PRIVACY POLICY Pocket Bones: Board Games Effective Date: October 27, 2026 Last Updated: October 27, 2026 1. KEY POINTS This summary gives you the main points. The full policy follows, and it controls if the two ever seem to differ. - Pocket Bones: Board Games (“Pocket Bones” or the “app”) is published by Jesus Afkerian, an individual operating under the AFKERIAN INTERACTIVE brand (“AFKERIAN INTERACTIVE,” “we,” “us,” or “our”). - Pocket Bones has no accounts. You do not give us your name, email address or phone number to play. - Your games, statistics, settings, Nearby username and friend list are stored on your phone. We do not have servers that receive them. - Pocket Bones shows ads from Google AdMob. Google’s ads software collects your IP address, your Android advertising ID, an app set ID, how you use the app and its ads, and performance data. Google and the advertising companies it works with use this information to show ads, which can be personalized, to measure them and to prevent fraud. - We use Google Firebase to measure how the app is used and to receive crash reports. In the countries where we offer Pocket Bones, Firebase turns on automatically, without asking you, once Google’s consent tool has recorded on your phone that European consent rules do not apply to you. The app has no switch to turn it off. - Starting with version 1.2, the app downloads its legal documents from our website when it starts, when you open Legal & licenses, and about once every 24 hours in the background while your phone is online. Our hosting provider, Cloudflare, sees your IP address in these requests and, normally, your phone’s model (Section 5.1). - When you host a Nearby table, phones nearby that are searching for the same game can see the first 15 characters of your Nearby username. When you play Nearby, your username and your moves go directly to the phones you play with, over Bluetooth or Wi-Fi. They never reach us. - The app asks for location permission only because Android requires it to find nearby phones. Pocket Bones never reads your location. - We do not sell personal information for money. Some US state laws treat personalized ads as a “sale” or “sharing” of personal information. Sections 19 and 21 explain your choices. - Pocket Bones is for adults 18 and older. - To delete your data, see Section 18 and our page https://afkerianinteractive.com/pocket-bones/data-deletion.html. - Questions and requests: afkerian.support@gmail.com. 2. WHO WE ARE AND HOW TO CONTACT US AFKERIAN INTERACTIVE publishes Pocket Bones and is responsible for the personal information we control under this policy. Google is responsible for the information it collects for its own purposes (Sections 6, 7, 8.4 and 9.3). Jesus Afkerian is the founder and owner of AFKERIAN INTERACTIVE. We are located in Florida, United States. For support, privacy questions and data requests, write to: afkerian.support@gmail.com Our founder and owner is also the person in charge of the protection of personal information for the purposes of Canadian privacy law, including Quebec’s Act respecting the protection of personal information in the private sector. You can reach him at the same address. 3. WHAT THIS POLICY COVERS This policy covers: - the Pocket Bones app for Android, including its games, its Nearby multiplayer feature and its radio station, Pocket Bones FM; and - emails you send us about the app. This policy does not cover our website, which has its own privacy policy at https://afkerianinteractive.com/privacy-policy.html. The requests that the app itself makes to our website for its legal documents are described in Section 5.1. This policy also does not cover Google Play, Android, your phone’s manufacturer, or the phones of other players. Those are run by others under their own terms and policies. This policy describes the app as it works on the Last Updated date above. 4. INFORMATION THAT STAYS ON YOUR PHONE Pocket Bones stores the following information in its private storage on your phone. The app does not send this information to us, and we cannot see it. Some of it also leaves your phone in the cases described in Section 5. - Games and statistics: games in progress, a record of each match you finish (the game, the result, how long it took, the date and time, the number of players and the mode), your results against each computer opponent, and a replay of one highlight. - Names you type: your Nearby username (up to 32 characters), the names of pass-and-play players (up to 24 characters each) and, if you use the domino competition mode, the event name, the referee’s name, the four players’ names, the scores, the penalties and the reasons entered for them. - Your friend list: if you tap “Remember device” after connecting with another player, their username, a short fingerprint of their phone’s Nearby key and that public key. - Your Nearby identity: a security key pair that the app creates in your phone’s Android Keystore the first time you use Nearby. It is used only to sign Nearby connections. The private key stays in the Keystore. - Settings: sound, music, vibration, radio, language, menu layout, game order, favorite and hidden games, the computer opponent’s level, your game setup choices, the Mahjong help options and the “App recommendations” switch. - Ad rules: if you earn an ad-free reward, the time you earned it, the local date, your phone’s time zone, a timer reading and your phone’s restart count, which together let the app end the reward at the right time. The app also keeps a list of codes for finished matches so that it never shows more than one full-screen ad per match. - Pocket Bones FM: which radio segments you have already heard, and the alarm for the next show reminder. - Privacy choices: the records that Google’s consent tool saves on your phone (Section 7). - Legal documents: starting with version 1.2, the verified copy of the app’s legal documents most recently downloaded from our website, and at most one earlier verified copy (Section 5.1). - Files of Google’s software: Google’s ads, consent, analytics and crash reporting software keep their own files in the app’s storage, such as identifiers for your installation of the app (Sections 6 to 8). - Saved crash information: while crash reporting is off, Google’s crash reporting software saves details of any crash in the app’s storage. If crash reporting is turned on later, it sends them to Google (Section 8.1). To delete this information, see Section 18. Some of it is included in Android backups if you use them (Section 12). 