In short
- Who we are: Business Safety Coaching International Sp. z o.o. (Tychy, Poland) is the data controller. For anything, write to info@bsci.coach.
- What we use: the account you sign in with (Google, or email and password, handled by Google's Firebase), your game profile (public name, trophies, currencies, pieces, missions, Pass), match outcomes, reports and blocks, and the technical data needed for the connection.
- What other players see: your public name, your trophies, the robot you drew, its name and your Portrait, during a match. Our server forwards these drawings to your opponent but does not keep them: they stay on your phone.
- What we don't do: no ads, no third-party analytics, no tracking across apps or websites, no selling of data. The only outside service in the app is Google and Firebase sign-in.
- Where: the game server and database run on Amazon Web Services in Frankfurt (EU). Firebase sign-in may involve a transfer to the United States, with the safeguards the GDPR requires.
- How long: your profile for as long as you have an account; matches 90 days; reports one year; technical logs are overwritten in rotation.
- You can delete your account in the app (Settings → Delete account) or by email. You have the GDPR rights and can complain to the Polish supervisory authority (UODO) or to the one in your country.
- Age: the game is for people aged 13 and over; below the age of digital consent in your country a parent's consent is needed.
1. Data controller
Business Safety Coaching International Sp. z o.o.Romana Dmowskiego 22/112, 43-100 Tychy, Poland
NIP (tax ID): PL6463026358
Email: info@bsci.coach
This policy covers the Bot Rivals game for iOS and Android, the game's online server and this website (botrivals.app). For any question about your data, or to exercise your rights, write to the address above.
2. What data we process
2.1 Account and sign-in
Playing online requires an account. Sign-in is handled by Firebase Authentication, a Google service. You can sign in in two ways:
- With Google: Google's sign-in page opens. Google gives Firebase your Google account identifier, your email address and, if present, your Google profile name and photo.
- With email and password: the app sends your email and password straight to Firebase, which stores the password only in protected (hashed) form. Firebase also sends the address verification and password reset emails.
Our game server receives from Firebase only a signed sign-in token, from which it reads the account identifier (uid) and the sign-in method. The name, email and photo of your Google or email account are neither read nor stored by our server, and they never become your name in the game.
After sign-in the server gives you a session (a signed code valid for 30 days, renewed while you play), stored on your phone.
2.2 Game profile
On our server we keep, linked to your uid:
- your public name: at first a generated name (for example "PILOT 1234", derived from the uid and revealing nothing about your account), then the one you choose;
- trophies, trophy record, wins, losses and number of duels;
- game currencies (Coins, Blueprints, Crystals), pieces, materials, weapons with their levels and copies, toolboxes waiting to be opened and the toolbox pity counters;
- the Pass (season, level, points, rewards claimed), missions, achievements, league road rewards, rewarded practice and tutorial counters;
- the list of players you have blocked (500 at most) and the daily count of reports you have sent.
2.3 Matches
The server runs every duel: it receives the commands you give during the match, simulates the duel and works out the result. For each match it keeps a record with: the match identifier, the uids of the two players, the winner, the reason the match ended and its length. It is used to work out rewards, to link a report to the right match and to prevent abuse.
To play, the app also sends the server your robot drawing (strokes, materials, fitted pieces and levels), the robot's name and your drawn Portrait. The server uses them for the match and forwards them to your opponent, but does not store them: once the match is over they are no longer on the server.
2.4 Reports and blocks
When you report a player we record: who reports (uid), who is reported (uid), the match, the reason chosen (offensive drawing, offensive name, cheating, other) and the date. The report is also written to the server log. When you block a player, their uid goes into your block list and the two of you are never matched again.
2.5 Technical data
- IP address: needed to connect you to the server and, in memory only, to limit the number of requests from the same address (abuse protection). The game server does not write it to its logs; the HTTPS proxy in front of the server does not keep access logs, but its technical error messages may occasionally contain an IP address.
- Server logs: technical messages with uids, the public names of the players in a duel, reports and errors. They are used to run the service, fix problems and for moderation.
- Revoked sessions: when you sign out or delete your account, we record that the sessions issued up to that moment are no longer valid.
2.6 Messages to us
If you write to us we process your email address, the content of your message and any details you give us so we can help (for example your in-game name).
