Privacy Policy
Who is responsible
This policy covers Dots & Boxes: Conquer! / Puntos y Cajas: Conquista! and its game service at dbc.darkfangstudios.com. The controller is Arturo Gaxiola Cinco, operating as Dark Fang Studios. Contact support@darkfangstudios.com for privacy questions and requests.
Accounts and player profiles
An account is optional for basic play and required for the account-based cosmetic wallet, purchases and collection. Firebase Authentication processes your account identifier, email address and authentication information. You may register with email/password or use supported Google/Apple sign-in. Those providers may share your email, name and provider identifiers according to your choices. Password authentication is handled by Firebase; the game server does not store your password. We use short-lived authentication tokens to identify your account. Your chosen nickname and equipped avatar are visible to your opponent; you do not need to use your real name.
Gameplay and network information
Online matches and connected Solo matches send session identifiers, room codes, moves, match state, screen-fit dimensions and connection activity to the authoritative server for matchmaking, validation, turn synchronization and reconnection. IP addresses are received for communication, rate limiting and abuse prevention. Hidden cell contents remain private until the rules permit disclosure. Offline Solo and same-screen play run locally. Local Wi-Fi discovery exchanges service identifiers, network endpoints and session information, then moves and match state directly between participating devices. A local mode does not itself disable advertising, consent, authentication or store services.
Cosmetic currency, rewards and purchases
Microsoft Azure SQL stores account-linked cosmetic balances, owned and equipped items, verified coin-purchase records, reward draws, completion records and eligibility/anti-abuse information. This supports delivery, reconciliation, daily limits and prevention of duplicate rewards or purchases. Cosmetic currency is distinct from the gold used during a match. Apple App Store or Google Play processes payments for coin packs and Remove Ads; Unity IAP obtains prices, transactions and ownership and completes or restores eligible purchases. For coin packs, our server receives and verifies purchase tokens or signed transaction information with the appropriate store, including product, quantity, transaction identifier, environment and account-binding information. We do not receive your full payment-card number or bank credentials. Purchased consumable coins and outfits are not restored to a newly created game account after deletion.
Advertising, consent and app verification
Google AdMob and its consent platform may process IP address (which may indicate approximate location), device/app identifiers, ad interactions, diagnostics and consent choices to deliver and measure ads and prevent fraud. Availability depends on device settings, consent and SDK configuration; test ads also contact Google. We do not request GPS location for gameplay. Firebase App Check uses Google Play Integrity on Android and Apple App Attest on iOS to verify app/device authenticity. These providers process attestation and technical information. Where applicable, use the in-game Privacy choices control and device privacy settings to manage consent and advertising identifiers. Limited or non-personalized ads may still process technical data. Remove Ads suppresses future ad requests once ownership is recognized; it does not erase earlier data or disable authentication or purchase verification.
Local storage and support
The device stores audio and language preferences, nickname/avatar choices, local match counters, and cached collection, sign-in and purchase status. Device backups may include local data. Support receives the email, message, screenshots and diagnostics you choose to send. Hosting and SDK providers also process operational and security diagnostics.
Providers and disclosure
We use Microsoft Azure for hosting and SQL storage, Google Firebase for authentication and app verification, Google AdMob for advertising/consent, Apple and Google for sign-in, attestation and store purchases, and Unity IAP for purchase integration. Depending on the activity, providers act as processors or independent controllers under their terms and may process information outside your country. We disclose necessary public match information to opponents, data you request us to disclose, and information needed for legal obligations or service protection. We do not sell match records or support messages to advertisers; AdMob processing and any applicable legal “sharing” classification are separate.
Retention and account deletion
Account authentication and cosmetic/economy records persist while the account is maintained; these are not only temporary room data. You can initiate deletion in the app: Main menu → Account → Delete account. Confirmation and fresh authentication protect against unauthorized deletion. Apple-linked accounts require Apple authorization so its sign-in token can be revoked. Deletion removes the Firebase identity and our active account-linked wallet, collection, equipment, purchase details and reward records, and removes account links from stored completion records. The operation requires connectivity; if it fails or is interrupted, retry until the app confirms completion or contact support. Data already removed cannot be recovered even if another step requires a retry. Deletion is irreversible, does not automatically refund purchases, and does not cancel or delete records held independently by Apple/Google. Remove Ads remains a store entitlement subject to store restoration rules.
Minimal retained records and other retention
We retain SHA-256 fingerprints of deleted account identifiers to prevent stale tokens or delayed events from recreating an erased account, and transaction fingerprints to prevent re-crediting previously delivered purchases. These security records contain no email, nickname, outfit list, balance or raw purchase token; they are retained for ongoing replay prevention and are not a new wallet or usable account. In-memory rooms/sessions expire according to connection state; inactive sessions are normally removed after approximately 30 minutes and server restarts clear that state. Operational hosting logs have a 30-day retention period. Support correspondence is kept as needed to handle requests and legal obligations. Infrastructure backups and provider-controlled records follow their applicable retention schedules and may not be erased immediately. Uninstalling alone does not delete your account, store purchase history or provider-held data.
Requests, security and legal grounds
You can also request deletion without the app through our account-deletion page. For access, correction, deletion, objection, restriction or withdrawal of consent where applicable, email support@darkfangstudios.com with the subject “Privacy request”, your app/platform and enough information to locate the account. Never send passwords, card numbers or authentication/purchase tokens. We may require proportionate identity verification and can act only on data we control or coordinate with providers. Applicable law may permit limited retention for security, transactions and legal obligations. The public API and provider services use encrypted connections. Local Wi-Fi gameplay does not add application-level encryption: use a trusted network. No system is completely secure. Where required, processing relies on delivering requested services, legitimate interests in operation/security, legal obligations, and consent where applicable. Rights vary by jurisdiction; you may contact your data-protection authority.
Children and updates
We do not require a real name, date of birth, contacts, photos or microphone recordings to play. A parent or guardian concerned about a child’s information should contact support. Store age ratings do not replace applicable parental-consent requirements. We update this policy when the game, providers or requirements change, and provide additional notice or seek consent when required.
Google Privacy · Google partner services · Firebase Privacy · Apple Privacy · Microsoft Privacy · Unity Privacy