5. WHEN INFORMATION LEAVES YOUR PHONE Pocket Bones has no accounts, and we have no servers of our own that store information about you. We receive information about you only in these ways: as analytics and crash reports in our Firebase project, which Google runs (Section 8); starting with version 1.2, as the records of the app’s requests for its legal documents that our hosting provider’s dashboard shows us (Section 5.1); in emails you send us (Section 14); and, if you review the app on Google Play, as your review and the name Google Play shows with it. Google also shows us aggregated reports about the app in our Google Play Console and AdMob accounts, such as install numbers and ad statistics. Information leaves your phone only in these cases: - Google’s advertising and consent software sends information to Google, and an ad can load content from servers of other ad companies (Sections 6 and 7). - Google Firebase sends analytics and crash information to Google (Section 8). - Starting with version 1.2, the app downloads its legal documents from our website (Section 5.1). - When you host or join a Nearby table, nearby phones receive your Nearby name, and during Nearby play your phone exchanges information directly with the phones you play with. Google Play services also collects usage statistics (Section 9). - Android backs up some app data to your Google account if you have turned on backup (Section 12). - You tap a link, for example to an app on Google Play or to this policy (Section 13). - You email us (Section 14). 5.1 Legal document downloads from our website Starting with version 1.2, the app downloads its Privacy Policy, Terms of Service and Third-Party Notices from our website so that it can show you the current versions, even offline. Earlier versions of the app do not make these requests. - When: each time you start the app, each time you open the Legal & licenses screen and, after you first start version 1.2, about once every 24 hours in the background while your phone is connected to a network, even on days you do not open the app. If your phone is offline when you start the app, that check waits until your phone connects. Android may delay the background checks, for example to save battery. - Where: https://afkerianinteractive.com, which Cloudflare, Inc. hosts for us. - What the request contains: the address requested, which includes the app’s package name; your IP address, which is part of every internet connection; your phone’s standard network identification string, which normally includes your Android version, your phone’s model and its build number; and, after the first download, cache codes that let the server reply that nothing has changed. These cache codes come from our website’s earlier reply and are the same for every user of the app. The request contains no advertising ID, no Firebase identifier, no cookie, no Nearby username and no information about your games or settings. - Security: the app uses HTTPS only, connects only to our website and refuses redirects. Before it uses a downloaded document, it checks the document against a list that we have digitally signed, and it replaces its copy only with a newer signed version. - What the app shows: the Legal & licenses screen shows the most recent verified copy or, until the app has downloaded one, the copy included in the app. It shows the Spanish documents when the app is set to Spanish and the English documents otherwise. Each document has an “Open on our website” button. We use these requests only to deliver the documents and to protect the website. Cloudflare processes them as our service provider and may derive your country from your IP address. We do not export, download or keep any record of these requests: Workers Logs is disabled and we do not use Logpush. Cloudflare’s dashboard shows us traffic statistics and records of individual requests: a sample of all requests, whether or not a security feature acted on them, and the requests that a Cloudflare security feature blocked or challenged. Each record can include the IP address, user agent, path and country of the request. Cloudflare’s documentation states that these records are available to us for up to 31 days. Cloudflare also keeps its own records as its privacy policy describes: https://www.cloudflare.com/privacypolicy/. You cannot turn these downloads off inside the app, and your choices in Google’s consent tool do not affect them. They stop when you uninstall the app. 6. ADVERTISING 6.1 The ads you see Pocket Bones is free and is paid for by ads from Google AdMob, a service of Google LLC (“Google”). The app shows: - a banner ad at the bottom of the main menu and of game screens; - a full-screen ad that may appear after you finish a match, when you go back to the menu or start a rematch, and never more than one for each finished match; and - a rewarded ad, only if you choose to watch it from the “Ad-free day” button. After you watch it, the app shows no ads and makes no ad requests until midnight in the time zone your phone used when you earned the reward. If you watch it less than 2 minutes before midnight, the ad-free time lasts 2 minutes instead. You can earn this reward once per day. During the ad-free time, Google’s consent tool still checks with Google each time you open the app (Section 7). The app requests ads only after Google’s consent tool says that ads may be requested (Section 7), and only when your phone has a working internet connection. 