Privacy Policy

This privacy policy covers the SkyRoute Tycoon game made by Gamquo ("we"):

• the Android app (package com.gamquo.skyroute),
• the web version at https://skyroute.gamquo.com,
• the desktop versions,
• the online game server we run for it at wss://skyroute.gamquo.com/ws,
• and the optional SkyRoute account service at https://skyroute.gamquo.com/api, with its delete-account page at https://skyroute.gamquo.com/delete-account.

Summary

Information stored on your device

The game keeps these files on your device:

• Game save: the state of your current offline game, so you can continue it later. Online games are not saved on your device.
• Settings: your choices, such as volume, game speed, haptics, interface size, full screen, reduce motion, battery saver, language, the board camera view, which tips you have seen and whether you have finished the guide. Player names you type for pass-and-play are kept here to remember your last game setup.
• Profile: your name, your coins, the figures, dice sets and board designs you own and use, your friend list (friend codes and names), the last online room code, and a random install code. The game creates the install code on your device. It works like a private key for online play and is never shown.
• Account sign-in (only if you sign in): a sign-in token that keeps you signed in, your account's friend code, your email address and a pending email address if you have one, and a copy of your account's coins, items, friends and statistics. While you are signed in, your guest coins, items and friends are kept aside on the device, and you get them back when you sign out. Your password is never saved on the device.

Where these files live:

• Android app: in the app's private storage.
• Web version: in your browser's storage for the site skyroute.gamquo.com. Each browser on each device keeps its own copy.
• Desktop versions: in the game's data folder on your computer.

Coins are earned only by playing games: 20 coins for each finished game and 40 more for a win. You spend them on figures, dice sets and board designs in the in-game Shop. Coins cannot be bought with real money and have no money value.

As a guest, these files stay on your device and we cannot access them, except for the parts sent during online play, listed below. Ways to delete them:

• Android: clear the app's storage in Android Settings, or uninstall the game.
• Web: clear the site data for skyroute.gamquo.com in your browser settings.
• Desktop: uninstall the game and delete its data folder.

Deleting the files on your device does not delete an account on our server. To delete an account, see "Deleting your account" below.

If you have turned on Android's own device backup, Android may include app data in your personal backup. That backup is handled by Google under your Google account settings, not by us.

Information sent when you use online play

When you open Play Online, the game connects to our server over an encrypted connection (secure WebSocket, wss://). It sends:

• Name: as a guest, the display name you choose, up to 14 characters. When you are signed in, your account's username is used instead. Please don't use your real full name or any personal details.
• Figure: which game piece you chose, for example "Jet" or "Rocket".
• Install code: the random code described above. The server uses it to put you back in your seat if your connection drops. The server never sends it to other players.
• Friend code: as a guest, an 8-character code worked out from your install code (your install code can't be worked out from it). When you are signed in, your account's own friend code is used instead. You can give your friend code to friends so they can add you.
• Your friends' codes: while you are online, the game sends the friend codes in your list so the server can tell you which friends are online. The server answers and does not keep the list.
• Room codes and game moves: the room you create or join, and the moves you make, such as rolling, buying, trading and building.
• Account sign-in token (only when signed in): the game server passes it to our account service on the same machine to check which account you are, and does not keep it. When an online game ends, the game server tells the account service whether each signed-in player won, so it can add your coins and update your statistics.

We use this information only to run online games: matching you to rooms, showing which friends are online, delivering invites, running the rules, reconnecting you after a drop and, for signed-in players, recording game results in the account.

Accounts

Creating a SkyRoute account is optional. Guests can play everything, offline and online. SkyRoute accounts are separate from the accounts of our other game, Baize Club: SkyRoute has its own account database, and the two games do not share player data.

To create an account you choose a username and a password, and tick a box to confirm that you are 13 or older and accept the Terms of Use and this Privacy Policy. When you create an account, the coins, items, equipped items and friends on your device are copied into the new account once (up to a value of 3,000 coins). Only friends who have a SkyRoute account carry over. The device keeps its own guest copy, which comes back when you sign out.

