Privacy Policy

This privacy policy explains what data the Gingerbread Gambit: RPS mobile app collects, on both Android and iOS, how it is used, and who it is shared with. It also covers this website, gingerbreadgambit.com.

Who we are

Gingerbread Gambit: RPS (formerly "Battle RPS") is developed by an independent developer, Ziv Mizrahi, publishing as Nice Try apps (the "Developer", "we"). Contact: support@gingerbreadgambit.com.

Data we collect

The game collects the minimum amount of data needed to run the game.

Account data (only if you sign in)

Sign-in is optional. On Android you may sign in with Google; on iOS you may sign in with Google or with Apple.

• Your display name and profile photo URL, as supplied by the provider
• Your account identifier from that provider (used only inside Firebase)
• If you use Sign in with Apple and choose "Hide My Email", we only ever receive Apple's relay address, never your real one.
• The email address your provider supplies is held by Firebase Authentication as part of your sign-in credential. The game never copies it into your account record; it is used only to match an exact-address friend search (see Finding friends).

Anonymous / guest mode

No account data is collected. The app generates an anonymous Firebase user identifier so your progress can be saved on our servers.

Gameplay data (all modes)

• In-game statistics: wins, losses, draws, level, XP, ELO, current and best streak
• Per-weapon-type win counters (rock / paper / scissors) for the Profile "Favorite Plays" stat
• Shop ownership: which board themes, soldier skin packs, emotes and promo bundles you have purchased, and which are equipped
• In-game currency balance: coins and gems
• Achievement unlocks (derived from your win and streak counts; not stored separately)
• The timestamp of your last played game
• For online matches only: the list of moves and RPS picks made during the match (for replay-based anti-cheat verification) and opponent matchmaking metadata (ELO range)

Push notification data (only if notifications are enabled)

• A Firebase Cloud Messaging device token, used solely to send you "your turn" reminders for in-progress online matches, friend requests and match invites from your friends, and announcement messages tied to the broadcast topic. Never shared with third parties.
• You can disable notifications at any time via Settings → Notifications, which unsubscribes you from the topic and prevents new tokens from being registered.

In-app purchase data

• A purchase token (Android) or signed transaction (iOS) plus the product ID for each purchase. On Android this comes from Google Play Billing and is validated against Google's servers; on iOS it comes from Apple StoreKit and is validated against Apple's servers. It is then stored under users/{your_id}/processedPurchases/{token} to prevent a double grant.
• We never see your card number. Google Play and the Apple App Store handle all payment processing under their own privacy policies.

Advertising data (Google AdMob)

• The game shows two kinds of ad, both served by Google AdMob:
  • Opt-in rewarded video: you choose to watch an ad in exchange for in-game coins. Nothing happens unless you tap to start it.
  • Interstitial ads, shown occasionally between matches. These are not opt-in, but they are rate-limited and never interrupt a match in progress. Purchasing "Remove Ads" removes them permanently.
• To serve and measure ads, AdMob may collect device and usage information such as a device advertising identifier, IP address and ad-interaction data, per Google's policies and how Google uses data.
• Consent (EEA/UK): before serving personalized ads to users in regions that require it, we present Google's consent form (User Messaging Platform). You can choose personalized or non-personalized ads; outside those regions standard ads are shown.
• iOS App Tracking Transparency: on iOS, before any ad request, the system asks your permission to track. If you decline, you still get the full game and can still watch rewarded ads; the ads are simply non-personalized. You can change this at any time in iOS Settings → Privacy & Security → Tracking.
• The game is a general-audience (13+) app; ad content is capped at a Teen-appropriate rating and is not child-directed.

Technical and diagnostic data

• Firebase Crashlytics: crash reports and stack traces (no personal content)
• Firebase Analytics: screen-view events and game lifecycle events (game_start, game_end, battle, screen_view). These contain no personally identifying information.
• Firebase App Check (Android only): a device-attestation token from Google Play Integrity, used solely to refuse calls that did not come from a genuine copy of the app. Generated and validated server-side; never persisted in your account record.

What we do not collect

• We do not collect your contacts, photos, location or microphone data.
• We do not collect phone numbers, and we do not store your email address in any record the game writes (see Finding friends).
• We do not sell your personal data.
• We do not ourselves build a profile of you across other apps or websites, and we do not sell or share your data with data brokers.

Leaderboard and other players

The game has a global leaderboard, and this, together with friends (see Finding friends), is where some of your data is shown to other players rather than only to us.

When you play a ranked or online match, the following is uploaded to our server and may be shown publicly on the leaderboard and to your opponent in a match:

• your display name
• your ELO rating and level
• your wins, losses and draws
• your chosen avatar / profile image, if you set one

Nothing else is published. Your email address is never shown to other players, and neither is any purchase, balance or diagnostic information.

• You can play without appearing anywhere. VS AI, Local Pass-and-Play and Campaign are entirely offline as far as other players are concerned; no score from those modes is uploaded or ranked. The leaderboard only reflects online play.
• Display names are moderated. A name is checked on our server against a profanity filter and a character allowlist before it is saved, so a name you choose may be refused.

Deleting your account (see Your rights) removes your leaderboard entry along with the rest of your record.

