Crossroads DuelPrivacy Policy

1. Who we are

Crossroads Duel is a free-to-play online duel game for Android phones, with optional purchases through Google Play. It is made and run by one person, the developer of Crossroads Duel (called “we” or “us” in this policy). We decide how the data described here is used, and we are responsible for it.

This policy covers the Crossroads Duel app and the game server it connects to, including these web pages.

Questions? Email support@crossroadsduel.com.

2. What we collect

2.1 Your account (saved on the game server)

• Your username and email address.
• Your password, but only as an argon2id hash. A hash is a scrambled, one-way version of the password: the server can check that the password you type is right, but nobody, including us, can turn the hash back into your password.
• If you made your account with Sign in with Google: it has no password, and its email address is the one Google gave us when you made it (Google confirms that the address is yours). We also save when we got it.
• If you use Sign in with Google (you made your account with it, or linked it in Settings): your Google account id and when you linked it. See 2.8.
• When the account was created and when you last signed in.
• Sign-in tokens (the digital keys that keep you signed in), also stored only as hashes, with the time each was created, when it expires and whether it was cancelled.
• The date and version of the terms you accepted, and your confirmation that you are 13 or older.

2.2 Your games (saved on the game server)

• Stats: rating (an Elo number that goes up when you win and down when you lose), wins, losses, shots, hits and your best draw time; for 2 vs 2 a separate rating, wins and losses.
• Match records: the game mode, the two players (or the computer opponent's difficulty in Training), the winner, how the match ended, the result of each round (including draw times, false starts and the health left, and, when a player leaves or loses the connection, the round that was cut short) and when the match started and ended. For a 2 vs 2 match also: the four seats (which team each player was on, or that a computer player sat there), the winning team, whether a player left early, and each player's rating change.
• Target practice courses: for every course you finish: the score, the points, the quick-draw bonus, shots, hits, your fastest first hit after the gong, which course it was (a number) and, for the day's course, the date, the challenge code it answered (if any) and the time. Free practice is not saved.
• Arcade runs: for every run: the score, the stages cleared, the lives left, the challenge code it answered (if any), and when it started, was last updated and ended. Each Arcade duel is also saved as a match record (above).
• Challenge codes: the codes you create to challenge friends: the code, whether it is a course or an Arcade run, the run's score (and stages), and when you made it.
• Coins: your coin balance and a history of every change: the amount, the reason (for example a match reward, a purchase in the Shop or coins bought through Google Play), the related match, item or purchase, and the time.
• Items: the items you own (with when and how you got them: free, bought with coins, earned by playing, for example an Arcade boss's look or hat, a gun's inlay or a Showman hat earned with a feat, from a pack bought through Google Play (see 2.6), or kept as an Early rider: accounts made before version 0.10.0 keep the two looks that were free until then) and the ones you have equipped: your look, hat, chest piece and gun, and the finish on each of your guns.
• Gun records: for each of your guns: the duels, wins and head shots that counted for it, your fastest draw with it, the rank it has reached and the engraving you chose for it (two words from fixed lists, if any). For every match that counted: the match, the gun, the game mode, whether you won and when; for a counted match against other players (Quick Match or private) also the random account ids of those opponents, so that only three wins a day against the same opponents count.
• Control statistics (from version 0.10.1): for every match you play (each Arcade duel too) and every target practice course you finish: whether you played with motion or touch controls, the game mode, 1 vs 1 or 2 vs 2, your gun, how many rounds reached the gong and in how many of them you fired, the time from the gong to your first shot in each of those rounds (and their median), your shots, hits and head shots, the touch settings the server used, and when. We use them only to compare touch and motion players and tune the controls so that neither has an advantage.
• Reputation (from version 0.10.0): your Reputation points and level, and a log of what added to them. For each counted match the log keeps the points it added and when; for Quick Match and private rooms it also keeps which human opponents it was against, so the daily allowance and the limit per opponent can be applied. The log also holds the one-time points for your first duel and, for accounts made before 0.10.0, a start credit.
• Feats (from version 0.11.0): your progress toward each feat, for example how many rounds you won at full health against the Hard CPU, your current and best run of 2-0 Training wins against it, and how many times you beat each Arcade boss, and when you completed each feat. It is counted from the matches saved above; some feats count only matches played with motion controls.
• Whether the account is banned.
• An “entitlements” field kept free for possible future subscriptions. It is empty today.

