Gridlock Privacy Policy
This policy describes what Gridlock ("the app", "we") collects when you play, why, and how it's handled. It reflects what the app and its backend (gridlock-server) actually do today.
1. Who this covers
Gridlock is a 1v1 tactical board game. This policy applies to the mobile app and its backend services. It is not directed at children under 13, and we do not knowingly collect data from children under 13.
2. What we collect
Account information
- If you play as a guest: a randomly generated account ID, with no personal information attached.
- If you create an account: the email address and username you provide, and a securely hashed password (we never store your password itself).
- If you sign in with Google: your Google account ID and the basic profile info Google shares with us for authentication (name/email), via Google's own Sign-In flow — Google's handling of that exchange is covered by Google's privacy policy, not this one.
Gameplay data
- Match history: who you played, the outcome, and when.
- Rating data: your skill rating (Glicko-2) and rank tier, which update after ranked matches.
- In-match moves: recorded to support anti-cheat/replay verification and to correctly resolve match outcomes.
Analytics
- We record a small set of gameplay events (app opens, match starts/ends, reconnect attempts, and app errors) to understand how the game is used and to catch bugs. These events are not sent to any third-party analytics company — they're stored only in our own backend, on our own infrastructure.
- Analytics events are tied to your account ID, not to any additional personal information.
What we don't collect
- No location data, camera, microphone, contacts, or photos — the app never requests these permissions.
- No advertising identifiers. We don't show ads and don't use any ad network.
- No third-party analytics or tracking SDKs (no Firebase Analytics, no Meta/Facebook SDK, no ad-tech pixels).
3. How we use what we collect
- To run matches, calculate ratings, and show you your match history and profile.
- To keep accounts secure (authentication, session management).
- To understand aggregate usage and fix bugs (analytics).
- To enforce fair play (anti-cheat checks on recorded moves).
We do not sell your data, and we do not share it with third parties for their own marketing purposes.
4. Where data is stored
Gameplay, account, and analytics data is stored in our backend, hosted on Cloudflare's infrastructure (Cloudflare Workers and D1). Cloudflare acts as our infrastructure provider — it does not use this data for its own purposes. See Cloudflare's privacy policy for how they handle infrastructure-level data as our processor.
5. Third-party services
- Google Sign-In: used only if you choose to sign in with Google, to verify your identity. See Google's privacy policy.
- Cloudflare: our hosting/infrastructure provider (see above).
We do not integrate any other third-party service that receives your data.
6. Your choices
- Guest play: you can play offline (hot-seat or vs. AI) and in casual online matches without ever creating an account or providing any personal information.
- Account data access/correction: you can view and edit your username and profile from within the app at any time.
- Account deletion: to request deletion of your account and associated data, contact us at imhassan6197@gmail.com. (Deletion is currently handled manually on request rather than through a self-service in-app control.)
7. Changes to this policy
If how we collect or use data changes materially, we'll update this document and change the "Last updated" date above.
8. Contact
Questions about this policy or your data: imhassan6197@gmail.com.