Privacy Policy

This policy covers Dice Duo: 2 Player Dice Games, also previously called DiceBack, and the Bouncy Comet website. Bot and same-device play do not require email or Google registration. Online play, account progress and advertising involve the data described below.

Contents

• 1. Studio and contact
• 2. Scope
• 3. Website and email
• 4. Dice Duo data
• 5. Uses of data
• 6. Legal bases
• 7. Providers and sharing
• 8. Age and parental requests
• 9. Choices and rights
• 10. Retention and account deletion
• 11. Security
• 12. International processing
• 13. Updates

1. Studio and contact

Bouncy Comet ("we", "us") develops and operates Dice Duo and bouncycomet.com. We are responsible for the account and game-service data we process. Advertising and other providers may also process data for their own purposes, as explained below.

For privacy, access, correction or deletion requests, email privacy@bouncycomet.com. For game help, including a purchase or refund question, use support@bouncycomet.com; the steps are on our Refunds and Cancellations page. Legal enquiries go to legal@bouncycomet.com.

2. Scope

This policy describes the website and the current Android Dice Duo service, including bot play, local two-player play and online games. Grid War, DiceBack, Roll Race, Six Spots and Scoop Stack are games inside Dice Duo. Future games or materially different features may need an updated policy. Links to another company's site, app store or advertisement are subject to that company's own policies.

3. Website and email

This website is served from the same rented server infrastructure that runs our game service. Serving a page involves technical request information such as IP address, requested page, browser information and time; the website's web server does not keep an access log of these requests. This website has no player login and no advertising tracker, and it takes no payments: where purchases are offered, they are made inside the Dice Duo app through Google Play. Its contact and deletion-request buttons open your email application; they do not submit a web form to our game server.

This website serves its own fonts from bouncycomet.com. No page requests a font from another company.

This website links to Dice Duo on Google Play and to our Facebook and Instagram pages. These are plain links: no page here loads a script, pixel, widget or image from those companies. If you follow a link, or follow or message us there, that company handles your information under its own privacy policy.

If you email us, we receive your email address, message and any attachments you choose to send. Our studio mailbox and game verification messages use Google's email services. We use correspondence for support, handling privacy requests and keeping necessary records of those requests. Do not send us passwords, payment-card details or unnecessary sensitive information.

4. Dice Duo data

Bot play, same-device play and local settings

Bot and same-device two-player games do not require you to register an email or Google account. Newer app versions require an internet connection and an available game service to start and continue play, including bot and same-device games. A mode labelled "Offline" describes local play rather than a promise that the app works disconnected. Local saves, game choices, sound and vibration settings remain on your device unless a feature sends them to the service as described below. Your Android or device backup settings may affect whether local files are backed up or restored. Signing out, deleting a server account and uninstalling the app are different actions; none should be assumed to erase device-provider backups.

Playing without an account does not mean no network or advertising data can be processed. The app retrieves service configuration and advertising components can process technical data when they operate.

Accounts and authentication

For an email account we process your email address, chosen display name, account ID, a securely hashed password, verification/reset records and login sessions. A password entered into the app is sent to our server over HTTPS for authentication; the account database stores a password hash rather than the original password.

For Google sign-in we receive the sign-in identifier and account information Google provides, such as email, verification status and a name used to initialise your game profile. We do not receive your Google password. The app may automatically create or restore a guest game profile on this device. Linking an email or Google account is separate. Online matches, private rooms, the online store, daily rewards and leaderboards need a signed-in game session and a connection; guest sessions are supported where available.

Gameplay and public profile

The online service processes match participation, moves and results, activity times, rating, level and XP, virtual-coin balances and transactions, reward claims and cosmetic inventory. Offline results may be reported when you use signed-in reward or progress features. These records operate matches, progress, rewards and leaderboards and help investigate cheating or disputed rewards.

Your display name, selected game avatar and relevant game statistics can appear to opponents and on leaderboards. Choose a nickname that does not reveal private information. Avatars and skins are selected from game-provided artwork; the current game does not offer player photo uploads or player-to-player chat.

Device, session and service records

We process installation/device identifiers, device name, IP address, browser or client information, app/service activity times and authentication tokens. Service, security and advertising-reward records may include account IDs and technical request details. These support authentication, connectivity, fraud prevention, troubleshooting and correct rewards. IP address may also be used by advertising providers to infer approximate location; the game does not request precise GPS location.

