Ballothoid Privacy Policy

Last updated: 25 October 2026

Developer and contact for developer-controlled data: Jaroslav Strnad
Email: ballothoid1@gmail.com

This policy describes how Ballothoid handles game data, cloud accounts, purchases and advertising. It covers the Android game and the developer website.

Cloud account and saved progress

Ballothoid uses a developer-operated cloud service for account sign-in, saved progress and purchase entitlements. This account is separate from your Google Play Games account. Registration uses a chosen username and password, without requiring an email address. The server stores an internal account identifier, username, a salted password hash, a hash of your recovery code, session-token hashes and account creation time. Passwords and recovery codes are transmitted over HTTPS for authentication; they are not stored as readable passwords or recovery codes on the server.

When you use cloud synchronization, the game sends your campaign progress, scores, achievements recorded by the game, earned currency, rewards, cosmetic selections, control and language settings, and queued leaderboard submissions to the cloud service. A local cache lets you continue playing offline. Synchronization and restoration require the same Ballothoid cloud account. Conflicting profiles are resolved by choosing a complete profile rather than adding their currency balances together. Unsynchronized progress can be lost if you uninstall or clear app data.

The server stores the current profile and a limited history of recent revisions to support recovery and prevent conflicting updates. Cloud progress is not currently stored using Google Play Games Saved Games. Android may independently back up selected local app data when device backup is enabled; availability and timing are controlled by Android and Google.

Optional Google sign-in

Where configured, optional Sign in with Google can create a Ballothoid cloud account or be linked to an existing account after verification of its Ballothoid password. Linking retains the same internal account and does not merge accounts or add their balances. Google processes account selection and authentication. The app sends a short-lived Google ID token over HTTPS to the backend for verification. The backend stores a hash of the Google account subject identifier associated with the Ballothoid account; it does not retain the Google ID token, email address, name or photograph. One-time authentication challenges expire after five minutes. Google sign-in does not give the developer access to Gmail or Google Drive.

Google Play Games separately handles sign-in, achievements and global leaderboard scores. Google processes your Play Games player identifier and profile information for these features. Other players may see your Play Games profile name and submitted scores according to your Google settings. Online features may be unavailable while you are offline or not signed in. The game queues eligible scores for later submission.

Purchases and refund verification

Google Play Billing processes optional purchases such as automatic-ad removal and cosmetic theme packs. The developer does not receive your payment card details. To verify, restore and protect purchases against duplicate claims, the game sends the product identifier and Google Play purchase token to the Ballothoid backend, together with authenticated account information. A hashed account binding is supplied to Google Play to associate the purchase with the correct cloud account.

The backend checks purchases with the Google Play Developer API and stores encrypted purchase tokens, token hashes, product identifiers, ownership, verification status, timestamps and transaction records. Google Play notifications and subsequent checks let the backend detect refunds and revoked purchases and update entitlements. Purchase ownership is managed separately from the uploaded game-progress profile. Consumable core packs are currently unavailable for purchase.

Advertisements and consent

The game includes Google Mobile Ads and Google's User Messaging Platform. When advertisements are requested, Google and its advertising partners collect or process information such as IP addresses, device and advertising identifiers, app interactions, diagnostic information and performance data for advertising, analytics and fraud prevention. An IP address may be used to estimate approximate location. The game does not request precise GPS location for these purposes.

Where required, the game presents Google's consent choices before requesting advertisements. You can reopen applicable choices through Ad Privacy in the main menu and manage advertising settings on your device. Rewarded advertisements are optional; the offered in-game reward is shown before viewing. Purchasing automatic-ad removal disables automatic advertisements, not optional rewarded advertisements.

Diagnostics and service security

The game stores basic gameplay event counts locally for diagnostics. Firebase Analytics is not configured in the current release. If this changes, the privacy policy and Google Play Data safety disclosure need to be updated before distribution.

