: los detallamos para cada uso en la sección “Para qué usamos los datos y con qué base jurídica” y para cada servicio en la sección “Quién recibe los datos”.

Para qué los usamos: para que BombaDuel funcione y para responderte cuando nos escribes. Estas son finalidades primarias: son necesarias para prestarte el servicio.

Finalidades secundarias: si no te opones, también los usamos para:

  • estadísticas de uso (Google Analytics para Firebase)
  • informes de errores (Firebase Crashlytics)

Cómo limitar el uso de tus datos: en Ajustes › Opciones de privacidad puedes desactivar cuando quieras las estadísticas de uso y los informes de errores. La app sigue funcionando igual. También puedes escribirnos a support@iocodo.com.

Derechos ARCO: puedes pedirnos acceso a tus datos, su rectificación o su cancelación, y oponerte a su uso. Nuestro departamento de datos personales atiende estas solicitudes en support@iocodo.com: dinos qué derecho quieres ejercer y sobre qué datos. Te respondemos en un plazo máximo de 20 días.

Tecnologías que recopilan datos automáticamente: mientras usas la app, los componentes de software (SDK) de estos servicios recopilan datos de forma automática:

  • Firebase Authentication
  • Cloud Firestore
  • Firebase Realtime Database
  • Firebase Remote Config y Firebase Installations
  • Firebase App Check
  • Google Analytics para Firebase
  • Firebase Crashlytics

En la sección “Quién recibe los datos” puedes ver qué recopila cada uno. En Ajustes › Opciones de privacidad puedes desactivar Google Analytics para Firebase y Firebase Crashlytics. Para que los demás dejen de recopilar datos, tendrías que desinstalar la app.

Cambios a este aviso: los publicamos en esta página, con la fecha de la nueva versión. Si un cambio afecta la forma en que usamos los datos que ya tenemos de ti, te avisamos en la app antes de aplicarlo.

South Africa

If you are in South Africa, you can object at any time to our use of your personal information. In Settings › Privacy choices, you can turn off usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics); for any other use, write to us at support@iocodo.com. You can also lodge a complaint with the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, South Africa; email POPIAComplaints@inforegulator.org.za; telephone +27 10 023 5200.

Türkiye: Aydınlatma Metni

Bu metin, BombaDuel uygulamasını Türkiye'de kullanan kişileri 6698 sayılı Kişisel Verilerin Korunması Kanunu'nun (“Kanun”) 10. maddesi uyarınca aydınlatmak amacıyla hazırlanmıştır.

Bu metin yalnızca bilgilendirme amaçlıdır. Açık rızanız, bu metinden ayrı olarak uygulama içinde alınır.

Veri sorumlusu: BombaDuel uygulamasını geliştiren IOCODO LLC. IOCODO LLC, Amerika Birleşik Devletleri'nin Wyoming eyaletinde kayıtlı bir sınırlı sorumluluk şirketidir.

Posta adresi: 30 N Gould St Ste N, Sheridan, WY 82801-6317, Amerika Birleşik Devletleri
E-posta: support@iocodo.com

Amaçlar ve hukuki sebepler: Kişisel verilerinizi aşağıdaki amaçlarla işliyoruz.

  • Hesabınızın ve oyunun işletilmesi; oyuncular arasındaki düello davetlerinin iletilmesi; kullanıcı adınızın, puanınızın ve oyun geçmişinizin diğer oyunculara gösterilmesi

    Veriler: rastgele bir kullanıcı tanımlayıcısı; e-posta adresiniz ve Google ya da Apple hesabınızın adı (bunlarla giriş yaparsanız); seçtiğiniz kullanıcı adı ve onu en son ne zaman değiştirdiğiniz; puanınız, galibiyetleriniz, mağlubiyetleriniz, beraberlikleriniz, oynadığınız oyun sayısı, serilerinizin kaydı, sıralamanız ve en son ne zaman dereceli bir maç oynadığınız; bir maç beklerken seçtiğiniz tahta boyutları; oynanan bir maçın hamleleri; çevrimiçi olup olmadığınız; avatarınız; engellediğiniz oyuncular; gönderdiğiniz ve aldığınız düello davetleri (iki oyuncu, gönderilme zamanı ve tahta boyutu); diğer oyuncuların size düello daveti gönderip gönderemeyeceği; son bir gün içinde gönderdiğiniz davetlerin kaydı (kime ve ne zaman); Firebase Authentication'ın kaydettiği isteklerinizin IP adresi; e-posta adresinizi doğrulamak veya şifrenizi sıfırlamak için gönderilen e-postalardaki bağlantı.

