Privacy Policy

Last updated: 2 September 2026

Gomoku - Caro is made by an independent developer, so this policy is written to be read. It explains what the app collects, what it does not, and how to delete your data. It is dated 2 September 2026 and will be amended, with a new date, whenever the app starts doing something different. Questions go to contact@gomoku.com.

The short version

• No account is required: you are signed in anonymously and can play right away.
• No ads, no tracking, no in-app purchases, no push notifications.
• Match history and replays, daily-puzzle progress and streaks, and settings stay on your device.
• Online play sends only your moves, a fixed set of emoji reactions, invitations and room codes, and your nickname. The game server stores your player code, rating and match results.

What the app collects

Sign-in (Firebase Authentication)

On first launch the app creates an anonymous account through Firebase Authentication: a random identifier with no name, email or phone number attached, which the game server uses to tell players apart.

You can optionally link a Google or Apple account in Settings → Account so your player code and Elo rating survive a new phone or a reinstall. When you link, the provider's identifier (and, for Google, the account's email address) goes to Firebase Authentication only; the game server keeps seeing the same anonymous identifier.

Nickname

You choose a nickname; the default is "Player" ("Người chơi" in Vietnamese). It is shown to opponents and stored with your match results on the game server, so keep personal information out of it.

Online play

Online play connects to the game server operated by the developer. The app sends:

• your moves;
• reactions chosen from six fixed emoji — there is no free-text chat;
• invitations and room codes — the server gives you a code such as NANG-3184 that friends use to invite you;
• draw offers, undo requests and resignations;
• your nickname.

The server is authoritative: it checks every move and decides every result. It keeps your player code, your Elo rating, which starts at 1200, and your match results.

Stored on your device only

Match history and move-by-move replays, daily-puzzle progress and streaks, the friend codes you have added, and all settings live on your phone and are never uploaded. Uninstalling the app deletes them.

Analytics

The Firebase Analytics SDK is included because it ships alongside Firebase Authentication, but it currently records no events — no screen views, no gameplay statistics, nothing. If that ever changes, this policy will be updated first.

iOS: App Tracking Transparency

On iOS the app shows Apple's App Tracking Transparency prompt once. Its purpose string mentions understanding how the game is played and showing relevant ads; that describes possible future uses, not current ones. Today there is no cross-app tracking and there are no ads. Choosing "Ask App Not to Track" changes nothing, and choosing "Allow" enables nothing.

Android permissions

The app requests a single permission, INTERNET, for online play and sign-in. It does not ask for storage, camera, microphone, location or contacts.

What the app does not do

• It does not sell your data or share it for advertising.
• It shows no ads and contains no ad networks.
• It does not read your contacts, photos, location, clipboard or files.
• It sends no push notifications.

Third parties

• Firebase (Google LLC) provides authentication; its analytics SDK is present but inactive. See Google's privacy policy.
• Google Sign-In and Sign in with Apple are used only if you choose to link an account, and only while linking.
• The game server is run by the developer, not a third party.

Children

The app has no chat, no ads and no purchases, and collects nothing beyond an anonymous identifier and a nickname. It does not knowingly collect personal information from anyone; if a child has put personal details in a nickname, email the address below and it will be removed.

Retention and deletion

Your player code, rating and match results stay on the game server for as long as the online service runs. To delete them, email contact@gomoku.com — from the address you linked, or with your nickname and roughly when you last played. Requests are handled within 30 days, and the Firebase Authentication account is deleted with the data. Everything on your device is removed by uninstalling the app.

Changes

This policy is dated and will be updated whenever the app's behaviour changes — for example, if analytics is ever switched on. Material changes are also noted in the release notes. Continuing to use the app after a change means you accept it.

Contact

Questions, corrections and deletion requests: contact@gomoku.com.