The backend uses account identifiers and hashed request-rate keys to limit abuse. Hosting providers may process connection information such as IP addresses, request times and service diagnostics to operate and secure their infrastructure. Application error logs are designed to exclude passwords, recovery codes, purchase tokens and complete request bodies.

Service providers and protection

The cloud API and PostgreSQL database are hosted on Render. Encrypted database backups are stored in Backblaze B2 for disaster recovery. Google provides Play Games, billing, purchase verification, advertisements and consent services. These providers process the information needed for their respective services. The developer does not sell player accounts or game progress.

Connections from the app to the backend use HTTPS. Saved cloud profiles and purchase tokens are encrypted on the server, and external database backups are encrypted. This is not end-to-end encryption: the running backend can decrypt data to provide the service. Usernames, ownership and transaction records are not all covered by the profile encryption. No storage or transmission method can guarantee absolute security.

Provider processing may occur outside your country. Google's services are described in Google's Privacy Policy. Hosting and website providers also apply their own privacy policies.

Retention and deletion requests

Local cached data remains on your device until it is cleared, replaced or removed. Signing out or uninstalling does not delete your cloud account, synchronized progress or purchase records. Authentication sessions expire after 30 days, but session expiry is not account deletion. Profile revision history is limited to recent revisions; accounts and purchase records currently have no automatic inactivity-deletion period.

External encrypted backups are configured to rotate by hiding backups after 30 days and deleting hidden versions after a further day. Hosting-provider recovery copies have their own retention settings. A deletion from the live database does not immediately remove a record from an existing backup. Google retains its own Play Games, billing and advertising records according to its policies.

For access, correction or help with deletion of data controlled by the developer, email ballothoid1@gmail.com with the subject Ballothoid data request and your cloud username. Do not send passwords, recovery codes, payment card details or purchase tokens. Ownership must be verified before account data can be disclosed. For permanent deletion, use the in-app option or the secure web form described below.

From app version 79, you can permanently delete the signed-in cloud account through CLOUD → DELETE CLOUD ACCOUNT. You must re-enter the account password and explicitly confirm deletion. You can also use the secure web form linked from the account-deletion page without reinstalling the app. Recover a forgotten password in the app with your recovery code, or contact support; never email your password or recovery code.

Deletion removes the cloud account, authentication sessions, cloud progress and revision history, wallet, inventory, purchase-entitlement records, encrypted receipt tokens and transaction ledger from the live database. In-app deletion also clears the local profile on that device; after web deletion, clear app data on your devices to remove local copies. Old purchases cannot be transferred to a newly registered cloud account. Deletion does not request a Google Play refund and does not delete your Google account or data held by Google.

Only the internal account identifier and deletion timestamp are retained in a minimal deletion journal for 35 days, to prevent deleted profiles from being reactivated when an older backup is restored. This journal contains no username, password, saved progress or purchase token. Backup restoration requires applying the current deletion journal before the restored database serves players.

Delete your Ballothoid cloud account. Signing out is not deletion. For information controlled by Google, use Google's account privacy controls, including the controls for Play Games data.

Support and this website

For a session signed in with Google, in-app deletion requires fresh authentication with the same linked Google account instead of a Ballothoid password. Deletion also removes the linked Google identifier and authentication challenges. To request deletion outside the app, contact ballothoid1@gmail.com; ownership must be verified. Never email passwords, recovery codes or Google ID tokens.

If you contact the developer by email, your email address and message are used to handle your request. Avoid sending unnecessary personal or sensitive information. You can contact Jaroslav Strnad at ballothoid1@gmail.com about this policy and data requests.

This website is hosted on GitHub Pages. It contains no developer-added analytics, advertising, cookies or tracking scripts. GitHub may log visitors' IP addresses for security purposes, as described in its Privacy Statement.

Provider privacy information

Google Privacy Policy · Render Privacy Policy · Backblaze Privacy Policy · GitHub Privacy Statement