Privacy policy
Short version. Flock & Load is an online game, so it needs an account. Your account starts as a guest with a random id; we store your game progress with it. If you choose to save your progress with Apple, Google, Steam or an email address, we also keep that sign-in's id. We don't show ads, we don't track you, and we don't sell or share your data for advertising. You can delete your account in the game at any time.
Who we are
Flock & Load is made by Cobo Makes Games. Questions about this policy or your data: bixmakesgames@gmail.com.
What we collect and why
- A random account id. Made the first time you open the game, so your cards and progress have a home. You play as a guest; you never give us your name.
- Your game progress. Your cards, packs, gold, dust, decks, commanders, quests and match results. We need it to run the game and keep your progress.
- Sign-ins you choose to add. Only when you tap to save your progress:
- Apple: your Apple account's stable id, and the email Apple shares with us (this can be a private relay address);
- Google: your Google account's id and email address;
- Steam: your Steam id and your Steam name;
- Email: your email address.
- One-time sign-in codes. When you save with an email address, we send you a code. We store it only as a scrambled hash, and it stops working after 10 minutes.
- Purchases. When you buy packs: the store's transaction id, which bundle you bought, the store's country, when, and whether it was refunded. We use this to give you exactly the packs you paid for, once, to take packs back after a refund, and because some countries don't allow paid random packs. Payment details never reach us: Apple, Google or Valve (Steam) handle the payment.
- Online matches. Your moves pass through our server to your opponent while you play. We keep the match's result, not the moves.
- Connection data. Like any online service, our servers see your IP address when the game connects. Our hosting providers keep it in their security and error logs for a short time. We don't use it to track you or to work out where you are.
- Crash reports (when switched on). If the game crashes, it can send a report to Sentry: the error, the game's version, the device type and the operating system. Reports carry no name, no email and no IP address.
We don't collect your contacts, location, photos, microphone, advertising id or browsing history, and the game has no ads and no analytics.
On your device
The game keeps your settings (language, sound, graphics) and a sign-in token on your device so you don't have to sign in each time. Uninstalling the game removes them. Playing over a local network (LAN) talks only to the other device on your network; nothing about it is sent to us.
Who processes it for us
- Supabase runs our database and game server, in the EU (Frankfurt, Germany). All game data above is stored there.
- Resend sends the one-time sign-in code emails.
- Vercel hosts our websites, including the page Steam returns you to after signing in on a phone.
- Sentry receives crash reports, when crash reporting is switched on.
- Apple, Google and Valve handle sign-ins and payments under their own privacy policies.
Some of these providers are based in the United States. Where your data leaves the EU, they protect it with the European Commission's standard contractual clauses. We don't sell your data and don't share it for advertising.
How long we keep it
We keep your account while you have it. Delete it any time in the game: Settings > Account and saving > Delete account. That deletes your account, progress and linked sign-ins at once. We keep purchase records (transaction id, bundle, country and date) without any link to you for as long as accounting and tax rules require. Sign-in codes expire after 10 minutes, and unfinished sign-ins are cleared automatically. Sentry keeps crash reports for at most 90 days.
Our legal reasons
We use your data to run the game you asked for (performing our contract with you), to keep the game safe and fix bugs (our legitimate interest), and to keep purchase records (a legal obligation).
Your rights
You can ask to see, correct, export or delete your data, and object to or limit how we use it. Write to bixmakesgames@gmail.com. If you live in the EU, the EEA or the UK, you can also complain to your data protection authority.
Children
Flock & Load is not made for children under 13, and we don't knowingly collect data from them. In some countries the age is higher (up to 16) unless a parent agrees. If you believe a child has given us data, write to us and we'll delete it.
Changes
If this policy changes, we'll post the new version at this address with a new date.