Privacy Policy

App: Ludo Titans (Android)
Effective date: 11 October 2026
Last updated: 17 October 2026

1. Who we are

Ludo Titans is published by Kamble Ashitosh Vinod, Safa Marwa Compound, near Kana Masjid, Iddya, Surathkal, Mangaluru 575014, India. Contact for privacy questions: ashitoshkamble2810@gmail.com. Website: https://ludo.dealcoast.in. Grievance officer and data protection contact: Kamble Ashitosh Vinod, ashitoshkamble2810@gmail.com.

2. Short version

Offline play (against the computer, or with friends on one device) works without an account. Your data stays on your device and we receive nothing.
Online play (quick match, private rooms, friends, clubs, tournaments, leaderboards, chat) needs an account on our server. You can use a guest account (display name only) or an account with an email address and password, or Google sign-in. If you use email or Google, we receive and store your email address.
The app also stores a random device id and a device secret, your game progress and results, your friends, your club, your friend messages, and reports you file.
The app does not use an analytics or crash-reporting service. Usage events and error logs stay on your device unless you share a log yourself.
The app contains Google's advertising (AdMob) and Google Play billing software. This version shows optional rewarded ads (section 3.5).
You can export your online data and permanently delete your online account inside the app (Settings, Account). There is also a web page for deletion requests.

3. Data we process

3.1 Stored only on your device

Saved in the app's private storage. We never receive it unless a later section says it is sent.

Display name and avatar choice.
Progress: XP, level, coins, gems, missions, daily rewards, achievements, season and ranked progress, cosmetics owned, match history, and offline club and tournament data.
Settings: language, theme, text size, contrast, haptics, sound, notification and friend-request preferences, chat and emote muting, quick-chat-only, analytics opt-out.
Age group: the band you pick on first launch (under 13, 13 to 17, 18 or older, or prefer not to say). Only the band is stored, never a birth date. It is not sent to our server.
Store data: items you own, ad counters, and records of your purchases and gift codes (product, purchase token, order state). Purchase tokens and gift-code details are sent to our server only when you use gift vouchers (section 3.2).
A random device id and a device secret, created on first online use. The device secret proves that this phone owns the guest account. It is kept in the Android Keystore where the phone supports it (otherwise in private app storage) and is excluded from backups.
Signed-in session: if you use an email or Google account, the session token, your account id and your device secret are kept in the Keystore (or private app storage if the Keystore fails) so you stay signed in. The app also keeps your email address, whether it is verified, and whether Google is linked, in private app storage.
Blocked-player list, a queue of reports not yet delivered (it can contain the reported chat text), and a cache of the game settings downloaded from our server.
Diagnostics log: the last 60 technical problems (error type, a short message with tokens, passwords and secrets removed, a short stack trace, the time). The removal is pattern based and may miss other text such as an email address that appears inside an error message. It stays on your device. We receive it only if you open Settings, Diagnostics, choose Share or Copy and send it yourself. You can clear it at any time.
Usage events (for example "match started") go into a memory buffer of up to 500 entries, are lost when the app closes, and are not written to storage or sent anywhere. You can switch them off in Settings. Debug builds also print them to the developer log. If we add an analytics provider we will update this policy before shipping it.

