Privacy Policy
In short
- You need no account to play solo. Your game (progress, gold, collection, house, settings) is saved on your phone.
- Online play uses an anonymous account, created automatically the first time you use an online feature: no email address, no password, no Google or Apple account. Our server keeps only what is needed: your friend code, your player name, your avatar, your level, your friends, your published house and a few technical counters.
- Ads are only optional videos that you choose to watch for a reward. They are provided by Google AdMob; in the European Economic Area, the United Kingdom and Switzerland, you decide whether they may be personalized.
- We do not sell your data. The game has no messaging between players, and we have added no audience measurement or error tracking tool to it.
- You can delete your online data at any time, in the game or by writing to us (how to do it).
1. Who we are
Bingoluma is published by Rokkiro, the name under which Benjamin Bonnet, sole trader (entrepreneur individuel, SIREN 977 823 376, SIRET 977 823 376 00016), publishes his games, 51 avenue César Bernaudon, 13310 Saint-Martin-de-Crau, France ("we").
For any question about your data or to exercise your rights: contact@rokkiro.com.
2. Data stored on your phone
The game stores in the app's private storage, which other apps cannot read:
- your progress: level, experience, gold, boosters, campaign stages, collections (cards, skins, avatars), house;
- your settings: music, sounds, vibration, language;
- the state of the daily features: challenges, daily bonus, bingo gauge, chests, wheel, mini-game, ad videos already watched today;
- your player identity: the identifier of your device account (section 3), your player name and your friend code;
- a play record: number of sessions, days played, rounds played and won, bingos, numbers daubed and videos watched.
This data is used to run the game. Your gold and your collection stay on your phone: they are not sent to our server.
Android may copy app data into your device backup on your Google account, if you turned that backup on. It is managed by Google according to your Android settings; we have no access to it.
To erase this data: uninstall the game, or use "Clear data" (or "Clear storage") in the app's Android settings. This does not delete your online account: for that, see the deletion page.
The game requests Internet access (for online play and ads) and vibration (for haptic feedback, which you can turn off in the settings). Google's advertising kit adds the permission to read the device's advertising ID (section 6). The game does not request access to your phone's location, camera, microphone, contacts or files. [À CONFIRMER : liste des autorisations de l'application publiée]
3. The online account
Playing online, playing with friends or visiting a friend's house requires an account on our server. The game creates it automatically, without asking you anything, the first time you use one of these features. As long as you only play solo, no account is created.
It is a device account: the game generates a random identifier, keeps it on your phone and sends it to our server so it can recognize you. This identifier is not your phone's advertising ID, nor its IMEI number, nor an email address, nor a Google account. There is no password, no email address, and no sign-in with Google or Apple.
The server gives you a friend code (for example "BL-4F7K"), which your friends use to add you; it also serves as the technical username on the server. You will find it on the game's Friends page ("Your friend code").
The server runs on a virtual private server rented from OVHcloud SAS (France), in a data center located in Roubaix, France (OVHcloud data centre EU-WEST-RBX).
