Privacy policy

Bomb And Conquer

Last updated: November 14, 2026 · Developer: For The Fun Game Studio

1. Who we are

Bomb And Conquer ("the App") is a game developed by For The Fun Game Studio ("we", "us"), who is the controller of the personal information described below. This policy explains what information the App and our game server handle, who handles it and why. It covers the App on Android, on iPhone and iPad, and on Windows through Steam ("On Steam"). It describes the App as it is now; where a feature is only planned (section 3, "Planned"), we say so, and we will update this policy before such a feature arrives.

2. Playing without an account

Matches against bots, the tutorial and (on Steam) games with friends on the same network need no sign-up and work without a connection. Your progress is saved in the App's private storage on your device (trophies, your match record and achievements, daily and season quests, your Zer (the game's own currency, earned by playing), your heroes and each hero's experience, your potion bag and the potions picked for the next match, looks, colour, your player name, the last mode, map and bot level you chose, and settings) so the game plays offline. When the App has a connection, a copy of your progress is also kept in your guest account on our servers (section 3). The copy on your device is removed when you uninstall the App. On iPhone and iPad it is part of your iCloud Backup or your computer's backup of the device, if you use one (Apple holds iCloud backups under its own terms), and restoring such a backup brings the same guest account back; the guest account on our servers stays until it is deleted, by you or automatically once it has not been online for 2 years (section 10).

Playing on the same network (on Steam): on Windows, Friends > Local Wi-Fi lets you host or join a game with friends on the same network. To find and play such a game, the App sends small messages directly between the computers on that local network: a game's name (the host's player name, or "Game" and a number when it has none) and player count, which every device on that network can receive, and, for the players of a game, their names, titles, heroes, colours, bomb shapes, potions and moves. These messages stay on the local network, are not sent to the internet and do not reach us. Earlier Android versions of the App could play this way too, and an "Invite a friend" button in those versions opened your phone's share sheet with a link to forthefungamestudio.com/join/, a page that shows where to get the game and stores nothing; we do not see the message or who it goes to. The App on Android and on iPhone and iPad has no such play today: it sends nothing to other devices on your network and does not ask for a local network permission.

On Steam, the App keeps its files in your Windows user folder (%LOCALAPPDATA%\For The Fun Game Studio\Bomb And Conquer), not in the game's install folder: your settings and the copy of your progress, your Steam ID and your account's number and account code, the e-mail address you protected your account with (if you did), feedback notes not sent yet and the game's caches. If the game crashes, it also writes a crash.txt file there with the reason, the last warnings and errors of that run and technical addresses; the next start reads it and deletes it. It is not sent anywhere. No password or secret key of your account is kept on your PC. Uninstalling the game through Steam may leave this folder in place; you can delete it yourself.

3. Your guest account and online matches

Guest account: the first time the App starts (and again after you delete your account, once you start the App again or come back to it after a minute or more away), it makes a random guest ID and a secret key on your device, without a sign-in, a name or an email. When it has a connection, it sends our server the ID and a copy of your progress: your trophies and match record (wins, losses, draws, blocks taken, matches by mode), your hero and colour, the looks you own and wear, the title you wear, your quest progress, each hero's experience, and whether you did the tutorial and chose a colour. We store the ID, a fingerprint of the key (not the key itself), that copy and when the account was last online (so we can tell when it has not been online for 2 years, section 10); the App sends the copy again when it changes, so your progress can come back, for example when a backup of the App's data (Android's backup, or an iCloud or computer backup of an iPhone or iPad) restores the same guest on a new phone. On iPhone and iPad the App also keeps the guest ID and its secret key in the device's keychain, so the account is still there after you delete and reinstall the App (or restore the device from a backup). Once the App has been online, it shows your account code in its settings (the gear): a short code worked out from your secret key. It cannot be used to play as you; we use it only to check that an email about an account, such as a request to delete it, comes from its player (section 10).

On Steam: your Steam account. On Steam you do not get a guest key: the App asks Steam for a sign-in ticket and sends it to our server, which checks it with Steam. Steam tells our server your Steam ID (the public number Steam gives every account) and whether your copy is borrowed through Steam Family Sharing or blocked by us on Steam. Our server keeps your Steam ID with your game account, with the date it was linked, so that the same profile opens every time you play on Steam; one Steam account has one game account. It does not keep the ticket, your Steam name, your friends or anything else from your Steam profile. The first time, the App reads your Steam name on your PC and suggests it as your player name; it reaches our server, as your public player name, only if you keep it.