2.7 This website
botrivals.app is a static website: it uses no cookies, external scripts, analytics or tracking. The hosting provider processes the minimum technical data needed to deliver the pages (for example the IP address in the request).
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your account, signing you in | Account, session | Performance of a contract (Art. 6(1)(b)) |
| Running the game: profile, economy, duels, matchmaking, rewards, Pass, missions | Profile, matches, drawings during the match | Performance of a contract (Art. 6(1)(b)) |
| Showing your name, robot and Portrait to your opponent | Public name, trophies, drawings | Performance of a contract (Art. 6(1)(b)): it is the core of the multiplayer game |
| Moderation: reports, blocks, sanctions, protecting other players | Reports, blocks, matches, logs | Legitimate interest in a safe and fair environment (Art. 6(1)(f)) and legal obligations on illegal content (Art. 6(1)(c)) |
| Security, preventing cheating and abuse, request limits | IP (in memory), matches, logs | Legitimate interest (Art. 6(1)(f)) |
| Support and answering requests | Email and messages | Performance of a contract (Art. 6(1)(b)) and legal obligation for data rights requests (Art. 6(1)(c)) |
| Purchases, once available | Transaction data | Performance of a contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)) |
We do not use your data for advertising, commercial profiling or marketing, and we do not sell it. Where we rely on legitimate interest you can object (section 10).
Account data is necessary to play online: without an account only offline practice with an already saved profile is available.
4. Data other players can see
During an online duel your opponent sees: your public name, your trophies, the robot you drew and its name, and your Portrait. They never see your email or your Google account name. Choose a public name that does not reveal your real identity, and do not put personal details in your Portrait (for example your full name or a recognisable drawing of your face).
5. Providers and recipients
- Google (Firebase Authentication and Google sign-in): handles accounts and sign-in on our behalf. The service is provided by Google LLC and/or Google Ireland Limited under the Firebase data processing terms. Today sign-in uses a Firebase project that Bot Rivals shares with Fleet Rivals, another app from the same publisher; it will move to a project dedicated to Bot Rivals in the future.
- Amazon Web Services (Amazon Web Services EMEA SARL): hosts the game server (Amazon EC2) and the database (Amazon DynamoDB) in the eu-central-1 (Frankfurt) region, as our processor.
- Apple and Google (App Store and Google Play): distribute the app and, once available, will handle payments. For this processing they act as independent controllers under their own privacy policies.
- Other players: the data in section 4.
- Authorities: only where the law requires it, for example following a reasoned request from a judicial authority.
The app contains no advertising, analytics, crash reporting or social network SDKs.
6. Transfers outside the EU
The game's server and database are in the European Union (Frankfurt). Sign-in data handled by Firebase may also be processed by Google in the United States. In that case the transfer relies on the EU-U.S. Data Privacy Framework adequacy decision, in which Google LLC participates, or on the European Commission's standard contractual clauses. AWS may access data from outside the EU only under the same safeguards. You can ask us for a copy of the safeguards at info@bsci.coach.
7. How long we keep data
| Data | Period |
|---|---|
| Game profile, public name, block list | For as long as you have an account. Deleted when you delete your account. |
| Backups of the profiles database | Point-in-time recovery covers at most the last 35 days: after deletion, the profile also leaves these backups within 35 days. |
| Match records | 90 days, then deleted automatically. If you delete your account, your uid in the records is replaced with "deleted". |
| Reports | 1 year from the report, then deleted automatically (see below for account deletion). |
| Session revocations (sign-out or deletion) | 31 days. |
| Session on the server | Not stored: it is a signed code, valid for at most 30 days from its last renewal. |
| Robot drawing and Portrait on the server | Only for the length of the match, in memory. |
| IP address for request limits | Only in the server's memory, never written to disk; cleared when the server restarts (at every update) or when the table fills up. |
| Server logs | At most 5 files of 20 MB: the oldest are overwritten in rotation, usually within a few weeks depending on traffic. |
| Firebase account (email, sign-in method) | Until you ask us to delete it (section 11). |
| Emails to support | As long as needed to handle the request and then at most 24 months, unless needed longer to establish or defend a legal claim. |
| Purchase data (in future) | For the periods required by tax and accounting law. |
8. Data stored on your phone
The app stores on your phone, without sending them to anyone except as described above: your robots, your Portrait, your name, your settings (language, audio, controls), your session, a random app identifier created at first launch and a small local diagnostics file (1 MB at most) that is never sent. The phone also remembers an anonymous code for players you have reported or blocked, so their drawings are no longer shown to you. Uninstalling the app deletes this data.