    Hukuki sebep: bir sözleşmenin kurulması veya ifasıyla doğrudan doğruya ilgili olması kaydıyla, sözleşmenin taraflarına ait kişisel verilerin işlenmesinin gerekli olması (Kanun md. 5/2-c).

  • Uygulamanın yapılandırılması ve çevrimiçi oyunun değiştirilmiş uygulamalara karşı korunması

    Veriler: kurulum tanımlayıcıları ve belirteçleri, uygulama sürümü, işletim sistemi sürümü, cihazınızın dili, ülke ayarı ve saat dilimi, uygulamanın Apple ve Google'dan istediği bütünlük kontrolleri.

    Hukuki sebep: bir sözleşmenin kurulması veya ifasıyla doğrudan doğruya ilgili olması kaydıyla, sözleşmenin taraflarına ait kişisel verilerin işlenmesinin gerekli olması (Kanun md. 5/2-c).

  • BombaDuel'deki etkinlikler ve büyük değişiklikler ile diğer oyuncuların size gönderdiği düello davetleri hakkında bildirim gönderilmesi

    Veriler: kullanıcı tanımlayıcınıza bağlı bir cihaz belirteci, cihazınızın platformu, uygulamanın dili ve uygulamanın bu belirteci abone ettiği konular.

    Hukuki sebep: bir sözleşmenin kurulması veya ifasıyla doğrudan doğruya ilgili olması kaydıyla, sözleşmenin taraflarına ait kişisel verilerin işlenmesinin gerekli olması (Kanun md. 5/2-c).

  • Davetlerin işletilmesi: bir davet kodunun onu paylaşan oyuncuya bağlanması ve her davetle katılan oyuncuların sayılması

    Veriler: paylaştığınız davet kodu ve kullanıcı tanımlayıcınız; bir davetle geldiyseniz o kod, sizi davet eden oyuncunun kullanıcı tanımlayıcısı ve tarih.

    Hukuki sebep: bir sözleşmenin kurulması veya ifasıyla doğrudan doğruya ilgili olması kaydıyla, sözleşmenin taraflarına ait kişisel verilerin işlenmesinin gerekli olması (Kanun md. 5/2-c).

  • Uygulamanın kullanımına ilişkin istatistiklerin tutulması ve çökmelerin giderilmesi

    Veriler: kullanım olayları, çökme raporları ve tanılama bilgileri, her uygulama oturumunun başladığına ilişkin bir kayıt, cihaz modeli, işletim sistemi ve uygulama sürümü, uygulamanın dili, uygulama örneği ve kurulum tanımlayıcıları, Google'ın IP adresinizden çıkarsadığı yaklaşık konum (uygulamanın telefonunuzun konumuna erişimi yoktur).

    Hukuki sebep: açık rızanız (Kanun md. 5/1). Türkiye'de kullanım istatistikleri ve çökme raporları siz açık rıza verene kadar kapalıdır.

  • Yasanın gerektirdiği yerlerde, uygulama mağazanızın paylaştığı yaş aralığının okunması

    Veriler: yaş aralığı; telefonunuzun belleğinde kalır, hiçbir zaman kaydedilmez veya gönderilmez.

  • Diğer oyuncular hakkındaki bildirimlerinizin işlenmesi ve bize yazdığınızda size yanıt verilmesi

    Veriler: bir bildirim için: kullanıcı tanımlayıcınız, bildirdiğiniz oyuncunun kullanıcı adı ve kullanıcı tanımlayıcısı, seçtiğiniz neden ve uygulama sürümü; bir e-posta için: e-posta adresiniz, mesajınız ve eklediğiniz her şey, ayrıca uygulamanın e-postanın sonuna yazdığı uygulama sürümü, platform ve işletim sistemi sürümü.

    Hukuki sebep: sorularınızın yanıtlanması bakımından, bir sözleşmenin kurulması veya ifasıyla doğrudan doğruya ilgili olması kaydıyla, sözleşmenin taraflarına ait kişisel verilerin işlenmesinin gerekli olması (Kanun md. 5/2-c); Kanun'un 11. maddesi uyarınca yaptığınız başvuruların sonuçlandırılması bakımından, veri sorumlusunun hukuki yükümlülüğünü yerine getirebilmesi için zorunlu olması (Kanun md. 5/2-ç ve md. 13); size nasıl yanıt verdiğimizi kanıtlayabilmek amacıyla yazışmaların yalnızca Kişisel Verileri Koruma Kuruluna şikâyet veya dava yolu açık olduğu sürece saklanması bakımından, bir hakkın tesisi, kullanılması veya korunması için veri işlemenin zorunlu olması (Kanun md. 5/2-e).