On Steam: your phone profile. If you type a transfer code or an e-mail code from your phone on Steam, the App links your phone's profile to your Steam account instead of moving it: both stay signed in, and what the Steam profile held (its Zer, also a balance below zero after a refund, its purchases, looks and potions) moves into the phone's profile, which keeps its own name, trophies and titles; the Steam profile's own name, trophies and titles are dropped and that profile is closed. If you link with a transfer code and the phone that made the code had your account's protected e-mail address saved, we send that address a short notice that the profile was linked to Steam. The link ends when you delete the account, when you get the account back with your e-mail on a phone, when you type a code for another profile on Steam (the link then moves to that profile, and the profile Steam had is merged into it and closed), or when our staff remove it at your request.

Your Zer, potions and looks: your Zer balance, the potions in your bag and the looks you own are kept by our server with your guest account, not on your device. The App shows a copy and asks our server for every purchase made with Zer (it needs a connection for that). Zer and potions you earn or use in matches against bots while offline are sent to our server the next time the App connects. With your account our server also keeps a Zer history: for every change, when it happened, the guest ID, the reason (for example a match, a quest, a purchase with Zer, a Zer pack, a refund or a gift from us), the amount, the new balance and what it was for (the match, the item or the purchase). We use it to answer your questions, to fix mistakes and to prevent fraud.

Moving to another device and getting your account back: in the App's settings (Your account) you can move your account to another device with a transfer code: our server gives you a short code that works for a few minutes; typed on the other device, the account opens there, and the old device is told that the account moved and starts a new guest account. The code is kept in our server's memory only; it is not written to a file or a log. You can also, if you want, protect your account with an e-mail address: our server sends a code to the address, and once you type it in the App, the address is linked to your account; on a new device you can then get your account back with the address and a new code. We do not store your e-mail address. Our server keeps only a fingerprint of it, which lets it find your account when you type the same address again but from which the address cannot be read back. To send the code, our server hands the address and the code to our own mailbox (noreply@forthefungamestudio.com) at our web hosting provider, which delivers the e-mail and may keep the recipient address in its mail logs under its own rules. To remove the e-mail, you type the address and the code our server mails to it; after a removal the old fingerprint can still bring the account back for 14 days (in case someone else removed it), then it is deleted. It is removed at once when your account is deleted. The App keeps the address you protected your account with, or got it back with, in a small file on your device; when you ask for a transfer code it sends the address along, so that our server can mail it a notice when your account moves to another device ("if this wasn't you, get your account back with this address"). Our server keeps the address in its memory only while that code is waiting. If you add no e-mail and lose your device, we cannot give your account back. Transfer and e-mail codes are limited in number per account and per network to prevent misuse.

Player name: our server gives your guest account a made-up name (two words and a number) and stores it with the account; no two accounts have the same name. You can change it on the Profile screen while connected: the first change is free, later ones cost Zer. Your device keeps a copy of it, so it also shows in games on the same network (on Steam). In online matches the server shows the other players of that match the name it stores for your account; in games on the same network your computer sends it to the other devices of that game. A name may not contain insults, hate, sexual words or pose as us: the App and our server check it against a list, and we may replace a name that breaks these rules with a made-up one. Please do not use your real name or anything that identifies you. When your account is deleted, its name is free for others at once and the game on your device stops using it; our server keeps it with the account's other kept data for 6 months (section 10).

Titles: you can wear a title over your hero, under its health and above your name. Most titles are earned by your heroes' experience; a few are given by us (for example to beta testers or to the winner of an event), and our server stores which of these your account holds. The title you wear is part of the copy of your progress, and the other players of your online matches (and, on Steam, of your games on the same network) see it. In an online match our server shows a title only when your account may wear it.

Reports: after an online match you can report another player of that match for an offensive name, cheating or something else. We store the report: the time, your guest ID, the reported player's guest ID and name, the reason, the match's number and mode. Our server also adds notes of its own to the reports when it finds something that may break the rules, for example a player name replaced by our moderation (with the old and the new name). These notes hold the account's guest ID, its player name and what was found. Our staff look at reports and these notes and decide what happens to an account; nothing happens to it automatically. We use reports only to keep the game fair and friendly (for example to replace a name or ban an account that breaks the rules), and the reported player is not told who reported them.

