Mini Brawl
Privacy policy
The short version
Mini Brawl has no ads and no sign-up. Purchases go through Apple or Google; we receive a receipt to confirm them, never your payment details. The app gets a random player id so your progress and trophies can be saved and recovered. Players you meet see your display name and trophies, and so does everyone on the league leaderboard if you are 13 or older and listed. Analytics are only for players 16 and over who say yes. You can delete your account in the app or by email.
Who we are
Mini Brawl is made by Eugene Rozental, an individual developer in California, United States. "We", "us" and "our" in this policy mean Eugene Rozental, who decides how your data is used and so is the "controller" under European law.
For anything in this policy, write to privacy@minibrawl.app.
What we collect, why, where and for how long
We never ask for your email, real name, password, location, contacts, photos, microphone or camera. This is everything else.
| Data | Why | Where it's stored | How long | Legal basis |
|---|---|---|---|---|
| A random player id and a secret token, made when the app first connects to our server | To tell your account apart from everyone else's and keep you signed in. | Our database (Neon, United States). The server keeps only a hash of the token. | Until you delete your account, or after 24 months without going online. | Contract: we need it to run the game for you. |
| The display name and tag you use | Shown to players you meet in live matches and in ghost replays. The tag tells two players with the same name apart. | Our database, and sent to the players you meet (see below). | As long as your account. Removed from match records after 30 days. | Contract. |
| Your cloud save: levels, stars, mastery, daily bonus and settings, including your language and your analytics choice | So a new phone or a reinstall does not lose your game. | Our database. | Until you delete your account, or after 24 months without going online. | Contract. |
| Live match results and your trophy history | To run ranked matches, keep trophies fair and check disputed results. | Our database. | Trophy history: until you delete your account. Match results: kept, but after 30 days they hold only random player ids, no names. | Contract. |
| The moves you make in live matches, and the ghost replays made from them | So a match can be checked afterwards, and so other players can practise against your recorded run as a "ghost". | Our database. Ghosts are replayed to other players. | 30 days. | Contract. |
| A Google Play Games or Apple Game Center player id | Only if your phone uses one: to link your account so a new phone can find it. We keep the id the platform gives this game, never your Google or Apple account details. | Our database. | Until you delete your account. Never collected for players under 13. | Contract. |
| Transfer codes you ask for | To move your account to another device without Google or Apple. | Our database, only as a keyed hash. | A code works once and expires after 10 minutes. Its record is deleted a day later. | Contract. |
| Feedback you send from the app, with your platform, app version and language | So we can read it and fix things. It is not linked to your player id. | Our database, with no player id. | 12 months. Players under 13 do not get the feedback box. | Legitimate interests: improving the game. |
| Survey answers: the quick questions the app asks after a few matches, and the beta tester form on our website, with your platform, app version and language | So we can see what players think and shape the next update. If you switch on "Attach my play stats" in the app, your answers are stored with your player id so we can read them next to your cloud save. That switch is only offered to players 16 and over who said yes to analytics, and is off unless you turn it on. A player tag typed into the website form is kept as part of your answer. | Our database. Without the switch (and always on the website), no player id. | 12 months. Attached answers are also deleted with your account. Players under 13 are not asked. | Legitimate interests: improving the game. Attaching to your account: your consent. |
| The year of birth you enter, or the youngest age in the range your app store shares | To switch on the right settings for your age, and move you up as you get older. | On your device only, and in your phone's own backup if you use one. Never sent to us or to analytics. | Until you uninstall the app. Deleting your account keeps it, so the age settings stay on. | Not applicable: it never leaves your device. |
| Invite codes: your own invite code, and, when a friend uses a code, which player invited which (both random player ids) and whether the inviter has been paid | To pay both players Shards when a friend joins through an invite, and to stop the same reward being paid twice. Not offered to players under 13 or when no server is in use. | Our database. | Until either account is deleted. | Contract: we need it to give you the reward. |
| Analytics events and crash reports | To find levels that are too hard and fix crashes. Only for players 16 and over who say yes. | GameAnalytics (see Analytics). | GameAnalytics' retention period. | Consent. You can withdraw it any time in Settings. |
| Your IP address | To limit abuse, for example how many feedback messages one address can send per hour. | Our server's memory only. Not written to the database or logs. | Not stored. | Legitimate interests: preventing abuse. |
| Purchase records: the product bought, the store's transaction id or order id, and a Google Play purchase token, when you buy Gems | To confirm the purchase with Google or Apple and add the Gems to your account once, even after a crash or a reinstall. | Our database, keyed by your player id. No card, price or billing details ever reach us. | As long as your account. | Contract: delivering what you bought. |
| Server logs: player ids, platform, app version and error details | To keep the server running and find bugs. | Fly.io, which runs our server. | Until Fly.io's log retention removes them. | Legitimate interests: running a reliable service. |
On your device. The app also keeps your progress, name and tag, a history of your recent matches with your opponents' display names, and a few other players' ghost replays on your phone. A small log of game events stays on the device and is never sent anywhere. Uninstalling the app removes all of it.
