Privacy Policy
What data we collect, why, and how you can control it.
Last updated: 6 November 2026
1. Who we are
BlotX (“we”) is operated by Blot X LLC («ԲԼՈՏ ԻՔՍ» ՍՊԸ), a company registered in the Republic of Armenia — state registration number 999.110.1595096, TIN 02951752, registered address: Paronyan St. 28A, apt. 36, Kentron, 0015 Yerevan, Republic of Armenia.
This Privacy Policy explains how we handle your personal data when you use the BlotX app on iOS, Android or the web, or visit blotx.am. For anything related to this policy or your data, write to [email protected].
2. What we collect
Account data. What we receive depends on how you sign in:
- Phone — we use your number to send a verification code (SMS or WhatsApp) and to identify your account. By entering your phone number and requesting a code, you ask us to send that code to that number — by SMS or via WhatsApp. We send nothing else to that number. Your number is stored by our authentication provider (Supabase) and, with your account, on our game servers; it is never shown to other players.
- Email — if you sign in with email, we use your address to send a one-time code and to identify your account. By entering your email address and requesting a code, you ask us to send that code to that address. We send nothing else to that address. Your address is stored by our authentication provider (Supabase) and, with your account, on our game servers; it is never shown to other players.
- Google — we receive your email address, name and profile picture from Google.
- Apple — we receive your name and email address (or Apple’s private relay address if you chose to hide your email).
We never see or store passwords — sign-in is handled entirely by our authentication provider.
Profile data. Your username, your avatar (a preset image, or a photo you choose to upload — we keep your last five uploads so you can switch back), and your interface language.
Game data. Games you play and their outcomes: bids, cards played, results, statistics, experience and level, league placement, Chip balance and Chip transactions, tournament participation.
Reports and blocks. When you report or block a player, we store the report (the reason, your optional note and the game it came from) or the block, together with any moderation action we take on an account (a rename, a profile photo reset or a suspension). We keep these records to keep the community safe, for as long as we keep account data (see “How long we keep your data”).
Technical data. A random device identifier created when the app is installed, used only to rate-limit verification-code requests — it is not tied to your hardware. Your IP address is used transiently for the same rate limiting and is not stored. When the app starts, it checks for updates with our servers and with Expo, which delivers app updates; both see the app’s version and platform and your IP address. For each code we send by SMS or WhatsApp, we keep a delivery record: the provider, the country, the delivery status and the cost, with the phone number reduced to its last four digits and a one-way keyed hash from which the number cannot be recovered.
Crash and error reports. When the app crashes or runs into an error, it sends a report to Sentry, our error-monitoring provider: what went wrong and where in the app’s code, the screens you visited and the taps and server requests that led up to it, the app version, your device model and operating system, and your account’s internal ID. Sentry also estimates an approximate location (country and city) from your IP address; the IP address itself is not stored. Reports never include your name, username, phone number, email address or sign-in credentials. For a small share of sessions, the app also measures how long screens and requests take. We use these reports only to find and fix bugs.
Product analytics. To understand how the game is used and what to improve, the iOS, Android and web app sends usage events to PostHog, our product-analytics provider: when the app is installed, opened and sent to the background, which screens you open, when you join and finish a game (the game mode, the game’s ID and whether you won), and completed Chip purchases (the pack and the number of Chips). Each event also carries the app version, your device model and operating system, language and screen size, and a random analytics identifier stored on your device. Once you sign in, events are linked to your account’s internal ID. PostHog also estimates an approximate location (country and city) from your IP address. Events never include your name, username, phone number, email address or sign-in credentials, and we do not record your screen or your taps. We use these PostHog events only to improve BlotX: never for advertising, and we do not share them with advertisers or combine them with data from other companies’ apps or websites.
Ad measurement (Google, Android). We advertise BlotX through Google Ads. To learn which of our ads bring players who actually sign in and play, the Android app sends a small set of events to Google Analytics for Firebase: when the app is first opened and used (sessions), when you sign in (the sign-in method), when you finish a game (the game mode and whether you won), and Google Play purchases (the product and its price, as recorded by Google Play). Each event carries your device’s advertising ID, a random app identifier created by Firebase, the app version, your device model, operating system and language, and an approximate location (country and city) that Google derives from your IP address. Google uses this data only to attribute installs and these actions to our ads and to optimize our campaigns. We have turned off ad personalization and Google’s optional data sharing for it. The events never include your name, username, phone number, email address or account ID. You can reset or delete your advertising ID at any time in your phone’s settings. The iOS and web versions of the app do not send these events.
