Last updated August 13, 2026

Privacy policy

This policy describes the current internal TestFlight beta of ThatBoundGame. The service collects the limited account and gameplay data needed to authenticate players, run authoritative multiplayer matches and keep results consistent. It does not use advertising or cross-app tracking.

Who operates this beta

ThatBoundGame is operated by the Apple developer account publishing this TestFlight build (“we,” “us,” or “the operator”). During the internal beta, contact is provided through Apple's TestFlight feedback channel described on the Support page. A separate verified product mailbox may be published before external review.

Data we collect

Account and contact data

Username, required email address, internal account identifier, account creation/update times, and a one-way BCrypt password hash. The server does not store your plaintext password.

Authentication and security data

Opaque session-token digests, expiry/revocation times, connection state, security rate-limit values and limited request metadata such as IP address, route, time and result where needed to protect and operate the service. The opaque session token is stored in the iOS Keychain on your device and is not stored in plaintext on the server.

Rooms and gameplay

Room names and membership, team/readiness choices, selected mobile, bounded commands, server timestamps, wind and random state, positions, terrain, projectile events, damage, match outcome, reconnect state and integrity hashes. A private room password is one-way hashed; plaintext is not retained.

Progress and economy

Gold, GP, games played, wins, losses, match settlements and ledger entries. These values are calculated and stored by the server.

Feedback you choose to send

TestFlight feedback, descriptions and screenshots are handled through Apple when you submit them. Do not include passwords, session tokens or unnecessary personal information.

How we use data

• Register, authenticate and secure your account.
• Create rooms, connect players and resolve authoritative matches.
• Restore state after a disconnect and prevent duplicate commands or rewards.
• Calculate results, Gold, GP and integrity-preserving ledgers.
• Detect abuse, investigate defects, maintain availability and recover from failures.
• Respond to beta, privacy and account-access feedback.

Tracking, ads, cookies and analytics

ThatBoundGame does not include advertising SDKs, cross-app tracking, third-party analytics or behavioral profiling. This static website sets no cookies and loads no third-party scripts, fonts or pixels. The app's privacy manifest declares no tracking.

Disclosure and processors

We do not sell account or gameplay data and do not disclose it for advertising. The beta uses product-isolated application and PostgreSQL resources on operator-managed infrastructure. Apple processes TestFlight distribution and feedback under its own terms. Data may also be disclosed when required by law, to protect users and the service, or to investigate abuse.

Visibility to other players

Your username, room presence, selected mobile, team/readiness state, gameplay actions and match result can be visible to players in the same lobby, room or match. Your email address, password hash, session token and private-room password are not sent to other players.

Retention

• Active account and session data is retained while needed to provide and secure the beta. Login rotates the account's active session; logout and deletion revoke it.
• Authoritative commands, snapshots, results and economy ledgers are retained to preserve multiplayer integrity and diagnose beta defects. Full match snapshots are bounded by the server's retention policy.
• Transient rate-limit entries expire in process. Operational journal retention is set and reviewed on the staging host; logs must not contain passwords, bearer tokens, email request bodies or gameplay payloads.
• Encrypted database backups follow a seven-daily, four-weekly and six-monthly rotation. A deleted account's pre-deletion data can therefore remain only in restricted recovery copies for up to six months.

Account deletion

Use the signed-in app's Delete Account action. It revokes sessions, releases username/email and irreversibly tombstones the account while retaining only unlinkable records needed for completed match and economy integrity. An active match is first resolved as a deterministic forfeit. Read the complete account deletion explanation.

Security

Mobile traffic must use authenticated HTTPS/WSS outside simulator-only localhost development. Passwords are one-way hashed, session tokens are random and stored only as digests on the server, the app stores its token in Keychain, the API binds to loopback behind TLS, and staging backups are encrypted and access restricted. No system can be guaranteed perfectly secure.

Your choices and questions

You can stop using the beta, log out, or delete your account in the app. To ask for access, correction or another privacy action during internal testing, use the TestFlight feedback instructions and begin the message with “Privacy request.” We may need to verify control of the relevant account.

Policy changes

We may update this policy as the beta changes. The page's updated date will change when processing or retention materially changes. App Store privacy answers and the app privacy manifest must remain consistent with the released build and backend.