Flockfire — Privacy Policy

Effective date: 2026-10-29 Version 1.1 Operator: Junqiang Guo

This policy explains what information Flockfire (星渊战机, "the Game") collects about you, why, where it is stored, how long we keep it, and how you can see and delete it. It applies together with our Terms of Use.

1. In short

The Game saves your progress to a server account. The first time it goes online it creates a guest account for you, and you can link an Apple or Google account to move to a new device. Our servers are in Google Cloud's Sydney, Australia region and hold your account, game progress, currency history, battle results and input recordings, error reports, and logs of each request with its IP address. The current version sells nothing, so we receive no purchase or payment data; Google AdMob provides ads; co-op connects devices directly on the same Wi-Fi. We do not sell your personal information. We use no analytics or tracking tools and no third-party crash-reporting SDK (the Game sends its own error reports to our server, see section 3.7), there is no chat, and we send no push notifications. You can delete your account in the Game at any time.

2. Who is responsible for your data

The Game is operated by Junqiang Guo, an individual developer in Australia ("we", "us"), who is the controller of your personal information. Contact details are in section 13.

3. What we collect

Organised by the Apple App Privacy and Google Play Data safety categories.

3.1 Account and sign-in

• Player ID and device ID: our server generates a random ID for your account and for each of your devices, and records the device platform (iOS / Android) and when it was first and last seen.
• Guest key: the first time the Game goes online, your phone generates a key pair. The private key is kept in your phone's Keychain (iOS) or encrypted storage (Android) and never leaves your phone; our server receives only the public key and, at each sign-in, a signature over a one-time challenge.
• Apple / Google account: if you use Sign in with Apple or Google Sign-In, Apple or Google gives us an ID that represents your account and, if they provide one, your email address (if you sign in with Apple and choose Hide My Email, we receive Apple's relay address). We never receive your password.
• Sign-in tokens: access tokens last 15 minutes; refresh tokens last 30 days, are tied to one device, and are stored on our server only as a hash.

3.2 Game data

• Progress: stage records, gear, ships, talents, awakenings, quests, pass, check-ins, stamina, patrols, achievements, in-game mail and so on.
• Wallet and history: your balance of each in-game currency and a record of every change (currency, amount, balance, reason, time). We use it to run the game rules, check compensation, and deal with cheating.
• Request records: so that a network retry cannot perform the same action twice, our server briefly keeps the ID and result of each action.

3.3 Battle results and input recordings

• When a battle starts, the server records the stage, difficulty, ship, your loadout stats and the battle's random seed. When it ends, your device reports the result (win or loss, time, score, kills, hits taken, remaining health, skills, rating, revives and so on).
• Each battle also uploads an input recording: your control inputs and the random seed, with no audio, video or camera content. The server replays the battle to check that the result is genuine (see section 6 of the Terms of Use), and uses the verified results of all players to build statistics (such as each stage's score distribution) that help spot unusual results.
• In co-op, each player gets their own ticket for the battle from the server, and the host also uploads the team's seats and loadouts so the server can check everyone's results.
• Practice runs played while the Game cannot reach our servers upload nothing.

3.4 Purchases

The current version does not sell anything, so there is no payment to process and we receive no purchase or payment data. If a later version offers purchases, we will update this policy first.

3.5 Advertising

• The Game shows only rewarded video ads, and only when you tap a "watch an ad" button.
• So that rewards are given only for completed ads and within daily limits, our server creates an ad voucher each time you tap, recording the placement, status, times and the transaction ID AdMob sends back. When the ad plays, we pass your player ID and the voucher ID to Google so that Google can confirm to our server that you finished watching (server-side verification).
• The Google AdMob SDK collects its own data: the advertising ID (on iOS only if you allow tracking in the system prompt), approximate location inferred from your IP address, device model and OS version, ad views and interactions, and SDK diagnostics. Google handles this under its own policies. The ad SDK starts on the main menu once you have cleared stage 1 and the opening story has played, or the first time you ask for an ad (in the EU, UK and some US states after Google's consent form, and on iOS after the system tracking prompt) and may preload an ad.

3.6 Co-op (same Wi-Fi)

• Co-op connects phones directly and works only on the same Wi-Fi network or hotspot. When you create or join a room, your nickname, chosen ship, ready status, combat stats and some technical values (protocol version, screen height and the like) are sent to the host's phone, which passes them to everyone in the room. They are held only in the players' phones' memory while the room exists.
• When you create a room, the room code, your nickname and whether the room is locked are broadcast over Bonjour / mDNS to every device on the same network, which can also see your phone's local IP address. On public Wi-Fi, strangers may see them too.
• There is no chat, voice or free text in the Game. The only thing you write that other players can see is your nickname, which is stored only on your phone and never uploaded to our servers. Please do not use your real name, phone number or other personal details as your nickname.

3.7 Technical data and logs

• Server request logs: for every online request we log the time, the endpoint, the result, how long it took, your IP address and your player ID; our host, Google Cloud, also logs the IP address, User-Agent (app and OS version) and other standard access details. We use these to fix problems, keep the service secure and limit request rates.
• Error reports: when something goes wrong, the error and its stack trace, the stage, ship and whether you were in co-op, and your recent currency changes are written to a log on your phone (up to 20 entries). The next time the Game is online it sends these entries to our server automatically, where they are written to the server log together with your player ID, platform and game version. We use them only to find and fix faults.