Ad measurement (Meta). We also advertise BlotX on Facebook and Instagram. To learn which of those ads bring players, the iOS and Android app sends app events to Meta through the Meta SDK: when the app is installed and opened and how long you use it (sessions), when you sign in for the first time (the sign-in method), when you finish a game (the game mode and whether you won), and, where the SDK detects them, App Store and Google Play purchases (the product and its price). Each event carries a random app identifier created by the Meta SDK, the app version, your device model, operating system, language and time zone, technical device details (such as screen size, mobile carrier and storage), and your IP address; on Android it also carries your device’s advertising ID and the Google Play install referrer. On iOS, the app asks for your permission to track (Apple’s App Tracking Transparency prompt). Only if you allow it do the events also carry Apple’s advertising identifier (IDFA), which lets Meta attribute installs and these actions to our ads per device. If you don’t allow it, the app does not read the IDFA, and on iOS Meta measures our ads only in aggregate, through Apple’s SKAdNetwork. You can change your answer at any time in your iPhone’s settings, under Privacy & Security > Tracking. Meta uses this data to attribute installs and these actions to our ads and to optimize our campaigns; under Meta’s Business Tools Terms it may also match the events to a Facebook or Instagram account you have. The events never include your name, username, phone number, email address or account ID. You can reset or delete your advertising ID in your phone’s settings, and you can manage how Meta uses activity from other apps under “Your activity off Meta technologies” in your Facebook or Instagram settings. The web version of the app does not send these events.
Rewarded ads (iOS and Android). The Shop offers an optional video ad: watch it to the end and you receive bonus Chips, up to five times a day. An ad plays only when you choose to watch one. These ads are served through Unity LevelPlay, an ad-mediation service run by Unity Technologies, which picks the ad from the ad networks listed under “Ad partners” in Section 5. To show an ad and to pay you the reward, the LevelPlay SDK in the app sends Unity your account’s internal ID (so the reward reaches your account), a random identifier for the app installation, the app version, your device model, operating system, language and time zone, your network type, your IP address (from which an approximate location is derived) and how you interact with the ad. On Android it also sends your device’s advertising ID; on iOS it sends Apple’s advertising identifier (IDFA) only if you allow tracking (the same App Tracking Transparency prompt as above), and otherwise Apple’s SKAdNetwork measures the ads only in aggregate. Unity’s servers then tell ours that you finished the ad, and we credit the Chips. Unity and the ad networks use this data to choose and show the ad (which can include ads based on your activity in other apps, where your device settings allow it), to measure it and to prevent fraud. You can reset or delete your advertising ID, or limit ad personalization, in your phone’s settings. This data never includes your name, username, phone number or email address. The web version of the app shows no ads.
Push notifications. If you allow notifications when the iOS or Android app asks, the app registers your device’s push token with our servers: an identifier issued by Expo, our push delivery provider, together with your device platform (iOS or Android). We use it only to tell you about your own game, such as an achievement unlocked, a new level or your weekly league result. Signing out removes the token from our servers, and you can turn notifications off at any time in your phone’s settings. The web version does not use push notifications.
What we don’t collect. Apart from the optional rewarded ads described above, the app shows no ads, and we ourselves do not build a profile of you across other companies’ apps and websites. Crash reporting and product analytics (above) are used only to fix and improve BlotX; ad measurement (above) is used only to measure our own campaigns on Google and Meta. We do not collect your precise location (crash reports and analytics carry only the approximate country and city described above) or your contacts; the advertising ID is read only for ad measurement and rewarded ads: by the Android app, and by the iOS app only if you allow tracking, and we do not access your camera or microphone. Your photo library is opened only when you yourself pick an avatar image. If any of this changes, we will update this policy first (see “Changes”).
3. Why we process your data
| Purpose | What it covers |
|---|---|
| Running the game | Creating your account, matching you into games, running gameplay, showing your profile to other players |
| Your balance and purchases | Maintaining your Chip balance, crediting purchases, preventing duplicate or fraudulent transactions |
| Competition | Leaderboards, leagues, tournaments and their results |
| Notifications | Push notifications about your own game, if you allow them |
| Service integrity | Rate limiting, preventing abuse and fraud, diagnosing errors |
| Improving the game | Understanding which features are used and where players drop off, through product analytics |
| Measuring our advertising | Learning which of our ads bring players who sign in and play: Google Ads (Android only) and Meta (iOS and Android) |
| Rewarded ads | Showing the optional reward videos in the Shop and crediting the bonus Chips |
| Support | Answering you at [email protected] |
| Legal obligations | Keeping records the law requires, responding to lawful requests from competent authorities |
Your consent. By creating an account and using BlotX, you consent to the processing described in this policy. Your consent remains valid for as long as your account exists. You may withdraw it at any time — by deleting your account in the app or writing to [email protected]. Because we cannot run the game without your account data, withdrawing consent means closing your account. Records we are legally required to keep survive withdrawal (see “How long we keep your data”).