6.2 What Google collects Google’s ads software (the Google Mobile Ads SDK) runs inside the app. For the version in Pocket Bones, Google says it automatically collects and shares: - your IP address, which may be used to estimate the general location of your phone; - how you use the app and its ads, such as app launches, taps and video views; - information about the performance of the app and of Google’s software; and - device and account identifiers: your Android advertising ID, an app set ID and other identifiers related to accounts signed in on your phone. Google says it uses this information for advertising, analytics and fraud prevention, and that it encrypts it in transit using Transport Layer Security (TLS). Google’s ads software is also allowed to use Android’s ad services on phones that support them. These include the advertising ID and Android’s attribution and topics features. You can manage them in your phone’s privacy or ads settings. 6.3 Who receives it Google receives this information directly from the app. Google may share it with other advertising companies that take part in choosing, showing and measuring ads through Google’s systems. Our AdMob settings use the lists of these companies that Google maintains. Google’s policies allow some ads to be served or measured from the ad servers of advertisers and other ad companies. When such an ad loads, those servers receive the information that any internet connection sends, such as your IP address. See https://support.google.com/adspolicy/answer/94230. Google uses advertising information under its own privacy policy, as well as to provide its services to us. See: - Google Privacy Policy: https://policies.google.com/privacy - How Google uses information from sites or apps that use its services: https://policies.google.com/technologies/partner-sites - Google Mobile Ads SDK data disclosure: https://developers.google.com/admob/android/privacy/play-data-disclosure 6.4 Personalized ads We have not told Google to show only non-personalized ads. Unless you opt out (Section 19) or delete your advertising ID, Google and its advertising partners may use the information above to personalize the ads you see in Pocket Bones and elsewhere. 7. GOOGLE’S CONSENT TOOL AND YOUR PRIVACY CHOICES Pocket Bones uses Google’s User Messaging Platform (the “consent tool”). Each time you open the app, shortly after it starts, the app asks the consent tool whether a privacy message or privacy choices are needed where you are. The consent tool contacts Google to answer, and Google decides based on your location. - In the European Economic Area, the United Kingdom and Switzerland: we do not offer Pocket Bones there, but if you open the app while you are there, Google may show a consent message. Ads and Firebase then follow your choices. - In the US states that Google covers with its US state privacy message: Google shows this message when you tap the “Privacy choices” button in Settings, under Data (starting with version 1.2, the same button also appears in the Legal & licenses screen). There you can opt out of the “sale” or “sharing” of your personal information and of targeted advertising. The consent tool sends your choice to Google. This choice applies to Google’s ads. It does not turn off Analytics or Crashlytics (Section 8.1). - Everywhere else: no message appears and there is no “Privacy choices” button. The “Privacy choices” button appears only when the consent tool tells the app that privacy choices are required for you. The consent tool saves your choices on your phone in standard industry formats. They stay there until you clear the app’s storage or uninstall the app, and they are included in Android backups (Section 12). The consent tool and your choices in it do not affect the legal document downloads (Section 5.1). 8. ANALYTICS AND CRASH REPORTS We use Google Analytics for Firebase (“Analytics”) and Firebase Crashlytics (“Crashlytics”), both provided by Google, together with the supporting Firebase Installations and Firebase Sessions software. 8.1 When they are on Analytics and Crashlytics are off when you first open the app. They stay off until Google’s consent tool has recorded on your phone whether European consent rules apply to you. - Where those rules do not apply, which includes every country where we offer Pocket Bones, the app then turns on Analytics and Crashlytics automatically, without asking you. It also tells Analytics that advertising-related storage, advertising data and ad personalization signals are allowed. These signals tell Google what Analytics may do with the data. Our Analytics property is not linked to any advertising product (Section 8.2), so we do not use Analytics data for ads. - Where those rules apply, Analytics and Crashlytics follow the choices you make in Google’s consent message. If you withdraw your consent there, Crashlytics stops from the next time you open the app. While Crashlytics is off, Google’s crash reporting software still saves information about any crash in the app’s storage on your phone. If Crashlytics is turned on later, it sends those saved crash reports to Google. Outside the European Economic Area, the United Kingdom and Switzerland, Pocket Bones does not have an in-app switch that turns off Analytics or Crashlytics, and the “Privacy choices” opt-out in Section 7 does not reach them. To stop them, you can uninstall the app. Deleting your advertising ID stops Analytics from receiving it (Section 19). 8.2 What Analytics collects According to Google, Analytics collects: - an app-instance ID, a random identifier for your installation of the app; - your Android advertising ID; - approximate location, down to your city, derived from your IP address (Google says it uses masked IP addresses); - events that Analytics records automatically: when you first open the app, your sessions and how long the app is on screen, the screens you view, app and Android updates, clearing the app’s data, and uninstalling the app; - events about the ads in the app that Google’s ads software reports to Analytics, such as ad requests, ads shown on screen and rewards earned; and - device information, such as the device brand, model and name, screen resolution and operating system version. The Analytics software in the app also has permission to read the Google Play install referrer, which shows how the app was installed (for example, from a link). We have not added our own events, user properties or user IDs to Analytics. Our Pocket Bones Analytics property is not linked to AdMob, Google Ads or BigQuery, and Google signals is off. In our Analytics account, the setting that shares Analytics data with other Google products and services is off. The setting called “Modeling contributions and business insights” is on: Google says it combines this data with data from other websites and apps, so that it cannot be used to identify us or our users, and uses it to create features and publications. See https://support.google.com/analytics/answer/1011397. 