- No accounts, no email, no phone number, no contacts, no location. We never ask for your real name.
- The game makes a random ID on your phone. We use it to run the leaderboard, matchmaking and rewards.
- We collect gameplay analytics and crash reports on our own server (no analytics companies).
- Ads come from Google AdMob. Google only personalizes ads if you allow it, and never for players under 18.
- Payments go through Apple or Google. We never see your card.
- Delete everything our server has about you anytime: Settings → Delete my data.
This policy explains what BAITED (the mobile game, "we", "us"), operated by SalesKing LTD (Israel), collects, why, and your choices. It covers the BAITED apps for iOS and Android and the BAITED game server.
1. What we collect
Random game IDs (made on your device)
When you first open BAITED, the app creates two random IDs. They are not linked to your name, phone number, email or advertising ID:
- Game ID: identifies your device to our server for the leaderboard, quick match, online rooms and to confirm rewarded-ad rewards. For rewarded ads this ID is also passed to Google as a "server-side verification" user ID so Google can tell us a reward was earned.
- Analytics ID: a separate random ID used only for analytics and crash reports.
Your player profile
The display name you pick, your Goob's look (skin, face, hat, frame) and your trophies. These are public: other players see them on the leaderboard and in matches. Please don't use your real name. Names are filtered for offensive words. Players under 13 always get a random fun name on the server (see section 6).
Gameplay data
Results of online matches (refereed by our server), matchmaking requests, and anti-cheat signals (for example, how fast and accurate shots are) to keep the game fair.
Analytics
Events about how the game is used, for example: app opened, session length, tutorial steps, match started/finished (mode, speed, arena, result, duration, trophies), crate opened, level reached, quests and pass tiers, shop and offer views, purchase attempts (product and price, never payment details), ads shown, notifications opened, cloud save status and errors. Each event includes the app version, platform (iOS/Android), OS version, the country from your device's language settings (not GPS, not IP lookup) and your age range (under 13 / 13-17 / 18+). Analytics are stored on our own server (Cloudflare) and are not sold or shared with analytics or advertising companies.
Crash reports
When the game hits an error: the error message and code location (stack trace), app version, platform, the screen you were on and a short list of your last in-game steps (e.g. "opened shop"). No screenshots, no text you typed.
Age range
We ask for your birth year once. We keep only the age range (under 13, 13-17 or 18+) on your phone, never the year, and use it to choose safe ad and offer settings.
IP address
Your device's IP address reaches our server (hosted by Cloudflare) with every request — that is how the internet works. We use it for rate limiting and abuse prevention. Where we store anything about it, we store a one-way hash with a secret key that changes every day (for example, to limit how many new leaderboard rows one network can create per day). Cloudflare's request logs may keep IP addresses for a few days for security and debugging.
Reports and moderation
If you report a player, we store the report (reason, the reported name or match code, your game ID and a hashed IP) to review it. Players reported by several people may get their name hidden.
Purchases
Purchases are processed by Apple (App Store) or Google (Google Play). We receive the product, a transaction ID and the store receipt to deliver your items and to restore them. We never receive your name, card number or billing address.
Cloud save
If you use cloud save, a copy of your game progress (coins, gems, items, tricks, settings) is stored on our server, linked to your game ID, so you can restore it.
Push notifications
If you allow notifications, we store your device's push token to send game reminders (gift ready, Daily Hide, streak). You can turn them off anytime in your phone's settings.
2. Ads (Google AdMob)
BAITED shows optional reward videos and, for some players, short ads between battles. Ads are served by Google AdMob, which collects data directly from your device: the device advertising identifier (IDFA on iOS only with your permission, Android Advertising ID), IP address, device and app information, and ad interactions — to show ads, measure them, limit how often you see them and prevent fraud.
- Consent: in the EEA, UK and Switzerland (and other places where required) Google's consent message asks you first. You can change your choice anytime in Settings → Privacy & ad choices.
- iOS tracking: we only use your IDFA if you allow it in Apple's "Allow Tracking" prompt. You can change this in iOS Settings → Privacy → Tracking.