4. What other players can see
BlotX is a multiplayer game, so parts of your profile are public to the people you play with:
- At the table — your username, avatar and level, your seat and team, and your gameplay (bids and cards) as the game unfolds.
- Leaderboards and leagues — your username, avatar, rank, points and league placement.
- Tournaments — your username, avatar, standing and results.
That is the whole list. Your phone number, email address, real name and sign-in method are never shown to other players. One thing to keep in mind: if you upload your own photo as an avatar, everyone you play with will see it.
5. Who we share your data with
We use a small number of service providers, each for one job:
| Provider | Job | What they receive |
|---|---|---|
| OVH (France) | Hosting our servers and database | The data in this policy that our servers store |
| Supabase | Sign-in and account security | Your phone number or email address, or your Google/Apple account details |
| Twilio | Verification codes by SMS | Your phone number and the code |
| Nikita (Armenia) | Verification codes by SMS to Armenian numbers | Your phone number and the code |
| Meta (WhatsApp Business Platform) | Verification codes via WhatsApp | Your phone number and the code |
| Resend | Verification codes by email | Your email address and the code |
| Apple | App Store purchases; Sign in with Apple; delivering notifications to Apple devices | Purchase confirmations; your Apple account details if you use Apple sign-in; the notifications we send to your Apple device |
| Google Play purchases; Google sign-in; delivering notifications to Android devices | Purchase confirmations; your Google account details if you use Google sign-in; the notifications we send to your Android device | |
| Expo | Delivering push notifications and app updates | Your device’s push token and the notification text; when the app checks for updates, its version, platform and your IP address |
| Cloudflare | Network protection and delivery for our website and servers; storing avatar images and our database backups | Requests to our servers, including your IP address; photos you upload; backup copies of our database |
| Sentry | Error and crash monitoring | Technical error reports from our servers, with identifying request details stripped; crash and error reports from the app, as described in Section 2 |
| PostHog | Product analytics | App usage events linked to your account’s internal ID, as described in Section 2 |
| Google (Firebase, Google Ads) | Measuring our own ads (Android) | The ad-measurement events and advertising ID described in Section 2 |
| Meta (Facebook and Instagram ads) | Measuring our own ads (iOS and Android) | The ad-measurement events described in Section 2 and the advertising ID (on Android; on iOS only if you allow tracking) |
| Unity (LevelPlay) | Serving rewarded ads, through the ad partners below | The rewarded-ad data described in Section 2 |
Ad partners. Rewarded ads currently come from: ironSource Ads (Unity Technologies) and Yandex Ads (Yandex). We add a network to this list before the app starts showing its ads.
Our game bots run on our own servers with our own game logic. They use no AI provider or other third party, and they see only the state of the table (cards and bids), never who you are.
We do not sell your data. We do not share it with data brokers; Google and Meta receive the ad-measurement data, and Unity and the ad partners the rewarded-ad data, described in Section 2, only for the purposes described there. Beyond the providers above, we disclose personal data only where the law requires it, at the lawful request of a competent authority.
6. Where your data travels
BlotX’s own servers and database are hosted in the European Union (Roubaix, France), and database backups are stored with Cloudflare. Error and crash reports are stored by Sentry, and product-analytics events by PostHog, in the European Union (Germany). Our authentication provider, Supabase, stores sign-in data (your phone number or email address and how you sign in) in the United States. Ad-measurement events are processed by Google (Android) and Meta (iOS and Android), including in the United States. Rewarded-ad data is processed by Unity and the ad partners, including in the United States and, for Yandex Ads, in Russia.
Some of the providers listed above operate from other countries, including the United States. Armenian law permits transfers to countries that ensure adequate protection of personal data, per the list approved by Armenia’s data-protection authority — the EU/EEA and, for certified US organizations, the United States are on it. Where a transfer is not covered by that list, we rely on your consent and on contractual safeguards with the provider.
Wherever your data goes, this policy still applies to it.
