Privacy Policy

Effective 20 October 2026

This policy explains what information the Bomb Pass mobile game ("the app") uses, why, and the choices you have. The app is made by Vantyra Labs ("we", "us"). It applies to the app and to this website.

1. Information stored on your device

To save your game, the app keeps the following only on your device. We never receive it:

• the display name you choose (it doesn't have to be your real name);
• your level, XP, coins, statistics, achievements, World Tour stars, daily challenge streak, and login reward streak and streak freezes;
• the cosmetics you have unlocked and equipped, and your mastery progress and colour choices for them;
• your settings (sound, music, vibration, graphics, control layout and similar);
• a random player ID created on your device, used only so you can rejoin a multiplayer game if your connection drops. It is not linked to you or to any account.

If Android backup is turned on, Android may include this data in your device backup to your Google account. That backup is handled by Google under Google's Privacy Policy.

Sharing a result or a clip. If you tap SHARE or CLIP on the results screen, the app makes a picture of your result, or a few-second video of the match's big moment, on your phone and opens your phone's share menu. It shows your display name and the other players' names as they appeared in the match. It goes only to the app and the people you pick, under that app's own policies; we never receive it. The video stays in the app's temporary storage until your next clip replaces it.

2. Multiplayer

Same Wi-Fi. Same Wi-Fi play (LAN Party) connects phones directly to each other over your local Wi-Fi network. No game server is involved and nothing is sent over the internet. While you are in a room, the other players in that room receive your display name, the cosmetics you have equipped, your moves and actions in the game, and any emotes you send. Your phone's local network address is shared with the other phones in the room so they can connect.

Online. When online play is available and you create or join an online room, the game traffic between the phones in that room passes through a relay server run by Edgegap Technologies (Canada), our relay provider (edgegap.com). The host's phone still runs the match. To set up the room, the app sends Edgegap each player's public IP address, which Edgegap uses to choose a relay near the players and to let only that room's players use it. During the game the relay passes on the same things the other players receive on Wi-Fi: your display name, equipped cosmetics, moves and actions, and emotes. This game data is encrypted between the players' phones, so Edgegap's relay forwards it without being able to read it, and we don't store it; the room is closed on Edgegap when the host leaves. Anyone with the room code can join that room, so share it only with people you want to play with.

To find and join rooms, the app needs the Android Internet, Wi-Fi state and network state permissions. It does not use your location, camera, microphone, contacts or files.

3. Crash reports

We use Firebase Crashlytics, a Google service, to find and fix crashes and errors. When the app crashes or hits an error, it sends a report to Crashlytics containing:

• technical details of the error (stack traces and the state of the app);
• your device model, operating system version, app version, and settings such as orientation, free memory and disk space;
• a Crashlytics installation identifier, a random ID used to tell how many devices are affected. It is reset if you reinstall the app or clear its data.

Crashlytics also records when the app starts and stops so it can calculate how often it crashes.

Crash reports don't include your display name, your game progress or anything you type. We use them only to make the app more stable, not for advertising or profiling. Crashlytics keeps crash reports for 90 days. Google processes this data under the Firebase privacy and security terms.

4. App updates and time checks

If you installed the app from Google Play, it asks Google Play whether a newer version is available and can show you an update prompt. Google Play handles the check and the download under Google's Privacy Policy. We don't receive any information from this.

Ratings. Now and then, after a win, the app may ask Google Play to show its rating prompt. Google Play decides whether to show it and handles any rating or review you give, under Google's Privacy Policy. We don't learn whether you rated the app or what you gave it; your public review appears on Google Play like any other.

When your phone is online, the app also asks our own website (bombpass-game.web.app, hosted on Firebase Hosting by Google) for the current time, about once each time your phone restarts. This keeps daily rewards and the daily challenge fair, so they can't be skipped by changing the phone's clock. The request carries no game data, name or identifier. Like any web request it reveals your IP address to Firebase Hosting, which handles it under Google's Privacy Policy; we don't log or store it. Without internet the game keeps working and uses the phone's clock.

Game settings. The app fetches a few settings from Firebase Remote Config (Google), for example whether online play is available and how many players it can take at once, so we can change them without an app update. To do this, Firebase receives a Firebase installation ID (a random ID for this copy of the app), the app version and basic device information such as language and platform. It contains no game data or name. Google processes it under the Firebase privacy and security terms.

Reminders. If you allow notifications, the game schedules up to two reminders a day on your phone, for example when your daily challenge is ready or your streak is about to end. They are created on your device from your own progress; nothing is sent to us or to any other service to produce them. You can turn them off in the app's Settings or in Android's notification settings at any time. For this the app uses the Android notifications permission (asked for once) and the permission to run at startup, so reminders survive a phone restart.

5. What we don't do

• We don't ask for or collect your name, email, phone number or location.
• We don't show ads or use advertising IDs.
• We don't use analytics or tracking tools.
• We don't sell or share personal information.
• The app has no in-app purchases. Coins are earned by playing and can't be bought.

If any of this changes, for example if we add optional purchases or ads, we will update this policy before the change reaches you, and Google Play's data safety section will be updated to match.

6. Summary of data

7. Your choices and deleting your data

• Reset progress in the app's Settings erases your level, coins, stats, awards and streaks.
• Uninstalling the app, or clearing its storage in Android settings, deletes everything it stored on your device.
• Crash reports can't be traced back to you by name. If you'd still like reports linked to your device deleted, contact us (section 11). Include the approximate date of the crash and your device model so we can find them.

8. Your rights, wherever you live

Bomb Pass is available worldwide, and we offer the same rights to every player. Depending on where you live, laws such as the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), Brazil's LGPD and India's Digital Personal Data Protection Act may also give you these rights by law.

• Who is responsible. Vantyra Labs is responsible for (the "controller" of) the crash report data described in section 3. Google acts as our service provider (processor) for Firebase Crashlytics and Remote Config, and Edgegap for online game relays.
• Why we may use it. We process crash reports because we have a legitimate interest in keeping the app stable and working for everyone. Crash reports are minimal and technical, and you can always stop them by uninstalling the app.
• Your rights. You can ask us to tell you what crash data relates to your device, to delete it, or to stop processing it, and you can object to our use of it. We won't treat you differently for using these rights.
• Selling and sharing. We don't sell your personal information or share it for cross-context behavioural advertising, as those terms are defined in California law.
• International transfers. Google may process crash reports and Remote Config data in the United States and other countries where it operates, and Edgegap runs relays in many countries, choosing one near the players. Where the law requires it, these transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses, which Google includes in its Firebase data processing terms.
• Complaints. Please contact us first and we'll do our best to help. You can also complain to the data protection authority where you live.

The data on your device (section 1) never reaches us. You control it fully, and you can delete it at any time as described in section 7.

9. Children

Bomb Pass is a cartoon game for a general audience. It has no accounts, chat, ads or purchases, and we don't knowingly collect personal information from children. The crash reports described in section 3 are technical and contain no personal details. If you believe a child has sent us personal information, contact us and we will delete it.

10. Security

Crash reports and settings requests are sent to Firebase over encrypted connections. Same Wi-Fi games travel only across your local network; online games travel through Edgegap's relay, which only the players in that room are allowed to use, and are encrypted between the players' phones so the relay can't read them. Like any app, we can't guarantee perfect security, but we collect as little as possible to begin with.

11. Contact

Questions about this policy, or want to use any of your rights? Email us at vantyralabs@gmail.com. We aim to reply within 30 days.

12. Changes to this policy

If we change this policy, we will post the new version on this page and update the effective date above. If a change affects how your information is used, we will also let you know in the app.