Privacy Policy
com.asdigital.duoorb), web, and the DuoOrb game server.1. Who we are
DuoOrb is a tactical grid-strategy game by AS Digital. The mobile app talks to our authoritative game server for accounts, matchmaking, rooms, friends, history, cosmetics and ratings. Authentication is provided by Supabase Auth (supported OAuth sign-in providers and guest sessions minted by our server). Post-game engine analysis runs locally on your device. Free play may show Google AdMob ads; DuoOrb Premium (sold through Apple App Store and Google Play) removes them. Contact: support@duoorb.com.
2. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account identifiers | User ID, username (@handle), display name, email (signed-in accounts only) | Account management, sign-in, player identity in matches |
| Player content & customization | Bio (max 280 chars), avatar URL, badge showcase, equipped Ball & Wall cosmetic skins | Profile display, in-match cosmetic rendering, social features |
| Game activity | Match history, moves, results, Glicko-2 ratings (Classical 1v1), achievements, AI wins, bot mastery stars (1–3 stars) and unlocked bots | Gameplay, leaderboards, fair play / anti-cheat, progress syncing |
| Social graph | Friend requests, friendships, blocks, room participation | Friends, challenges, rooms, blocking |
| Premium status | Whether Premium is active, whether it is a Lifetime unlock, and (for recurring plans) when it expires (from Apple App Store or Google Play via RevenueCat; we never receive card or payment details) | Unlocking Premium features (ad-free play, all 39 bots, 16 cosmetic sets, 6 Hints & 4 Undos per bot match, unlimited reviews, diamond badge) |
| Diagnostics | Hashed IP (SHA-256, for guest rate limiting), user-agent, crash/error logs | Security, abuse prevention, stability |
| Advertising (AdMob) | Device advertising identifier (IDFA with ATT consent on iOS, or Advertising ID on Android), approximate location, ad-interaction data, collected by Google under its own Privacy Policy | Serving banner, interstitial, and optional rewarded video ads (for extra Hints, Undos, bot unlocks, and extra match reviews) to free players |
We do not collect precise location, contacts, camera, microphone, or files. There is no free-form in-game chat (only preset emoji reactions).
3. How we use data
Account management, gameplay and matchmaking, leaderboards and ratings, friends/challenges/rooms, syncing cosmetics and bot mastery stars, Premium entitlement, safety (rate limiting, replay detection, cheat validation), and support. Post-game engine match analysis runs locally on your device. Free players may see banner/interstitial ads and optional rewarded ads; Premium members see none. We never sell personal data and never share it with data brokers.
4. Sharing
Processors only: (a) Supabase (authentication - email, auth tokens), (b) hosting provider for the game server / database (account, game and social rows needed to run the service), (c) Google AdMob (advertising identifiers and ad-interaction data, under Google's policies), (d) Apple App Store & Google Play Billing via RevenueCat (purchase and entitlement status only - no payment details touch our servers). No data is shared with data brokers. Reactions during matches are ephemeral and never stored.
5. Security & encryption
All client-server traffic uses HTTPS (TLS) / WSS. Passwords are never handled by us (OAuth via Supabase). Guest refresh tokens are stored only as SHA-256 hashes and rotate on every refresh; replayed tokens revoke the session. Access is limited to what is needed to operate the game.
6. Retention
Accounts, profiles, game history, ratings and social rows are kept while the account exists so progress and fair-play records persist. Guest sessions expire after 180 days of inactivity and are purged. When you delete your account (in-app Settings > Delete account or the web request below) we delete the User row and everything that cascades from it: profile, ratings, rating history, game-player links, friend requests, friendships, blocks, AI wins, achievements, badge slots and guest sessions. Finished Game rows may remain without your player link so opponents' histories stay consistent. Backups age out within 90 days. We may retain minimal logs required for security, fraud prevention or legal compliance and will disclose that in response to a request.
7. Your rights & deletion
You can edit your display name, username, bio and avatar at any time in Settings. You can request access, correction, export or deletion of your data at any time:
- In-app: Settings > Delete account & data (signed-in or guest). This calls
DELETE /api/meand wipes local credentials immediately. - Web (no reinstall needed): follow Delete Account & Data or email support@duoorb.com from the address on the account (or include your @handle + user ID from Profile > Settings) with subject "Delete my DuoOrb account". We confirm and complete deletion within 30 days.
See your App Store privacy disclosure or Google Play Data Safety section for the same links.
8. Children
DuoOrb is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child provided data, contact us and we will delete it. Parents may request review or deletion at support@duoorb.com.
9. Changes
We will update this page and the in-app links when practices change. Material changes will be noted here with a new date before taking effect.