7. How long we keep your data
| Data | Kept for |
|---|---|
| Account and profile data | While your account exists (plus the 14-day deletion grace period — see the next section) |
| End-of-game result screens | 24 hours |
| Detailed game and tournament records | Kept for game integrity and fraud prevention — but permanently unlinked from your identity when your account is deleted |
| Purchase and Chip-transaction records | Up to 5 years after your account closes, as required for financial audit |
| Push token | Until you sign out on that device or your account is deleted; tokens that stop working are removed automatically |
| Queued push notifications | 7 days |
| Verification-code counters (phone or email, IP, device) | About one hour |
| Code delivery records (provider, country, status, cost; phone number only as its last four digits and a one-way hash) | 12 months |
| Database backups | Up to 8 weeks: a backup is taken every 6 hours, all are kept for 7 days, then one per week |
| Crash and error reports | 30 days |
| Product-analytics events | Up to 12 months |
| Ad-measurement events (Android, Google Analytics for Firebase) | 2 months at event level; Google keeps aggregated campaign reports longer |
| Ad-measurement events (Meta) | Kept by Meta under its own retention rules, which we cannot configure |
| Rewarded-ad data held by Unity and the ad partners | Kept by them under their own retention rules, which we cannot configure |
| Our record of each rewarded ad you finished | Your daily ad count resets each day; the Chips you earned are a Chip transaction (see above); the technical log of Unity’s reward notices is kept 7 days |
| Server logs | Short-lived and rotated automatically |
The app shows completed tournaments for 30 days after they end; that is a display window, not a deletion date — the underlying records follow the table above.
8. Deleting your account
You can delete your account at any time in the app: Settings → your profile at the top → Delete account. The web version at app.blotx.am has the same screens, so you can do this even without the app installed. You can also write to [email protected] and we will verify the request and process it for you. These instructions are also published at blotx.am/delete-account.
What happens next:
- Immediately — you are signed out everywhere and your account becomes inaccessible; if you are mid-game, you leave it.
- For 14 days — your account sits deactivated. Changed your mind? Sign in again and it is restored exactly as it was.
- After 14 days — deletion becomes permanent: your profile is anonymized, your sign-in account and uploaded avatar photos are erased, and historical game records are permanently unlinked from your identity (see the previous section). Backup copies of the deleted data are overwritten within 8 weeks.
Unused Chips are not refunded on deletion — Chips have no monetary value (see the Terms of Use). Purchase and transaction records are retained as the previous section describes.
9. Your rights
You can, at any time:
- See your data — ask what we hold about you.
- Correct it — your username and avatar you can fix yourself in the app; for anything else, ask us.
- Delete it — use the account-deletion flow (Section 8), or ask us to destroy specific data.
- Withdraw your consent — Section 3 explains what this means for your account.
- Object — if you believe our processing violates the law, tell us and we will review it.
We respond to these requests without undue delay, within the timeframes established by Armenian law. Write to [email protected], ideally from a channel connected to your account, or with enough detail for us to verify you — we cannot act on requests we cannot verify.
If you are not satisfied with our response, you can complain to the Personal Data Protection Agency of the Republic of Armenia (pdpa.am) or apply to court.
10. Security and breaches
What we do to protect your data:
- All connections to BlotX are encrypted (HTTPS/TLS).
- Sign-in is handled by our authentication provider — we never see or store passwords.
- Payment card data never touches our servers; purchases run entirely through Apple and Google.
- Sensitive actions are rate-limited and monitored for abuse.
- Error reports from our servers are stripped of identifying request details; crash reports from the app carry no name, contact details or sign-in credentials.
No online service can promise absolute security. If a breach affecting your personal data ever occurs, we will act as Armenian law requires: contain it, inform affected users, and notify the competent authorities.
11. Cookies and local storage
Our website sets no cookies — no analytics, no trackers.
The app (including its web version) stores a small amount of data on your device to function: your sign-in session, your language choice, sound and vibration preferences, the random device identifier, the analytics identifier, the Meta SDK’s app identifier (iOS and Android) and, on Android, the Firebase app identifier described in Section 2. This is first-party storage, not cross-app tracking, and it leaves your device only as this policy describes.
Because we use no non-essential cookies, there is no cookie banner to click through. If that ever changes, this policy changes first.
12. Age
BlotX is not for children: you must be 13 or older to create an account and play, and players aged 13 to 17 need the consent of a parent or legal guardian. We do not knowingly collect data from anyone under 13; if we learn that we have, we delete the account and its data. If you believe a child under 13 is using BlotX, write to [email protected].
13. Marketing
We currently send no marketing at all: no promotional emails, SMS or push notifications. The only messages you will receive from us are verification codes and, if you allow them, push notifications about your own game (Section 2).
If we ever introduce marketing communications, they will be strictly opt-in: we will ask you first, and every message will include a way to opt out.
14. Changes and contact
When we change this policy, we update the date at the top — and for meaningful changes, like a new data practice or a new provider, we announce it in the app before it takes effect. New practices never start silently.
This policy is published in Armenian, English and Russian; if the versions ever differ, the Armenian text prevails.
Blot X LLC («ԲԼՈՏ ԻՔՍ» ՍՊԸ) Paronyan St. 28A, apt. 36, Kentron, 0015 Yerevan, Republic of Armenia [email protected]