Optional play reminders

Play reminders are off until you turn them on in the game and allow notifications on your device. When they are on, the app schedules one reminder on your device for when you have been away, with quiet hours from 9 PM to 9 AM local time.

If you are signed in and we have switched on server reminders, the app also sends our server a notification token from Google's Firebase Cloud Messaging (FCM), the platform (Android), your device's language setting and its time-zone setting, linked to your game account. We use them only to send the reminders you turned on through FCM: no more than three a week, at least a day apart and never during quiet hours. The server stores the token encrypted, and the record expires 90 days after the app last registered it. Turning reminders off in the game stops them and deletes the token from our server; if you block notifications in your device settings, the app removes the token the next time it runs. Deleting your account deletes it too.

Advertising and measurement

Dice Duo includes Unity LevelPlay / ironSource mediation, Unity Ads, Google's Mobile Ads components and Google's User Messaging Platform (UMP). Ads may be switched on or off by service configuration. When available, rewarded ads are optional and can offer virtual coins. Other supported ad formats can be displayed under the applicable game settings. Choosing not to watch a rewarded ad does not disable every SDK's technical processing.

Advertising providers can collect and share advertising and installation/device identifiers, IP-derived approximate location, account-related identifiers, ad views and interactions, device/app information and performance diagnostics. Unity Ads' data disclosure also lists purchase history. The game itself records virtual-coin transactions and, where a purchase is made, the Google Play purchase records described under Purchases below. Providers use data to deliver and measure ads, analyse performance, prevent fraud and operate their services. Depending on your choices and the applicable provider rules, this can include personalised advertising. A mediation provider may send requests to its enabled advertising partners.

The app does not ask for your date of birth. Versions that offer an advertising age-group choice store a separate declaration on your device: not answered, under 18, or 18 or older. This is a self-declaration, not identity or parental-consent verification. Unknown and under-18 age groups receive conservative under-age and child-treatment restrictions and no-sale/sharing treatment. A declaration of being 18 or older can allow adult ad requests, subject to the applicable UMP privacy choices and provider permission; the age declaration itself does not grant advertising consent. Advertising-ID opt-out remains enabled for every age group. Ads remain disabled if required privacy handling cannot be applied. Restrictions can reduce available ads and do not stop every SDK's technical processing, such as IP address, device information and diagnostics. These choices do not change the game's intended audience of players aged 13 and over.

The app uses UMP to request applicable advertising privacy choices before its explicit ad-provider initialisation. Privacy choices and available forms depend on region, under-age treatment and provider settings. Opening Settings → Privacy & ads → Ad choices in the game pauses ad requests and discards loaded ads; further requests depend on current permission and successful privacy handling. Use this option when available, your Android advertising controls, or contact us for help. Resetting an advertising ID does not remove every installation or account identifier. Account deletion is not the same as withdrawing an advertising provider's consent.

Optional Meta app measurement

In app versions that offer App measurement, Meta measurement is off by default. Before it can start, you must separately confirm that you are 18 or older and choose Allow measurement. Unknown age, an under-18 declaration, closing either choice or choosing to keep it off does not enable it. You can use the supported game features with measurement off. Google's UMP advertising choices do not grant this separate permission.

The app stores your age band (not answered, under 18, or 18 or older), measurement choice and choice record on your device. We do not ask for a birth date or exact age, and this is a self-declaration, not identity or parental-consent verification. This integration does not send the declaration, age band or game-account information to Meta or to our game server.

If you opt in, Meta's Android App Events SDK can send app-install and app-open events, app/device information and installation or attribution identifiers to Meta. Meta also receives your IP address when the SDK connects. These records help measure our ads and understand which ads bring players to the app. Advertising ID collection is disabled for this integration, and it does not send your name, email address or phone number. Disabling Advertising ID does not remove other installation or attribution identifiers and does not make the data fully anonymous. This optional measurement covers eligible players who opt in, rather than every installation.

Your explicit Do not sell or share my info choice in Settings also keeps Meta measurement off. Turning that choice on withdraws an existing measurement permission and stops new app-requested measurement. Turning the choice off again does not enable measurement: an adult must make a new, separate measurement opt-in. This setting and the measurement permission do not supply the separate advertising age-group choice or override applicable UMP privacy choices.