4. The data in one table
| Data | Why | Who sees it | How long |
|---|---|---|---|
| On your phone | |||
| Progress, gold, collection, house, settings, play record (section 2) | to run the game | only you (and the Android backup, if you turned it on) | until you uninstall the game or clear its data |
| On our server, only if you use an online feature | |||
| Random identifier of the device account | to recognize you without a password | only us | as long as the account exists |
| Friend code | so friends can add you; technical name of the account | your friends and the people you give it to | as long as the account exists |
| Player name ("Joueur 1234" by default, editable, cleaned up by the server), chosen avatar (a number), level | to show you to other players | the players in your room, your friends (section 5) | as long as the account exists |
| Friends list (mutual friends) | to play with friends | your friends | as long as the account exists |
| Room invitations | to invite a friend to play | the invited friend | deleted after 10 minutes |
| Friendship notifications (request, acceptance) | to let you know | you | deleted after 30 days |
| Published house: the variant chosen for each spot, the rooms opened | so your friends can visit | your friends only | as long as the account exists |
| Gold won today in multiplayer; number of multiplayer rounds played | to cap the day's winnings; to know whether the account is in use | only us | the day's gold starts again from zero each day; the number of rounds, as long as the account exists |
| Hourly request counters | to prevent abuse (too many requests in a short time) | only us | start again from zero every hour |
| Date you last opened the game | to delete unused accounts (section 11) | only us | as long as the account exists |
| Fingerprint of the IP address: never the address itself, only a salted, truncated fingerprint | to slow down mass account creation from a single address | only us | counter reset after one hour, erased after 24 hours |
| Server technical logs (warnings and errors, without player names) | to diagnose failures, security | only us | 12 months at most |
| Web server access logs [À CONFIRMER : existence et contenu, par exemple adresse IP, date et heure] | security | only us | [À CONFIRMER : durée de conservation] |
| At Google | |||
| Data collected by the AdMob kit: IP address, advertising ID, other device identifiers, interactions with ads, diagnostics (section 6) | to show and measure the videos, to prevent fraud; to personalize them if you consent | under Google's policy | |
| Google Play statistics (section 7) | to monitor the game's quality | Google; us, as overall figures | under Google's policy |
| With us, if you write to us | |||
| Your email address and your message (section 8) | to answer you | us and our email provider | [À REMPLIR : durée, par exemple 12 mois après le dernier échange] |
Game rooms are never stored: they exist only in the server's memory during the game, then disappear. Your gold is not on our server: it stays in your phone's save; it is an in-game currency with no real value, which cannot be bought, withdrawn or exchanged.
5. What other players see
- In an online room: only your seat number, your player name, your avatar, your level, your number of bingos and your rank.
- Between friends: the same information, plus your account identifier. Your friends also see whether you are online and can visit your published house, without being able to change it.
- No messaging: players cannot write to each other in the game.
- Robots, that is, simulated players, labelled as such in the game, fill out the online rooms.
6. Ads
The game shows only optional rewarded videos: you are the one who chooses to watch one to get a reward (gold, a wheel spin, a mini-game play, double winnings, opening a chest, 5 extra balls or a star). There are never forced full-screen ads, and never banners.
These videos are provided by Google AdMob (Google Ireland Limited for the European Economic Area). To show them, measure them and prevent fraud, the AdMob kit built into the game automatically collects from your phone: your IP address (from which an approximate location can be estimated), the device's advertising ID according to your consent choices and your Android settings, other device identifiers, your interactions with the ads and diagnostic information. Google uses this data under its own policy: policies.google.com/technologies/partner-sites.
Your consent. In the European Economic Area, the United Kingdom and Switzerland, a message from Google appears the first time you launch the game: there you choose whether your data may be used for personalized ads. You can review this choice at any time in the game: Settings > "Ad privacy" [À CONFIRMER : libellé anglais du bouton dans le jeu]. Without your consent, non-personalized or limited ads may be shown.
You can also reset your phone's advertising ID in the Android settings.
[À AJOUTER QUAND LE PREMIUM SERA EN VENTE : "Premium subscribers see no ads.", and a section on the subscription (payment handled by Google Play, purchase data received).]
7. Google Play and its statistics
If you installed Bingoluma from Google Play, Google may give us overall statistics about the game: number of installs, versions in use, crashes and freezes (for devices whose owner agreed to share these diagnostics), ratings. If you write a review, it is public, under the name you chose for your reviews. This is Google's own processing, under its own policy (policies.google.com/privacy). Apart from Google Play and the AdMob kit, we have put no audience measurement or error tracking tool in the game.
8. If you write to us, and this page
If you write to contact@rokkiro.com (support, a question, a request about your rights), we receive your email address and the content of your message. We use them to answer you and keep them for 12 months after the last exchange. Please do not send us sensitive data.