3.2 Sent to and stored on our server (online play)

Display name (2 to 20 letters, digits, space, underscore or hyphen). Other players can see it in friend search, rooms, clubs, tournaments and leaderboards. Do not use your real name if you do not want it shown.
Device id (random 24-character value made by the app). It identifies your account on this phone. It is not your Android advertising ID or a hardware id.
Device secret: the server stores only a SHA-256 hash of it.
Email address, if you create an email account: stored in lower case with a hash of your password (PBKDF2-HMAC-SHA512, never the password itself), whether you verified the email, and the time of creation and last password change. We use it to sign you in, to send verification and password-reset emails, and to tell you apart from other accounts. Reset and verification tokens are stored only as hashes.
Google sign-in: if you sign in with Google or link Google, the app sends Google's ID token to our server. We verify it and store your Google account identifier (the subject) and the email address Google reports. We never receive your Google password. Google processes the sign-in itself under its own privacy policy.
Country code (2 letters) taken from your phone's language and region setting, not from GPS. Used for country leaderboards.
Account id, role, creation time, and a last-seen time (updated at most every 30 minutes while you are signed in). The last-seen time is used only to decide when an unused guest account can be removed. It is not shown to other players and not included in your export.
Game stats calculated by the server: XP, coins, gems, rating, wins, matches played. Rating and name appear on leaderboards.
Match records and results: room code, mode, number of players, start and end time, winner; per player: placement, XP and coins awarded, rating before and after. Tournament entries, brackets and prizes.
Friends, friend requests and your friend-request preference; your block list. Blocking removes any friendship and pending requests.
Clubs: membership, your XP contributions, any removal from a club, and clubs you created (club name and description are visible to others).
Direct messages between accepted friends: the server stores message text, sender, recipient, time and whether it was read (up to 200 messages per pair, older ones are deleted). Messages are not encrypted end to end. They are not served once either friend blocks the other or the friendship ends, but they are kept so they can still be reported.
Gift vouchers: if you buy a gift in the Store, the app sends the Google Play purchase token and product id to our server, which stores the token, the voucher code, the product, who issued it, when it expires and who redeemed it. If server-side purchase checking is switched on, our server sends the token to the Google Play Developer API to confirm the purchase. Purchase checking with Google is not switched on at launch.
Reports you send (see 3.3). Bans and chat mutes applied by moderators or by an automatic rule, with reason, time, expiry and who applied them. An audit entry (who, what action, which account id) is written for each admin and automatic moderation action.
Push notification tokens: this version of the app does not register a push token and does not contain Firebase. The server has an optional push feature that is switched off. If it is ever switched on and an app version registers, we would store the token and send notifications through Google Firebase Cloud Messaging, and we would update this policy first.
Game settings request: the app fetches the public game configuration (balance values, maintenance notice, minimum app version) from our server. The request carries no account data, but any request reveals your IP address to the server.
Technical data: your IP address is used by the server for rate limiting (in memory) and appears in server log lines for rejected admin access and for admin actions. Hosting or proxy logs may also contain IP addresses and request paths. Our hosting provider keeps these logs for a limited time under its own settings. We do not use them for advertising or profiling.
Developer server address: the app has a hidden developer setting for pointing it at a different server. If someone sets it, the app sends everything in this section to that server instead of ours. We do not operate or control such servers.

We do not collect: phone number, real name, contacts, photos, files, microphone, camera, GPS location or payment card details. We do not send your advertising ID to our server.

3.3 Chat, emotes and reports

Text chat exists in private rooms (rooms created with a code), in club chat and between friends (direct messages). There is no text chat in public quick-match games. Quick chat phrases and emotes are short preset reactions.
Messages are limited to 200 characters, rate limited, passed through a word filter, and not delivered to players who blocked the sender. You can also mute chat in Settings. Players who chose the under-13 or prefer-not-to-say age group get quick chat phrases only in the app. This is a setting in the app, not a check made by our server.
Room and club chat messages are kept only in the server's memory (last 50 messages per room or club) and are dropped when the room is cleaned up or the server restarts. They are not written to the database. Direct messages are stored (see 3.2).
If you report a player and attach a chat message (room, club or direct message), the server saves a copy of that message text, your report reason (3 to 500 characters), optional context you provide (up to 500 characters), your account id and the reported account id, so moderators can review it.
Moderators and the people who run the server can read reports, the message copies in them, and, with database access, any stored data including email addresses and direct messages. Only the publisher can reach the database and the moderation tools, and access needs a secret key.

3.4 Moderation and safety data

Reports, bans and chat mutes are kept for safety review. Account ids, not names, are what the audit trail records.
Rewards are capped for repeated matches between the same accounts, and rate limits apply to sign-in, search, invites, chat and game actions. These use account ids and IP addresses.

3.5 Ads and purchases

The app includes Google Mobile Ads (AdMob) and the Google Play billing library. They are part of the app even when ads are off.
This version shows optional rewarded ads through Google AdMob. Ads are never shown during a match, and never to players who say they are under 13 or who prefer not to give their age.
Rewarded ads (optional, shown only if you choose to watch one, never during a match) are served by Google AdMob. AdMob may collect your advertising ID, device and app information and IP address under Google's own privacy policy. The app asks Google's consent form where required and uses non-personalised ad requests for teens and while the app is in its conservative mode. We do not receive what Google collects.
In-app purchases are processed by Google Play. We do not receive your card details. Purchases are recorded on your device. Purchase tokens go to our server only for gift vouchers (section 3.2). Purchases of coins and items are not checked by our server. The products are coin packs, a starter bundle, a season pass and a one-time ad-free purchase.