To withdraw measurement directly, open Settings → Privacy & ads → More choices → App measurement → Turn off. The app saves the off choice and stops making new measurement requests. SDK work already queued or in flight and information already sent cannot be withdrawn by either switch. Turning it off is separate from requesting deletion of information Meta already holds; see Meta's privacy information below or contact us for help. UMP advertising forms and advertising age-group treatment remain separate from this measurement permission.

Optional Firebase usage analytics

In app versions that offer Usage analytics, Google Firebase Analytics is off by default for a new installation. The app asks separately whether you are 18 or older and whether you allow usage analytics. Unknown age, an under-18 answer, dismissing the prompt or keeping it off does not grant permission. Your local age-band and consent record are not sent to Analytics. This is a self-declaration, not identity or parental-consent verification. Playing, signing in, using a guest mode, notification permission and advertising choices do not grant this permission.

If you opt in, Firebase can receive first app opens, sessions, engagement, basic app/device information and a random app-instance identifier. Where Google Play purchase tracking is linked and in-app purchases are available, Firebase can automatically receive purchase events such as product ID/name, price, currency and quantity. This does not give Analytics your card or bank details. Google receives the connection IP address and may derive approximate location. Our custom screen labels are welcome, guest and signed in. In newer app versions, we also measure first play, practice and match starts/completions, sign-in/linking steps, skin collection views and ad load/display/reward outcomes, using predefined game and mode categories. We do not set an Analytics user ID or send your game-account ID, name, email, phone number or advertising ID through this integration. Analytics storage is enabled after opt-in; advertising storage, ad-user data and ad-personalisation consent stay denied. This does not make the data fully anonymous or change the separate advertising SDK practices described above.

Measurement can begin on the welcome screen after you allow it, before you sign up or choose guest play. It therefore includes consenting adults who never create an account. It cannot observe a download that is never opened. Firebase first-open events can also include reinstallations and existing installations first receiving Analytics, so they are not an exact count of new Play Store users. Authorised studio staff see aggregate activity reports in our protected admin panel through a separate read-only reporting connection. The panel does not receive individual app-instance records or use the reporting connection to change ads, payments, login or notifications.

Withdraw through Settings → Privacy & ads → More choices → Usage analytics → Turn off. The app saves the off choice, disables Analytics collection and resets local Analytics data. Do not sell or share my info also withdraws this choice; turning that switch off again does not enable Analytics without a new adult opt-in. SDK work already queued or in flight cannot be recalled. Signing out, deleting a game account or resetting the Analytics identifier does not automatically delete information already received by Google. Contact privacy@bouncycomet.com for provider-data requests; we may need information sufficient to locate a record, and a game account alone may not identify separate Analytics records. Do not send passwords or unnecessary sensitive information.

For this Analytics property, event-level retention is currently two months and user-data retention is fourteen months, with the user-data timer reset by new activity. Most standard aggregate reporting is not governed by those event/user retention settings. Local consent remains until changed or local app data is cleared and may be affected by device backup/restore. The admin reporting cache is short-lived and does not create a separate event-level player database. Google processes Analytics data under its applicable terms and privacy controls; see Firebase privacy and security information and Analytics retention controls.

Purchases

Dice Duo may offer optional purchases of virtual items through Google Play. They are not offered in every version of the game or in every country. Google takes the payment and handles your payment method under its own terms and privacy policy. We do not receive, see or store card, bank or other payment-method details. When a purchase starts, the game gives Google Play a one-way hashed identifier of your game account, so that the completed order can be matched to the account that made it.

To deliver a purchase, the game sends our server the product ID and the purchase token issued by Google Play, and the server verifies them with Google. We keep a purchase record linked to your game account: a hash of the purchase token, the one-way hashed account identifier, the Google Play order ID, the product, the purchase status and times (including a later refund or reversal) and the items delivered. A purchase token that is still waiting for Google's acknowledgement is held in protected form until that step completes. We use these records to deliver each purchase once, restore one-time bundles, answer purchase and refund requests, and detect duplicate or fraudulent claims.

Nothing in Dice Duo is played for real money, and there are no cash prizes or withdrawals. Coin balances, purchased virtual items and cosmetic transaction records are game data, not a bank balance.

