BubbleNova: Pop Quest (the "game") is made by AMCRAFTS ("we", "us"). This policy says what the game collects, why, where it goes, and how to get rid of it. It is written to match what the software actually does; where the game changes, this page changes with it and the date above moves.
The campaign, the boss levels, Nova Rush, Arcade, Relax and the daily and weekly challenges all run on the phone. Your progress, settings and statistics are stored in the game's own database on the device. The game asks for no permissions beyond network access and vibration, and it never reads your contacts, location, photos, or anything else on the phone.
When you choose Continue as guest on the Cloud Save screen, the game generates a random identifier on your phone and sends it to our server so that your progress can be backed up and restored on the same device. It is not your phone's hardware id, not an advertising id, and not linked to any other app. Reinstalling the game generates a new one, which is why a guest's backup does not survive a reinstall.
To back up progress across devices and appear on the leaderboards you can create an account. For that we hold:
| Data | Why | Notes |
|---|---|---|
| E-mail address | To sign you in and to identify the account when you ask us to delete it | Never shown to other players; never used for marketing |
| Password | To sign you in | Stored only as an Argon2id hash; we cannot read it |
| Display name | Shown next to your scores on the leaderboards | 2 to 20 characters; you choose it and can change it |
| Avatar and title | Shown next to your scores | Chosen from the game's own cosmetics |
| Installation id | To link a guest's existing progress to the new account | As above |
With an account or a guest id, the game synchronises your progress with our server so it can be restored: which levels you have completed, stars, best scores and fewest shots per level, when you first completed and last played each level, your experience points, coin and gem balances, the fourteen lifetime statistics the achievements are computed from (bubbles popped, shots fired, bosses defeated and so on), and your daily streak. This is game data about play, not about you; it is what you would lose if the phone were lost.
In Nova Rush, Arcade and the daily and weekly challenges the game submits your score, the number of shots and your best combo for that run to the leaderboard for that board. Your display name and avatar appear beside the score for other players to see. Scores that fail our plausibility checks are not shown.
Each request to our server carries the game's version and a random request id so we can find a failure in our logs. Our server logs record the request id, the method, the path and the app version. They do not record your e-mail address, your IP address, your tokens or the contents of any request. To limit abuse of the sign-in form we keep a one-way hash of your IP address for at most an hour, after which a scheduled job removes it.
On the phone, data lives in the game's private storage, which other apps cannot read. Android's automatic backup may include your progress and settings if you have backup turned on; your sign-in tokens are deliberately excluded from it, so a restored backup never restores a session.
Between the phone and our server everything travels over HTTPS; the game refuses plain HTTP. Sessions use short-lived tokens that rotate on every refresh and are revoked together if one is reused. Passwords are hashed with Argon2id and never stored or logged in the clear.
Account and gameplay data are kept for as long as the account exists. When you delete the account, the profile, statistics, level progress, session tokens and leaderboard entries are deleted with it in the same operation, not marked for later. Rate-limit hashes are removed within an hour. Server request logs, which contain no personal data, are kept only as long as we need them to run the service.
If you live somewhere that gives you further rights over your data — access, portability, objection, complaint to a supervisory authority — you have them, and contact@amcrafts.in is where to exercise them.
The game is for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children under 13; an account requires an e-mail address and our terms require the holder to be at least 13. If you believe a child has created an account, tell us at contact@amcrafts.in and we will delete it.
When this policy changes, the date at the top changes, and for a change that affects how your data is used the game will tell you before it applies.
AMCRAFTS · contact@amcrafts.in