Toplama yöntemi: Kişisel verilerinizi aşağıdaki iki yöntemle elde ediyoruz.

  • Otomatik yollarla: uygulamayı kullandığınız sırada, cihazınızdaki BombaDuel uygulaması ve uygulamanın içinde yer alan hizmet sağlayıcılara ait yazılımlar (SDK) aracılığıyla.
  • Bir veri kayıt sisteminin parçası olmak kaydıyla otomatik olmayan yollarla: bize yazdığınızda, yani e-postalarınız aracılığıyla.

Aktarım: BombaDuel uygulamasını işletmek için aşağıdaki sağlayıcılardan hizmet alıyoruz. Her biri yalnızca kendi hizmetiyle ilgili verileri alır.

  • Google LLC: hesap ve oyun (Firebase Authentication, Cloud Firestore, Firebase Realtime Database, Cloud Functions for Firebase), Google ile giriş yapmayı seçerseniz girişiniz, uygulamanın yapılandırılması ve korunması (Firebase Remote Config, Firebase Installations, Firebase App Check ve Google Play Integrity), bildirimler (Firebase Cloud Messaging); açtıysanız kullanım istatistikleri (Google Analytics for Firebase) ve çökme raporları (Firebase Crashlytics)
  • Apple Inc. (ABD): iPhone ve iPad'de bildirimlerin iletilmesi (Apple Push Notification service), isteklerin gerçekten BombaDuel uygulamasından geldiğinin doğrulanması (App Attest) ve Apple ile giriş yapmayı seçerseniz girişiniz
  • Resend, Inc.: diğer oyuncular hakkındaki her bildiriminizi bize e-postayla iletir
  • GoDaddy Operating Company, LLC: destek posta kutumuz (GoDaddy Professional Email); bize gönderdiğiniz e-postaları ve yanıtlarımızı saklar
  • Bilgi teknolojileri hizmet sağlayıcıları (ABD): bize gönderdiğiniz e-postaları ve diğer oyuncular hakkındaki bildirimlerinizi okumak ve yanıtlarımızı hazırlamak için kullanabileceğimiz araçları sunan şirketler

Haklarınız: Kanun'un 11. maddesi uyarınca, veri sorumlusuna başvurarak kendinizle ilgili aşağıdaki haklara sahipsiniz.

  • kişisel verilerinizin işlenip işlenmediğini öğrenme
  • kişisel verileriniz işlenmişse buna ilişkin bilgi talep etme
  • kişisel verilerinizin işlenme amacını ve amacına uygun kullanılıp kullanılmadığını öğrenme
  • kişisel verilerinizin yurt içinde veya yurt dışında aktarıldığı üçüncü kişileri bilme
  • kişisel verileriniz eksik veya yanlış işlenmişse düzeltilmesini isteme
  • Kanun'un 7. maddesindeki şartlar çerçevesinde kişisel verilerinizin silinmesini veya yok edilmesini isteme
  • düzeltme, silme ve yok etme işlemlerinin, kişisel verilerinizin aktarıldığı üçüncü kişilere bildirilmesini isteme
  • işlenen verilerin münhasıran otomatik sistemler vasıtasıyla analiz edilmesi suretiyle aleyhinize bir sonucun ortaya çıkmasına itiraz etme
  • kişisel verilerinizin kanuna aykırı olarak işlenmesi sebebiyle zarara uğramanız hâlinde zararın giderilmesini talep etme

Başvuru: Başvurunuzu yukarıdaki posta adresine yazılı olarak ya da support@iocodo.com adresine e-postayla iletebilirsiniz. Talebinizi, niteliğine göre en kısa sürede ve en geç otuz gün içinde ücretsiz olarak sonuçlandırırız (Kanun md. 13).

Việt Nam: chuyển dữ liệu cá nhân xuyên biên giới

Khi bạn dùng BombaDuel tại Việt Nam, dữ liệu cá nhân của bạn được chuyển ra nước ngoài và được xử lý tại đó. BombaDuel là ứng dụng của IOCODO LLC, một công ty tại Hoa Kỳ.