2.3 Stored on your phone

• Your sign-in token, kept in Android's secure storage. The app sends it to the server to keep you signed in; the server stores only a hash of it (see 2.1).
• Your settings: control mode, sensitivity, inverted aim, calibration angles, the sound, vibration, voice, sensor-display and crash-report switches, the opponent filter, the server address and whether your phone has a gyroscope. Only the control mode and the opponent filter are sent to the server, when you look for a match (see 2.4); the control mode is also saved with each match's control statistics (see 2.2). The other settings stay on your phone.
• Crash reports waiting to be sent (at most 30, each for at most 7 days) and the random installation id that goes with them (see 2.7).
• Motion sensors. The game reads your phone's accelerometer and gyroscope to notice when you draw and where you aim. This is worked out on your phone. During a match, only the result is sent to the server: when you lower the phone into the holster position and when you draw, fire and reload, and the coordinates you aim at. The raw sensor readings never leave your phone.
• Touch controls. Where your thumbs touch the screen is worked out on your phone. During a match only the result is sent: when you draw, holster, fire and reload, when you start and stop aiming, and the coordinates you aim at.
• Spoken announcements use your phone's own text-to-speech engine.

The app does not take part in Android's automatic backup, so nothing from it is copied to your Google account.

The app only asks Android for five permissions, none of which shows a prompt: Internet (to connect to the game server), vibrate (for feedback), wake lock (to keep the phone awake during a duel), Google Play billing (to open Google's purchase sheet, 2.6) and network state (Google Play's billing library checks whether the phone is online). It does not use the camera, microphone, location, your contacts or the advertising ID.

2.4 Kept only for a short time in the server's memory

These are needed while you play. They are held in the server's working memory, are never written to the database, and are gone at the latest when the server stops:

• The opponent filter your app sends when you look for a match: whether you only want opponents with the same controls.
• The app version, sent when the app connects, to check that it is up to date.
• Measurements of how long messages take to travel between your phone and the server (round-trip time).
• Counts of sign-up, sign-in and account-deletion attempts, kept per IP address (the internet address your phone is using) and per IP address together with the username or email typed, and attempts to confirm an in-app account deletion per account, to slow down password guessing. Each count is removed one to two minutes after it started.
• Counts of crash reports per IP address (for an IPv6 address, per its first half, which is the same for one home or mobile network) and per installation id (see 2.7), so that nobody can flood the server with them. Each count is removed one to two hours after it started.
• Counts of purchase checks per account and per IP address (an IPv6 address by its first half), so that nobody can flood the server with them. Each count is removed one to two minutes after it started.
• For Sign in with Google: a random one-time code that the app gives Google, for at most 5 minutes; when you make an account with Google, your Google account id and email address for at most 10 minutes while you choose a username; Google's public keys; and counts of these requests per IP address (an IPv6 address by its first half) and per account, each removed one to two minutes after it started.
• Matchmaking queues and rooms, including 2 vs 2 team rooms (who sits in which seat) and whether you chose 1 vs 1 or 2 vs 2.
• An Arcade run in progress: its stage, lives and score (also saved after every duel, see 2.2).
• The live state of a match, including the aim coordinates and timing of each shot. (What is saved after a match is listed in 2.2.)

Your app also sends its control type (motion or touch) when you look for a match. From version 0.10.1 it is saved with that match's control statistics (see 2.2), so it is not only kept in memory.

2.5 Server logs

The server writes a line for each request to its log. With the default setting, a line contains your IP address and port, what was requested (the method and path), the result code and how long it took. Some lines also contain the random id of an account or a match, for example when a match starts or ends or an account is deleted. Passwords, sign-in tokens and the admin key are not written to the logs, and neither are the purchase tokens Google gives each purchase (a line about a purchase carries only a short fingerprint of its token).

These logs are kept only in the server's working memory and are never saved to a file. The log holds at most 64 MB; a line is deleted after at most 7 days, and the whole log is erased whenever the server restarts. The web front door that receives your connection keeps no record of requests; its own error messages (which can contain an IP address) go to the same memory-only log. The company that hosts the server may keep its own technical logs (see section 5).

