Bones privacy
EFFECTIVE 15 SEPTEMBER 2026 · PLAIN ENGLISHBones is a dominoes game. It wants to know as little about you as it can. You can play it in full — and buy any skin — with no account at all; signing in with Apple is optional and unlocks online multiplayer. Playing offline sends nothing anywhere. Playing online creates a small profile — the name you pick and your ranking — and passes your moves through the game server so two devices can share the same match.
What is collected
Nothing that identifies you in the real world, and no account is required to use the app. Single‑player, your scores, settings and any skins you buy all live on your device. Online multiplayer needs a sign‑in: Sign in with Apple (optional) shares only an anonymous Apple identifier — no email, no real name — and creates a profile under the display name you choose. To that profile the server attaches your standing: your rating (shown in‑app as "bones"), wins and losses, streaks and match results. During a match, your display name, an anonymous match token and the game's moves pass through the server so both players see the same board. No contacts, no address book, no advertising identifier, no location.
Friends and social play
If you add friends, the server keeps who you've added, requests you've sent, anyone you've blocked, and whether you're currently online — so friends can find each other, invite each other into private rooms, and see who's around. Your display name and rating appear on a global leaderboard and on your friends' lists. Remove a friend, block someone, or delete your account to clear this.
Notifications
If you allow notifications, your device registers a push token with Apple's notification service so the server can tell you when a friend invites you to a game. The token identifies the device, not you; turn notifications off in iOS Settings and it stops.
Where it lives
On your iPhone, and in iCloud only if you have iCloud backup enabled for the app — in which case it is encrypted under your Apple account, not mine. Your online profile, rating, friends and match history live on the game server — rented infrastructure I operate — for as long as your account exists. The live state of a single match is discarded when the match ends; what's kept is the result it produced, like who won and the rating change. Your IP address is used only in the moment, to rate‑limit and cap connections against abuse; it isn't stored against your profile or sold.
Analytics, ads and crash reports
No advertising, no ad SDKs, no tracking identifiers, and no product analytics building a profile of you. The one thing the app reports for its own health is crash and performance diagnostics, through Sentry, so I can find and fix what breaks. It starts only for players who've confirmed they're 13 or older, carries no advertising identifier, and isn't tied to your name or account. What's collected is itemised in the app's privacy "nutrition label" on the App Store.
Third parties
Apple, for Sign in with Apple, the App Store purchase and push notifications, under Apple's own privacy policy. Crash and performance diagnostics go to Sentry, as above. The multiplayer service — matchmaking, ratings, friends and the leaderboard — is operated by me on rented infrastructure. Nothing is sold, and nothing is shared for advertising.
Deleting your data
Delete the app and the local data goes with it. If you signed in, Settings › Delete Account removes your online profile — display name, rating, friends and match history — straight away and revokes the Sign in with Apple link. Prefer email? Write to support and it's gone within a day.
Children
The app is suitable for all ages and collects nothing that could identify a child. No age gate is required because no personal data is gathered in the first place.
Changes
If this policy changes, the effective date above changes with it and the previous version stays available on request. Material changes will also be noted in the app's release notes.
Contact
Questions go to privacy@playbones.app and reach me directly. PLAYBONES LLC is the data controller for the purposes of GDPR; there is no data protection officer because there is one person and no dataset.