Bên nhận dữ liệu: IOCODO LLC và các nhà cung cấp dịch vụ của chúng tôi, gồm:

  • Google LLC
  • Resend, Inc.
  • Apple Inc.
  • GoDaddy Operating Company, LLC

Nơi xử lý: Hoa Kỳ và các quốc gia khác nêu tại phần về nơi xử lý dữ liệu trên trang này.

Mục đích xử lý: vận hành BombaDuel và trả lời khi bạn liên hệ với chúng tôi.

Ngoài ra, tùy theo lựa chọn của bạn, dữ liệu còn được dùng cho:

  • thống kê việc sử dụng ứng dụng (Google Analytics for Firebase)
  • báo cáo sự cố để chúng tôi khắc phục lỗi (Firebase Crashlytics)

Phần về bên nhận dữ liệu trên trang này cho biết mỗi dịch vụ nhận những dữ liệu nào và để làm gì. Bạn có thể bật hoặc tắt thống kê sử dụng và báo cáo sự cố bất cứ lúc nào trong ứng dụng, tại Settings › Privacy choices.

Email bạn gửi cho chúng tôi: Bên nhận: GoDaddy Operating Company, LLC tại Hoa Kỳ (nhà cung cấp hộp thư hỗ trợ của chúng tôi) và Anthropic, PBC tại Hoa Kỳ (Claude, trợ lý trí tuệ nhân tạo mà chúng tôi có thể dùng để đọc email và soạn bản nháp thư trả lời). Điều này cũng áp dụng cho các báo cáo bạn gửi cho chúng tôi qua email.

Xử lý tự động: Khi chúng tôi dùng Claude để đọc một email, nội dung email đó được xử lý tự động. Claude là một mô hình ngôn ngữ, có chức năng đọc văn bản và soạn bản nháp thư trả lời. Chúng tôi không đưa ra bất kỳ quyết định tự động nào về bạn: một người phụ trách tại IOCODO sẽ trực tiếp đọc và quyết định cách trả lời. Nếu bạn muốn từ chối, hãy ghi «KHÔNG AI» vào tiêu đề email gửi đến support@iocodo.com: chúng tôi sẽ xử lý email đó mà không dùng trí tuệ nhân tạo.

14. Children

BombaDuel is not meant for children under 13.

The app never asks for your age or your year of birth. Where it asks for your consent to usage statistics and crash reports, the button that allows them states the age from which your consent counts there; the button that refuses them states no age. If you are younger than the age on the button, refuse, and the app works the same.

Your consent counts from an age that depends on where you are: 13 in Belgium, Estonia, Iceland, Malta, Norway, Portugal and Sweden; 14 in Austria, Cyprus and Spain; 15 in Czechia, Denmark, France, Greece and Slovenia; 16 in the other countries of the European Economic Area. When the app sees signs of more than one country, the highest of their ages applies. In Brazil, an Allow turns usage statistics and crash reports on only when your app store tells the app that you are 18 or older; otherwise they stay off.

In Brazil, the app reads the age range your app store shares with it (Apple's Declared Age Range, Google Play Age Signals). It uses the range only for this check, keeps it only in your phone's memory, and never logs or sends it.

For parents: BombaDuel has no chat and no messages between players. Your opponent sees your username during an online match, and the leaderboard lists the best-rated players with their username, rating and record. Usernames pass through a filter that refuses offensive names, players can be reported from the leaderboard, and a blocked player is never paired with you again. Signed-in players with a username see who is online now and can challenge each other to a duel; a challenge shows only the challenger's username, which passed the same filter, and a player you blocked cannot challenge you.

If you think a child has given us personal data, write to support@iocodo.com and we will delete it.

15. "Do Not Track" and other companies

Some browsers and devices can send a "Do Not Track" signal. There is no common standard for responding to it, so neither BombaDuel nor this page changes what it does when it receives one. The choices described in this policy are how you control your data.

In the current version of BombaDuel, only the service providers listed in Who receives data receive data from the app, for the purposes listed there. We do not let other companies use BombaDuel to collect personal data about your activity over time and across other apps and websites.

16. Changes to this policy

We update this policy when BombaDuel or the law changes, and the date at the top shows when the current version took effect. If a change affects how we use data we already have about you, we tell you in the app before it applies, and we ask for your consent again where the law requires it.

This version was last updated on .

Earlier versions: 2026-11-09, 2026-08-18

17. Contact

IOCODO LLC
Postal address: 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Email: support@iocodo.com
Report criminal or illegal content: iocodo.com/report/

Person in charge of the protection of personal information (Québec): the managing member of IOCODO LLC, at support@iocodo.com.