Invite links
A link like minibrawl.app/r/CODE carries a friend's invite code so you can get your bonus Shards without typing it. How the code reaches the app depends on your phone, and it is used for nothing else:
- Android. Google Play tells the app which link sent you to the store page (the "install referrer"). On first launch the app reads it once and uses it only for the invite code and the channel tag described below. Nothing else in it is kept or sent to us.
- iPhone. Apple gives apps no such information. When you tap the download button on our invite page, the page copies the invite code to your clipboard. The first time you open the app, and only if your clipboard holds any text, the app asks whether to check it. If you agree, iOS may ask you to allow pasting, and the app looks for our invite code and ignores everything else on your clipboard. If you say no, the app does not read it. The app asks once.
- If a code is found, only the code is sent to our server with your player id (see the invite codes row above).
Which link brought you
Our posts link to minibrawl.app/get with a short tag for where the post was, like ?src=reddit. When you open that link, the website adds one to a count for that tag, your kind of device (iPhone, Android or computer), your country as Cloudflare sees it, and the day. It stores no IP address, no cookie and nothing else about you.
On Android the tag rides along to Google Play as part of the install referrer. The first time you open the app, it sends the tag and your platform to our server, with no player id, token or device id, and the server adds one to that day's count. On iPhone there is no tag to send, so the app sends only the platform. We see totals, never who installed.
Children and age
- Mini Brawl is for all ages.
- Before your first match, the app asks for your year of birth on a neutral screen that does not suggest an answer. The year stays on your device and is never sent to us or to analytics. Until you answer, the app treats you as under 13.
- If your app store shares your age range with the app (Apple's Declared Age Range or Google Play's age signals), the app uses it instead of asking, and keeps only the youngest age in that range, on your device. It is never sent to us or to analytics.
- Players under 13 get no analytics and no feedback box, pick their display name from a list of preset names instead of typing one, and cannot link Google Play Games or Game Center.
- Players under 18, and anyone who has not given an age, never see the red "streak ends tonight" warning.
- If you live in California and are under 18, you can remove what you have posted in Mini Brawl, which is your display name: change it on the Account screen, delete your account, or email us. Other players' phones may still show it in their match history.
- For players under 13 we collect only the persistent identifiers needed to run the game, which US children's privacy law (COPPA) allows for "support for internal operations". That means the random player id and token, and the save and match data tied to them. We collect nothing that needs a parent's consent.
- A parent or guardian can ask to review or delete a child's data at privacy@minibrawl.app.
- Some US states require app stores to check ages and get a parent's consent for a minor's account and downloads. Apple and Google handle this in their own account settings; we do not see that consent.
Analytics
Analytics are only for players 16 and over, and are off unless you say yes when your first match starts. Nothing is sent before you answer, and nothing is sent if you say no.
You can change your mind any time: Settings, then Themes & gameplay, then Share gameplay stats under Privacy. Turning it off stops sending from then on.
If you say yes, the app uses GameAnalytics. It receives:
- gameplay events, such as match started, won, lost or quit, first troop placed, level picked and share card opened;
- your device model and operating system version;
- your country, which GameAnalytics works out from your IP address;
- when each session starts and how long it lasts;
- a random install id, and Android's app set id or Apple's identifier for vendor (ids that are the same only across one developer's apps);
- crash reports: the error message and where in the app it happened.
We never send GameAnalytics your name, tag or player id.
We do not request or use advertising identifiers. The app removes Android's advertising-ID permission and never shows Apple's tracking prompt. Android versions before 13 do not enforce that permission, and the analytics library we ship does not include Google's advertising-ID component.
GameAnalytics' own policy is at gameanalytics.com/privacy.
What other players see
- Players you meet in live matches, and players who get one of your recorded runs as a ghost, receive your display name, tag and trophy count. The app shows them your name and trophies.
