We are a one-person game studio in Israel. We collect as little as we can. Most of our games keep your progress only on your phone. Where you choose to make a BananaBolt ID account, we keep your username, email, a scrambled password and your game data on our own server, and you can delete it all at any time. Free games show Google ads, and Google may use device data for them; you choose whether ads are personalised, and children never get personalised ads. We never sell your data and never send marketing email. Each game also has its own page that lists exactly what that game does.
Each game's own privacy page
This policy covers everything we do. The game pages list exactly what each game stores and sends:
- Doodle Hunt (online, optional BananaBolt ID account, drawings)
- Wagon Run (offline, optional leaderboard)
- Gorilla Rush (offline)
- Twistbloom (offline, optional leaderboard)
If a game page and this policy differ, the game page is more specific and applies to that game.
Who is responsible for your data
The "controller" (in Israeli law, the "database owner") is Daniel Nahman Levi (operating as Banana Bolt), 89 Derech Ramatayim, Hod HaSharon, Israel. Email: [email protected]. We have not appointed a Data Protection Officer because the law does not require one for a studio of our size; the owner handles all privacy questions personally.
What we collect and why
| Information | When | Why | Legal basis |
|---|---|---|---|
| Game progress and settings on your device | All games | Saving your game. It stays on your device; we never see it. | Not sent to us |
| Username, email, scrambled (hashed) password, sign-in sessions | Only if you create a BananaBolt ID | Running your account, helping you, keeping it secure | Your consent and our agreement with you (contract) |
| Game data: level, stats, friends, coins, items, missions, purchase records | Account games | Saving progress, friends, shop, leaderboards | Contract |
| Drawings and titles | Doodle Hunt drawings | Showing your content to other players; moderation | Contract; our legitimate interest in keeping players safe |
| Game-made leaderboard name, stars, level, random player ID | Twistbloom and Wagon Run, only if you join the leaderboard | Public star ranking | Your consent (you choose to join) |
| IP address | Every connection to our servers | Stopping abuse. Kept only in memory for a few minutes, not stored with your data | Legitimate interest (security) |
| Advertising ID, IP address, approximate location, ad interactions, diagnostics | Free games with ads; collected by Google | Showing, measuring and protecting ads | Your consent for personalised ads; otherwise legitimate interest for non-personalised ads |
| Your emails to us | When you write to us | Answering you, handling refunds and reports | Legitimate interest; legal obligation for refund records |
You do not have to give us any information by law. You can play our offline games and Doodle Hunt's Quick Play without any account. If you do not give the information an account needs, you cannot use the account features (friends, shop, drawings, saved progress online).
We do not collect your real name, phone number, contacts, photos, precise location, voice or face. We do not run our own analytics or tracking.
Ads
Our free games show ads from Google AdMob (and, on the web, Google's ad placements for games). Google collects the data listed above under its own policy: policies.google.com/technologies/partner-sites. In the EEA, the UK and Switzerland, the game asks your consent with Google's certified consent form before any personalised ads. On iPhone, Apple's "Allow tracking?" question decides whether the advertising identifier is used. You can change your choice at any time in the game's settings ("Privacy choices") or in your phone's settings. In Doodle Hunt, when you watch a reward ad, your BananaBolt ID user number is sent with the ad's reward check so the coins go to the right account; it is not your name or email.
We tell Google to treat players who are under 13 (or under the age of digital consent in their country) as children: they get only non-personalised, family-friendly ads.
Children
Our games are made for everyone, and children play them. We treat children carefully:
- Our offline games need no account and send us nothing about the player.
- We are adding an age question before account creation, drawings or chat. Once it is in a game, players under 13 (or under the age of digital consent where they live) will need a parent's consent, given by the parent's email; until then, those features stay off for them.
- Children get no personalised ads, and their data is never sold or shared for advertising.
- Leaderboard names are made by the game, so children cannot reveal their name there.