Online matches: when you choose to play online, the App connects to our game server, which puts you in a match with other players and fills empty seats with bots. For that the server receives the mode you picked, your guest ID (so it can show your player name), hero, colour, bomb shape, the title you wear, the potions you bring and your hero's experience (it checks that the potions are allowed for that experience and picks the bots' difficulty from it), your moves during the match, and your IP address (needed to send you the match). Other players in your match see your player name, title, hero, colour, bomb shape and what you do in the match, and our staff can watch a match while it is played (to check reports of cheating; our admin log notes that a match was watched, not who played in it); there is no text or voice chat. Our server keeps no record of the moves after a match ends. Your Zer history notes what the match took from or gave you, with the match's number (above), and our server's own log notes, without anyone's identity, that a match of a mode and map was played and how it ended; when someone leaves early, it notes the penalty with the first 8 characters of their guest ID. An online match costs 10 Zer, which our server takes from your balance when the match starts; when it ends, our server adds the Zer you earned in it and takes the potions you used. It counts for your quests and your hero's experience, not for trophies.

Leaving an online match: if you leave an online match before it ends, or your connection is lost and you are not back within 10 seconds while the match is still running, a bot plays on for you and you pay a penalty of 20 Zer (or the Zer you have, if fewer) and get no rewards from that match. Games on the same network, a match that ends within those 10 seconds and a hero already out of the match are not charged. Our server takes the penalty from your Zer balance at once (not below zero) and writes it in your Zer history.

Feedback (optional): the game's Feedback screen lets you send us a note. We receive the text you write (up to 500 characters), the mood and topic you pick and, only if you switch on "Add my last match and device" (it is off until you switch it on), the App version, the platform, the graphics chip, the screen size, the last game mode, whether it was 1 vs 1 or for 4 players, the bot level, the last result, your hero and your trophies. The same form can be opened during a match (the speech-bubble button); there the switch reads "Add this match and my device" and, when it is on, the note also says that it was written during a match, which kind of match and how many seconds in. It is sent to our game server over the same encrypted connection, together with your guest ID so that we can answer you in the game, and kept on that server, where access is limited to our staff; we use it only to read and answer the feedback and to fix problems. Notes still waiting on your device when you delete your account are dropped. Please do not write personal information in it. The note carries no IP address; the connection that sends it is in the traffic log like every other (below).

Friends: in Friends > Online you can send a friend request by typing another player's name, or from the players' list after an online match; the other player accepts or declines it. Our server stores, with both accounts, who is friends with whom, the requests sent and received, and when (at most 100 friends). Your friends see your player name and whether you are online now (connected, or seen by our server in the last few minutes); nothing else about you, and not your guest ID. You can remove a friend or cancel a request at any time.

Blocking: you can block a player (from your friends list or after an online match). Blocking ends a friendship and its requests, the blocked player can no longer send you requests or invitations, and our matchmaking does not put the two of you in the same online match while other players are waiting. The blocked player is not told. Our server stores the block with your account until you unblock the player (Friends > Online > Blocked) or one of the two accounts is deleted.

Teams and invitations: you can open a team and invite friends to it. Your teammates see your player name and your hero and its looks on their home screen; the team leader starts an online match (the team queues together and other players and bots fill the empty seats) or a friendly match for the team alone. A team and its invitations exist only on our server while you use them: an invitation ends after 5 minutes, and a team ends when its members leave or the server restarts; nothing of it is stored. Team matches are online matches like any other (above).

Messages from us: we may send a short message to your guest account, for example an answer to your feedback, a warning about your player name, or why your account was banned from online play. It is stored on our server with your account (the last 20 messages), the App fetches the ones you have not seen while it has a connection and shows them on its home screen, and tells our server when you have seen one. When a new message arrives, our server may also send a short notice to your phone (section 6). Messages are erased with the rest of a closed account's data, 6 months after it was closed (section 10).

Your language: from version 8.1.0 the App also tells our server which of its languages it shows (on Steam too), together with your notification choices. Our server keeps it with your account until the account is deleted, so that notifications and the e-mails it sends you (codes and notices) come in your language; a code e-mail for a device that has no account yet goes in English.

Rules and bans: to keep online play fair and friendly we may give your account a made-up name instead of one that breaks the rules, or ban it from online play for a time or for good (the App tells you why and until when; you can still play against bots, and on Steam on the same network). A ban, with its reason and a short note, is stored with your account. Our staff do this through an administration tool made for them. Every change they make is written to an admin log: who made it, when, the guest ID, and what changed (for a new name the old and the new name, for a ban its length, reason and note, for a message from us its first 120 characters, for a title which one). Each email request to delete an account that we check against its account code is written there too: the player name it gave, the guest ID of the account with that name, and whether the code matched and the account was deleted (a code that does not match deletes nothing); the code itself is not written. The admin log is kept for two years, then deleted automatically; access to it is limited to us. Once an account is closed, our staff can no longer change it (section 10).