What an account stores

• Username: 3 to 16 letters, digits or _. It is public: other players see it online, and it is shown in the friends lists of players who add you.
• Password: never stored. We keep only a random salt and a one-way scrypt hash, so nobody, including us, can read your password back.
• Email address (optional): only if you add one. A new address is "pending" until you type the 6-digit code we email to it. We use it only to confirm the address and to send password-reset codes. It is never shown to other players. Several accounts may use the same email address.
• Email codes: 6-digit confirmation and password-reset codes are stored only as a salted hash, with an expiry time and a count of wrong tries. They work for 15 minutes.
• Friend code: a random 8-character code for your account, which friends use to add you.
• Coins and items: your coins, the figures, dice sets and board designs you own, and the ones you use.
• Friends list: up to 100 friends, saved as friend code and username.
• Statistics: online games, wins, losses, current win streak and best streak, plus games and wins against the computer or on one device. To limit cheating, only the first 15 games on a device per day (UTC) earn coins, so the account also stores today's date and how many of those games you have played today.
• Dates: when the account was created, when you accepted the Terms and Privacy Policy, and when the account record was last changed.
• Sign-in tokens: random keys that keep you signed in on each device, so you don't type your password every time. Each one stops working after 60 days or when you sign out. Changing your password signs out your other devices, and resetting it signs out all of them.

What we use account data for

• To run your account: signing in on any device, keeping your coins, items, friends and statistics, and the Shop.
• To show your username to other players online and in friends lists.
• To confirm your email address and send password-reset codes, only if you add an email.
• To keep coins fair: online results are recorded only by our game server, and coins from games on a device are limited per day.
• To keep the service secure: see "Security" below.

Emails we send

We send only two kinds of email: a code to confirm your email address, and a code to reset your password when you ask for one. We never send newsletters or marketing. The emails come from noreply@gamquo.com and are delivered by Brevo, an email delivery service that acts on our behalf. Brevo receives your email address and the email itself, which contains your username and the code. See https://www.brevo.com/legal/privacypolicy/.

How long we keep account data

• Your account is kept until you delete it, until we remove it under the Terms of Use, or until the service ends. We do not delete accounts for being inactive.
• Email codes expire after 15 minutes, and sign-in tokens after 60 days at most.
• Backups: once a day, the account service saves a complete copy of the account database on the same server. Only the newest 7 copies are kept, so a deleted account can remain in these backup copies for about a week before it is gone from them too. We use backups only to restore the database after a failure.
• Logs: the account service writes short operational log lines. Some of them contain a username: when an account is created or deleted, and when a password is reset. If an email fails to send, the log shows the address in a masked form such as a***@example.com. Email codes and passwords are never logged. These lines go to the server's system log, which deletes them after 30 days.

Deleting your account

You can delete your account at any time:

• In the game: on the main menu, open Account, then Delete my account. Enter your password and type DELETE.
• On the web, without the game: go to https://skyroute.gamquo.com/delete-account, enter your username and password, and type DELETE.

Deleting removes, straight away, your account record (username, password hash, email address, coins, items, friends list and statistics) and all of its sign-in tokens, and it removes you from other players' friends lists. It can't be undone, and your username becomes free for someone else to use. Copies remain only in the backups (about a week) and log lines (30 days) described above. If you can't sign in to delete your account, write to support@gamquo.com.

Who can see your information

• Players in the same room see your name (your username when signed in), your figure, whether you are connected, and your moves in the game.
• Anyone who has your friend code can see your name, whether you are online and whether you are in a room. You decide who gets your friend code.
• Account holders who add you with your friend code keep your friend code and username in their friends list, and see your current username there, until they remove you or you delete your account.
• A friend you invite sees your name and friend code with the invite.

Other players never see your email address, your coins or your statistics. There is no chat or messaging. The only text other players can see from you is your name.

How long we keep online data

• Our game server keeps online game data only in memory. It does not save rooms, names or moves to a database. Only the result of a finished online game is saved, to the account of each signed-in player (see "Accounts").
• When you disconnect, your connection details are removed.
• A game room, with the names, figures and moves in it, is deleted about 5 minutes after the game ends, or about 10 minutes after everyone has left. If the server restarts, every room ends at once.
• The game server writes short operational log lines that contain only room codes and seat counts, for example that room ABCDE was created or started. These lines never contain names, friend codes, install codes, sign-in tokens or IP addresses. They go to the server's system log, which deletes them after 30 days.
• Our web server (Caddy) does not keep access logs of page visits or connections.

IP addresses

Your device's IP address is necessarily visible to our server and our hosting provider when you connect, as with any internet connection. This also happens when your browser loads the web version, or these Privacy, Terms and Support pages, from our website.

