Privacy Policy for Pass the Bomb
This Privacy Policy describes how Pass the Bomb ("the App", "we", "us", or "our") handles information when you use the App on Android or iOS. The App is provided by Sotiris Pallis, an individual developer based in Greece, European Union.
If you have any questions about this policy or your data, you can contact us at contact@spallis.dev.
1. Summary
Pass the Bomb is a local, single-device party game. We designed it to need as little of your data as possible:
- We never collect the player names you type into the game. They stay on your device.
- We do not require you to create an account.
- We do not ask for your name, email, phone number, or address.
- We do not show advertising.
- We do not sell your data.
- All gameplay (modes, timers, results) runs entirely on your device.
The only information that ever leaves your device is:
- Purchase data, handled by Apple, Google, and our purchase provider (RevenueCat), so we can deliver the features you paid for.
- Anonymous product analytics, sent to PostHog, so we can understand how the App is used in aggregate and improve it.
The sections below explain this in detail.
2. Information we collect
2.1 Information you provide
The App does not have user accounts, login, or profile creation. We do not knowingly collect any information that you actively provide.
Before a game, you type in the names of the people playing. These are stored only on your device, so the App can remember them next time. They are never transmitted anywhere — not to us, not to our service providers, and not in any analytics event. We do not send them, count them, measure their length, or store hashes of them. The same applies to any question, prompt, or answer text shown during a game.
2.2 The identifier
On first launch, the App generates a single random identifier (a UUID) and stores it on your device. It is not derived from your device, your hardware, or your advertising ID — it is a random number, generated by the App itself.
It is used for exactly two purposes:
- as the anonymous user id in our analytics
- as the anonymous user id for purchase management
It is deleted when you uninstall the App, and a new, unrelated identifier is generated if you install again. We have no way to connect the two.
2.3 Information collected automatically
When you use the App, the following information may be processed:
Purchase data
Pass the Bomb sells one-time purchases that unlock content permanently. There are no subscriptions and nothing renews. When you make or restore a purchase, the App communicates with the Apple App Store or Google Play Store, and with our purchase processor RevenueCat. The following may be processed:
- The anonymous identifier described in section 2.2
- Purchase token / receipt issued by Apple or Google
- The item purchased, the purchase date, and which content it unlocked
- Country/store associated with the purchase
- Platform (iOS or Android) and app version
We need this information to grant you access to the features you paid for, to support restore-purchases, and to detect refunds.
We never see or receive your payment details. Card and billing information goes to Apple or Google and stays with them.
Anonymous usage analytics (PostHog)
The App sends a small, fixed set of anonymous product analytics events to PostHog. These events are not linked to your real identity. They consist of:
- The random identifier described in section 2.2
- Which game mode was played, and how many people were playing
- How many rounds were played, and how long a game lasted — as a coarse range, never an exact figure
- Whether a game was finished or abandoned, and whether a free trial was used
- Whether the purchase screen was opened, and whether a purchase was started, completed, or failed
- The selected theme and language, and whether paid content is owned
- The platform (iOS or Android) and the app version
We do not send player names, question or answer text, your email, phone number, IP address (the App explicitly instructs PostHog to discard the IP address and to disable geolocation lookup), advertising ID (IDFA/AAID), precise location, device model, contacts, photos, or microphone audio.
The App contains no crash reporting or error-reporting service, so no crash data is collected.
Our PostHog analytics data is hosted in the European Union.
2.4 Information stored only on your device
Some data stays on your device and is never uploaded to us:
- The player names you enter before a game
- Which game modes you have already tried
- Your selected theme
- The random identifier described in section 2.2
- Cached state required to run the game
You can clear this at any time by uninstalling the App or clearing the App's data from your device's settings.
3. How we use information
We use the limited information described above only to:
- Provide the App and its features
- Deliver and restore purchases
- Understand which game modes and features are used, in aggregate, to improve the App
- Comply with legal obligations (for example, tax and consumer-protection rules around purchases)
We do not use your data to build a personal profile, to target advertising, or for automated decision-making with legal effects.
