SoliDuel

Privacy Policy

Last updated and effective: November 7, 2026

한국어: 개인정보 처리방침

Polski: Polityka prywatności

1. Who we are

SoliDuel is a card game for two players, made and published by IOCODO LLC, a company registered in Wyoming, United States. In this policy "we" means IOCODO LLC. We decide how the data described here is used.

IOCODO LLC
30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Privacy contact: support@iocodo.com

2. Guest play and accounts

You do not need an account to play. If you choose Guest, the app gives you a guest profile with a random identifier, with no username and no email address.

To pick a username, add friends and appear on the leaderboard, you sign in. Sign-in is handled by Firebase Authentication, and what we receive depends on the method you choose:

• Google: the email address and the basic profile details of the Google account you pick.
• Apple: the email address you decide to share, which can be one of Apple's private relay addresses, and your name if you allow it.
• Email and password: your email address. Your password is handled by Firebase Authentication and is not visible to us.

3. What we collect

• Profile: your username, your avatar (an emoji and a colour), your country, your email address if you signed in, and the date you joined.
• Play: wins, losses and draws, your rating, your match history, your record against each opponent and your place on the leaderboard.
• Friends and challenges: your friends, friend requests, challenges, the invite links you create, and the players you block or mute.
• Chat: the messages you exchange with your opponent during a match.
• Presence: whether you are online or in a match, and when you were last seen.
• Device and app: the app version, the operating system, your language, the token that lets us send you notifications, and the IP address our providers receive when the app connects.
• What you send us: feedback, reports and support emails, with your email address when you give it.
• Usage statistics and crash reports, described in section 6.

The app also keeps your settings and a copy of some of this data on your device, so that it opens quickly.

Your age range, from your app store. The app asks Google Play or the App Store for the age range of your account:

• on Android, for a Google Play account in the United States or Brazil
• on iPhone and iPad, when Apple says an age law applies to your account; Apple may first show you its own screen

The app uses the answer only to protect minors:

• if the store says you are under 13, the app creates no notification token and deletes one it made before
• in Brazil, if the store says you are under 18, usage statistics and crash reports stay off

The answer stays on your phone, where the app keeps only what it decided from it. It is never sent to us or to anyone else.

4. What other players can see

SoliDuel is played against other people, so part of your profile is public inside the game:

• your username, your avatar, your statistics, your rating and your place on the leaderboard
• whether you are online or in a match
• when you were last seen, unless you switch off Show Last Seen in Settings
• the flag of your country, only if you choose to show one on your avatar
• the chat messages you send to your opponent

Your email address is not shown to other players.

5. Chat and moderation

During a match you can exchange short text messages with your opponent. Before your first chat with a player, the app asks whether you want to start it. Guests cannot use the chat.

Messages are stored with the match and deleted 30 days after it ends. A conversation that has been reported is kept until the case is closed.

When a match ends, software checks its chat for wording typical of scams that push players to move to another app. It looks for fixed word patterns and decides nothing: a match only creates a report. Reports, whether sent by a player or created by this check, are read by a person on our team. Chats that nobody reported are not read.

When a player reports a chat, the messages of that match are also sent once to Gemini, a service of Google, together with the identifiers of the two players. This happens only if every other person who wrote in that chat agreed to it before chatting, and never for a report of intimate content shared without consent. Nor does it happen when either player is in the European Economic Area, the United Kingdom or Switzerland. Gemini checks the messages against our content rules and writes a suggestion for the person who reviews the report. It decides nothing, and nothing it writes is shown to players.

A player who breaks the content rules can lose the chat or the account.

Bots. Some opponents are played by our server. Their chat replies are picked from a fixed set of phrases.

6. Usage statistics and crash reports

Firebase Analytics records how the app is used: the screens you open, the buttons you tap, the matches you start and finish, together with the app version, the device model, the operating system, your language and your approximate location, worked out from the connection.

Firebase Crashlytics records errors and crashes, with technical details of the device and of the app at that moment.

These records are not anonymous. They are tied to an identifier of your app installation, and error and crash reports also carry your account identifier and the identifier of the match. A daily copy of the usage events is kept in Google BigQuery, where we count them.

You can switch both off, and on again, in the app: Settings, then Privacy, then Analytics & Crash Reports.

In Thailand and Saudi Arabia, the legal basis for these records is our legitimate interests (section 24(5) of Thailand's Personal Data Protection Act; article 6(4) of Saudi Arabia's Personal Data Protection Law).