- Your live matches are replayed to other players as ghost opponents for up to 30 days. A player whose phone already downloaded one of your runs can keep replaying it there, offline.
- If you are 13 or older and "Show me on the leaderboard" is on in Settings, every player can see your display name, tag, trophies, league and rank on the league leaderboard. You are only listed after a ranked match in the last 30 days. Players under 13 can look at the leaderboard but are never listed.
- Their app keeps a match history with your display name on their own device.
- Share cards never show the opponent's name.
Service providers
These companies handle data for us, each under its own terms and security commitments:
- Fly.io runs our game server, in the United States.
- Neon hosts our database, in the United States.
- Cloudflare hosts this website.
- GameAnalytics receives analytics and crash reports, only if you opt in.
- Google and Apple, only if your phone is signed in to Google Play Games or Game Center: our server checks with them that the sign-in is genuine when your account is linked or recovered. They also process any purchase you make in the Gem store, under their own terms, and our server asks them to confirm each purchase before adding Gems to your account.
- Porkbun forwards the email you send to support@ and privacy@minibrawl.app.
The app's fonts are built into the app, so it does not download them from Google.
International transfers
We and our providers store data in the United States. If you live somewhere else, including the EU or the UK, your data is transferred there. Where the law requires it, we rely on our providers' standard contractual clauses or equivalent safeguards.
No selling, no ads
We do not sell your personal information, and we do not share it for targeted advertising. There are no ads in Mini Brawl and no ad networks. We do not share personal information with anyone for their own marketing.
Cookies
This website sets no cookies and loads nothing from third parties: its fonts, images and styles all come from minibrawl.app. The app uses no cookies. That is why there is no separate cookie policy.
Cloudflare keeps short-lived request logs, including the visitor's IP address, to run and protect the website. If you open a shared link with a ref tag, the tag only travels on to the app store and is not recorded here. minibrawl.app/get links are counted as described in Which link brought you.
Your rights
Wherever you live, you can ask to see, correct, get a copy of, or delete your data. You can change your display name yourself on the Account screen. For everything else, email privacy@minibrawl.app and we will answer within one month.
There is no email or password on your account, so to check a request is yours we ask for your player tag and a few details only your account would show, such as roughly when you started playing and your trophy count. Tags are not unique, so we may ask for more.
EU and UK. The legal basis for each use is in the table above. You can withdraw consent to analytics at any time in Settings; that does not affect what was sent before. You can object to uses based on legitimate interests, and ask us to restrict how we use your data. You can also complain to your data protection authority, for example the Information Commissioner's Office (ICO) in the UK.
US states. Depending on your state, you may have the right to know what we hold, get a copy, correct it, delete it, and opt out of its sale, sharing or use for targeted ads. We do none of those three things. We will not treat you differently for using your rights. Someone you authorize can make a request for you; we may ask them to show that you authorized them.
California. We do not respond to "Do Not Track" browser signals, because we do not track users across other sites or apps.
How to delete your account
In the app: on the home screen, tap your player card (your name and tag) at the top. On the Account screen, scroll to Account, tap Delete account, then Delete. You need to be online.
By email: write to privacy@minibrawl.app from any address. See minibrawl.app/delete for what to include.
What is deleted: your display name and tag, token, cloud save, linked Play Games or Game Center id, transfer codes, ghost replays, trophies and trophy history, and your match moves. Your name is removed from match records. The app also wipes what it stored on your phone about your account and progress, and other players' ghost replays. It keeps only your year of birth, so the right settings for your age stay on.
Moves from a live match that never finished, for example because our server restarted mid-match, are not linked to a match record, so they are deleted after 30 days instead.
What remains:
- your random player id, with no name or tag, marked as deleted;
- results of past live matches, holding only random player ids;
- match histories on other players' own phones, which may show your old display name. We cannot reach those;
- server logs, until Fly.io's log retention removes them;
- analytics at GameAnalytics, which are not linked to your player id, so we cannot find them. You can stop analytics at any time in Settings.
Uninstalling the app removes everything stored on your phone, but does not delete your account on our server.
Security
Our server stores only a hash of your token and of any transfer code, never the secret itself. The app talks to our server over encrypted connections, the server talks to the database over encrypted connections, and this website is HTTPS only. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.
Changes to this policy
If this policy changes, we will update the date at the top. For significant changes we will also show a notice in the app, and tell the app stores where they require it.
Contact
Eugene Rozental, California, United States · privacy@minibrawl.app for privacy, support@minibrawl.app for everything else.