• The game server does not read or store IP addresses.
• The account service uses your IP address, in memory only, to limit how often someone can try to sign up, sign in, ask for a password reset, enter a reset code or use the delete-account page. These counts are never saved to the database or written to the logs, and they are forgotten when the service restarts.
• We do not use IP addresses to find your location.

Where the server is and who runs it

The online server, the account service, the account database and its backups, and the web version all run on Gamquo's own cloud server, rented from the hosting provider LightNode and located in Riyadh, Saudi Arabia. If you play online or use an account from another country, your data is sent to and processed in Saudi Arabia. LightNode runs the machine for us and may keep its own network logs, which can include IP addresses.

The same server also runs our other game, Baize Club. The two games have separate account databases and do not share player data. They share only the machine and our email delivery service (Brevo).

When you email us

If you write to support@gamquo.com, we receive your email address and whatever you put in the message. Cloudflare, which runs our domain name, forwards the email to our inbox at Gmail (Google). We use it only to answer you.

Sharing of information

We do not sell, rent or trade your information. We do not share it with advertisers, data brokers or analytics companies. Apart from our hosting provider (LightNode), our email services (Brevo for the emails we send; Cloudflare and Gmail for emails you send us) and the other players described above, we only disclose information if the law requires it.

Advertising and analytics

The game contains no advertising and no analytics, tracking or crash-reporting software. The web version uses no cookies for advertising or tracking.

Your choices and rights

• Play as a guest. You don't need an account for anything in the game. A guest who never opens Play Online sends nothing to our server.
• Don't use online play. If you never open Play Online, the game sends nothing to our game server. The whole game, apart from online play and accounts, works offline.
• Change your name. Guests can change their display name at any time in the Shop. Account usernames can't be changed in the game.
• Add, change or remove your email at any time under Account in the game. Removing it deletes it from your account straight away, but then you can't reset a forgotten password.
• Sign out under Account. This ends the sign-in on that device.
• Delete your account as described under "Deleting your account".
• Stop online play by leaving Play Online or closing the game. Your online game data on our server is deleted on the schedule above.
• Delete everything on your device as described above: clear the app's storage or the browser's site data, or uninstall the game. This also creates a new install code and guest friend code next time. It does not delete an account.
• Ask us at support@gamquo.com. Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to or restrict how it is used. Most of your account data is shown in the game under Account. For anything else, write to us from the email address on your account if you have one, or tell us your username, so that we can check the request is yours. You may also complain to your local data protection authority.

Children

SkyRoute Tycoon is not designed for children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from them. You must be 13 or older to create an account.

• A guest's offline play sends nothing, so children can enjoy it without sharing any information.
• Online play shows a player's name and figure to other players. There is no chat, no free-text messaging and no links to social media.
• Parents who don't want a child to play online should ask them not to use Play Online or create an account. They can also block the app's internet access in Android settings, and offline play keeps working.

If you are a parent or guardian and believe your child under 13 has created an account, or has used online play with personal information in their name, contact us at support@gamquo.com. We will delete the account and help.

Permissions

On Android the game asks for:

• Internet: used only for online play and for SkyRoute accounts. A guest's offline play does not use it.
• Vibrate: used for haptic feedback when haptics are switched on in Settings. It does not involve any personal data.

The game does not request access to your location, contacts, camera, microphone, photos or files.

Security

• On Android, data on your device stays in the app's private storage, protected by Android's app sandbox.
• Online play uses an encrypted connection (wss://) to our server. The account service and the website use HTTPS.
• Passwords and email codes are stored only as salted hashes. Attempts to guess passwords and codes are rate-limited, and a code stops working after 5 wrong tries.
• The account database and its backups are kept in a private folder on our server that only the account service and our server administrator can open.
• The server checks every move against the game rules, and only our game server can record online results in an account.
• Your secret install code proves which seat is yours, and it is never shown to others.

No system is perfectly secure. Please use a password that you don't use anywhere else.

The game always connects to our own server. Your account's sign-in token is only ever sent to our server, never to any other address.

Changes to this policy

If this policy changes, we will post the new version at this address and update the effective date above. If a future version of the game starts collecting more data, we will update this policy and the game's store listing before that version is released.

Contact

Questions about this policy: support@gamquo.com
Gamquo, https://gamquo.com

See also the Terms of Use and Support.