7. Notifications

If you allow notifications, Firebase Cloud Messaging keeps a token for your device so that we can tell you about challenges, friend requests and decisions about your account. In Settings, under Notifications, you choose who can send them to you. You can also turn them off in the settings of your device.

8. Advertising

SoliDuel includes Google AdMob, the advertising service of Google LLC, so that the game can show ads. When ads are shown, Google and its advertising partners receive the advertising identifier of your device, your IP address and information about the ads you see. They may combine this with what they know about your activity over time in other apps and on websites, to choose and measure ads.

Where the law requires your agreement for this, the app asks you before any ad is requested. You can also manage ad personalization in the settings of your device (iPhone and iPad: Settings, Privacy & Security, Tracking. Android: Settings, Google, Ads).

• Google Privacy Policy
• Google Mobile Ads SDK data disclosure

9. Who receives your data

We do not sell your personal data. We share it only with the companies that run the services the game needs, and with an authority when the law requires it.

• Google LLC (Firebase and Google services), 1600 Amphitheatre Parkway, Mountain View, California 94043, United States:
  • sign-in: Firebase Authentication, Google Sign-In
  • databases: Cloud Firestore, Realtime Database
  • server code: Cloud Functions
  • notifications: Cloud Messaging
  • settings sent to the app: Remote Config
  • checking that requests come from the real app: App Check
  • first read of a reported chat: Gemini API
  • usage statistics: Analytics, BigQuery
  • crash reports: Crashlytics
  • advertising, when ads are shown: AdMob
• Apple Inc.: Sign in with Apple, the delivery of notifications on iPhone and iPad, and the check that requests come from the real app (App Attest, DeviceCheck).
• Resend: delivers to our support mailbox the feedback and the reports you send from the app.
• IT service providers (United States): tools we may use to read the emails, feedback and reports you send us, and to draft our replies.
• Email hosting provider (United States): hosts our support mailbox.

Each of these companies also handles data under its own privacy policy. Other players see what is listed in section 4.

10. Where your data is processed

Our databases and our server code run in Google data centres in the United States. Google and the other providers may also process data in other countries where they operate. The IT service providers in section 9 are in the United States and are not covered by an adequacy decision, by UK adequacy regulations or by safeguards such as the EU-U.S. Data Privacy Framework or standard contractual clauses.

11. How long we keep it

• Profile, statistics, match history and friends: until you delete your account.
• Guest profiles: deleted automatically after about 30 days without play.
• Chat messages: 30 days after the match, or until the case is closed if the chat was reported.
• Reports and moderation records: for as long as we need them to handle the case and apply our rules.
• Feedback and support emails: we keep them as a record of our support, to answer you if you write again and to show how we handled your request, until you ask us to delete them. If the law requires us to keep an email, or we need it for a legal claim, we keep it until that reason no longer applies.
• Usage statistics: up to 14 months in Google Analytics. The copy in BigQuery is kept for as long as we need it to understand how the game is used.
• Crash reports: 90 days.
• Data on your device: until you uninstall the app.

12. How we protect it

Data travels between the app and our providers over encrypted connections. The access rules of our databases limit what each player can read and change. Access to our systems is limited to the people who run SoliDuel.

13. Your choices and rights

• See and correct your data. You can change your username and your avatar in Settings. To get a copy of the data we hold about you, or to have something corrected, write to support@iocodo.com.
• Delete your account. In the app, open Settings and choose Delete Account. This removes your profile and your email address, your username, your preferences, your statistics, your match history, your friends, your notification tokens, your rows on the leaderboards and the chat messages you wrote. The support tickets you sent stay as a record of what was asked, with your email address removed. If you prefer, write to us and we do it for you.
• Guest profiles are removed automatically, as described in section 11. You can also ask us to remove one sooner.
• Switch off usage statistics and crash reports, hide when you were last seen, choose whether to show a flag, and decide who can send you notifications, all in Settings.

Depending on where you live, the law may give you more rights over your data, such as receiving a copy of it or objecting to some uses. Write to us and we handle your request.

14. Changes to this policy

We update this policy when SoliDuel or the law changes. When a change is important, we change the date at the top of this page, which shows when the current version took effect.

15. Contact

IOCODO LLC
30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Privacy contact: support@iocodo.com
Website: iocodo.com

16. Notices for some countries and US states

California and Delaware

If you live in California or Delaware: some browsers and devices can send a "Do Not Track" signal. There is no common standard for answering it, so SoliDuel does not change what it does when it receives one.

Other companies can collect data about your activity over time and across other apps and websites through SoliDuel only when the app shows ads: Google and its advertising partners, as section 8 describes.

