Home

Privacy Policy - DuelBox

Last updated: 23 October 2026

DuelBox is a collection of two-player games for Android. This policy explains what the app does and does not do with your information.

The short version

Nothing you type, name, or play is sent to us. A two-device match exchanges your display name and moves with the other phone only. An online match sends them to the other player through Google's Firebase servers, and they are deleted when the match ends (see below). If you open a room to anyone, your display name is not on the list of open rooms, and a player who joins from that list is not shown it. Nothing else you play leaves your phone.

Only if you agree, the app reports usage statistics to Google Analytics for Firebase — how often the app is opened, which screens are reached, which games are played and in which way, and what kind of device it is running on — along with identifiers for the installation and the device (see below), and, if the app crashes, stops responding or has to stop a match on a fault of its own, a report of the fault to Firebase Crashlytics. The app asks once, when it is first opened. Nothing is sent before you answer, or if you say no. Neither is tied to your name or to any account, and **you can change your answer at any time in Settings → Privacy**.

If you are signed in to Google Play Games, the trophies you earn and four counts for its leaderboards are sent to Play Games under your Play Games profile (see below).

If Android backup is turned on for your phone, Android also backs up your saves, settings and records to your own Google account, as it does for other apps (see below).

There is no account to create, no advertising, and no server of our own. Playing online signs the app in anonymously, with no name, email or password (see below).

What stays on your device

The app stores a small amount of data locally, using Android's own app storage:

None of this is sent to us. It is deleted from the phone when you uninstall the app, with one exception: Android backup.

Android backup

If backup is turned on in your phone's settings, Android includes the items above in the backup it keeps in your own Google account, and copies them across when you set up a new phone. That is what lets a reinstalled or new phone keep your records and saved matches. The backup is Android's and Google's, held under your account; it is not sent to us, and we cannot read it.

The app lists exactly what is included: saved matches, and the settings file that holds your names, preferences and records. Saves the app has set aside as unreadable, and its analytics identifiers, are left out. You can turn backup off, or delete it, in Android's own settings under Settings → Google → Backup (the exact place varies by phone).

What is exchanged when you play on two devices

Choosing Two devices uses Google's Nearby Connections, which links the two phones directly over Bluetooth and Wi-Fi. **No game data travels over the internet, and none of it reaches us or anyone else.**

While a match is running, the two devices exchange:

This exchange lasts only as long as the match. Nothing is stored on either device afterwards, and nothing is sent anywhere else.

What is exchanged when you play online

Choosing Online lets you play someone who is not nearby. One player creates a six-character code and sends it to the other, who types it in. The player creating it can instead open a room, which anyone can then join from a list without being sent the code. The two phones then meet in a "room" on Google's Firebase Realtime Database, in Google's europe-west1 region (Belgium), which carries the game between them. Online play is available for the turn-based games only.

What is stored in a room, and who can see it:

Only the two players in a room can read it; the database's security rules refuse everybody else. Before joining, anyone who has the code can see who is hosting, which game, and when the room was made — the same things the invitation itself tells them. A player who joins by typing your code sees your display name, and you see theirs, as you would across a table.

Open rooms. A room you open to anyone is also put on a list that every player can read on the Join a game screen: its code, which game it is for, the app's protocol version and when it was made. Your display name is not on that list. It stays on the list only while it is waiting: it is taken off as soon as somebody joins, when you cancel, or when your connection drops. A room made with Create a code is never on the list. The list is read only when you tap Play online on that screen, not when you open it: the read signs the app in anonymously and connects to the database for as long as it takes.

Two players who meet through that list are strangers, and the app shows neither of them the other's name: each sees the other as "Opponent". The joining player's name is not sent at all. The host's name is still stored with the room, as it is for every room, because a friend may join the same room with its code; the app does not show it to a player who came from the list.

How long it is kept: the room, and everything in it, is deleted when the match ends. If the app is closed or loses its connection before then, it deletes the rooms it made the next time it is opened, and a code more than a day old can no longer be joined. A room the app never gets the chance to delete — because it was uninstalled mid-match, for example — stays on the server until we remove it; it holds nothing beyond the list above.

Anonymous sign-in. To keep strangers out of rooms, the app signs in with **Firebase Authentication the first time you play online, which includes tapping Play online** on the Join a game screen. The sign-in is anonymous: it creates a random user ID and asks for no name, email or password. Google processes your IP address and the app's version while signing in, to prevent abuse. The ID stays with this installation until you uninstall the app or clear its data.

App Check. Online play also uses Firebase App Check with Google Play Integrity, which checks that requests come from a genuine copy of the app on a genuine device. Google's handling of that check is described in the Play Integrity documentation.

What online play sends travels encrypted (HTTPS/TLS). Google processes it as our data processor under Google's Privacy Policy and the Firebase privacy and security information. None of it is used for advertising, and none of it is combined with the usage statistics or the crash reports below.

