Privacy policy

1. Overview

Palmo is a puzzle game made by Bardino Technology. This page says what the game keeps on your phone, what it sends away, who receives it and how to get rid of it.

It describes the game as it is built today, including the cloud save, the optional sign-in, the analytics events and the crash reporting. An earlier version of this page described a build that had none of those; it was replaced on the day they shipped.

2. Your identity in the game

The first time you open Palmo it asks Firebase Authentication for an anonymous identity. This happens on its own. You are not asked for a name, an e-mail address or a phone number, there is no sign-up screen and there is no login wall anywhere in the game. The identity is a random string, and its only job is to be the name of the folder your cloud save sits in.

Linking a Google or Apple account is optional. Its only purpose is to let you pick the game up on a second device, or on the same device after a reinstall. Linking converts the anonymous identity instead of making a new one, so the save you already have stays exactly where it is.

• Google: signing in passes an ID token to Firebase, which is what proves the account is yours.
• Apple: offered on iOS. The game requests the e-mail scope only. Apple may hand back a relay address, or no address at all, and only on the first authorisation.
• If an address does come back, Firebase Authentication keeps it on the device and the Settings screen shows it so you can see which account you are on. Where no address is available, that row reads Linked instead.

3. What stays on your device

All of this is written with the operating system's own preference storage. It is the game's real memory: the cloud copy described in the next section is made from it, not the other way round.

• Progress: which levels you cleared, how many stars each one holds, and the lifetime counts of regions settled, cells taken and nine-cell regions.
• Settings: sound, music, haptics, path hints and the language you picked.
• Lives and their timer, how many rewarded ads you watched today, and whether you bought the ad-free version.
• Jokers, and a note of which chapter rewards have already been paid out.
• Housekeeping: how long it has been since the last ad, whether you have seen the tutorial, your answer to the ad consent form, and a random identifier generated on the device that marks which install last wrote to the cloud. That identifier is made by the game, not read from the phone; reinstalling produces a new one.

4. What is saved to the cloud

The game keeps one document per player in Cloud Firestore, at the path /users/{your identity}. There are no other collections and no sub-documents. It holds:

• levels cleared and stars per level;
• the lifetime counters (regions settled, cells taken, nine-cell regions);
• joker counts and the chapter rewards already paid;
• which lessons you have been taught and whether the tutorial has been seen;
• your settings: music, sound, haptics, path hints and language;
• three bookkeeping fields: a format version, the identifier of the install that wrote last, and a server timestamp of that write.

Three things are deliberately not sent: your lives and their timer, your daily rewarded-ad counts, and the ad-free flag. Lives are a timer rather than a possession, and the ad-free purchase belongs to the store, which is the only thing that can confirm it.

The database rules require that a request is signed in and that the identity in the request matches the identity in the path, for reading, writing and deleting alike. There is no query that lists the collection, so one save cannot be reached from another. Every path outside this one is refused by default. The rules are published as part of every deployment.

The cloud copy is a convenience. If Firebase cannot start, if the network is down or if a write is refused, the game carries on from the copy on your phone.

5. Analytics

The game sends Firebase Analytics a short list of events, all of them about the board rather than about you:

• a level was opened, and a level was finished with its star count, its duration and how many settled regions you pulled apart;
• a level ended without being solved, split into the case where the board ran out of moves and the case where you left it;
• a board reached a dead end, and how much budget was left;
• a settled region was pulled apart;
• a joker was used, and which of the three it was;
• an ad was shown, and whether it paid out;
• the ad-free version was bought;
• an account was linked, and whether it was Google or Apple.

Consent for analytics is narrowed in code before the first event is sent: ad storage, ad personalisation signals and ad user data are all set to denied, and only analytics storage is allowed. The anonymous identity is not passed to Analytics, so these events arrive as counts rather than as a profile. There is no level of detail here that could carry a name, a message or anything you typed, because the game has no text entry of any kind.

6. Crash reports

Firebase Crashlytics records crashes and the handled errors that should not pass silently, such as a refused cloud write or a sign-in that failed. A report contains the stack trace and the device information the Crashlytics library collects itself: device model, operating system version and app version.

Two things are attached deliberately. The first is the number of the level you were on. The second is your anonymous identity, so that a crash can be matched with the cloud save it belongs to when we are working out what went wrong. That identity is a random string with no name, e-mail address or device identifier in it.

7. Ads

• Between levels (Google AdMob): from level 11 onwards a full-screen ad can appear, at most one every four levels and not within three minutes of the last one. There is never an ad after a level that ended with zero stars, and there are no banner ads anywhere.
• Ads you choose to watch: one earns a life, another earns a joker. Both are optional, both are capped per day, and skipping them takes nothing away from you.
• What Google receives: to select and measure an ad, the device's advertising identifier and standard request data such as approximate region, device type and operating system version. You can reset or switch off that identifier in your device settings at any time.
• Consent: in the EEA and the UK, and anywhere else Google's rules require it, Google's consent form is shown before the ad library is started, and your answer is stored on the device. You are not stuck with that first answer: where the form applies, Settings carries an Ad privacy row that reopens it. Where it does not apply the row is not drawn, because a row that does nothing when tapped is worse than no row.
• App Tracking Transparency (iOS only): before anything is requested from the ad network, iOS asks whether the app may track you across other companies' apps and websites. Saying no changes nothing about the game; it only means the ads you see are not personalised.

8. Purchases

There is one purchase, it removes the ads, and it is a one-off rather than a subscription. It is sold by Google Play and the App Store: payment happens inside the store, we are not the seller of record, and no card number or billing address reaches us. The game keeps a yes/no flag on the device and asks the store to confirm it again on a new one.

9. Deleting your data

You can delete the cloud save and the identity it is filed under from inside the game, and you can clear the copy on your phone separately. The steps for each, and what each one does not cover, are set out on the Account deletion page.

10. Children

Palmo contains no chat and no user-generated content, and there is nowhere in it to type anything. It is not directed at children. The game does show ads, so it is rated for a general audience rather than declared a children's app.

11. Changes

Material changes to this page are published here with a new date. When the game gained cloud save, sign-in and measurement, this page was rewritten rather than patched, because the previous version said the opposite. The same applies next time.

12. Contact

[email protected] · com.bardino.palmo