2.6 Purchases (saved on the game server)

You can buy coins and the founder's pack in the app. Google Play takes the payment: you pay Google, under Google's own terms and privacy policy. We never see or store your card or other payment details, your billing address or your Google account; Google does not send them to us.

For each purchase, the game server keeps:

• what you bought (the product) and how many, and what it gave your account (coins and items);
• when you bought it, when the server delivered it and when it confirmed it to Google;
• Google's order number and purchase token (a long code Google gives each purchase; the server uses it to check the purchase with Google and to confirm it);
• a coded account id: a one-way scrambled form of your account's random id. The app gives it to Google with the purchase, and Google gives it back, so the server can check that the purchase belongs to your game account. It cannot be turned back into your account id, username or email address;
• whether it was a test purchase (made by a tester, without money);
• if the purchase is refunded or charged back: when, Google's reason code, and what we took back.

To check a purchase, the server asks Google about it with its purchase token. Google's answer also says in which country the purchase was made; the server uses that for nothing and does not store it. Coins you buy also appear in your coin history (2.2).

2.7 Crash reports (saved on the game server)

When something goes wrong in the app (an error in the game's code, or the app closing because of one), the app writes a crash report. It sends it to the game server the next time it starts or you sign in. Reports go only to our own game server, never to a crash-reporting company. A report contains:

• What went wrong: the kind of error (in the game's code or in Android), whether it closed the app, the error message and the list of places in the app's code that led to it (a “stack trace”). Before a report leaves your phone, the app blanks out anything in it that looks like an email address or a sign-in token.
• The app's version and build number.
• Your phone's Android version, manufacturer and model (for example “Google Pixel 7”).
• A random installation id that the app makes for itself the first time it sends a report. It is not your phone's Android ID or advertising ID. It lets us count how many phones have the same problem.
• When the error happened (by your phone's clock) and when the server got the report.
• If you are signed in when it is sent: your account's random id, which the server takes from your sign-in, so that we can find problems that affect only some accounts.

The app adds nothing else: no username, email address or location. In rare cases an error message contains a piece of text the app was handling; email addresses and sign-in tokens are blanked out, and reports are used only to fix the error.

You can turn crash reports off at any time in Settings → Account → Send crash reports. The app then stops making and sending them, and deletes the reports it has not sent yet and the installation id. If you turn them on again later, the app makes a new installation id.

The server keeps each report for 90 days and then deletes it (see section 6).

2.8 Sign in with Google (optional)

You can make your account with Google, or link Google to your account in Settings → Account, so that you can sign in with Google on any phone, also if you forget your password. You never have to: a username, email address and password work without Google.

• How it works: Google shows its own sign-in screen on your phone. If you agree, Google gives the app a sign-in token signed by Google, and the app sends it to our server. The server checks it with Google's public keys: that Google made it for Crossroads Duel, a few minutes ago, for this one sign-in.
• What Google gives us: only the basic sign-in information: your Google account id, your email address and whether Google has confirmed it, your name and the link to your Google profile picture. We never get your Google password, and we cannot see or use anything else in your Google account (no contacts, mail, files or other data).
• What we keep: your Google account id and when you linked it. If you made your account with Google, also its email address as your account's email address (2.1). We do not keep your name or the profile picture link: the server does not read them, and the token itself is never saved or written to the logs.
• What we use it for: only to sign you in, to keep your account safe and to answer your requests about your account. Never for ads or marketing. We do not sell it or share it (section 5). Our use of information we receive from Google follows the Google API Services User Data Policy.
• How to stop: unlink Google in Settings → Account (the app asks for your password; an account made with Google cannot be unlinked, because Google is its only way to sign in), or delete your account (section 7). You can also remove Crossroads Duel from your Google account's connections (myaccount.google.com/connections); that does not delete your game account or the Google account id we keep: to remove those, unlink Google or delete your account.