Finding friends

Signed-in players can add each other as friends and invite a friend to a match. One way to find a friend is to type their exact email address. Here is exactly what that involves:

• We never store your email address. No record the game writes contains it. Friend search compares the exact address someone typed against Firebase Authentication, the sign-in service that already holds the address your Google or Apple sign-in supplied, and nothing else. There is no partial or "starts with" search.
• A match never reveals your email. Someone who finds you sees only your display name, your rank (ELO rating) and your avatar, and can send you a friend request. A search that does not match looks identical whether or not an account with that address exists.
• You are findable only after the app has told you so. The first time you open a version of the app with friends while signed in, it shows a notice explaining email search, and you choose whether to stay findable. Until that notice has been shown, nobody can find you by email.
• You can turn it off at any time in Settings → "Let friends find me by email". Existing friends are not affected.
• Guest (anonymous) accounts cannot be found by email, and cannot search by email either, because they have no email address. They can still add players they have played an online match with.
• What your friends see: your display name, rank, avatar, when you last played, and since when you have been friends. A match invite from a friend may arrive as a push notification (see Push notification data above).
• Friend requests you decline are declined silently. The sender is not told. To stop the same player re-sending it straight away, we keep a private note that you declined, for 7 days; unanswered requests expire after 14 days.
• Matches against friends are friendly: they do not change your rank, and to prevent abuse we keep a count of how many rewarded matches two friends have played on the current day.
• Deleting your account deletes all of this: your friends list, pending and declined friend requests, your entry in other players' friends lists, any request you sent them, and any pending match invite.

How data is stored

• Firestore (Google Firebase) stores your account record and gameplay stats.
• Firebase Realtime Database holds temporary online-match rooms and match invites (an invite stands for two minutes).
• Firebase Crashlytics and Analytics process diagnostics.
• On-device storage keeps your local preferences (sound on/off and similar), which never leave the device.

All server storage is in Google's Firebase infrastructure. See Google's Firebase privacy terms: firebase.google.com/support/privacy.

In-app purchases

Purchases are processed by Google Play Billing on Android and by the Apple App Store on iOS. We never see your card number; each store handles all payment processing under its own privacy policy (Google, Apple).

Server-side, we validate every purchase before granting anything, against Google's Play Developer API on Android and Apple's App Store Server API on iOS, then write the grant to your account. We retain the purchase token, product ID and timestamp under your account record indefinitely so we can refund or audit if needed.

Children

Gingerbread Gambit: RPS is rated for general audiences. We do not knowingly collect data from children under 13. If you believe a child has provided us with data, contact support@gingerbreadgambit.com and we will delete it.

Your rights and deletion

You can:

• Delete your account from inside the app, on both Android and iOS: open Profile, scroll to the bottom, and tap Delete Account. This is immediate and permanent. It removes your account record and every subcollection under it (campaign progress, processed purchases, processed ad rewards, processed matches, friends, friend requests and rate-limit logs), your entry in other players' friends lists, your matchmaking entry, any pending match invite, and your sign-in credential itself. If you signed in with Apple, your Apple session is also revoked, so the app no longer appears under your Apple ID. This is offered for guest (anonymous) accounts as well as Google and Apple ones. Full details.
• Deleting your account cannot be undone, and purchases cannot be restored afterwards, because the record they were granted against is gone.
• Alternatively, request deletion by emailing support@gingerbreadgambit.com with the subject "Gingerbread Gambit — delete my data".
• Uninstall the app at any time; this stops all local data collection. Server-side backups may take up to 30 days to fully purge after account deletion.
• Play as a guest without creating an account.

If you are in the EEA, the UK or another region with data-protection law, you also have the right to ask for a copy of your data, to have it corrected, and to complain to your local data-protection authority. Email us and we will respond within 30 days.

For players in Israel

• You are under no legal obligation to give us any personal data. Signing in, notifications and personalized ads are all optional. If you choose not to sign in, you play as a guest and your progress stays tied to your device; if you decline notifications or personalized ads, the game works fully without them.
• Under the Israeli Privacy Protection Law, 1981, you have the right to review the personal data we hold about you and to ask us to correct or delete it. Email support@gingerbreadgambit.com; we will respond within 30 days.
• You may also complain to the Privacy Protection Authority (הרשות להגנת הפרטיות) at the Israeli Ministry of Justice.

This website

gingerbreadgambit.com is a plain information site. It sets no cookies, runs no analytics or advertising, and loads its fonts and images from its own server rather than from third parties. Its only scripts run inside your browser: one chooses which store button to show first, based on your browser's user agent; one opens the Hebrew version of a page if your browser's preferred language is Hebrew or your device's clock is set to Israel time, and remembers the language you pick with the header switch; and the accessibility menu remembers your display settings (text size, contrast and similar). Your language and display choices are kept in your browser's local storage on your own device. We do not look up your location or IP address, and nothing is sent anywhere.

Store links on this site carry a campaign label naming the place the link was shared, such as website or tiktok. When you tap one, that label goes to Google Play or the App Store together with your visit, and the store reports back to us only how many installs came from each label. The label describes the link, never you: it holds no identifier, and we receive no information about who used it.

The site is hosted on Google Firebase Hosting. Like any web host, it processes your IP address and standard request details to deliver pages and protect against abuse, under Firebase's privacy terms. We do not use those logs to identify you.

Store buttons link to Google Play and the Apple App Store, which have their own privacy policies.

Changes to this policy

If we change this policy, we will update the "Last updated" date above and post the new policy inside the app before changes take effect for existing users.

Contact

Questions? Email support@gingerbreadgambit.com.