5. Uses of data

• Game functionality and account management: verify accounts, authenticate sessions, run online matches, save supported progress, manage cosmetics, deliver verified purchases and award virtual rewards.
• Security and fair play: detect misuse, investigate invalid rewards and refunded or duplicate purchases, enforce bans and protect accounts and the service.
• Diagnostics and analytics: investigate service faults and measure advertising and SDK performance.
• Advertising: request, deliver, personalise where permitted and measure advertisements.
• Optional app measurement: after an adult declaration and explicit opt-in, measure app installs, app opens and advertising performance using Meta, as described above.
• Optional reminders: send the play reminders you turned on, at the times and limits described above.
• Communications and legal duties: send verification, reset and account messages, answer requests and comply with applicable legal obligations.

We do not sell an email list or provide account passwords to advertising partners. Advertising-related sharing may be treated as a sale or sharing under some privacy laws even without a payment for the data. The provider disclosures and your applicable privacy choices matter; this policy does not claim that advertising sharing never occurs.

6. Legal bases

Where applicable law requires a legal basis, account and requested gameplay processing supports the service you request; security, fraud prevention and necessary operations rely on legitimate interests where allowed; consent applies to optional advertising/device processing where required; and legal obligations apply to records or disclosures required by law. You may withdraw consent or object as applicable. We do not treat reading this policy as consent to every kind of processing. Optional Meta app measurement and Firebase usage analytics each require their separate in-app adult declaration and affirmative choice described above.

7. Providers and sharing

• Google: Google Play distribution, Google Play payments and purchase verification where a purchase is offered, Google sign-in, Gmail-based transactional/studio email, Mobile Ads, UMP and Firebase Cloud Messaging for optional play reminders, and Firebase Analytics for optional adult usage analytics described above. See Google's Privacy Policy and advertising information.
• Unity / ironSource: LevelPlay mediation and Unity Ads, including enabled advertising partners. See Unity's Game Player and App User Privacy Policy and LevelPlay legal resources.
• Meta: optional Android app-install/open measurement after an adult declaration and explicit opt-in, including the app/device information, IP address and installation/attribution identifiers described above. See Meta's Privacy Policy. Meta may process received information under its own applicable terms and privacy practices.
• Game-server infrastructure: hosting, storage and network services used to operate our API, databases and this website. These can process technical/account data as service providers. Write to our privacy contact for questions about your records and the relevant infrastructure.

Other players can see the public game profile and gameplay described above. Authorised studio staff can access records needed for support, moderation, security and operations. We may disclose relevant records for valid legal requirements or to protect rights and safety. Advertising providers may have independent purposes and retention practices; their processing is not limited to instructions from us.

8. Age and parental requests

Dice Duo is intended for players aged 13 and over. It is not intended for children under 13. Being 13 does not automatically make someone an adult or old enough to give privacy consent in every country. Players must meet local eligibility rules and obtain parent or guardian permission where required. A store age rating describes content and is not a substitute for these requirements: Google Play shows Dice Duo as "Rated for 3+" (an IARC content rating), which describes what is in the game, not the age it is intended for.

Advertising age-group treatment and optional measurement use separate device-local choices. Unknown and under-18 advertising age groups keep restricted ad treatment; a declaration of being 18 or older does not itself grant UMP advertising consent. Optional Meta measurement and Firebase usage analytics each remain off until their own adult declaration and separate opt-in. These self-declarations are not dates of birth or verified ages and do not change the intended audience. The app does not send the local age-band declaration to Meta, Analytics or our game server; advertising providers receive the applicable request-treatment flags described above.

If you believe a child below the permitted age has provided personal data, or you are a parent or guardian making a request, contact privacy@bouncycomet.com. We will take reasonable steps to verify the request and remove the affected account/data as applicable, subject to necessary security or legal retention. We do not claim a children's privacy certification or that the current app includes a verified parental-consent system.

9. Choices and rights

You can play supported bot and same-device modes without email or Google registration, subject to the connection requirement in newer versions. You can change supported profile/settings options, turn play reminders on or off, keep optional Meta app measurement and Firebase usage analytics off or withdraw them in Settings, use available advertising privacy choices and request account deletion. Depending on the law where you live, you may also have rights to access, correct, delete or receive your data, restrict processing, object, withdraw consent or complain to a privacy regulator.