8.3 What Crashlytics, Installations and Sessions collect When the app crashes, Crashlytics sends Google a crash report. Google says it contains the stack trace, the relevant state of the app, information about your device and a Crashlytics installation identifier. Because the app also uses Analytics, a crash report can include a log of the Analytics events recorded just before the crash, such as the screens you viewed (Google calls these “breadcrumbs”). Reports also carry the Firebase installation ID and a session ID. The app does not add custom logs or keys to crash reports. Firebase Installations creates the Firebase installation ID, an identifier for your installation of the app, and sends it with a Firebase user agent, which describes your device and the Firebase software in the app. Firebase Sessions collects the app’s package name, operating system information, the version of the Firebase software, the type of network connection, your device’s manufacturer and model, and the time when the app came to the foreground. 8.4 Google’s role Crashlytics, Firebase Installations and Firebase Sessions are Firebase services. Google states that for Firebase it generally acts as a data processor under European law and as a “service provider” under California law, handling the data on our behalf. Google also collects and generates what it calls “Firebase service data” while it provides Firebase. As of October 27, 2026, our Firebase settings do not allow Google to use this service data to give us analysis, insights and recommendations about Google services that are not Firebase or to improve those services. Google says it still uses this service data for other purposes under its privacy policy and applicable terms, including to provide, maintain and improve Firebase, to make recommendations about Firebase, to protect users, the public and Google, to comply with legal obligations, and to deliver and improve other services we request, such as Google products we link to our Firebase project, as described on Google’s Firebase privacy page. Google Analytics is a separate Google service under its own terms (https://marketingplatform.google.com/about/analytics/terms/us/). The settings in Section 8.2 limit how Google may use our Analytics data. Google says Firebase encrypts the data it collects in transit using HTTPS, and that Analytics encrypts the data it collects in transit using TLS. See https://firebase.google.com/support/privacy and https://support.google.com/analytics/answer/11582702. Retention periods are in Section 17. 9. NEARBY PLAY Nearby play lets you play with people next to you, without the internet. It uses Google Play services Nearby Connections, which connects phones directly over Bluetooth, Bluetooth Low Energy and Wi-Fi. No server of ours or anyone else’s relays your games. 9.1 Before you connect While you host a table, your phone announces a Nearby name made of the first 15 characters of your Nearby username, followed by “~” and a 16-character fingerprint of your phone’s Nearby public key. If you have not chosen a username, the app uses “Pocket Bones.” Phones nearby that search for tables of the same game in Pocket Bones can read this announcement. It is sent over the air before any connection is made, so treat your username as visible to anyone near you. The announcement stops at the latest when you stop hosting. Nearby also stops when Pocket Bones goes to the background. When you search for tables, your phone does not announce itself. When you ask to join a table, your phone sends the same Nearby name and fingerprint to the phone that hosts it. The fingerprint stays the same until you clear the app’s storage or uninstall the app. It lets other players’ phones recognize your phone. 9.2 After you connect When you connect with a phone that is not in your friend list, both phones show a code, and you confirm that the codes match. Phones in your friend list connect without the code. In both cases the phones then exchange their public keys and signed security checks, and after that the game moves and game state, which can include the names shown at the table. Google says these connections are fully encrypted. There is no chat, and the app does not send files, photos or audio over Nearby. The other player’s phone receives your username, fingerprint and public key. If the other player taps “Remember device,” their phone keeps them in its friend list. What other players do with what their phones receive is up to them. 9.3 Google’s usage statistics Google says that when apps use Nearby, Google Play services collects usage statistics: the time it takes to discover and connect, reliability and throughput, and your device model, country, build version and the app’s package name. Google says it collects them to improve the experience. You can allow or stop this in your phone’s Settings app: open Settings, tap Google, then tap Usage & diagnostics. 