Texas and Nebraska

If you live in Texas or Nebraska, the Texas Data Privacy and Security Act or the Nebraska Data Privacy Act gives you these rights over your personal data:

• to confirm whether we process it and to access it
• to correct it
• to delete it
• to get a copy of it in a format you can move to another service
• to opt out of the sale of your personal data, of targeted advertising and of profiling that has legal or similarly significant effects
• to appeal if we turn down your request

The personal data we process and why are in sections 3 to 8. The data we share, and the kinds of companies that receive it, are in section 9.

You can send a request in two ways, and neither needs a new account: write to support@iocodo.com, or delete your account in the app.

We answer within 45 days. If a request is complex we may take up to 45 days more, and we tell you why.

If we turn a request down, you can appeal by replying to our answer with the word "Appeal". We answer an appeal in writing within 60 days, and if we turn it down again we tell you how to complain to the Attorney General of your state.

Canada

The companies listed in section 9 process and keep your data outside Canada, mainly in the United States. While it is there, it may be accessed by the courts, law enforcement and national security authorities of that country under its laws.

Person in charge of the protection of personal information (Québec): the managing member of IOCODO LLC, at support@iocodo.com.

Vietnam

If you use SoliDuel in Vietnam, your personal data is transferred abroad. It is received by Google LLC, in the United States, which stores and processes it for us in order to run the game: sign-in, your profile and matches, the chat, notifications, usage statistics and crash reports. The feedback and the reports you send from the app are also delivered by Resend, in the United States, to our support mailbox.

Some messages are processed automatically by artificial intelligence. The AI decides nothing about you, your account or your access: a person at IOCODO decides.

• A reported chat. Gemini, a service of Google LLC, reads its messages once and suggests an outcome to the person who reviews the report, as section 5 describes. It does so only if everyone else who wrote in that chat agreed when the chat opened, and the app tells you before you send the report.
• Emails, feedback and reports in our mailbox. Our support mailbox is hosted by GoDaddy, in the United States. We may read what reaches it with Claude, an AI assistant of Anthropic, PBC, in the United States, which suggests how to sort each message and drafts our reply.

If you do not want an email or a feedback message to go through the assistant, write KHÔNG DÙNG AI in the subject of your email to support@iocodo.com or at the start of your feedback message. We then handle it without artificial intelligence.

To report a chat or a player without the assistant, send the report by email with those words in the subject.

Korea

This policy in Korean, written for Korean law, is on 개인정보 처리방침.

Mexico

Our privacy notice for people who use SoliDuel in Mexico is in Spanish on Aviso de privacidad.

European Economic Area

If you are in the European Economic Area, the GDPR applies to the data described in this policy. This is the legal basis for each use:

• Running the game: your guest profile or account and sign-in, matches, your rating and the leaderboard, friends, challenges and invite links, your online presence, the chat with your opponent, the notifications you allow and the settings sent to the app.

  Legal basis: our contract with you, the Terms of Service (GDPR art. 6(1)(b)).

• Protecting players and the game: the automatic checks on chat wording and usernames, the review of reports by a person and what we decide (section 5), and the check that requests come from the real app.

  Legal basis: our legitimate interest in protecting players from scams and abuse, in applying the content rules and in keeping our servers safe (GDPR art. 6(1)(f)).

• Answering what you send us: feedback, reports and emails.

  Legal basis: our legitimate interest in answering you and in keeping a record of how we did it (GDPR art. 6(1)(f)). For a request about your rights under the GDPR, our legal obligation to handle it (GDPR art. 6(1)(c)).

• Usage statistics and crash reports (section 6).

  Legal basis: your consent (GDPR art. 6(1)(a)), which the app asks for before they start. You can withdraw it at any time in Settings, under Privacy. Withdrawing it does not affect the lawfulness of the processing done before you withdrew it.

• Advertising, when ads are shown (section 8).

  Legal basis: your consent (GDPR art. 6(1)(a)), which the app asks for before any ad is requested.

• Answering an authority when the law requires it.

  Legal basis: our legal obligation (GDPR art. 6(1)(c)).

Under the GDPR you can:

• object at any time to a use based on our legitimate interest, by writing to support@iocodo.com
• access your data, have it corrected or erased, and restrict its use
• receive it in a format you can take to another service
• complain to the data protection authority of the country where you live or work, if you think we handle your data wrongly

Türkiye

If you use SoliDuel in Türkiye, this is our notice under Law No. 6698 on the Protection of Personal Data, in Turkish.