Traffic log (required by law): for every connection to our game server (the guest account's sync, friends and teams, online matches, feedback and map updates) the server writes down the IP address and port it came from (and the new port, if your network changes it during the connection), when it connected and when it ended (UTC), the guest ID it proved, if any, which of these services it used, and how many bytes went each way. Nothing else is in it: no moves, no progress, no note text. Turkey's Law No. 5651 on internet publications, which the studio is subject to, requires a host to keep this traffic information for at least one year and to keep it accurate, complete and confidential. We keep it for one year and one day, after which the server deletes it automatically; it is protected against changes; access to it is limited to us; and we use it only to meet that law, to answer a lawful request from a court or an authority, and to investigate attacks on or abuse of the server. It is never used for marketing, never combined with other data and never sold. Our hosting provider may also keep its own network logs under its own rules.

Where: our game server is rented from a hosting provider in Europe; at present it is located in the United Kingdom. Communication between the App and our server is encrypted, and the App checks the server's identity.

Finding our server: to find our game server, the App looks up its name (play.forthefungamestudio.com) when it starts and from time to time while it runs. It asks public DNS services directly: Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9). If none answers, the App keeps the address it found before, or uses the address built into it. These lookups are not encrypted. The service that answers sees your device's public IP address and the name asked for, and nothing else about you; it handles them under its own privacy policy.

Planned (not in the App yet): leaderboards and seasons. Before either arrives we will update this policy and say what it needs. Your Zer belongs to Bomb And Conquer only; it is not shared with our other games.

4. Purchases

You can buy Zer packs in the shop (and, once, a Starter Pack with Zer and a bomb look). Payments are handled entirely by Google Play on Android and by Apple's App Store on iPhone and iPad: you enter your payment details with them, and we never see or receive your card or other payment details. See the Google Play Terms of Service and Apple's Media Services Terms.

How a purchase reaches your account: when you buy, the App gives the store a code worked out from your guest ID (it does not reveal the ID), so the purchase stays tied to your account. After the payment, the App sends our server the store's proof of purchase: on Android the purchase data Google signed (the product, the order number, a purchase token and the time), on iPhone and iPad the transaction number, which our server checks with Apple. Our server verifies the proof with Google or Apple, adds the Zer to your account once (each purchase is counted only once) and only then lets the store complete the purchase. Until then the store keeps the purchase, so it is not lost if the connection drops.

What we keep: for each purchase, the store, a scrambled form of the purchase token or transaction number, the order number (Google's order ID or Apple's original transaction number), the pack, the Zer added, the date, the guest ID and whether it was a test purchase. We use it to add the Zer, to answer your questions, to handle refunds and to prevent fraud, and keep it for accounting (section 9). Our server also asks Google and Apple about refunded or cancelled purchases: when a purchase is refunded, its Zer are taken back from your balance, which can then go below zero until you earn or buy Zer again; the looks you have stay yours.

On Steam, Zer packs are paid in Steam's own window (the Steam overlay); Valve handles the payment and we do not see your payment details. To start an order our server sends Steam your Steam ID, our order number, the pack, its price and currency and the language of the window. It does not send your IP address. To show prices in your Steam currency, our server asks Steam for your Steam wallet's currency and country and keeps them in its memory only, for at most a day. We keep for each order: our order number, Steam's transaction number, the pack, its price and currency, the Zer added, the date and your guest ID, for as long as your account exists and 5 years after it is deleted, for tax and accounting (an order you did not pay is removed about five weeks after it ended). Our server reads Steam's sales report to learn of refunds and chargebacks: a refunded pack's Zer are taken back from your balance, which can then go below zero.

Zer is also earned by playing (quests, matches against bots and online matches). It buys looks (which do not change a match), potions, which help in a match for a short while (how strong a potion a hero may take depends on that hero's experience), and online matches. Zer has no money value outside the game and cannot be exchanged or paid out.