10. PERMISSIONS Pocket Bones asks for, or declares, these Android permissions: - Nearby devices (Bluetooth advertise, connect and scan; on Android 13 and later, nearby Wi-Fi devices): to find and connect to other players’ phones for Nearby play. - Location (approximate and precise): Android requires this permission to find nearby phones. On Android 12 and 12L, the app asks for it whenever you use Nearby. On Android 13 and later, it asks only when you search for tables. Pocket Bones does not read your location and has no code that requests it. If you refuse, the rest of the app still works, but the Nearby features that need the permission do not. - Local network access (Android 17 and later): for Nearby play over Wi-Fi. - Notifications (Android 13 and later): for radio show reminders (Section 11). The app asks when you turn the radio on from the home screen, if you have not allowed notifications yet. - Run at startup: to set the next radio reminder again after your phone restarts or the app is updated. - Vibration: for touch feedback. You can turn it off in Settings, under Sound. - Network access, network state and Wi-Fi state: for ads and Firebase, to load ads only when your phone has a working internet connection, for Nearby play and, starting with version 1.2, to download the app’s legal documents (Section 5.1). - Advertising ID, Android ad services and the Google Play install referrer: added by Google’s ads and analytics software (Sections 6 and 8). - Keeping the phone awake and running background tasks: used by Google’s software to send its data. Starting with version 1.2, the app also uses Android’s background task scheduling for its checks for updated legal documents (Section 5.1). Pocket Bones does not ask for access to your camera, microphone, contacts, photos, files, phone, text messages, calendar or accounts. 11. RADIO REMINDERS Pocket Bones FM runs on a weekly schedule. If you allow notifications, the app shows a reminder about 5 minutes before a show starts, but only if you are not already listening and the show has segments you have not heard. The reminders are created on your phone by an alarm. They are not sent from a server, and the app has no push messaging service. You can turn reminders off in your phone’s notification settings for Pocket Bones. 12. BACKUPS AND NEW PHONES Pocket Bones allows Android’s automatic backup and phone-to-phone transfer. If you have turned on backup in your phone’s settings, Android copies the app’s files to your Google account, except the ones listed in the next paragraph. The files copied include your settings, Nearby username, friend list (including the stored public keys), pass-and-play names, the ad-free reward record, the records saved by Google’s consent tool, the list of matches already used for ads, your radio progress, the “App recommendations” and Mahjong help settings, and the highlight replay. They can also include the files that Google’s ads, consent, analytics and crash reporting software keep in the app’s storage, such as their identifiers, unless that software excludes them from backup. Android does not back up your games in progress, match history and statistics, or domino competition records. They stay only on your phone. Starting with version 1.2, Android also does not back up, or transfer to a new phone, the copies of the legal documents that the app downloads (Section 5.1). The app downloads them again the next time it checks our website. According to Google’s Android documentation, Android makes a new backup when at least 24 hours have passed since the last one, your phone is idle and it is connected to Wi-Fi (or to mobile data, if you allowed backups over mobile data). Backups are stored in a private folder in your Google Drive, limited to 25 MB per app, and do not count toward your storage quota. Only the most recent backup is kept. On Android 9 and later, the backup is end-to-end encrypted with your screen lock (PIN, pattern or password) if you have set one. If you install Pocket Bones again on a phone signed in to the same Google account, Android may restore this data. We cannot access your backups. You control backups in your phone’s settings. 13. LINKS AND PROMOTION OF OUR OTHER APPS The game menu shows cards for our other apps (XO Arcade, Air Strike Arcade, Tap Odyssey and QR Decoder). The pictures are part of the app, and nothing is downloaded to show them. The app does not record or report which card you see or tap. If you tap a card, the app opens that app’s page in the Google Play Store app, or in your browser if the Play Store app is missing. The link contains only the app’s package name. You can hide these cards with the “App recommendations” switch: in Pocket Bones, open Settings, tap the “i” (Information) button at the top, then tap “Legal & licenses.” The switch is on when you first install the app. Pocket Bones FM also plays short promotions for our other apps. They are part of the radio audio stored in the app and collect nothing. Starting with version 1.2, the “Privacy policy” link in the Information screen and the “Open on our website” buttons in Legal & licenses open the document’s page on our website, in Spanish when the app is set to Spanish and in English otherwise. In earlier versions, the app opens a page on Google Docs, a Google service, to show the privacy policy. When you open a link to Google Play, to this policy or to another website, the site you open receives the information that browsers and apps normally send, such as your IP address. Google Play and Google Docs are covered by Google’s privacy policy, and our website by its own privacy policy. 14. EMAIL TO SUPPORT If you email afkerian.support@gmail.com, we receive your email address, the name on your email account, your message, any attachments and the usual email information (such as the date and the servers it passed through). Our mailbox is hosted by Google’s Gmail service. We use your email to answer you, to handle your request, to keep a record of privacy requests, to prevent abuse and, if needed, to protect our legal rights. Please do not send passwords, payment card numbers, identity documents or health information. We will never ask you for them. 15. HOW WE USE INFORMATION AND OUR LEGAL BASES 15.1 Purposes Information is used: - on your phone, to run the games, save your progress, show your statistics, apply your settings, run Nearby play and remind you about radio shows; - by Google, to show and measure ads, to personalize ads where allowed and to prevent ad fraud; - by us, through Analytics and Crashlytics, to understand how the app is used and to find and fix crashes; - by us, starting with version 1.2, to deliver the current legal documents to the app and to protect our website (Section 5.1); - by us, to answer emails and requests; and - by us, to comply with the law and to protect our rights. We do not use your information to make decisions about you that have legal or similarly significant effects. Google may build advertising profiles under its own policies. 