- Parents can ask us at any time to see, correct or delete their child's data and to stop further collection. Write to us from the parent's email; we answer within 30 days.
- If we learn we have data from a child under 13 without a parent's consent, we delete it.
Who else gets data
We never sell personal information. Only these companies are involved, each for a specific job:
- Google (ads; Google Play billing; our support email runs on Gmail).
- Apple (App Store purchases; App Tracking Transparency).
- Cloudflare (protects and delivers our website, and runs Doodle Hunt matches in memory).
- Other players see what the game shows them: your username, level, stats, approved drawings and messages you send.
- Authorities, only when Israeli law requires it, or to protect someone from serious harm.
Where data is kept, and international transfers
Our own server (BananaBolt ID and leaderboards) is in Israel. The European Commission recognises Israel as giving adequate protection to personal data, so data from the EU can be transferred here. Google, Apple and Cloudflare may process data in the United States and other countries under their own safeguards (such as the EU Standard Contractual Clauses and the EU-US Data Privacy Framework).
How long we keep data
| Data | How long |
|---|---|
| BananaBolt ID accounts | Until you delete the account. We may delete an account that has not been used for 3 years, after a warning in the game. |
| Sign-in sessions | Expire after 90 days |
| Leaderboard entries (Twistbloom, Wagon Run) | Until you ask us to delete them, or the leaderboard closes |
| Server backups | Replaced every day; deleted data is gone from backups within 7 days |
| IP addresses | Minutes, in memory only |
| Store receipt references | Kept without any link to you after account deletion, so a receipt cannot be used twice |
| Support emails | 2 years after the conversation ends, longer only if needed for a legal claim or tax record |
How we protect data
Passwords are stored only as salted scrypt hashes, sign-in tokens only as hashes, and all connections use HTTPS. Only the owner has access to the server and its backups. We collect as little as possible and keep a written database definition and security procedure, as the Israeli Privacy Protection (Data Security) Regulations require. If a serious security incident happens, we will report it to the Israeli Privacy Protection Authority and tell affected players when the law requires it.
Your rights
Wherever you live, you can ask us to:
- see the personal information we hold about you and get a copy;
- correct it if it is wrong;
- delete it (you can delete your BananaBolt ID yourself in the game or on the Delete your BananaBolt ID page at bananabolt.xyz);
- withdraw a consent you gave, at any time, without affecting what was done before;
- object to processing based on our legitimate interests, or ask us to limit it;
- receive your account data in a common format (data portability).
Under the Israeli Privacy Protection Law you have the right to see your information (section 13) and to ask for it to be corrected or deleted (section 14). If you are in the EU or the UK, you have the rights in the GDPR and UK GDPR. If you live in California or another US state with a privacy law, you have the right to know, delete and correct, and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information; to stop ad-related sharing, turn off personalised ads in the game's privacy choices or your device settings.
To use a right, email [email protected], ideally from your account's email. We answer within 30 days and may ask you to prove the account is yours. There is no charge.
If you are not happy with our answer, you can complain to the Israeli Privacy Protection Authority (gov.il), to the data protection authority where you live in the EU, or to the UK Information Commissioner's Office (ico.org.uk).
Cookies and storage on your device
Our website and web games use your browser's storage only for things you need, such as staying signed in and your settings. We use no advertising or analytics cookies on our own website. Details: Cookies and storage.
Emails and notifications
We do not send marketing emails or messages. In-game notifications (for example, "your drawing was approved") appear only in the game. Reminder notifications on your phone are set by the game on your device and can be turned off in the game's settings. If we ever want to send news by email, we will ask for your separate, clear consent first, and every message will have a one-click way to stop.
Changes to this policy
If we change how we handle data, we update this page and its date. For important changes we also tell players in the game before the change applies, and we ask for new consent where the law requires it.
Contact
Email: [email protected] · Post: Daniel Nahman Levi (operating as Banana Bolt), 89 Derech Ramatayim, Hod HaSharon, Israel