3.8 Data that stays on your device

Your settings (volume, vibration, language, HUD options), nickname, avatar choice, cached progress, and the private key and sign-in tokens in section 3.1 stay on your device.

3.9 What we do not collect

Your name, phone number, date of birth, precise location, contacts, photos, files, clipboard, microphone or camera content, device hardware serial numbers, or payment card details. We use no analytics, statistics or third-party crash-reporting SDKs and send no push notifications.

4. Why we use your data (and our legal bases)

We do not use your data to track you across other companies' apps, and we do not sell it. Freezes and bans under our anti-cheat rules are decided by a person after review, not solely by automated means.

5. Who we share it with

• Service providers that process data only on our behalf and on our instructions: Google Cloud (servers, database, recording storage and logs, in Sydney).
• Apple and Google: to verify sign-in tokens and to distribute the Game. They also act as independent controllers under their own privacy policies.
• Google AdMob: see section 3.5; Google is an independent controller.
• Other players: players in your co-op room and devices on the same Wi-Fi, as described in section 3.6.
• Legal reasons: to comply with the law, respond to valid legal process, or protect the safety of players, us or the public.
• Transfer of operation: if the operation of the Game passes to someone else or to a company we set up, your data would move with it and stay covered by this policy; we would tell you in advance.

We do not sell your personal information.

6. Where your data is stored

Our servers, database, recordings and logs are all in Google Cloud's Sydney, Australia region. If you play outside Australia, your data is transferred to Australia. Apple, Google and AdMob process the data they receive worldwide, including in the United States. Wherever your data is stored, we protect it as this policy describes, and the providers we use (such as Google) offer safeguards such as standard contractual clauses for international transfers.

7. How long we keep it

8. Deleting your account, and inactive accounts

1. Delete it yourself: you can permanently delete your account on the in-game Account page, without contacting us. We then delete your sign-in identities (including your email), progress, wallet, battle records and ad vouchers, revoke your sign-in tokens and clear the sign-in credentials on your phone; if you signed in with Apple, we also ask Apple to revoke the Game's access.
2. What we keep after deletion: to meet our record-keeping obligations and to prevent fraud and ban evasion, we keep currency history and cheating records, with your player ID replaced by a code that does not directly identify you. We also keep the account core record (random ID, status, creation and deletion dates) and device records (platform, when first and last seen). None of this stays linked to your email or your Apple or Google account. Retention periods are in section 7.
3. Inactive accounts: section 3.8 of the Terms of Use reserves our right to delete accounts that have been inactive for a long time; if we ever use that right, the account is deleted in the same way.
4. Deletion cannot be undone. If you cannot open the Game, you can also email us at the address in section 13 with your player ID or linked email address, and we will delete the account once we have verified it is yours.

9. Your choices and rights

• Ads: every ad is optional and plays only when you tap a "watch an ad" button. On iOS you can turn off tracking in Settings → Privacy & Security → Tracking; on Android you can reset or delete your advertising ID in system settings; in the EU, UK and similar regions you can also change your consent at any time under Settings → Ad Privacy Settings in the Game. If you turn off personalisation you may still see non-personalised ads.
• Not linking: if you do not link an Apple or Google account, we have no email address for you, only random player and device IDs.
• Deletion: see section 8.
• Access, correction, portability, restriction, objection: you can ask for a copy of the data we hold about you, ask us to correct inaccurate data, and restrict or object to some processing (such as processing based on legitimate interests). Where we rely on consent (personalised ads), you can withdraw it at any time.
• EU / UK: you also have the right to complain to your local data protection authority.
• US states (such as California under the CCPA / CPRA): we do not sell your personal information. Providing data to AdMob for personalised ads may count as "sharing", which you can opt out of with the system settings and consent options above. We will not treat you differently for exercising your rights.
• Australia (Privacy Act 1988 and the Australian Privacy Principles): you can ask to access and correct the personal information we hold about you. If you are unhappy with how we handle it, complain to us first and we will reply within 30 days; if you are still unhappy, you can complain to the Office of the Australian Information Commissioner (OAIC, https://www.oaic.gov.au). Even if we are exempt from the Act as a small business, we voluntarily handle your information as this policy describes.
• To exercise your rights, email [email protected] with the player ID shown on the in-game Account page so we can confirm it is you. We reply within 30 days.

10. Children

The Game is intended for players aged 13 and over and is not directed at children under 13 (in some countries or regions the age is higher; local law and the store's age rating apply). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has given us personal information, contact us and we will delete the account. The stores' target audience is set to 13 and over.

11. Security

• All traffic between the Game and our servers is encrypted with HTTPS.
• The guest private key stays in your phone's secure storage; our server stores refresh tokens only as hashes, never the tokens themselves.
• Our servers limit request rates; the admin console is open only to authenticated staff, and every admin action is recorded.
• Co-op connections on the same Wi-Fi are unencrypted local-network traffic; rooms can be protected with a password.
• No system is perfectly secure. If a data breach is likely to affect you, we will notify you and the regulator as the law requires.

12. Changes to this policy

We may update this policy and will change the effective date at the top when we do. We will announce significant changes in the Game in advance and, where needed, ask you to confirm them again. The current version is always available in the Game under Settings → Privacy Policy and at https://starabyss.app/privacy.

13. Contact us

Operator: Junqiang Guo (Victoria, Australia) Email: [email protected] Web: https://starabyss.app