Google Play Games

If you are signed in to Google Play Games on your phone, the app tells Play Games about the trophies you earn, as Play Games achievements, and four counts for its leaderboards: your wins (leaving out matches with a friend on the same phone), your experience, your wins against the computer at Hard, and your wins online. Nothing else about your matches is sent: no moves, no names, no record of who you played.

Play Games is Google's service and is used under your own Play Games profile. Google holds your achievements and scores under that profile and shows them to you, and the leaderboards show your Play Games name and picture beside your scores to other players, as your Play Games settings allow. The app does not read your Play Games profile and does not receive your name, picture or account. The one thing it reads back is your own place on each of its four leaderboards, to show it on your player page; it is not stored. You can see, hide or delete what Play Games holds in the Play Games app or in your Google Account, as described in Google's Privacy Policy.

Play Games may sign you in when the app starts, as it does for other games, if your Play Games settings allow it. Otherwise you are asked only when you tap Sign in to Google Play Games on your player page. If you are not signed in, nothing is sent, and every game, trophy and level works the same.

Usage statistics

The app includes Google Analytics for Firebase. It is switched off until you agree to share usage data (see "Your choice" below). When it is switched on, the Firebase SDK collects a standard set of measurements automatically, and the app adds six events of its own about how it is played. That is all of it:

We use this only to see how often the app is used, which games and ways to play are worth working on, where meeting another player goes wrong, and which devices to keep working on. The app shows no advertising, and it tells Google's SDK so: the three advertising uses the SDK offers (advertising storage, advertising user data and ad personalization) are refused from the start, and nothing in the app switches them on. The statistics are processed by Google as our data processor; Google's own handling of it is described in Google's Privacy Policy and in How Google uses data from apps that use our services. Google Analytics keeps event-level data for the retention period set for the app's Analytics property, and aggregated reports for longer; see Google's data retention documentation.

What is never collected: your display name or the guest name, anything else you type, such as a secret word or a room code, the moves of any game or who won it, your records, your settings, your contacts, your files or your precise location. Of a two-device or online match the statistics hold only the facts above: that one was started or finished, which game it was, and whether the two phones found each other. What an online match stores is described above; the usage statistics never include it.

Crash reports

The app includes Firebase Crashlytics. When the app crashes or stops responding, a report is written on your phone and sent to Crashlytics the next time the app starts. When a fault in the app's own code stops a match without closing the app, a report of it is written and sent the same way. A report holds:

We add nothing to a report: no name, no board, nothing you typed. From a stopped match we also leave out the text of the error itself, which could hold the board. We use the reports only to find and fix faults. Google processes them as our data processor and keeps them for 90 days; see the Firebase privacy and security information.

Your choice

The first time the app is opened it asks whether to share usage data: one question for the usage statistics and the crash reports. Until you answer, and if you answer no, nothing described in this section is collected or sent. A copy of the app installed before this question existed shared by default; once it is updated it stops sharing and asks you the same question, unless you had already used the switch in Settings, in which case what you chose there stands.

You can change your answer at any time under Settings → Privacy → Share usage data. Switching it off stops the statistics immediately, and they stay off on every later launch. No crash report is sent while it is off, and one already written on your phone is deleted unsent. Nothing else about the app changes; every game works exactly the same whichever you choose.

You can also reset or delete your advertising ID in Android's own settings, under Settings → Privacy → Ads.

Feedback, rating and telling a friend

Three rows under Settings → Privacy and about hand you to another app. None of them sends anything by itself.

Once, after you have finished a few matches, the app asks Google Play to show its rating window. That window is Google Play's own. A rating or a review you give in it goes to Google Play under your Google account, as it would from the Play Store, and can be changed or deleted there. The app is not told whether the window was shown or what you answered.

Permissions

Two-device play asks for Bluetooth and nearby-device permissions when you first use it. Android requires them to let two phones discover and connect to each other.

You can decline these permissions. Two-device play will not work, but every other way of playing — pass and play, and playing the computer — is unaffected.

The app also holds the internet permission. It is used for four things: sending the usage statistics and the crash reports described above, online play when you choose it, and Google Play Games when you are signed in to it. No other game data is sent over it. Online play needs no permission beyond this one.

Children

The app is not directed at children and asks for no personal information from anyone. It contains no advertising. If you are setting it up for a child, we recommend not sharing usage data: answer no when the app asks, or switch Share usage data off in Settings. Nothing is then collected, the advertising ID included.

Your rights

If you are in the EU or UK, you can ask what is held about you, ask for it to be deleted, or object to the processing, by writing to the address below. Switching Share usage data off in the app is the fastest way to stop the statistics and the crash reports, and uninstalling the app ends them entirely. The anonymous user ID used for online play, and any room still held under it, can be deleted the same way. Being anonymous, it is not linked to anything we can look you up by, so include a room code you played with; uninstalling the app, or clearing its data, also cuts your phone off from it for good.

Changes

If this policy changes, the updated version will be published here and the date at the top updated.

Contact

Questions about this policy: ataalpaltug@gmail.com