15.2 Legal bases and consent Where a law requires a legal basis or consent, we rely on: - your consent, including consent you give in Google’s consent message where one is shown; - the need to provide the features you choose to use, such as Nearby play; - our legitimate interest in funding a free app with ads, in keeping it stable, in keeping its legal documents current and our website secure, and in answering you; and - our legal obligations. In countries whose laws allow consent to be given through your conduct, you agree to the processing described in this policy by using the app after this policy has been made available to you. You can withdraw that consent at any time by stopping use of the app and uninstalling it, by deleting your advertising ID and by using the choices in Section 19. Withdrawing consent does not affect processing that took place before. 16. WHO RECEIVES INFORMATION - Google LLC, as the provider of AdMob and the consent tool, receives the information in Sections 6 and 7 and uses it for its own purposes as well as to provide its services to us. - Advertising companies that take part in Google’s ad systems may receive information from Google, and the ad servers of advertisers and other ad companies may receive information directly when an ad loads (Section 6.3). - Google LLC, as the provider of Firebase and Google Analytics, receives the information in Section 8. It handles Crashlytics, Installations and Sessions data on our behalf, except for the Firebase service data it uses as described in Section 8.4. It handles Analytics data under the Google Analytics terms and the settings described in Section 8.2. - Google LLC, as the provider of Gmail, hosts the emails you send us. - Cloudflare, Inc., as our service provider for our website, receives the requests that the app makes for its legal documents, starting with version 1.2 (Section 5.1). - Google LLC, as the provider of Google Play services and Android backup, receives the information in Sections 9.3 and 12. - Phones nearby that search for tables of the same game receive your Nearby name while you host (Section 9.1), and other players receive the information in Section 9 when you play Nearby. - Authorities, courts or other parties, if we must disclose information to comply with the law or a valid legal process, or to protect the rights or safety of anyone. - A buyer or successor, if AFKERIAN INTERACTIVE is involved in a merger, acquisition or sale of assets. This policy will continue to apply to the information. We do not sell personal information to data brokers, and we do not receive money in exchange for personal information. 17. HOW LONG INFORMATION IS KEPT - Information on your phone: until you delete it with the app’s controls, clear the app’s storage or uninstall the app. - Android backups: Android keeps only the most recent backup. See Section 12 and our deletion page. - Analytics: our settings keep event data and user data for 2 months each. The period for user data starts again each time you use the app, so that data is deleted 2 months after you last use the app. Google deletes expired data once a month. Aggregated reports, such as daily totals of users, are not affected by these settings. - Crashlytics: Google says it keeps crash reports and their identifiers for 90 days and then starts removing them. - Firebase installation IDs: Google says Firebase deletes an installation ID after it has been inactive for 270 days, which is Google’s current threshold, and that data tied to a deleted installation ID is removed from its live and backup systems within 180 days. Deleting an installation ID does not delete Analytics data, which follows the Analytics periods above. Pocket Bones does not delete installation IDs itself. - AdMob and the consent tool: Google keeps this information under its own retention practices. Google says it anonymizes advertising data in its server logs by removing part of the IP address after 9 months and cookie information after 18 months. See https://policies.google.com/technologies/retention. - Nearby usage statistics: kept by Google under its own policies. - Legal document downloads: we do not export or keep any record of these requests. Cloudflare’s dashboard shows us traffic statistics and a sample of individual requests, which can include the IP address, user agent, path and country, for up to 31 days. Cloudflare keeps its own records as its privacy policy describes (Section 5.1). - Support emails: we delete them 24 months after our last message with you, unless you ask us to delete them sooner (Section 18) or we must keep them longer to comply with the law or to resolve a dispute or legal claim. We keep a short record of each privacy request (its date, type and how we answered) for 24 months. 18. DELETING YOUR DATA There is no account to delete. Our page https://afkerianinteractive.com/pocket-bones/data-deletion.html explains every case step by step. In short: - Information on your phone: in Settings, under Data, “Reset data” erases your match history, statistics and the highlight replay. Under Nearby play, “Forget” removes a friend from your list, and you can change your username. To delete everything, including your Nearby identity, open your phone’s Settings app, tap Apps, then Pocket Bones, then Storage, and choose “Clear storage” (names vary by phone), or uninstall the app. A copy may remain in your Android backup; our deletion page explains how to remove it. - Information Google collects for its own purposes: we do not hold it and cannot delete it. You can delete or reset your advertising ID and use Google’s own tools (Section 19). - Firebase: the app does not show us who you are, so we cannot find the records that relate to you. Analytics and Crashlytics records are deleted automatically on the schedule in Section 17. Firebase deletes installation IDs after 270 days without activity (Section 17). - Requests the app makes to our website for its legal documents: we