4. Why we use data

Run the game: accounts, sign-in, matchmaking, rooms, turn handling, rewards, ratings, leaderboards, tournaments, clubs, gifts.
Account services: email verification, password reset, account security.
Social features: friends, invites, chat, blocking.
Safety: reports, moderation, mutes, bans, rate limiting, abuse prevention.
Security and reliability of the service.
Remote settings: balance values, maintenance notice, minimum supported app version.
Ads and purchases, where enabled: showing rewarded ads you choose to watch, delivering what you buy, issuing and redeeming gifts.

We do not sell your data. We do not use it for profiling. Where the law requires a legal basis, we rely on: running the game and your account (contract); keeping players safe and the service secure (legitimate interests); and showing ads where required (your consent).

Hosting: the server and database run at Render (application server) and Supabase (database), both in Singapore. The provider processes data on our behalf.
Email delivery: verification and password-reset emails go through an email delivery service that we choose, which sees the recipient address and message.
Google sign-in: if you use it, Google handles the sign-in. We receive the data in section 3.2.
Google Play: purchases are handled by Google Play. If purchase checking is on, our server also calls the Google Play Developer API with the purchase token.
Ads: where ads are on, Google AdMob receives device and ad data as described in section 3.5.
Push: not used in this version. If switched on later, Google Firebase Cloud Messaging would receive the push token and a short notification payload.
Other players can see: your display name, rating, country (on leaderboards), online status (to friends), your club, club name and description, and your in-room chat, club chat and emotes. Friends can read your direct messages to them.
Share sheet: if you tap Share (result card, Export my data, or a diagnostics log), the app hands a picture or text to the Android share sheet. You choose the destination. We do not receive it.
Legal: we may disclose data if required by law or to protect users.
We do not share personal data with data brokers.

6. Retention

Local data on your device: until you clear app storage, delete your account in the app, or uninstall.
The server has an automatic clean-up job with the periods below. These apply only while the job is switched on in live mode. A new install of the server starts it in count-only (dry-run) mode, which deletes nothing. The 14-day match-queue and 30-day tournament items below run on their own schedule and do not depend on that job. At launch the job runs in count-only mode. We will switch it to live mode after checking it on real data, and until then data stays until you delete your account.
Password-reset and email-verification tokens: 7 days after they expire or are used.
Gift vouchers never redeemed: 90 days after they expire. Redeemed vouchers stay, without your id after you delete your account.
Direct messages: 90 days. A message that an open report points at, and messages from a player who is currently banned or muted, are kept longer.
Room and club chat: server memory only (last 50 per room or club, lost on restart), and older than 30 days is dropped.
Resolved or dismissed reports: 180 days after they are closed. Open reports are kept.
Match results and match records: 365 days, but never those inside the current season or the last 8 days. Your rating, wins, XP and leaderboard standing are stored on your account and kept until you delete it.
Processed match-result queue entries: 14 days.
Tournaments that finished or were cancelled: 30 days.
Guest accounts that never played and have no email or Google sign-in: 365 days after last activity.
Admin and moderation audit entries: 365 days.
Accounts with an email address or Google sign-in, bans, and club contributions: kept until you delete the account (no inactivity deletion).
Server and proxy logs: kept for a limited time by our hosting provider under its own settings; they can hold IP addresses and account ids.
Backups: our database provider may keep automatic backups under its own schedule. Data you delete can remain in a backup until that backup expires.

7. Security

Signed access tokens (JWT, HMAC-SHA256) with a 30-day lifetime, renewed with the device secret. Banned or deleted players are rejected on every request. A password change or reset ends older sessions.
Passwords are hashed (PBKDF2-HMAC-SHA512) and never stored or logged in clear. Reset and verification tokens are random, stored as hashes, single use and expire. Sign-in and password-reset answers do not reveal whether an email is registered, except that sign-up says when an email is already taken.
The device secret is stored on the server only as a hash and compared in constant time. Knowing a device id alone does not give access to an account.
Rate limits on sign-in, API calls, friend requests, search, invites, chat and game actions; request size limits. Repeated failed sign-ins lock an email for a while.
The server decides dice rolls, turns and results, so clients cannot set their own rewards.
Input sanitising for names and chat; generic error responses; security headers; HTTPS required in production. Release builds of the app block plain-HTTP traffic and trust only the system certificate store.
Admin actions are written to an audit log; admin access needs a key.
On the device the device secret and session are in the Android Keystore where available, and cloud and device-to-device backup of app data is disabled.

Known limits: access tokens cannot be revoked individually before they expire (they stop working at once when the account is deleted or banned, or the password changes); on a phone without a working Keystore the app falls back to private app storage; if the device secret is lost (for example by clearing app data) a guest account cannot be recovered, so secure it with email or Google if you want to keep it; deleting an account needs only a valid sign-in, not the password again; direct messages are stored readable by the server; no system is perfectly secure.

