Privacy Policy — Bellis
Last updated: [EFFECTIVE DATE]
This Privacy Policy explains how [DEVELOPER / COMPANY NAME] (“we”, “us”) handles information when you use the Bellis web game at [WEBSITE URL] (the “Service”). By using the Service you agree to this Policy.
1. Who is responsible
The data controller for the Service is:
[DEVELOPER / COMPANY NAME]
[POSTAL ADDRESS]
Email: [CONTACT EMAIL]
2. What we collect, and why
a) Information you choose to give us
| Data | When | Why |
|---|---|---|
| Email address | If you sign up to be notified about the physical board / pre-orders | To email you about availability. Optional. |
| Review: a star rating (1–5), a display name, and review text | If you submit a review | To show community reviews. Reviews and the name you enter are publicly visible. Optional. |
Please don’t put personal information you don’t want public into a review or the name field.
b) Information collected automatically (analytics)
We use Google Analytics (Firebase) to understand how the Service is used. This may include: pages/screens viewed, approximate location (derived from IP address, not precise GPS), device and browser type, referring website, and interaction events (for example, that a pre-order email or a review was submitted). Google Analytics sets cookies / uses similar identifiers for this purpose.
c) Online play (peer-to-peer)
Online games use WebRTC via PeerJS to connect two players directly. To establish a direct connection, your device’s IP address may be shared with the other player and with the connection-brokering/“STUN” servers involved. Game moves are sent directly between the two players and are not stored by us.
d) Stored on your device only
We keep small preferences in your browser’s local storage (e.g. chosen language, light/dark theme, dots/numbers setting, and whether you’ve already seen the pre-order prompt). This data stays on your device and is not sent to us.
3. What we do not collect on the web
The website has no user accounts and no login. It does not collect a name (other than one you type into a review), does not track a ranked ELO rating, and does not sell your data.
4. Legal bases (GDPR)
- Consent — for the pre-order email, for submitting a review, and for analytics cookies/identifiers where consent is required. You can withdraw consent at any time.
- Legitimate interests — operating and securing the Service, and measuring aggregate usage.
- Performance of a request you make — e.g. connecting you to another player when you start an online game.
5. Sharing and processors
We don’t sell your personal data. We use the following service providers, who process data on our behalf or as part of delivering the Service:
| Provider | Purpose |
|---|---|
| Google / Firebase (Cloud Firestore, Google Analytics) | Stores pre-order emails and reviews; usage analytics |
| Cloudflare | Website hosting / content delivery |
| PeerJS (connection broker) and STUN servers | Establishing peer-to-peer online games |
6. International transfers
Some providers above (e.g. Google, Cloudflare) may process data outside your country, including in the United States. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and/or applicable data-transfer frameworks.
7. How long we keep data
- Pre-order emails — until the pre-order campaign ends or you ask us to delete them.
- Reviews — for as long as they are shown, unless you ask us to remove yours.
- Analytics — per Google Analytics’ retention settings ([e.g. 14 months]).
- Online play — connection data is transient and not retained by us.
8. Your rights
Depending on where you live (e.g. under the EU/UK GDPR), you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. To exercise any of these, contact [CONTACT EMAIL]. You also have the right to lodge a complaint with your data-protection authority (in Germany, your state’s Datenschutzbehörde).
9. Children
The Service is not directed to children under [13/16], and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
10. Security
We use reputable providers and reasonable measures to protect data, but no method of transmission or storage is completely secure.
11. Changes
We may update this Policy; we’ll change the “Last updated” date above and, for material changes, provide a more prominent notice.
12. Contact
Appendix — Mobile apps & store declarations
The App Store “App Privacy” and Google Play “Data safety” forms ask you to declare what the app collects. The Bellis apps collect everything above, plus the following (adjust to your final build):
| Data (app) | Purpose | Linked to identity? |
|---|---|---|
| Display name & country flag you set | Shown to opponents and on the leaderboard | Pseudonymous |
| ELO rating & games-played count | Ranked matchmaking & leaderboard | Pseudonymous |
| Anonymous player id | Identifies your profile across sessions | Pseudonymous |
| Recovery-phrase hash | Lets you restore your profile on another device (we store only a one-way hash, never the words) | Pseudonymous |
| Online room / game state | Running an online match | Transient |
| IP address (via online play) | Connecting players | Not stored by us |
Suggested mapping — Google Play Data safety: “App activity”, “App info & performance”, and “Device or other IDs”; Apple App Privacy: “Identifiers”, “Usage Data”, and (if you keep the email signup in-app) “Contact Info”. Declare analytics as data collected for “Analytics”. Confirm each against your shipped build.
This document is a template generated from the app’s data flows and is not legal advice. Review it with a qualified professional and tailor it to your final products and jurisdiction before publishing.