do not keep any record of them, so there is nothing for us to delete. Cloudflare’s dashboard shows them to us for up to 31 days (Section 5.1). - Emails: ask us and we will delete them from our mailbox, including its trash, within 30 days. 19. YOUR CHOICES - Privacy choices: if the button appears in Settings, under Data, you can use it to change your consent choices or to opt out of the sale or sharing of personal information and of targeted advertising (Section 7). - Advertising ID: on recent Android versions, open your phone’s Settings app and go to Privacy, then Ads (on some phones, Google, then Ads), and tap “Delete advertising ID,” or “Reset advertising ID” for a new one. After you delete it, apps receive a string of zeros instead of the ID. This limits personalized ads and stops Google’s software in the app from receiving your advertising ID. - Android ad services: manage them in your phone’s privacy or ads settings. - Google’s own tools: My Ad Center (https://myadcenter.google.com/) and the Data & privacy page of your Google Account (https://myaccount.google.com/data-and-privacy). - Google’s usage statistics for Nearby: in your phone’s Settings app, tap Google, then Usage & diagnostics. - App recommendations: in Pocket Bones, open Settings, tap the “i” (Information) button, then “Legal & licenses.” - Notifications, permissions and backup: in your phone’s settings. You can refuse or remove any permission. Nearby needs its permissions; the rest of the app does not. - Not using a feature: Nearby play, the radio and rewarded ads are optional. 20. YOUR RIGHTS 20.1 Rights we offer to everyone Wherever you live, you can ask us to: - confirm whether we hold personal information about you, tell you what it is and how we use it, and give you a copy; - correct it; - delete it; - tell you which third parties receive it; and - stop using it for a purpose you object to, or withdraw your consent. In practice, the personal information we hold about you is the email you send us. We do not keep records of the requests the app makes to our website (Section 5.1). We cannot link Analytics or Crashlytics records to a person, because the app does not ask who you are and does not show its identifiers. We also do not hold the information Google collects for advertising or Nearby. If you ask about those, we will explain this and point you to Google’s tools. To make a request, email afkerian.support@gmail.com. We may ask you to reply from the same email address, or for other details, to confirm the request is yours. We answer within 45 days, or within any shorter period that the law where you live requires. If we need more time where the law allows it, we will tell you why. Requests are free. You may use an authorized agent. We may ask for your written permission for the agent and ask you to confirm your identity with us. If we decline your request, you can appeal by replying with “Appeal” in the subject line. We will answer the appeal within 45 days. If you disagree with the result, you can contact the attorney general of your state or the data protection authority of your country. We will not treat you differently, or offer you a different version of the app, because you exercised these rights. 20.2 Complaints You can complain to the data protection authority where you live. We would appreciate the chance to address your concern first. 21. ADDITIONAL INFORMATION FOR US STATE RESIDENTS Several US states, such as California, Colorado, Connecticut and Virginia, give their residents privacy rights. Depending on our revenue and the number of people who use our apps, some of these laws may not apply to us. We offer the rights in Section 20 to everyone anyway. 21.1 Categories of personal information In the past 12 months, the following categories of personal information were collected through Pocket Bones, as these categories are defined in the California Consumer Privacy Act: - Identifiers: IP address, Android advertising ID, app set ID, other identifiers related to accounts signed in on your phone, Firebase installation ID, Analytics app-instance ID and Crashlytics installation identifier; and your email address and name if you email us. - Internet or other electronic network activity: how you use the app and its ads, performance and crash information and, starting with version 1.2, the app’s requests to our website for its legal documents, including your phone’s standard network identification string. - Geolocation data: approximate location derived from your IP address. We do not collect precise geolocation. - Inferences: Google and its advertising partners may draw inferences about your interests for advertising. We do not. We do not collect sensitive personal information as defined by those laws. Sources: your phone, through Google’s software in the app and, starting with version 1.2, through the app’s requests to our website (Section 5.1); and you, when you email us. Purposes: Section 15. Recipients: Section 16. Retention: Section 17. In the past 12 months, identifiers, internet or other electronic network activity and approximate location were disclosed to Google for these business purposes: analytics, crash reporting and, for ads, the purposes described in Section 6. Starting with version 1.2, identifiers (your IP address) and internet or other electronic network activity (the app’s requests for its legal documents) are also disclosed to Cloudflare, our service provider, to deliver those documents and to protect our website. 21.2 Sale, sharing and targeted advertising We do not receive money for personal information. However, allowing Google and its advertising partners to collect identifiers, usage information and approximate location through the app for personalized ads may be a “sale” or “sharing” of personal information, or “targeted advertising,” under some state laws. We do not link Analytics to any Google advertising product, and we have turned off sharing of Analytics data with other Google products (Section 8.2). Your choice in “Privacy choices” applies to Google’s ads. It does not turn off Analytics or Crashlytics. We have no actual knowledge of selling or sharing the personal information of anyone under 16. To opt out: - use “Privacy choices” in Settings, under Data (or, starting with version 1.2, in the Legal & licenses screen), when it appears for your state; Google receives your opt-out; and - delete your advertising ID on your phone (Section 19). 