PRIVACY POLICY
1. WHO WE ARE
Bridge Attack is the game available at bridgeattack.com and as a mobile app ("the Service"). For anything privacy-related, contact [email protected].
2. WHAT WE COLLECT
Nothing is required to play. When you first open the game, your device generates a random player ID and a device credential. That is your guest account — it contains no name, email, or personal details.
- Things you choose to set: a callsign (a pseudonym — it does not have to be your real name and we suggest it isn't), a pixel avatar, and a team preference.
- Gameplay records: wins, losses, campaign progress, medals, match results (game mode, duration, outcome, opponent), and your in-game Scrap balance and the cosmetic items you own. These sync to our servers so your progress follows your account.
- Email address (optional): only if you link one for sign-in. We store the address tied to your player ID. We use it to send sign-in codes, and — unless you turn it off — occasional re-engagement emails about rivalry activity (for example, when someone beats your time or challenges you). Every such email has a one-tap unsubscribe link, and you can toggle it any time in the game under Account. We do not send newsletters, ads, or sell your address.
- Google / Apple Sign-In (optional): if you sign in with Google or Apple, the provider shares an account identifier and your email address with us so we can recognize you. We request no other access — no contacts, no files, nothing else.
- Push notifications (optional): if you enable notifications, we store a device push token (and, for web push, the browser's encryption keys) plus a device label (your browser/OS user-agent string) so we can deliver notifications such as streak reminders, "a rival beat your time," friend requests, and live-battle invites. You can turn notifications off in your device or browser settings; dead tokens are removed automatically.
- Friends & social play: you can search for other players by callsign, send ally requests, and challenge or "dare" friends. To make this work we store your friend connections, the challenges and dares you send and receive, and a "rivals feed" of results between you and other players.
- Replays and challenges: when you share a replay or challenge link, or post a daily/weekly leaderboard win, the match recording is stored on our servers. A recording contains game inputs (what was built, when troops were sent) — not personal data — and is publicly viewable by anyone with its link code. Shared recordings expire after roughly 60 days. To keep leaderboards honest, submitted wins are re-simulated on our servers to confirm they are real.
- Network / technical data: like any internet service, our servers briefly see your IP address. We use it transiently to prevent abuse (rate-limiting sign-in attempts, spam, and floods); these counters are short-lived and are not used to track or profile you.
- Aggregate counters: worldwide totals like "battles fought" contain nothing personal.
3. WHAT IS PUBLIC OR SHARED
- Leaderboards display your callsign, avatar, rank insignia, and results.
- In multiplayer, your opponent sees your callsign, avatar, faction, taunts, and moves.
- Your friends can see your callsign, avatar, win count, and rough online status. Results you record against another player's challenge appear in their rivals feed.
- Replays and challenge links you share are viewable by anyone who has the link.
4. IN-GAME PURCHASES
Scrap is a virtual, in-game currency earned by playing. It has no real-world value and cannot be exchanged for money. You can spend Scrap on cosmetic items (fort skins, unit colors, avatar bits) in the in-game Store. Your balance and owned items are stored on our servers, tied to your account, and are authoritative there so they can't be tampered with on the device.
5. ANALYTICS
We use Google Analytics to understand aggregate usage — which modes get played, where new players give up, whether features get used. It relies on cookies and device identifiers handled by Google; see Google's privacy policy. Analytics events describe game actions (like "match started" or "tutorial completed") and never include your callsign, email, or account identity. We do not use analytics data for advertising. Depending on your region, your browser or device privacy controls may let you limit this; where required, we honor applicable opt-out signals.
6. WHAT WE DON'T DO
- No advertising on the Service.
- No selling, renting, or sharing of your data with advertisers or data brokers.
- No passwords: device credentials are stored only as cryptographic hashes, and email sign-in uses short-lived one-time codes.
- Beyond Google Analytics (above), no cookies except the browser storage the game itself needs to remember your progress and settings on your device.
7. WHERE YOUR DATA LIVES
The Service runs on Cloudflare (hosting, database, and email delivery) — Cloudflare processes data on our behalf. Google processes analytics data (Section 5) and, for Google Sign-In, your sign-in exchange; Apple processes Sign in with Apple; and mobile push is delivered through Apple/Google/Firebase and your browser's push service. Their privacy policies cover their side. Your device also keeps a local copy of your progress in local storage; clearing it removes the local copy, and a linked email, Google, or Apple account lets you recover everything.
8. RETENTION & DELETION
Account data is kept while your account is active. Shared replays expire after roughly 60 days; sign-in codes and abuse-prevention counters are short-lived. You can delete your account and all its data yourself: in the game under Account → Delete account, or on the web at bridgeattack.com/delete-account.html (verified with an email code). Deletion removes your identity, device credentials, linked logins, results and replays, friends and rivals data, and push subscriptions. You can also email [email protected] for help.
9. CHILDREN
The Service is not directed at children under 13, and we do not knowingly collect personal information from them — play requires no personal information at all. If you believe a child has linked an email address, contact us and we will remove it.
10. CHANGES
If this policy changes, the new version will be posted here with a new effective date. Material changes will be noted in the game.