3. Why we use your data

• To create your account, let you sign in with your username or email address, and keep you signed in.
• If you choose Sign in with Google: to make your account or link it, and to sign you in with Google (2.8).
• To find opponents (and in 2 vs 2 partners) for you and run fair matches. The server decides who hit whom and who won.
• To calculate ratings and stats and to show the leaderboards, your personal bests and challenge results.
• To give you coins and keep track of your items.
• To keep your gun records and ranks, give you the items you earn by playing, and limit how many wins against the same friends count.
• To keep your Reputation. Reputation sets the pace for earned looks, hats and chest pieces; its daily allowance and the limit per opponent stop farming.
• To count feats, which decide who earns the Showman hat and chest piece and the boss hats. For the feats that count only motion controls, we use the controls your app reports for each match (the control statistics in 2.2).
• To keep touch and motion controls fair: we compare how players do with each (the control statistics in 2.2) and tune the touch controls.
• To prevent abuse: limiting sign-in attempts, spotting cheating, banning accounts that break the Terms of Use and fixing wrong coin balances.
• To keep the service running and find and fix problems (server logs).
• To find and fix crashes and other errors in the app (crash reports, 2.7).
• To deliver what you buy, check each purchase with Google and confirm it, and take back what a refunded or charged-back purchase gave (purchases, 2.6).
• To prevent fraud with purchases, and to keep the records we need to answer refunds and chargebacks and for tax and accounts.

We do not use your data for advertising or marketing, and we do not send you marketing emails.

4. What other players can see

• In a match: your username, rating, look, hat, chest piece, weapon, its finish, rank and engraving, control type (motion or touch) and the match results. In 2 vs 2 your partner and both opponents see this (with your 2 vs 2 rating), and everyone's hits, shots and downs after the match.
• In a 2 vs 2 team room: your username and seat, to everyone in the room.
• On the leaderboards (top 50 players each, 1 vs 1 and 2 vs 2): username, rating, wins and losses (on the 2 vs 2 board the 2 vs 2 ones), as well as best draw time, shots, hits and accuracy.
• On the target practice and Arcade boards (top 50 players): username and best score (for Arcade also the most stages cleared).
• On a challenge, to everyone who has its code: the username and score (for Arcade also the stages cleared) of the player who made it and of everyone who answered it.

For this, other players' apps also receive your account's random id.

Your email address is never shown to other players. Tip: choose a username that does not give away your real name.

5. Sharing

• We do not sell or rent your personal data, and we share it only as described in this section.
• Google Play (purchases, 2.6): when you buy something, you pay Google, and the app gives Google the coded account id with the purchase. The server asks Google about each purchase with its purchase token, confirms it, and asks Google which purchases were refunded. Google handles your payment under its own privacy policy.
• Google (Sign in with Google, 2.8): when you use it, your phone talks to Google under Google's own privacy policy. Our server only downloads Google's public keys to check sign-in tokens; it sends Google nothing about you.
• The game has no ads, no analytics services or SDKs, no crash-reporting services and no third-party trackers. The control statistics (2.2) and the crash reports (2.7) stay on the game server.
• Where the game runs and how your connection travels. The game server runs on a server we rent from Vultr (The Constant Company, LLC, United States) in its data centre in Paris, France. The connection between your phone and the server is encrypted with HTTPS. Vultr provides the machine, its storage and the network; we do not send your data to Vultr for any purpose of its own. The address game.crossroadsduel.com is looked up through Cloudflare's DNS service (Cloudflare, Inc., United States), which only tells your phone where the server is and does not carry the game's traffic. Vultr and Cloudflare may keep their own technical logs.
• Service providers. Besides Google Play (above), we use: Vultr to host the game server and to keep automatic copies of the whole server (see section 6); Cloudflare for the domain's DNS, for storing our encrypted daily backup copies (Cloudflare R2, normally in Western Europe) and to forward email sent to our support address to our mailbox at Google (Gmail). The backup copies are encrypted on our server before they are sent, with a key that only we hold: Cloudflare cannot read them.
• Where your data is stored. You may play from anywhere. Your data is stored on our server in France and, as encrypted backup copies, with Cloudflare (normally in Western Europe). Vultr and Cloudflare are companies based in the United States, so your data may be handled by companies outside your country. We keep it to what this policy lists, encrypt it on its way to and from your phone, and encrypt every backup copy before it leaves our server.
• The law. We would give data to authorities only if the law requires us to.