21.3 Nevada We do not sell covered information as Nevada law defines that term. Nevada residents can still send an opt-out request to afkerian.support@gmail.com. 22. ADDITIONAL INFORMATION FOR CANADA AND LATIN AMERICA 22.1 Canada You have the right to access and correct the personal information we hold about you, and to withdraw consent, as described in Section 20. Our person in charge of the protection of personal information is named in Section 2. You can complain to the Office of the Privacy Commissioner of Canada and, in Quebec, to the Commission d’accès à l’information. 22.2 Latin America Depending on the law of your country, you have the rights of access, rectification, cancellation or deletion, and opposition, and the right to revoke your consent. Use the process in Section 20. You can also complain to the data protection authority of your country. Residents of Argentina: you may exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner, as provided in Article 14(3) of Law 25,326. The Agencia de Acceso a la Información Pública, as the authority responsible for enforcing Law 25,326, handles complaints and claims about breaches of personal data protection rules. 23. DO NOT TRACK, GLOBAL PRIVACY CONTROL AND TRACKING BY OTHERS “Do Not Track” and Global Privacy Control are signals that web browsers send to websites. Pocket Bones is an app, not a website, and it cannot receive these signals, so it does not respond to them. Use the choices in Section 19 instead. Google and its advertising partners may collect information about your activity in Pocket Bones, and in other apps and websites, over time, for example through your advertising ID. They do so under their own policies. 24. CHILDREN Pocket Bones is for adults 18 and older. In Google Play, we have set the app’s target audience to ages 18 and over. The app is not directed to children and is not part of Google Play’s Families program. The app’s content rating on Google Play (for example, Teen in North America) describes its content. It does not mean the app is meant for teenagers. The app does not ask your age, and Google’s software in the app collects the information described in Sections 6 and 8 from anyone who uses it. Starting with version 1.2, the app also makes the requests described in Section 5.1, whoever uses it. We do not knowingly collect personal information from children under 13, or from anyone under 18. If we learn that someone under 18 has used Pocket Bones: - if that person or a parent has sent us personal information, such as an email, we will delete it after we have answered, if an answer is needed, and we will keep only the short record of the request described in Section 17; - we will tell the parent how to delete the app’s data on the phone, how to delete the phone’s advertising ID and how to uninstall the app; and - because the app has no accounts, we cannot identify that person’s phone or its Firebase or advertising records. Analytics and Crashlytics records are deleted on the schedule in Section 17. Parents and guardians can contact us at afkerian.support@gmail.com. 25. SECURITY - Google states that its ads software and Analytics encrypt data in transit with TLS and that Firebase uses HTTPS. - Google states that Nearby connections between phones are fully encrypted. A connection with a phone that is not in your friend list must be confirmed with a matching code, and the phones always check each other’s security keys. The Nearby name that a hosting phone announces before any connection (Section 9.1) can be read by any phone that searches for it. - Your Nearby private key is kept in your phone’s Android Keystore. - Starting with version 1.2, the app downloads its legal documents over HTTPS only, connects only to our website and refuses redirects. It checks each downloaded document against a list that we have digitally signed before it uses it (Section 5.1). - The app stores its data in its private storage on your phone, which other apps cannot read under Android’s normal security rules. - We limit access to our Firebase projects and to our support mailbox to people who need it to do their work. No method of storage or transmission is completely secure. If a security incident affects your personal information, we will notify the authorities when the law requires it, and we will notify you where the law requires it and we have a way to reach you. 26. WHERE INFORMATION IS PROCESSED We are based in the United States. Google processes the information it receives through Pocket Bones in the United States and in other countries where it or its providers have facilities. Starting with version 1.2, Cloudflare processes the app’s requests for its legal documents in the United States and in other countries where it has facilities (Section 5.1). The data protection laws of those countries may differ from the laws where you live. By using Pocket Bones outside the United States, you understand that your information will be processed in the United States and in those other countries, where the laws of your country allow this. 27. CHANGES TO THIS POLICY We will update this policy when the app, its software providers or the law change. The new version will show a new Last Updated date. Starting with version 1.2, the app also downloads the new version and shows it in Legal & licenses (Section 5.1). If a change is material, for example a new kind of information or a new recipient, we will announce it on this page and in the release notes of the app update that brings the change, before the change takes effect. 28. LANGUAGE This policy is written in English, and the English version controls. We also provide a Spanish version. If the law where you live requires a different rule, that law applies. 29. CONTACT AFKERIAN INTERACTIVE Florida, United States Email: afkerian.support@gmail.com Website: https://afkerianinteractive.com/