Email privacy@bouncycomet.com to make a request. Include the account email and the request; do not include your password. We may need to verify ownership or parental authority before acting. We respond within applicable legal deadlines; if a lawful extension is needed we will explain it. Requests about a provider's independent records may also need that provider's own privacy process.

10. Retention and account deletion

Delete in the game: Profile → Account → Delete account. Complete the confirmation and ownership check. Request deletion without installing or signing into the game: use our Dice Duo account-deletion page or email privacy@bouncycomet.com. Email requests are handled by studio staff after ownership verification.

Deletion revokes player sessions and removes the live account, profile/progress, balances, coin ledger, inventory, personal login links and associated account authentication records. Public match display names are changed to "Deleted player". Deletion is permanent. An account deletion does not erase another player's record of a match or automatically delete your device's local files or provider-managed backups.

• Active account/progress: retained while the account exists. Unverified sign-ups are eligible for cleanup after 7 days.
• Routine authentication/email records: verification/reset records are eligible for cleanup after 2 days; transactional email outbox records after 30 days; expired refresh-session records 7 days after expiry. Cleanup is periodic, so these are cleanup thresholds rather than exact deletion times.
• Administrative/security audit records: current routine cleanup threshold is 730 days.
• Advertising reward callbacks: current routine cleanup threshold is 90 days. Account links are detached where supported; callback payloads can contain technical details or a previous account identifier until cleanup.
• Play-reminder tokens: deleted when you turn reminders off or delete your account; otherwise the record expires 90 days after the app last registered it.
• Local Meta measurement choice: the app retains the local age-band and measurement-choice record until you change it or the app's local data is cleared. Device backups may retain or restore local data. Signing out or deleting a game account does not turn this separate local choice off; use the App measurement setting to withdraw. Meta applies its own retention and privacy-request processes to information it already received. Turning measurement off does not automatically delete that information.
• Purchase records: kept while the account exists. After account deletion the direct link to the account is removed, but the rest of the purchase record remains: the hashed purchase token, a one-way hashed account identifier, the Google Play order ID, the product, what was delivered, the purchase status and times, and the record of a one-time bundle. A purchase token still waiting for Google's acknowledgement also stays in protected form until that step completes. We keep these so that the same purchase cannot be delivered twice and a later refund or dispute can be checked. These records currently have no automatic expiry.
• Remaining match history: match/player identifiers and results can remain after deletion for opponent history and service integrity, with the public name replaced. An identifier alone is not a promise of full anonymisation.
• Security exceptions: bans, staff moderation notes and blocked-identity hashes can remain to investigate abuse and prevent ban evasion. Historical configuration can also contain old player IDs.
• Backups and operational logs: may contain older records after live deletion and are access-restricted operational copies. Current match/security exceptions, historical configuration, backup files and operational logs do not all have an automatic expiry. We therefore cannot promise that every copy or identifier disappears after a fixed number of days. Applicable rights and necessary-retention reviews still apply.
• Correspondence and provider data: support/privacy correspondence is kept as needed to handle the request and applicable obligations. Advertising, payment, email and hosting providers apply their own retention rules to records they independently control.

The deletion page gives the steps, ownership checks and retained-data details. Contact us if you need an explanation of retained information about your account.

11. Security

The app's public account/game-server connections use HTTPS and secure WebSockets. Transactional mail uses an encrypted SMTP connection. The listed advertising SDK providers document TLS for their data transfers. We hash account passwords, limit administrative access and revoke sessions during deletion. These measures do not mean data is end-to-end encrypted or that every stored file/database/backup is encrypted at rest.

No system can guarantee perfect security. If a personal-data breach requires notification under applicable law, we will provide the required notice.

12. International processing

Our hosting, Google, Meta and other advertising providers can process data in countries other than yours, with different privacy rules. Their policies describe their international processing and safeguards. Where applicable law requires additional safeguards for our transfers, those requirements apply; this policy does not claim that every provider contract or transfer arrangement has been independently certified.

13. Updates

We update this policy when the service or its data practices materially change and update the date above. Where required, we provide additional notice or seek new consent. Questions go to privacy@bouncycomet.com.