In the game's settings, the "Privacy policy" row opens this page in your phone's browser. It is hosted by OVHcloud (the publisher's server), which may record technical visit logs (IP address, date and time) under its own policy.
9. Why we use this data, and on what legal basis
| Use | Legal basis (GDPR) |
|---|---|
| The online account, multiplayer, friends, the published house | performance of the service you ask for (Art. 6(1)(b)) |
| Security, preventing cheating and abuse (move checks, limits, address fingerprint, logs) | our legitimate interest in protecting the game and its players (Art. 6(1)(f)) |
| Personalized ads | your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Non-personalized or limited ads | [À CONFIRMER : base légale, à faire relire] |
| Answering people who write to us | our legitimate interest in answering you (Art. 6(1)(f)) |
| Google Play's overall statistics | our legitimate interest in monitoring the game's quality (Art. 6(1)(f)) |
Your progress, your gold and your collection stay on your phone: we do not receive them. Only the items in the table in section 4 go to our server, and only if you use an online feature.
Anti-cheat. The server checks every move: it deals the cards itself, and it may reject an implausible result. If you think a result was rejected by mistake, write to us to dispute it. We do no profiling aimed at making decisions about you, and we make no automated decision that produces legal effects concerning you.
10. Who receives data
- OVHcloud SAS, our hosting provider, which runs our server on our behalf.
- Google: AdMob for ads (section 6), Google Play for statistics (section 7), and the Android backup if you turned it on (section 2).
- Our email provider, for emails: [À REMPLIR : nom du fournisseur].
- Other players, only what is described in section 5.
- Authorities, only when the law requires it.
We do not sell or rent your data.
Google may process data outside the European Union, in particular in the United States, under its policy and the safeguards provided by the GDPR.
11. How long we keep data
The period for each piece of data is in the table in section 4. For the account itself:
- an account with no friend, no multiplayer round played and that you have not opened for 180 days is deleted automatically;
- an account whose creation never got as far as a player profile is deleted after 2 days;
- an account that you have not opened for 1 year is deleted automatically, even if it has friends or multiplayer rounds played;
- you can also delete it at any time (deletion page);
- the server's database is backed up every night, encrypted; each backup is kept for 14 days and then deleted. Deleted data may therefore remain in these encrypted backups for up to 14 days. on the publisher's computer, in France, for 14 days at most
12. Security
- Traffic between the game and our server is encrypted (TLS).
- The server validates every move; the cards are dealt by the server.
- Your IP address is never kept in clear by our server (section 4).
- Database backups are encrypted.
- On your phone, the game's data is kept in the app's private storage.
13. Minimum age
Bingoluma is meant for people aged 13 and over; it is not intended for children. If you are a parent and believe that a child under 13 has given us data, write to us: we will delete it.
14. Your rights
You can ask to access your data, correct it, delete it, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interest. In France, you can also set instructions on what happens to your data after your death.
- Correct: you change your player name directly in the game.
- Withdraw your consent to personalized ads: at any time in the game, Settings > "Ad privacy" [À CONFIRMER : libellé anglais du bouton dans le jeu].
- Delete: in the game, Settings > "Delete my online data" [À CONFIRMER : libellé anglais du bouton dans le jeu], or by email (deletion page).
- Other requests: write to contact@rokkiro.com. Since your account is not linked to any email address, give us your friend code so we can find it. We answer within one month.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or with the data protection authority of your country.
15. Changes
If a version of the game changes the data processed, this policy is updated before that version is released, and the date at the top of the page changes. If the change is significant, we tell you in the game.
16. Contact
Rokkiro, the name under which Benjamin Bonnet, sole trader (entrepreneur individuel, SIREN 977 823 376, SIRET 977 823 376 00016), publishes his games, 51 avenue César Bernaudon, 13310 Saint-Martin-de-Crau, France, contact@rokkiro.com.