9. Minors
Bot Rivals is not an app for children. You may use it only if you are at least 13 years old. If you are under the age at which your country lets you consent to online services on your own (for example 14 in Italy, 16 in Poland and Germany), you may use Bot Rivals only with the consent and supervision of a parent or guardian. If we learn that an account belongs to someone under 13, or to a minor without the necessary consent, we delete it. A parent can write to us at info@bsci.coach.
10. Your rights
Under the GDPR (Articles 15 to 22) you have the right to:
- know whether we process your data and get a copy of it (access);
- correct inaccurate data (you can change your public name yourself in the app);
- have your data erased;
- ask for processing to be restricted;
- receive your profile data in a structured, machine-readable format (portability);
- object to processing based on legitimate interest, on grounds relating to your particular situation.
Write to info@bsci.coach. To protect your account we may ask you to write from the email address linked to the account, or to give us details that let us recognise it (for example your public name and sign-in method). We answer within one month; for complex requests this can be extended by two further months, and we will tell you if so.
11. Deleting your account
You can delete your account in the app: Settings → ACCOUNT → Delete account (two confirmations; you need a connection and must not be in a duel). Full instructions are on the Delete your account page.
What happens:
- all your sessions stop working;
- your profile, public name, trophies, currencies, pieces and block list are deleted from the server;
- in match records and in the reports you made, your uid is replaced with "deleted";
- reports received from other players stay until they expire (one year), but instead of your uid they carry an opaque code that does not identify you directly. The same account always produces the same code: this keeps the moderation history if the account comes back. Basis: legitimate interest in the safety of other players;
- your session, robots, Portrait and name are deleted from the phone.
Your Firebase sign-in account (email and sign-in method) is not deleted by this button, because the Firebase project is currently shared with Fleet Rivals and deleting it would also remove your access to that app. If you want us to delete it as well, write to info@bsci.coach and we will do so within one month. Signing in again with the same Google account or email starts from an empty profile.
12. Automated decisions
The server automatically decides the outcome of duels, rewards, matchmaking (based on trophies and blocks) and the contents of toolboxes, according to the rules of the game. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Suspensions and bans for breaking the rules are decided by a person after reviewing the case.
13. Security
- All communication between the app and the server is encrypted (HTTPS and secure WebSocket).
- The database is encrypted at rest; access is limited to the game server.
- We never see or store your password: Firebase handles it.
- The server is authoritative: duel outcomes, rewards and toolboxes are worked out on the server, not on the phone.
- Signed, revocable sessions; limits on the number of requests.
If we become aware of a data breach that puts you at risk, we notify the competent authority and, where the law requires it, you as well.
14. Purchases (once available)
Today nothing in Bot Rivals can be bought with real money. Once Crystals can be purchased, payment will go through the App Store or Google Play: we will not receive your card or payment method details. We will receive transaction information from the store (product, purchase identifier, date, status and refunds) to deliver your purchases and to meet legal obligations. We will update this policy before purchases are switched on.
15. Cookies and tracking
This website uses no cookies or similar technologies. The app uses no advertising identifiers and does not track you across other companies' apps or websites. During Google sign-in a Google window or page opens, which may use Google's own cookies under Google's privacy policy. On devices without the system sign-in window, Google sign-in goes through a page on our server that loads Google's Firebase library.
16. Complaints to an authority
If you believe we process your data in breach of the GDPR, you can lodge a complaint with a supervisory authority. Our lead authority is the Polish one:
Prezes Urzędu Ochrony Danych Osobowych (UODO)ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl
You can also contact the authority of the country where you live or work, or where the alleged breach took place; in Italy, for example, the Garante per la protezione dei dati personali (garanteprivacy.it). We do encourage you to write to us first: we can often sort things out straight away.
17. Changes
We may update this policy, for example when we add features (such as purchases) or change providers (such as the dedicated Firebase project). The date and version at the top of the page show the latest change. We will tell you about important changes in the app before they apply.