Privacy policy
Last updated: October 24, 2026
Bones is an All Fives dominoes game for Android, made by IdleHumans LLC (Idle Interactive) ("we", "us"). This policy covers the game and this website. It says what we collect, why, which other companies' software in the game collects data, how long we keep it, and how you can get it deleted.
In short
- You can play without giving us your name or email.
- We do not sell your data.
- Ads come from Google AdMob, which uses your phone's advertising ID where the law and your choices allow it.
- You can delete your account in the app, or from our account deletion page.
What we collect and why
Your account
When you first open the game it makes a guest account on our server. The app creates a random device ID for it and keeps it in the app's private storage. It is not your phone's hardware ID or advertising ID. We use it to sign you in, so your level and record follow you between sessions.
You can add an email address and password, or sign in with Google. If you do, we keep that email address (and a protected form of your password, never the password itself), or the ID Google gives us for your Google account and its email address. We use them only to sign you in and to reach you about your account.
Device and age checks
When you sign in, the game may ask Google Play to confirm that it is the copy of Bones from Google Play, running on a genuine Android device (the Play Integrity API). Google Play handles the check under Google's privacy policy and gives our server a verdict. We keep the latest check and its verdict with your account, to protect matches from modified apps, and delete them with your account.
When you open the game, it may also ask Google Play for your age range (the Play Age Signals API), if you have chosen to share it, so the age check can use it. That answer stays on your phone and is never sent to us.
Your profile and friends
The name and portrait you choose are public: other players see them at the table, on leaderboards and in search. We also keep your friends list, your friend code, the players you block, and the names and players you report, so those features work and so we can act on reports. A report of a player at a table carries the emotes that player sent there recently, never anything you type. Your friends can see whether you are online or in a match.
Your games
The server deals and scores every hand, so it records every match: the players, every move, the scores, and the numbers used to shuffle each hand. We use these records to run matches, to restore a match after a server restart, to let any player check that a deal was fair, and to settle disputes. From them we keep your level, your wins, games and points, and your places on the leaderboards. Quick-chat emotes are shown to the table and not stored.
Coins, items and purchases
We keep your coin balance and the items you own. When you buy something, Google Play handles the payment; we never see your card or payment details. Our server receives the purchase receipt from the app, checks it with Google, and keeps a record of the order so it is granted once.
Ads
The game shows ads between matches through Google AdMob (the Google Mobile Ads SDK). AdMob collects your phone's advertising ID, information about your device and app, your IP address and how you interact with ads, to show ads, measure them and prevent fraud. If you are in the European Economic Area, the UK or Switzerland, the game first asks for your consent through Google's consent tool (the User Messaging Platform), and shows ads only as your choices allow. In US states with privacy laws, Google's message lets you opt out of the sale or sharing of your data for ads. Where your region has these choices, Settings in the game has a Privacy entry that opens them again: it reads "Privacy choices", or "Do Not Sell or Share My Personal Information" in US states with privacy laws. You can also reset or delete your advertising ID in your phone's settings. If you buy ad removal, the game stops requesting ads.
On the coin store you can choose to watch a video ad for bonus coins, a limited number each day. When you do, Google tells our server the video was watched, with your account ID and a one-time code our server gave the app, so the coins reach your account once. We keep how many videos paid you today and any unused codes with your account.
Crash reports
Once you pass the age check, the game sends crash and error reports to our own crash-reporting server, which runs GlitchTip, open-source software, and receives them through the Sentry SDK for Godot. A report says what went wrong: the error message, cut to 1,000 characters, and where in the game's code it happened. It also describes your phone and the app: the make and model, Android version and whether the phone is rooted, memory, storage, screen, battery and connection type, language and time zone, the graphics hardware, the app's version and the permissions it holds, the game engine's version and settings, the options the engine was started with, and a random ID made for this install, which is not your phone's advertising ID. No account ID, player name or IP address is kept with a report. We use reports only to fix bugs, on the basis of our legitimate interest in keeping the game working, in every region. We run that server ourselves and do not share the reports. We keep crash reports for 90 days.
Product analytics
To learn how the game is played and where it goes wrong, the game records events such as opening the game, passing the age check, making, upgrading or deleting an account, starting and finishing a match or a hand (with how long it took, whether it was blocked and whether you went out), the size of a scoring play and its slam, a connection drop, a failed fairness check, changes to the slam and effects settings, sharing or opening a table invitation, adding, blocking or reporting a player, an ad shown or a rewarded video watched, and opening the store or starting and completing a purchase (whether coins or ad removal, never the amount you paid). Each event carries the game's version, your platform and a random ID made for this install, which is not your account ID, your phone's advertising ID or anything that names you. No event carries your name, email, coin balance, tiles, chat or anything you type. The events go to PostHog, an analytics service, on servers in the United States.