5. No outside statistics, crash reports or ads

The App contains no analytics, crash-reporting or advertising services (no Firebase Analytics or Crashlytics, no ad networks) and no tracking identifiers. On Android, the only Google Firebase feature the App uses is Firebase Cloud Messaging, solely to deliver the notifications in section 6. It brings two other parts of Firebase that it needs: Firebase Installations, which gives the App on your device a random installation ID that Google uses to deliver those notifications (the App registers with Firebase every time it starts, even when Invites is off), and Google's data transport library, which Firebase can use to report to Google how notifications were delivered (the App does not turn on Firebase's delivery reports). Errors are written only to your device's own log. What we learn about how the game plays comes from our own testing, from the feedback you choose to send and from our own counts (below).

Our own counts: our game server counts, from the data it already keeps, how many accounts play each day, how many new accounts come back after 1, 3, 7, 14 and 30 days, how many online matches are played and how many accounts buy Zer packs. For this it marks, with your guest account, on which of the account's first 32 days the App connected (these marks are erased with the account, section 10), and it keeps a daily total of these numbers, without any account in it, for 400 days. We look only at totals, never at one player, and use them to improve the game; no outside analytics service takes part. On iPhone and iPad the App contains no Firebase or other Google code; its notices go through Apple (section 6).

TestFlight (the iPhone and iPad beta): the beta for iPhone and iPad is handed out through Apple's TestFlight app. TestFlight is Apple's service, and under its terms Apple shares with us information about how the beta runs on your device, such as the device model, the iOS version, crash reports and how many sessions you played, and any feedback or screenshot you choose to send through TestFlight; if we invited you by email, also your name and email address. We use it only to fix problems and improve the game, and keep it in App Store Connect, Apple's developer site, while the beta is offered. Apple handles it under its own privacy policy, and you can stop testing at any time in the TestFlight app.

On Steam the App uses only these Steam features: the sign-in, the overlay (for the payment window, the store pages and this policy), checking that you own the game, Steam Input (to learn which controller is behind Steam's virtual pad, such as a PlayStation pad, so that the game shows the right buttons, and to read your Steam controller settings) and Steam's on-screen keyboard (in Big Picture mode, on a Steam Deck, or when you type with a controller). It does not use Steam achievements, statistics, friends lists, rich presence or crash reports, and its log is not written to a file or sent anywhere, except the crash.txt file after a crash (section 2), which stays on your PC. The App does not use Steam Cloud. Steam itself (Valve) sees that you play, for how long, and the screenshots you take with Steam, under Valve's own privacy policy.

6. Notifications

On iPhone and iPad the only notifications are the invitation, friend-request, message and news notices below (no reminders, new-version notices or offers), and the App asks for the notification permission once, the first time you open Friends; the Offers list below is Android only. On Android 13 and later the App asks for the notification permission at most twice: on the main screen after your first match, and the first time you open Friends if notifications are still off. Deleting your account does not make it ask again. If you allow notifications, the App shows one quiet notice when a new version is available on Google Play (once a day, when your phone has a network connection, Android's job scheduler lets the App ask Google Play; the check sends nothing about you to us), and, if you have not played for a few days, may remind you that new daily quests are ready (at most three times: 2, 5 and 10 days after you last played; playing again starts the count over). These are local notifications created on your phone and send nothing about you. You can turn them off at any time in your phone's settings.

Offers list: while "Offers" is on in the App's settings, the App downloads a short list of the studio's current offers from our website, forthefungamestudio.com: when you open the App and with the daily check above, at most twice a day, also while the App is closed and whether or not notifications are allowed. It may show one notice when an offer starts. The download sends nothing from the App's data, but like any web request it lets our website's host see your device's IP address, the time and the standard details Android adds to the request (such as the Android version and the phone model). Our hosting provider may keep these in its server logs for a limited time (see our website's privacy notes); we do not use them to identify you. Turn "Offers" off and the App stops downloading the list.

Invitations, friend requests, messages and news (push notifications): so that a friend's invitation or friend request, a message from us (section 3) or our news can reach you while the game is closed, the App uses Google's Firebase Cloud Messaging (FCM). FCM gives the App a notification token, a random identifier for the App on your device, which the App sends to our server while Invites is on (Firebase gives one at every start either way, section 5), and our server stores it with your guest account. When a friend invites you to a team or sends you a friend request, when we send a message to your account, or when we publish news, our server asks Google to deliver a short notice to that token, with only a fixed text ("A friend invites you to a match", "You have a new friend request", "You have a new message from the team" or "There's news from the team"): no names, no guest IDs, not the message or the news itself and nothing else about you or your friend; the App shows who it was, or what we wrote, after you open it. News notices go to every player whose token we have and who has "News" on in the App's settings, at most once a day; turning "News" off makes the App tell our server, which keeps that one on/off choice with your guest account until the account is deleted. Google processes the token and delivers the notice under its own terms and privacy policy. You can stop these notices in the App's settings ("Invites": the App then tells our server to forget your token, which stops all of them; "News": only the news notices), in your phone's settings, or, for one player's invitations and requests, by blocking that player. The token is deleted from our server when you turn Invites off, when Google replaces it, or when your account is deleted. Our staff may also get notifications on their own phones about the game server (for example that new feedback arrived); these go to a separate Firebase project and do not contain your data.