4. Legal bases for processing (GDPR)
Because we are based in the European Union, the General Data Protection Regulation (GDPR) applies. We rely on the following legal bases under Article 6 GDPR:
- Performance of a contract (Art. 6(1)(b)) — processing purchase data so we can deliver the paid features you requested.
- Legitimate interests (Art. 6(1)(f)) — sending anonymous analytics events to understand and improve the App. Because these events are not linked to your identity and do not include identifiers like IP or advertising ID, the impact on your privacy is minimal. You can object to this processing at any time using the contact details below.
- Legal obligation (Art. 6(1)(c)) — keeping limited records related to purchases for tax and accounting purposes.
5. Third-party services
We rely on the following service providers. They process some data on our behalf as described above.
RevenueCat
RevenueCat manages in-app purchases across Apple and Google. They receive the purchase data described in section 2.3. See their privacy policy: https://www.revenuecat.com/privacy/
PostHog
PostHog provides product analytics, hosted in the European Union. They receive the anonymous events described in section 2.3. See their privacy policy: https://posthog.com/privacy
Apple App Store and Google Play
When you install the App or make a purchase, Apple or Google process information according to their own privacy policies, which we do not control:
6. International data transfers
Our PostHog analytics data is processed on servers in the European Union. RevenueCat may process purchase data on servers located outside the European Economic Area (EEA), including in the United States. When data is transferred outside the EEA, we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission, and on the providers' own compliance frameworks.
7. Data retention
- Purchase data is retained for as long as the purchase remains valid — which, for a one-time unlock, is indefinitely — plus the period required by applicable tax and consumer-protection law.
- Anonymous analytics events are retained by PostHog according to our configured retention period and their internal policies. Because the events are not linked to your identity, they cannot be tied back to you personally.
- On-device data is retained until you uninstall the App or clear its data.
8. Your rights
If the GDPR applies to you, you have the following rights:
- Right of access — ask whether we hold data about you and request a copy.
- Right to rectification — ask us to correct inaccurate data.
- Right to erasure ("right to be forgotten") — ask us to delete data we hold about you.
- Right to restriction — ask us to limit how we use your data.
- Right to data portability — ask for your data in a machine-readable format.
- Right to object — object to processing based on legitimate interests, including analytics.
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time.
Because the App collects no direct identifiers such as an email address, we generally cannot tell which analytics records belong to you, and so we may be unable to locate them. We will not ask you for additional information purely in order to try. For purchase-related requests, we can usually locate data using the App Store / Google Play transaction ID, or the email associated with your Apple or Google account.
You can, at any time and without asking us, uninstall the App — this deletes the identifier and everything else stored on your device, and stops any further data being sent.
To exercise any of these rights, email contact@spallis.dev.
You also have the right to lodge a complaint with a data protection supervisory authority. In Greece, this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), https://www.dpa.gr.
9. Children's privacy
The App is intended for a general audience and is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). Some game modes contain questions intended for a teenage or adult audience; please see the content rating on the App's store listing. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the App, please contact us and we will take appropriate steps to delete it.
10. Security
We take reasonable technical and organizational measures to protect the limited information we process, including encrypted connections (HTTPS/TLS) between the App and our service providers. No method of transmission or storage is perfectly secure, but the small scope of data we handle reduces risk substantially.
11. Changes to this policy
We may update this Privacy Policy from time to time, for example when we add features, change service providers, or in response to legal changes. When we do, we will update the "Last updated" date at the top of this page. If the changes are significant, we will make a reasonable effort to highlight them in the App or on this page.
12. Contact
If you have questions, requests, or complaints about this Privacy Policy or your data, contact:
Sotiris Pallis
Email: contact@spallis.dev
Country: Greece (European Union)