If you are in the European Economic Area, the UK or Switzerland, nothing is recorded unless you agree in the consent message to storing information on your device and to measuring content performance. Until the consent message has been answered, events stay on your phone and are not sent, and if you do not agree they are thrown away. You can change your choice at any time in the game's privacy choices, which stops recording. Elsewhere, events are recorded once the consent message reports that none is needed. When you delete your account, the game makes a new random install ID, so later events cannot be linked to the old ones.
Feedback
The game's Settings page has a feedback form. When you send feedback, we store what you write (up to 2,000 characters) and the kind you choose (bug, idea or other), together with the game's version, your phone model, your Android version, the ID of the last match you played and the hand it was on, and the last part of the game's own log on your phone (up to 300 lines of technical messages, such as errors and connection events). We store it with your account ID and the time it arrived. Only the developer reads it, to fix problems and improve the game; it is never shown to other players. Your feedback is in the data you can download from the app, and it is deleted with your account.
Server logs
Our servers log technical events, such as errors and sign-ins, with your account ID and sometimes your IP address. We use them to keep the game running and secure. We never log your password, your email address in a form on this site, or the contents of a hand before it ends.
This website
The website loads nothing from other companies and sets no cookies. If you send an account deletion request, we keep your email and the player name you give to handle the request. Our hosting provider may keep request logs, which include IP addresses, for a short time to run and protect the service.
What we do not collect
We do not collect your location, contacts, photos or microphone. We do not use your spending, coin balance or results to change how you are matched, how the computer players play, or how tiles are dealt.
Other companies' software in the game
| Software | Used for | Its privacy terms |
|---|---|---|
| Google Mobile Ads (AdMob) and User Messaging Platform | Ads between matches, and asking for consent | policies.google.com/privacy and policies.google.com/technologies/partner-sites |
| Google Play Billing | Purchases | policies.google.com/privacy |
| Sign in with Google (Credential Manager) | Signing in, if you choose it | policies.google.com/privacy |
| Google Play Integrity and Play Age Signals | Checking the app and device at sign-in, and the age check | policies.google.com/privacy |
| Sentry SDK for Godot (open source) | Crash and error reports, sent only to our own server | None: reports never go to Sentry |
| PostHog | Product analytics | posthog.com/privacy |
Our game server runs Nakama, open-source game server software that we run ourselves with a PostgreSQL database, on servers hosted by Railway in the United States. Railway stores the data for us and does not use it for anything else.
How long we keep it
| Data | Kept |
|---|---|
| Account, profile, friends, level, stats, coins, items and device checks | Until you delete your account |
| Match records | As long as the game runs, so every deal stays checkable. When you delete your account they no longer link to you. |
| Purchase records | As long as the game runs, so an order is never granted twice and refunds can be handled. When you delete your account they no longer link to you. |
| Name and player reports | Until they are handled, and at most one year |
| Feedback | Until you delete your account |
| Server logs | Up to 30 days |
| Account deletion requests | Until the request is handled, then a record of the handling for one year |
| Crash reports | 90 days |
| Product analytics events | Up to 12 months |
| Advertising data | As Google's policies describe |
Your choices and rights
- Delete your account in the app, or from our account deletion page.
- Change your ad consent or opt out of the sale or sharing of your data for ads from Settings, then Privacy, in the game, where your region has these choices, or reset your advertising ID in your phone's settings.
- Save a copy of your data from the app (Settings, then Download my data under Account), or ask us for it.
- Ask us to correct or delete your data. Depending on where you live, laws such as the GDPR, the UK GDPR and US state privacy laws give you these rights. We answer within 30 days and do not treat you differently for asking.
Children
Bones is for players aged 13 and over. The game asks your age when you first open it and does not let anyone under 13 play. If you believe a child under 13 has given us information, contact us and we will delete it.
Security and transfers
Data between the app and our server travels encrypted (HTTPS). Our server runs in the United States; if you play from elsewhere, your data is processed there.
Contact and changes
Contact: IdleHumans LLC (Idle Interactive), email [email protected].
If we change this policy, we update the date at the top, and tell you in the game before a change that affects data we already hold.