Privacy policy
Grid Clash is a game made by an independent developer ("we"). This policy explains what the game and this website collect, why, where it is kept and how you can delete it. It applies to the Android and iPhone apps, the browser version at /play and this website.
The short version: you don't need an account. Playing against bots stays on your device. Only if you play online do we keep a name you choose and your game progress, and you can delete them at any time. There are no ads, no trackers and no selling of data.
Playing offline
Matches against bots, your XP, level, unlocks, settings and daily jobs are saved only on your device. We don't receive them. In the apps, the game keeps a second copy in the app's own storage on your phone, so your progress survives app updates. Uninstalling the app, or clearing the browser's data, erases it.
Playing online
When you first play online, you choose a name and the server gives your device a random secret key. We keep:
| What | Why |
|---|---|
| Your online name (2 to 12 letters, numbers, - or _) | Shown to the other players in your matches and rooms. Don't use your real name. |
| A fingerprint of your device key (a one-way SHA-256 hash; the key itself stays on your device) | To recognize you when you come back, without a password. |
| Your online progress: XP, level, unlocks, chosen ship and trail, rating, league, number of rated matches, the dates your profile was created and last updated | So the server can decide results, rewards and your league fairly. |
| Match records: when a match ended, quick or friends match, how many people and bots played, how long it lasted | To count how much the game is played. These records contain no names and no key. |
While you are connected, the server also sees your device's IP address and your key presses during a match, because that is how online play works. We don't store your IP address or your inputs in our database. Our hosting provider may keep short-lived technical logs that include IP addresses, to run and protect the service.
What we don't do
- No advertising, and no advertising or analytics SDKs in the apps.
- No tracking across other apps or websites, and no cookies on this site.
- No chat, no friend lists, no access to your contacts, photos, location, camera or microphone.
- We never sell or rent personal data.
Who handles the data for us
- Fly.io runs the game server and this website, in Frankfurt, Germany.
- Supabase hosts the database of online players and match records, in Sydney, Australia.
- Google Fonts provides the game's and this site's fonts. When they load, Google receives your IP address, as with any website request.
- Apple (App Store, TestFlight) and Google (Google Play) deliver the apps under their own privacy policies.
These providers process data only to provide their service to us. Your data may therefore be processed outside your country, including outside the European Economic Area, with the safeguards these providers offer.
How long we keep it
Your online profile is kept until you delete it. Match records contain no personal data and are kept for statistics.
Deleting your data
In the game, open Settings → Delete online profile. Your name, key fingerprint and online progress are removed from our database at once. You can also ask us by email; see Delete your account. To erase what is saved on your device, use Settings → Reset progress, or uninstall the app.
Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or Israel's Privacy Protection Law), you may have the right to access, correct, delete or export your data, and to complain to a data protection authority. Write to us and we'll answer within 30 days. We use your online data to provide the game you asked for (performance of a contract) and to keep it fair and running (legitimate interest).
Children
Grid Clash is not directed at children under 13, and we don't knowingly collect personal data from them. Online play asks only for a made-up name. If you believe a child has given us personal data, write to us and we'll delete it.
Security
Connections to the server are encrypted (HTTPS and secure WebSockets). The database accepts requests only from our server. Device keys are never stored, only their fingerprint.
Changes
If we change this policy, we'll update the date above and, for significant changes, say so on this site.
Contact
Questions or requests: dotan19586@gmail.com