6. How long we keep data

• Account and game data: as long as your account exists. When you delete it, see section 7.
• Your Google account id (2.8): until you unlink Google or delete your account.
• Purchase records (section 2.6): as long as your account exists. After you delete your account they are kept, linked only to the anonymous id, until 7 years after each purchase, because we need them to answer refunds and chargebacks and for tax and accounting records; then the server deletes them automatically.
• Crash reports (section 2.7): 90 days after the server got them, then deleted automatically. On your phone, a report waiting to be sent is deleted after 7 days if it could not be sent.
• Data in the server's memory (section 2.4): gone at the latest when the server stops. The attempt counts are removed within two minutes, the crash-report counts within two hours.
• Server logs: only in the server's memory, never saved to a file; at most 7 days, and erased whenever the server restarts (see 2.5).
• Backups: we keep three kinds of copies, each for a limited time:
  • every day, an encrypted copy of the whole database with Cloudflare R2: each copy is deleted after at most 30 days;
  • Vultr's automatic copies of the whole server: kept about 2 days;
  • before the server upgrades its database (and before we restore or move it), a full copy on the server itself: deleted automatically after 30 days.
  So after you delete your account, your data can still be in a backup copy for up to 30 days, and then it is gone.
• On your phone: until you uninstall the app or clear its data. Uninstalling the app does not delete your account.

7. Deleting your account

You can delete your account at any time, for free, in two ways:

• In the app: Settings → Account → Delete account. The app asks for your password. If your account has no password because you made it with Google, Google asks you to choose your Google account instead, to confirm it is you.
• On the web: the delete account page. Enter your username or email address and your password. If you made your account with Google, it has no password: email us from that Google account's email address and ask us to delete it (section 8). We write back to that address to confirm before we delete it.

Deletion happens immediately and cannot be undone.

• Deleted: your email address, username, password hash, the link to your Google account (your Google account id), sign-in tokens, coin balance and coin history, items and equipment, gun records, ranks and engravings, Reputation and its log, feat progress, your challenge codes (they stop working), and your crash reports: those sent while you were signed in, and those sent from the same installations of the app while signed out.
• Kept without your name: the account record keeps only an anonymous id, the date it was created, whether it was banned, and your game stats, so that past matches and your opponents' ratings stay correct. Your username is replaced by a random placeholder, and your email address is removed.
• You are removed from every leaderboard and challenge. Records of past matches (including 2 vs 2 seats), courses, Arcade runs and control statistics stay, linked only to the anonymous id.
• Your purchase records (2.6) stay, linked only to the anonymous id, until 7 years after each purchase (see section 6). Deleting your account does not refund a purchase: the coins and items you bought are deleted with it.
• Copies in backups disappear within 30 days (see section 6).

Can't sign in any more? Email us and ask us to delete your account (see section 8).

8. Your rights

You can email support@crossroadsduel.com to ask us to:

• send you a copy of the data we have about you;
• correct data that is wrong;
• delete your account and data.

We answer within 30 days. Before we act, we may ask you to show that the account is yours, for example by writing from the email address on the account.

Depending on where you live, the law may give you more rights, such as objecting to how your data is used or complaining to your data protection authority. Email us if you want to use any of them.

9. Children

Crossroads Duel is not made for children. You must be 13 or older to create an account, and you confirm this when you sign up. If we learn that a child under 13 has created an account, we delete it. If you are a parent or guardian and think this has happened, please email us.

10. Security

• Connections over the internet are encrypted with HTTPS; the Google Play version uses HTTPS only.
• Passwords are stored only as argon2id hashes, and sign-in tokens only as hashes. On your phone, tokens are kept in Android's secure storage.
• Google sign-in tokens are checked with Google's public keys, must be made for this game and for one sign-in only, and are never saved or written to the logs.
• Sign-up, sign-in and account-deletion attempts are limited per IP address, per IP address and username, and per account.
• Passwords, tokens and purchase tokens are not written to the server logs.
• The server checks every purchase with Google before it gives anything, and gives each purchase only once.
• The server is behind a firewall that lets in only secure web traffic and administrator logins; administrator access uses cryptographic keys only (no passwords), and the administration functions answer only on the server itself.
• Every backup copy is encrypted (AES-256) on our server before it is stored anywhere else, with a key only we hold.
• Security updates of the server's operating system are installed automatically every day.

No system is perfectly secure. Please use a password that you don't use anywhere else.

11. Changes to this policy

When this policy changes, we update this page and the version date at the top.

12. Contact

The developer of Crossroads Duel
Email: support@crossroadsduel.com