Climb and Bite

Climb and Bite has no analytics, no ads and no tracking. If you play without signing in, everything the game keeps stays on your own device. If you choose to sign in with Google, we store your Google account ID, your email address and a copy of your game save on our server, so you can get your progress back on another device. If you play online while signed in, we also note that your account has finished an online match and which account's room brought you in, for friend rewards. The Android app also sends us a notification token for your phone, so we can send you game news; if you are signed in it is filed under your account. That is all we store, and you can delete it from inside the game.

Who we are

Climb and Bite is a board game made by Maziminds, Gujarat, India. This policy covers the game at climbandbite.maziminds.com and the Climb and Bite app on Google Play, which opens the same game.

What the game keeps on your device

The game keeps one save on your device, in the browser's local storage. It holds: your wins and games played; your coins; the boards, music tracks and chips you own and which ones are equipped; your display name and any names typed for other seats in a pass-and-play game; your settings (sound, music, vibration, game mode, number of players, board size); your daily reward streak and the day you last collected it; and which first-time tips you have already seen.

If you sign in, the device also keeps a sign-in token from our server and the email address of the account, so that you stay signed in. The token lasts 90 days, after which you are asked to sign in again.

In the Android app, the daily reminder keeps its own settings on the phone: the reminder times and wording the game sends it, the day you last opened the game and collected the reward, and whether you have been asked for notification permission. Reminders are scheduled on the phone itself, and nothing about them is sent to us.

If you never sign in, none of this ever leaves your device. It is deleted when you uninstall the app or clear the site's data in your browser.

Signing in with Google (optional)

Signing in is optional and the whole game works without it. The sign-in button appears in the Profile screen. Google's sign-in script is loaded from Google's servers only when you open that screen while signed out, and Google handles the sign-in itself under Google's privacy policy, including any cookies Google sets on its own domain.

What Google gives us. We ask only for the basic "openid email profile" permission. With it, Google sends our server your Google account ID, your email address, whether that address is verified, your name and a link to your profile photo.

What we use. Your account ID is the key your save is filed under. Your email address is shown to you in the game so you can see which account is signed in, and lets us find your save if you write to us. Your first name is used once, when your account is first created, as your starting display name in the game; you can change it at any time in Profile. We do not store or use your full name or your photo.

What we store. On our server we store your Google account ID, your email address, a full copy of the game save described above (including any pass-and-play names in it), and the time it was last updated. Each time your progress changes while you are signed in, the new save replaces the old one.

Friend rewards. When an online match you played while signed in ends, we store that your account ID has finished an online match, and when. If it was your first, and the host of the room was also signed in, we store that the host's account ID brought yours, and when, so both of you can be given the reward once. Nothing else about the match is kept, and neither player's email address is part of it. In Profile, the host sees the display names of the friends they brought, and each friend sees the display name of the host who brought them; those names are read from the players' saves when Profile is opened, not stored again.

Why. Only to give your progress back to you on another device. It is not shared with anyone, not sold, and not used for advertising, analytics or anything else.

Where and how. The save is sent over an encrypted (HTTPS) connection to our server on Cloudflare and kept in a Cloudflare D1 database whose primary location is in the Asia-Pacific region.

How long. Until you delete it. We do not delete saves automatically, even if an account is not used for a long time.

Deleting it. Open the game, go to Profile and tap Delete cloud save, then tap it again to confirm. This removes your account ID, email address, save and friend-reward records from our server straight away, unlinks your phones' notification tokens from your account, and signs you out. The copy on your device stays. You can also write to the address at the end of this page from the email address you signed in with, and we will delete it for you.

Signing out. Stops syncing and removes the sign-in token from your device. Your progress stays on the device. Signing out does not delete the cloud save.

Playing online

Single player, pass-and-play, the shop and the daily reward work without a network. Online rooms need our room server.

When you host or join an online room, our room server receives your display name, the chip you are wearing, the four-character room code, your moves, the emotes you send, and a random token that lets you rejoin your seat if your connection drops. The other players in the room see your name and your chip. This is held only for the life of the room, which erases itself, and everything in it, about ten minutes after the last player has left. We keep no record of the match and no history of it; the only thing that outlives a room is the friend-reward record described above, and only for players who were signed in.

There is no free-text chat in the game. Online players can send each other emotes, which are picked from a fixed set of pictures in the game; the room passes each one on to the other players and does not keep it. Display names must follow our Terms of use, and any player can mute another player in a room, which hides that player's emotes and name on their own screen. A mute is kept only on that device.

Your display name is whatever you type, or your Google first name if you signed in and have not changed it. It does not have to be your real name. Online rooms never receive your email address. If you are signed in, the room server is told your Google account ID, for friend rewards; the other players are never shown it.

The Android app

The Google Play app opens this same game in Chrome. It asks for permission to show notifications, which is used for the daily reminder and for game news (below); you can refuse it or turn it off in Android settings and the game works the same. It also asks Google Play whether a newer version of the app is available, so it can offer you the update. That check is between your phone and Google Play and sends nothing to us.

Game news notifications. From version 1.2.0 the app can receive messages we send, such as a new board or an event, through Google's Firebase Cloud Messaging. To make that work, Firebase gives the app a notification token: a random ID for this install of the app on this phone. The app passes it to the game, which sends it to our server. We store the token and when it was first and last seen. If you are not signed in, it is stored on its own and is not linked to you. If you are signed in, it is stored with your Google account ID, so a message can be sent to you on all your phones; it moves back to the unlinked list when you sign out or delete your cloud save. We use the token only to send these notifications. It is not shared, not sold and not used for advertising or analytics. Google handles delivery under Google's privacy policy.

The messages appear under a "News" notification category, separate from the daily reminder. You can turn News off in Android settings and keep the reminder, or refuse notifications altogether. When you uninstall the app the token stops working, and we delete it the next time we send a message addressed to it and Google refuses it. You can also write to us to have it removed.

What we do not do

The game sets no cookies of its own and has no analytics, advertising or tracking. Apart from Google Sign-In, and in the Android app Google Play's update check and Firebase Cloud Messaging for game news, it uses no third-party services. We do not build a profile of you, we do not track you across sites or apps, and we do not sell or share your data.

Hosting

The game's files, the room server and the save server are run on Cloudflare. Like any web host, Cloudflare processes standard request data such as IP addresses to deliver the game and protect against abuse. We do not use this data to identify you and we keep no request logs of our own. See Cloudflare's privacy policy.

Children

The game is intended for players aged 13 and over and never asks a player's age. Signing in needs a Google account, which is subject to Google's own age rules. A player who does not sign in sends no personal data to us. There is nothing in the game that lets one player send another anything but a move on the board, an emote from the game's fixed set, or the display name described above.

Your choices

Everything we store about you is visible in the game itself, in Profile. You can ask us what we hold about you, ask for a copy of it, ask us to correct it, or ask us to delete it, by writing to the address below.

Changes

If this policy changes, the updated version will be posted on this page with a new date.

Contact

Grievance Officer: Asif Patel, Maziminds, Gujarat, India.
Email: contact@maziminds.com