Version 5 — Effective October 2, 2026

Ludo Road — Privacy Policy

This policy explains what data Ludo Road collects, why, and what your choices are. It covers the Ludo Road mobile game and the ludoroad.com website (together, the "Service"), operated by Tahir Khan (the "Operator"). It also serves as our cookie policy.

We collect as little as a game like this can. There is no selling of personal data, no data brokers, and the website runs no analytics at all.

Contact: support@ludoroad.com

1. Data we collect

Data you give us.

• Display name and avatar choice — shown to other players in online matches.
• Feedback messages — what you type in the in-app feedback form, and our replies.
• Bug reports — if you use the in-app bug report button, the message you write is sent together with technical gameplay data (the level or match being played, the game's random seed, board state, and a short log of recent game events). This data describes the game, not you, and is used only to reproduce and fix bugs.

Data created by playing.

• Account data — a guest account identifier and session token created automatically so your progress can be saved. If you later attach a sign-in (such as Sign in with Apple or Google), we store the identifier that the sign-in provider gives us.
• Game progress — levels completed, stars, coins and hearts, the boosters in your bag, match history and results, and purchase history (which in-game purchases were made, as reported by the app platform — we never see your payment details, card numbers, or billing address).
• Device and app data — platform (iOS or Android) and app version, sent with requests so we can support old versions and diagnose problems.
• Device attestation — each request to our server carries a short-lived token from Firebase App Check, in which your device's platform (Apple App Attest or DeviceCheck, Google Play Integrity) vouches that the app is a genuine, unmodified copy running on a real device. The attestation is performed by Apple or Google on the device; we receive and store only the verdict (verified or not) with your session — no device identifier reaches us — and we do not refuse service on it.
• Push token — if notifications are enabled, a Firebase Cloud Messaging token that lets us notify you (for example, that it is your move in a friend game).
• Server logs — like nearly every web server, ours logs requests with IP addresses for security and debugging; logs are routinely rotated and deleted.
• Play counts — so we can see how the game is doing and which levels are too hard, the app keeps a few running totals and sends them with the progress sync above: how many times it was opened, how many whole minutes a match was on screen, how many road levels were attempted and cleared (by level), how many robot matches were played, how many boosters were used, and how many launches ran into an error. They are counts for a day, not a record of what you did: nothing stores the time within a day, the order of events, who you played, or anything you typed. The per-level totals are kept with no account attached to them at all.
• Error reports — when the app runs into an error it did not expect, it notes what kind of error it was and where in the app's own code it happened (the first line of the error and a short technical trace), how many times it happened, and the app version and platform. These are sent with the progress sync and stored with no account attached: they describe the app's code, not you, and are used only to find and fix bugs.
• Country — the two-letter region your device is set to (for example `US`), sent with those counts so we know roughly where our players are. This is your device's own setting, not location tracking: we do not use your IP address to work out where you are, and we do not store a city, coordinates, or any finer location.

2. Advertising

The app shows ads through Google AdMob, including optional rewarded ads you can choose to watch. AdMob may collect device identifiers (such as the advertising ID) and use them to show and measure ads, acting as described in Google's privacy policy and how Google uses ad data.

Your choices:

• iOS asks for permission through App Tracking Transparency before the advertising identifier is used for tracking. You can decline, and you can change this any time in iOS Settings.
• Where consent is required (for example the EEA and UK), a consent form is shown before ads load, and you can choose non-personalized ads.
• Both iOS and Android let you reset or limit the advertising ID in system settings.

We do not show personalized ads to users we know to be under 16 — the Service requires players to be 16 or older.

We do not choose the ads you see. Which ads appear, and any tracking technology inside them, are Google's and not ours: we send no personal data to advertisers, we receive no record of which ads you were shown, and we cannot review an individual ad before it appears. If an ad is misleading, offensive, or behaves badly, please report it to Google with the ⓘ or ✕ marker on the ad itself, and tell us at support@ludoroad.com — AdMob lets us block particular advertisers, URLs and categories, and we will use that where a problem persists.

3. How we use data

• To run the game: save progress, match you with other players, run friend games, deliver notifications you asked for.
• To operate virtual currency: track coins, hearts, and purchases, and correct balances (for example, granting a make-good when an ad reward fails).
• To support you: answer feedback and fix bugs — the ones you report and the ones error reports show us.
• To improve the game: see how many people play, which levels are too hard or too easy, and which features get used — from the play counts described above, never from profiling an individual.
• To keep the Service fair and secure: detect cheating and abuse, enforce our Terms of Service, and protect players.
• To meet legal obligations.

We do not use your data for marketing emails (we do not collect email addresses for marketing), and we do not sell or share personal data for cross-context behavioral advertising, except that ad delivery by AdMob inside the app works as described in Section 2.

4. Who we share data with

• Service providers that host and run the Service: DreamHost (our server and database host, in the United States), Google (AdMob advertising, Firebase Cloud Messaging, Firebase App Check), and Apple and Google as app platforms, including their device-attestation services (App Attest, DeviceCheck, Play Integrity).
• Other players see only your display name, avatar, and in-game actions (moves, emotes) in matches you join.
• Legal — we may disclose data if required by law or to protect the Service, our rights, or players' safety.
• Business transfer — if the Service is transferred to a new operator, account data goes with it under this policy.

No other sharing, and no selling of personal data.

5. Cookies and the website

The ludoroad.com website is a set of static pages. It sets no cookies, runs no analytics, and embeds no trackers. Our web server keeps ordinary access logs (IP address, page requested, time) for security.

The app itself does not use cookies; it stores your settings and cached game data on your device, and a session token that authenticates your account to our servers.

6. How long we keep data

Account and progress data are kept while your account exists. Feedback threads are kept until resolved and for a reasonable period afterwards for support history. Error reports carry no account and are kept while they help fix bugs. Server logs rotate on a short schedule. When you delete your account, we delete the personal data associated with it within 30 days, except records we must keep for legal, security, or fraud-prevention reasons.

7. Your rights

Depending on where you live (for example under the GDPR or the California Consumer Privacy Act), you may have rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. You can delete your account yourself in the app (Settings → Account → Delete account), and exercise any of these rights by emailing support@ludoroad.com or using the in-app feedback form. We will respond within the time the law requires. We do not discriminate against you for exercising your rights.

If you are in the EEA or UK, you may also lodge a complaint with your data protection authority. Our legal bases for processing are contract performance (running the game you asked for), legitimate interests (security, fixing bugs, keeping the game fair), consent (ads personalization where required, push notifications), and legal obligations.

8. International transfers

The Service is operated from the United States, and data is stored on servers in the United States. If you play from outside the U.S., your data is transferred to and processed in the U.S., where privacy laws may differ from those where you live.

9. Children

The Service is for players 16 and older. We do not knowingly collect personal data from anyone under 16. If we learn we have collected data from a child under 16, we will delete it. If you believe a child under 16 is using the Service, contact support@ludoroad.com.

10. Security

Traffic between the app and our servers is encrypted (HTTPS). Access to server data is restricted to the Operator. No system is perfectly secure, but we keep the data we hold to a minimum, which is the best protection of all.

11. Changes to this policy

We may update this policy from time to time. The version number and effective date at the top will change, and the current policy always lives at https://ludoroad.com/privacy.html. Material changes will be surfaced in the app.

12. Contact

Privacy questions and requests: support@ludoroad.com, or the feedback form in the app's settings screen.