- Under 18: ads are never personalized. Under 13: ad requests are tagged as child-directed (COPPA) and between-battle ads are turned off.
Google's use of data: policies.google.com/technologies/partner-sites.
3. Why we use data (and legal bases)
| Purpose | Data | Legal basis (EEA/UK) |
|---|---|---|
| Run the game: leaderboard, matchmaking, online matches, rewards, purchases, cloud save | Game ID, profile, gameplay, transaction IDs, save data | Performing our contract with you |
| Fair play, security, abuse and fraud prevention, moderation | Game ID, hashed IP, anti-cheat signals, reports | Legitimate interests |
| Fix crashes and improve the game (analytics) | Analytics ID, events, crash reports | Legitimate interests |
| Personalized ads | Advertising ID and ad data (collected by Google) | Consent (you can withdraw anytime) |
| Non-personalized ads, frequency caps, ad fraud prevention | Ad data (collected by Google) | Legitimate interests |
| Reminders | Push token | Consent (OS permission) |
We don't sell personal information. We don't use your data for automated decisions with legal effects. We don't build advertising profiles ourselves.
4. Who we share data with
- Cloudflare (hosting our server and storage) — acts as our processor.
- Google (AdMob ads; Google Play purchases on Android) and Apple (App Store purchases on iOS).
- Other players see your display name, look and trophies.
- Authorities, if the law requires it or to protect players' safety.
Data may be processed outside your country (Cloudflare runs a global network; Google and Apple operate worldwide), with appropriate safeguards such as Standard Contractual Clauses.
5. How long we keep data
| Data | Kept for |
|---|---|
| Raw analytics events, crash markers per session | 30 days |
| Daily totals (e.g. "1,204 players today") — no IDs | Indefinitely |
| Grouped crash reports (no IDs) | 90 days |
| Analytics install record (first/last day seen) | Until 400 days after your last session |
| Leaderboard row | Until 60 days without playing |
| Player reports | 90 days |
| Rewarded-ad receipts | 30 days |
| Hashed IP counters | 2 days |
| Cloud save, purchase records | Until you delete your data (purchase records may be kept longer where tax or consumer law requires) |
6. Children
BAITED is made for players 13 and older. We ask for a birth year before you play. If a player tells us they are under 13, the game still works but: no custom name ever leaves the device (the leaderboard and opponents see a random fun name), ads are child-directed and never personalized, there are no between-battle ads and no pop-up offers. For these players we only process the random IDs and gameplay data needed to run the game, keep it secure and fix it (the "support for internal operations" exception of the US COPPA rule). We do not knowingly collect personal information from children under 13. If you're a parent and think your child gave us personal information, email hello@salesking.co.il or use Settings → Delete my data on their device, and we'll delete it.
Players aged 13-17 never get personalized ads, and offers are never priced based on how much they have spent.
7. Your rights and choices
- Delete: Settings → Delete my data erases your leaderboard row and name, reports you filed, ad-reward receipts, cloud save and all analytics and crash data linked to your device's IDs. Your progress stays on your phone until you uninstall the app.
- Access, correction, portability, objection, restriction (EEA/UK) and know / delete / correct / opt out of "sharing" (California and other US states): email hello@salesking.co.il. Because there are no accounts, we may ask for details that help us find your data (for example your display name and roughly when you played). The in-app delete button is the fastest way.
- Ads: Settings → Privacy & ad choices; iOS "Allow Tracking"; Android Settings → Google → Ads → delete advertising ID.
- Notifications: your phone's settings.
- You can complain to your local data-protection authority.
8. Security
Traffic is encrypted (HTTPS/WSS). Admin tools require a secret token. IP addresses are hashed with a rotating secret. No system is perfectly secure, but we keep the data we hold small on purpose.
9. Changes
If we change this policy we'll update the date at the top and, for important changes, tell you in the game.
10. Contact
SalesKing LTD (Israel) · hello@salesking.co.il