On iPhone and iPad these notices go through Apple's Apple Push Notification service instead of Firebase. Each time the App starts, iOS gives it a notification token, a random identifier for the App on your device (it changes if you reinstall the App). The App sends it to our server only while Invites is on, and our server stores it with your guest account. For an invitation, a friend request, a message from us or our news, our server asks Apple to deliver the same short, fixed notice to that token, with no names and nothing else about you or your friend. Apple processes the token and delivers the notice under its own terms and privacy policy. Invites, News, your device's settings and blocking work as on Android. The token is deleted from our server when you turn Invites off, when Apple tells us it is no longer valid (for example after you delete the App), or when your account is deleted.

On Steam there are no notifications: no reminders, no offers list and no push messages. Invitations, friend requests and our messages show in the game while it runs. Steam delivers updates.

News: the App shows the studio's news on its home screen. It asks our server for it while it has a connection, sending only the number of the news version it already has (no account is needed), and keeps a copy on your device so the news shows without a connection. The news is the same for every player and contains nothing about you.

7. Permissions

On Android the App uses these permissions:

Permission	Why
INTERNET, ACCESS_NETWORK_STATE	Online matches, the guest account, feedback, the new-version check and the offers list (section 6).
VIBRATE	Short buzzes for your own moments in a match; VIBRATION in Settings turns them off.
com.android.vending.BILLING	Google Play's billing library, for buying Zer packs (section 4).
POST_NOTIFICATIONS	The new-version notice, the reminders and the invitation, friend-request, message and news notices in section 6, only if you allow them.
com.google.android.c2dm.permission.RECEIVE, WAKE_LOCK	Come with Firebase Cloud Messaging: they let the App receive the invitation and friend-request notices in section 6 while it is closed.

On iPhone and iPad the App asks only for permission to show notifications (the invitation and friend-request notices in section 6), once, the first time you open Friends. On Steam the App asks for no permissions; when you host a game on your network, Windows may ask whether to let the game through its firewall. On every platform, the App does not access the camera, microphone, contacts, location, photos or your files, and does not track you across other companies' apps or websites.

8. Why we may process your information (legal bases)

To provide the game, the online matches you ask for and your guest account (performance of a contract); to keep matches fair and friendly, prevent cheating, act on reports, keep our server secure, keep the data of a closed account for 6 months, keep the admin log and our backups, and to read the feedback you send (our legitimate interests in security, fraud prevention and the establishment or defence of legal claims); to sell Zer packs and add them to your account, and to move your account or give it back with a transfer code or your e-mail (performance of a contract); to keep the Zer history (our legitimate interests in support and fraud prevention); to keep the server's traffic log (section 3) and the records of purchases for accounting (legal obligation).

