PIKUBOTSPrivacy policy
Last updated 20 September 2026. This page describes the game as it is built today. When the game changes what it stores, this page changes with it.
Short version: PikuBots keeps a game account and the progress on it. There are no ads and no analytics or tracking kit of any sort in the game. Nothing is sold or handed to advertisers. You can play offline against bots with no account at all, and you can ask for everything to be deleted.
Who is responsible
PikuBots is made and run by the developer of PikuBots, reachable at hello@pikubots.com. That address is also where privacy requests go, and a person reads it.
What the game stores
On the phone, the game keeps your settings (volume, music, haptics, control options, the offline switch), the last screen you were on, and a session token once you sign in. Deleting the app removes all of it.
On the server, an account row holds:
| What | Why |
|---|---|
| An account id, and a username and password hash if you make a named account | So the account is yours and can be signed into from another phone. The password is stored only as a salted hash, never as the password. |
| A device identifier the app generates on first launch, or an Apple or Google account identifier if you sign in that way, and the email address that sign-in hands over when it hands one over | To recognise the same player on the next launch and to recover an account. |
| Session tokens | To keep you signed in without asking for a password every time. |
| Progress: level, experience, coins, gems, trophies, the items you own and their levels, the chassis, weapons and cosmetics you have equipped, your pilot name and avatar, daily and season progress | That is the game. Without it the account is empty. |
| A line per match: when it ended, the mode, the score, kills, deaths, damage, and the reward paid | To pay the reward once, to run missions and the ladder, and to catch a broken or abusive result. |
| A ledger line per coin and gem movement, and the seed behind every chest, spin and lucky draw | So a disputed reward can be checked, and so the odds shown in the game are the odds that ran. |
| Purchase records from the store: the transaction id, the product, the store, and whether it was refunded | To give you what you paid for and to honour refunds. |
| If you use them: your clan, your friends list, messages in your inbox and your clan board posts | Those features only work with the other players in them. |
The game does not ask for your real name, your address, your phone number, your contacts, your photos or your location, and it has no way to read them.
What the game does not do
- No advertising, no ad network and no advertising identifier.
- No analytics or attribution kit, no third party tracker, no fingerprinting.
- No sale or sharing of personal data, and no profiles built for marketing.
- No microphone, camera or location access.
Who else sees it
- Apple and Google, if you choose to sign in with them. They tell the game a stable account identifier and, when you allow it, an email address. The game tells them nothing about you.
- Apple and Google again as the stores, when you buy something. They take the payment. The game never sees your card or your billing address.
- RevenueCat, which sits between the stores and the game server to confirm a purchase and tell the server to grant it. It sees the store transaction and the account id it belongs to.
- Fly.io, which hosts the game server and its database in Singapore.
Nobody else. There is no other company in the loop.
Where it is kept, and for how long
The server and its database run on Fly.io in the Singapore region. Accounts are kept while they are in use. A session token expires on its own. Match lines, ledger lines and draw seeds are kept while the account is, because they are the record behind your balances. When an account is deleted, the sign-in identities and the tokens go and the remaining rows are detached from any identifier that points at a person.
Children
PikuBots is for players aged 13 and over. On first launch the game asks; a player under 13 gets the offline game, against bots, with no account, no sign-in and nothing sent to the server. If you believe a child under 13 has made an account, write to hello@pikubots.com and it will be removed.
Your choices
- Play offline. The offline switch in settings keeps the game on the phone. Progress made offline is held on the device and sent the next time you go online, and nothing else leaves.
- Get a copy. Ask and you will be sent what the account holds, in a plain file.
- Correct something. A wrong pilot name, email or balance can be fixed on request.
- Delete everything. Delete the account in the game, or write to hello@pikubots.com from the address on the account. Deletion is permanent and cannot be undone: progress, items and purchases go with it.
Requests are answered within 30 days, usually much sooner. Depending on where you live you may also have the right to complain to a data protection authority.
Security
Traffic between the game and the server runs over TLS. Passwords are stored as salted hashes with a slow hashing function and are never logged. Access to the server is limited to the developer. No system is perfect, and if a breach ever touches your account you will be told what happened and what to do.
Changes
If this policy changes in a way that matters, the date at the top changes and the game says so on the next launch. Continuing to play after that means the new version applies.