Boltfront privacy policy

This policy covers Boltfront, our strategy game for iPhone and Android. It says what the app stores, what it sends and to whom, why, how long it is kept, and what you can ask us to do about it. The privacy notice for violabs.co.uk covers this website.

Who we are

Vio Labs LTD makes Boltfront and is the controller of the personal data described here. The company is registered in England and Wales, company number 17466165, with its registered office at 128 City Road, London EC1V 2NX.

To ask about your data or make a request, email contact@violabs.co.uk or write to us at the registered office.

In short

There are no accounts, no analytics and no crash reporting. We do not sell personal data.
Your progress and settings stay on your device.
Online duels go through our game server. It holds a match in memory while it is played, and its log has no IP addresses.
The free version shows adverts from Google AdMob, which collects data under Google's own policies. Buying Full Game Ad Free stops all advert requests.

On your device

The app keeps these on your device only:

your campaign progress, medals and settings;
battles you leave part way through, so you can carry on later;
your record of online duels played, won, lost and drawn;
when adverts and reward videos were last shown, so that they can be spaced out, and the rewards and paint schemes you have earned;
whether you own Full Game Ad Free, so adverts stay off when you are offline;
a player ID, made up of random numbers when you first open the app, and the display name you choose. Until you change it, the name is "Commander" and a random number.

None of this is sent to us, apart from what is described under "Online duels" below. Uninstalling the app deletes all of it. If your phone makes backups to iCloud or to your Google account, those backups may include it, as they do for other apps. We cannot see them.

Online duels

When you open online play, or open a duel invite, the app connects to our game server at wss://violabs.co.uk/boltfront/ws. The connection is encrypted. The game server runs on a dedicated server that OVH SAS hosts for us in France, the same server as violabs.co.uk. UK law recognises the European Economic Area as giving personal data adequate protection.

The app sends the server your player ID and your display name. It also sends your platform (iPhone or Android) and the version of the app and of the game rules, so that the server can match you with a player whose game is compatible. During a match the app sends your orders to the server, which runs the battle and sends each player only what their side can see. The server passes the preset chat messages you pick and your map pings to your opponent. There is no free text chat. Your opponent sees your display name, your platform and your app version.

The server keeps rooms and matches in memory only while they are in use and for 5 minutes after a match ends, and keeps no record of who played whom. Its own log records technical events: connections and disconnections, platform, app and game version, room codes, when matches start and end, and when a player is removed from a match for sending invalid orders or too many messages. It does not record IP addresses, player IDs or display names. To protect the service from abuse, the server also uses your IP address in memory, to limit how many connections and wrong room codes come from one address. It never writes it to its log, and forgets it within about 10 minutes of your last connection. The log is rotated daily, and each day's log is kept for 14 days after that day ends and then deleted.

The connection passes through the web server for violabs.co.uk, which records it in its access log like any other request: your IP address, the time, the address requested, whether it succeeded and your device's user agent string. If the connection fails, the web server's error log also records your IP address. Both logs are kept for 14 days, as the site privacy notice explains.

We use this data to run the online play you ask for. We keep the logs because we have a legitimate interest in keeping the service working and secure.

Advertising

The free version shows adverts from Google AdMob: one advert after some battles, and a reward video only when you choose to watch one. AdMob is provided by Google Ireland Limited for people in the UK and the European Economic Area, and by Google LLC elsewhere.

To show, measure and protect adverts, Google's software in the app may collect your device's advertising identifier, your IP address and the approximate location it shows, information about your device and the app, how the adverts perform, and how you interact with them. Google uses this under its own policies: how Google uses information from sites or apps that use its services and the Google Privacy Policy. AdMob reports to us in totals, such as the number of adverts shown.

Where the law requires consent, as in the UK, the European Economic Area and Switzerland, the app shows Google's consent message at the main menu, and no advert is requested until you have made your choices. Google's software keeps your choices on your device. You can change them at any time in the app's Settings, under Privacy options.

On iPhone, the app then asks once for permission to track, through Apple's App Tracking Transparency. It asks only players who see adverts. If you decline, you still see adverts, but they are not personalised using your device's advertising identifier. You can change your answer in the iPhone's Settings, under Privacy and Security, then Tracking.

On Android, you can reset or delete your advertising ID in your device's settings.

Where consent is needed, the legal basis for advertising is your consent. Otherwise it is our legitimate interest in paying for the free version with adverts.

If you buy Full Game Ad Free, the app stops requesting adverts of any kind, reward videos included, and gives you the rewards without a video. On iPhone it does not ask the tracking question. Google's software is still built into the app: it starts when the app opens and checks with Google whether consent is needed. So where the law requires consent, you may still see Google's consent message, and Google may receive the device details it needs for that check.

Purchases

Full Game Ad Free is bought through the Apple App Store or Google Play. Apple or Google handles the payment, and we never see your payment details. The store tells the app whether you own the upgrade, so that the app can remove adverts and you can restore the purchase after reinstalling or on a new device. Apple's or Google's own privacy policy applies to the purchase.

"Challenge a friend" and the other share buttons open your device's share sheet with a short message, such as the mission you beat and a room code. Nothing is sent unless you choose an app and send it yourself. If the share sheet is not available, the message is copied so that you can paste it.

What the app does not do

The app has no accounts and no sign-in. It runs no analytics and no crash reporting. It does not ask for your location, contacts, photos, camera or microphone. We do not sell personal data.

Children

Boltfront is meant for people aged 13 and over. It is not directed at children under 13, and it asks Google for ordinary adverts, not adverts for children. We do not knowingly collect personal data from children under 13. If you think a child under 13 has used online play, email contact@violabs.co.uk and we will delete anything we hold.

How long it is kept

On your device: until you uninstall the app, or longer in your own phone backups.
Rooms and matches on the game server: in memory, only while they are in use, and for 5 minutes after a match ends so that a player who lost the connection can still see the result.
Your IP address on the game server: in memory only, for up to about 10 minutes after your last connection.
The game server log: 14 days after the day it was written.
The web server access and error logs: 14 days after the day they were written.
Email you send us: only for as long as we need it to deal with what you asked.

Your rights

Under UK GDPR you can ask for a copy of the personal data we hold about you, and ask us to correct it, erase it, restrict how we use it or stop using it. Where it applies, you can also ask for your data in a portable format. Email contact@violabs.co.uk or write to us at the registered office above.

Most of what Boltfront handles never reaches us: it stays on your device. For the web server log, tell us the IP address you used and roughly when you played, so we can find any entries. For data that Google collects for adverts, use Google's own tools, or contact Google.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

Changes to this policy

If a new version of the app stores or sends anything new, we will update this policy before that version is released. The date of the last change is at the end of this page.