9. How long we keep it

• Your guest account and the copy of your progress: as long as the account exists, that is until you delete it, or until it has not been online for 2 years and our server deletes it automatically (not an account holding Zer bought with real money, section 10).
• Online matches: the moves are not kept after a match ends. What a match took or gave stays in each player's Zer history (below), and our server's own log notes the mode, the map and the result without identities (and an early leaver's penalty with the first 8 characters of the guest ID).
• The traffic log (IP addresses and ports, connection times, guest IDs, services used, bytes): one year and one day, then deleted automatically (section 3). Our hosting provider's network logs follow its own rules.
• Reports, and the notes our server adds to them (section 3): six months, then deleted automatically. A name brought to our attention stays marked with the account until our staff have looked at it.
• The admin log of our staff's changes and of the email deletion requests we check (section 3): two years, then deleted automatically.
• Our server's system log: it notes what happens to accounts (for example when one is made, renamed, moved, protected with an e-mail, deleted, pays a penalty or buys Zer), with only the first 8 characters of the guest ID. The server's operating system keeps this log for about 6 months.
• The data of a closed (deleted) account: 6 months after the account was closed, for security, fraud prevention and the establishment or defence of legal claims, then erased for good (section 10).
• Feedback notes: as long as we need them to read, answer and act on them. They are kept apart from your account: deleting the account does not erase them, but when its data is erased after the 6 months (section 10), the notes it sent no longer carry its guest ID. Email us (section 14) with roughly when you sent a note if you want it removed.
• Messages from us and bans: with your account (they are erased with the rest of a closed account's data after 6 months, section 10).
• Friends, requests and blocks: until you or the other player remove them, or one of the two accounts is deleted (then at once, section 10).
• The notification token: until you turn Invites off, Google (on iPhone and iPad, Apple) replaces it or reports it is no longer valid, or your account is deleted.
• Teams and invitations: only while they are open on our server (an invitation at most 5 minutes); not stored.
• Backups: we copy our server's account file, its feedback notes, its purchase records, its daily totals (no accounts in them) and its traffic log to the studio's own computer. Copies of the account file, the feedback notes, the purchase records and the daily totals are deleted at our first backup after they are 30 days old; copies of the traffic log at our first backup after one year and one day from the day they cover. Our hosting provider also makes a daily backup of the whole server and keeps only the latest one, replacing it every day.
• After a crash: if our server finds its account file or its purchase records damaged when it starts, it keeps a copy of the file as it was for 30 days, so that we can repair it, then deletes the copy.
• Our own counts (section 5): the day marks with your account, as long as it exists; the daily totals, which name no account, for 400 days.
• Your Zer balance, bag and looks: with your account, as long as it exists (section 10). The Zer history: one year and one day from each change, then deleted automatically, also after the account is deleted.
• Purchase records (section 4): as long as your account exists, and 5 years after it is deleted, for tax and accounting, then erased (only a scrambled form of the purchase token stays, so that a purchase is not counted twice). They hold no payment details.
• The e-mail fingerprint (section 3): until your account is deleted, or 14 days after you remove the address. The address itself: only on your device, and in our server's memory while a code is waiting. Transfer codes and e-mail codes: in our server's memory only, for a few minutes. Our web hosting provider's mail logs follow its own rules.
• Your Steam ID (on Steam): with your account, as long as the link exists (section 3). After a deletion or an unlink it stops being used at once and leaves our server's account file the next time the server writes that file again, at the latest when the account's data is erased 6 months later; backup copies on the studio's computer go 30 days after that (Backups, above). Your PC keeps it in the game's folder (section 2), because the game needs it to sign you in.
• Steam orders and purchases: as the purchases above (section 4). Your Steam wallet's currency and country: only in our server's memory, at most a day.
• Data processed by Google Play (the store, the new-version check) and by Firebase: according to Google's policies and your Google settings.
• Data processed by Apple (TestFlight, the App Store, push notifications, iCloud backups): according to Apple's policies; what TestFlight shares with us stays in App Store Connect while the beta is offered.
• Data processed by Valve (the Steam sign-in, payments, the overlay and the other Steam features): according to the Steam Privacy Policy.

10. Deleting your account and your data

You can delete your account at any time in the App: Settings (the gear) > Delete account, then confirm twice. The App tells our server (this needs an internet connection; if the App cannot reach us, or cannot confirm that the deletion went through, it tells you, and you can try again), and from that moment your account is closed: nobody can sign in to it or use it, nobody sees it in the game any more, and our staff can no longer change it. On your device the progress, Zer, potions, quests, looks, player name, titles and messages from us are erased at once, and so are the game's settings, except your choices for sound, music, invitations and offers and whether the App has already asked for the notification permission. Feedback notes still waiting on your device are dropped. The App makes no new account until you start it again, or come back to it after a minute or more away; then, with a connection, it makes a new guest account with a new made-up name. If the App never reached our server, there is no account there, and the deletion happens on your device only. If your account is shared with another of your devices (for example after a backup restored it on a new phone), that device learns it was closed the next time it connects, erases its copy too and tells you the account was deleted. Deleting cannot be undone, and your Zer (also Zer you bought) and everything it bought are lost.

What goes at once. Your player name becomes free for others, and no one sees it in the game any more. Your friends, your friend requests, your blocks, the friend requests other players sent you and your notification token are removed; your friends no longer see you in their list. Blocks other players had put on your account go within a day. Our server writes these removals to its account file at once; older entries in that file go when the server next rewrites it, and at the latest with the rest of the account's data after 6 months.