8. Children

Ludo Titans is a general-audience board game. On first launch it asks for an age group (under 13, 13 to 17, 18 or older, or prefer not to say) and offers no preselected answer. Only the group is stored, on the device.
Under 13 and prefer not to say: no ads are requested and no ad consent form is shown, and the app switches to quick chat phrases only, in room, club and friend chat. A player can switch this off again in Settings.
13 to 17: ads, if enabled, only after consent and always non-personalised.
18 or older: ads, if enabled, only after consent.
Until an age group is chosen, no ads are requested.
The age group does not stop anyone from creating an online account. The server does not know it. A player under 13 can still pick a display name, search for players, play with strangers in quick match and use clubs. Club names and descriptions remain free text. Ludo Titans can be played by people of all ages. If you are under 13 (or the age set by the law where you live), ask a parent or guardian before using the online features. A parent or guardian can email us to have a child's account deleted. Guest play needs only a nickname, and we show no ads to players who say they are under 13.
If you believe a child has given us data, contact ashitoshkamble2810@gmail.com and we will delete it.

9. Your rights and choices

Offline data: clear app storage or uninstall.
Display name and settings: change them in the app. The display name is sent to the server when you change it online.
Friend requests: switch off in Settings. Block and report players from friends, rooms and the report sheet.
Analytics events: switch off in Settings, Account. They are never sent anywhere.
Ads: change the age group and review ad choices in Settings, Ads and privacy (where ads are on).
Notifications: the app shows an in-app inbox only. It does not send push notifications.
Access and export: Settings, Account, Export my data downloads a JSON file with your profile, device id, stats, match results and matches, friends and requests, blocks, club membership and contributions, reports you filed and reports about you, bans, direct messages you sent and received, gift vouchers you issued or redeemed (with purchase tokens), your email and Google login records, how many push devices are registered, and any of your room or club chat still in server memory. Not included: password hash, device secret hash, reset tokens, tournament entries, last-seen time and admin audit entries that mention your account id.
Deletion: Settings, Account, Delete my account permanently deletes your online account and the progress on this device after you type a confirmation word. It removes your account, email and password hash, Google link, stats, match results, friends, requests, blocks, direct messages, club membership and contributions, tournament entries, vouchers you issued, push tokens, bans and reports about you, and ends your sessions immediately. If you lead a club, leadership passes to its longest-standing member, or the club is dissolved if you were the last member.
What deletion does not remove: reports you filed about other players stay for moderation but are made anonymous; vouchers you redeemed stay as records without your id; match records keep room code, mode and times (their winner link to you is cleared), and other players' results from the same matches stay; audit entries and queue rows that mention your account id stay until their retention period ends (section 6); logs and backups (section 6); data we must keep by law.
If you cannot use the app: email ashitoshkamble2810@gmail.com and we will delete your account or send a copy within 30 days after confirming it is yours (we may ask you to write from the email address on the account, or to send the account id shown in Profile). The public page for deletion requests is at https://ludo.dealcoast.in/delete-account.html.
Depending on where you live you may have rights to access, correct, delete, restrict, object, port, withdraw consent and complain to a regulator. To use these rights, email us at the address above. We will answer within the time the law requires.

10. International transfers

Our server is hosted in Singapore. Google services used by the app (sign-in, billing, and ads where on) process data in countries chosen by Google. Your data may be processed in countries other than yours. Our providers apply their own safeguards for transfers.

11. Third parties and software components

The app contains: Flutter, http, signalr_netcore (connection to our server), shared_preferences (local storage), flutter_secure_storage (Android Keystore), connectivity_plus (reads whether the phone has a network; sends nothing), url_launcher (opens the store page when an update is required), share_plus (system share sheet), audioplayers (local sound), google_sign_in (Google sign-in, section 3.2), google_mobile_ads (Google AdMob, section 3.5) and in_app_purchase (Google Play billing, section 3.5). Google AdMob collects crash and diagnostic data for itself (section 3.5). No other analytics, crash-reporting or push (Firebase) service is included.

12. Changes

We will post changes here and update the date. For material changes we will tell you in the app.

13. Contact

Kamble Ashitosh Vinod, Safa Marwa Compound, near Kana Masjid, Iddya, Surathkal, Mangaluru 575014, India. Email: ashitoshkamble2810@gmail.com. Web: https://ludo.dealcoast.in. Grievance officer: Kamble Ashitosh Vinod (same address and email).

Back to the home page