On Steam, the link to your Steam ID ends at once; the next time you start the game on Steam, a new account is made. On your PC the App erases its copy of your progress as it does on a phone, and keeps only your Steam ID in its folder (section 2), which it needs to sign you in again.

What we keep for a time. Closing an account marks it as deleted; the rest of its data (the guest ID, a fingerprint of its secret key, the player name it had, the copy of its progress, its studio titles, our messages to it, any ban, any mark on its name and when it was last online) is not erased at once. We keep it for 6 months after the account was closed, for security, fraud prevention and the establishment or defence of legal claims, and use it for nothing else; then our server erases it for good (it checks every day). Other records follow their own times (section 9): reports, and our server's lines about your account in them, 6 months; the traffic log, one year and one day, as the law requires (section 3); the admin log, two years; feedback notes are kept apart from the account and are not erased with it, but lose its guest ID when its data is erased after the 6 months. Backup copies of the account file on the studio's own computer are deleted at our first backup after they are 30 days old; until then, one can still hold a closed account's data after our server erased it. Our hosting provider's daily backup of the whole server is replaced every day, so erased data can stay in it at most one day longer. Purchase records are kept for 5 years after the account was deleted, for tax and accounting, and the Zer history for one year and one day from each change (section 9). The e-mail fingerprint, if you added one, goes at once.

Accounts nobody uses. If an account has not been online for 2 years (730 days in which the App was never opened with an internet connection), our server deletes it by itself, just as if you had deleted it (everything in this section applies): it is closed, and its data is erased for good 6 months later. An account that holds Zer bought with real money is kept, because bought Zer does not expire. Only accounts unused for that long are deleted this way; opening the App with an internet connection, even once in a while, keeps your account. If a device that still has the account goes online during those 6 months, it learns the account was closed, erases the App's progress on that device and tells you the account was deleted, as after any deletion.

After the 6 months our server's account file has nothing of the account left, not even its ID (the other records in section 9 keep to their own times). A device that still holds the old key and did not connect during all that time would then start a new account under the same ID: nothing of the old account comes back from our server, and the new one holds only the progress still on that device.

By email. If you would rather not use the App, or can no longer open it, email support@forthefungamestudio.com with the subject "Delete my Bomb And Conquer account", your player name and your account code (the App shows it in its settings, section 3). If the code matches, we delete the account just as the App does; if it does not, we delete nothing. Either way we answer you within one month. A device that still has the account erases its copy the next time it connects, and tells you the account was deleted. A guest account has no email or sign-in, and its player name is public, so without the code we cannot tell whether an account is yours, and we do not delete it on request; it is then deleted automatically once it has not been online for 2 years (above). See also forthefungamestudio.com/delete/. Progress saved only on your device (section 2) is deleted when you clear the App's data or uninstall it (on iPhone and iPad: when you delete the App).

11. Your rights (GDPR, UK GDPR, CCPA/CPRA and similar laws)

Depending on where you live, you may have the right to access the personal information we hold about you, to receive a copy of it, to correct it, to delete it, to restrict or object to its processing, and to withdraw consent at any time. To use these rights, email us (section 14); for a request about your guest account, add your player name and account code (section 3) so we know it is yours. We answer within one month. You may also complain to your data protection authority. We do not sell personal information and do not share it for cross-context behavioural advertising: the App shows no ads.

12. Children

Bomb And Conquer is not directed at children under 13, and online play is not meant for them. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has used the App's online features or sent us personal information, contact us and we will delete it.

13. Security, transfers and changes

Communication with our server is encrypted, access to the server is limited to us, and the App keeps only the guest account's secret key on your device (on iPhone and iPad also in its keychain; on Steam there is no key, Steam signs you in); there is no password. Purchases are checked with Google, Apple and Steam before any Zer is added. Your data is stored on our server in the United Kingdom (section 3), with backup copies on the studio's own computer in Turkey (section 9), copied there over an encrypted connection. Google (Google Play and Firebase, on Android), Apple (TestFlight, the App Store and push notifications, on iPhone and iPad) and the public DNS services the App asks to find our server (section 3) may process data in other countries under their own safeguards (such as the EU Standard Contractual Clauses). On Steam, Valve Corporation (United States) processes your Steam sign-in, payments and the other Steam features under the Steam Privacy Policy. We may update this policy, for example when new features arrive; the "Last updated" date above shows when it last changed.

14. Contact

For The Fun Game Studio
Email: support@forthefungamestudio.com
Website: forthefungamestudio.com