Privacy Policy
What data we collect, why, and how you can control it.
Last updated: 9 August 2026
1. Who we are
BlotX (“we”) is operated by Blot X LLC («ԲԼՈՏ ԻՔՍ» ՍՊԸ), a company registered in the Republic of Armenia — state registration number 999.110.1595096, TIN 02951752, registered address: Paronyan St. 28A, apt. 36, Kentron, 0015 Yerevan, Republic of Armenia.
This Privacy Policy explains how we handle your personal data when you use the BlotX app on iOS, Android or the web, or visit blotx.am. For anything related to this policy or your data, write to [email protected].
2. What we collect
Account data. What we receive depends on how you sign in:
- Phone — we use your number to send a verification code (SMS or WhatsApp) and to identify your account. By entering your phone number and requesting a code, you ask us to send that code to that number — by SMS or via WhatsApp. We send nothing else to that number. Your number is stored by our authentication provider (Supabase); our game servers store only your account identifier.
- Google — we receive your email address, name and profile picture from Google.
- Apple — we receive your name and email address (or Apple’s private relay address if you chose to hide your email).
We never see or store passwords — sign-in is handled entirely by our authentication provider.
Profile data. Your username, your avatar (a preset image, or a photo you choose to upload — we keep your last five uploads so you can switch back), and your interface language.
Game data. Games you play and their outcomes: bids, cards played, results, statistics, experience and level, league placement, coin balance and coin transactions, tournament participation.
Technical data. A random device identifier created when the app is installed, used only to rate-limit verification-code requests — it is not tied to your hardware. Your IP address is used transiently for the same rate limiting and is not stored. When the app checks for updates, it sends its version and platform.
What we don’t collect. The app currently contains no analytics, advertising or tracking SDKs. We do not collect your location, contacts or advertising identifiers, we do not access your camera or microphone, and we do not send push notifications. Your photo library is opened only when you yourself pick an avatar image. If any of this changes, we will update this policy first (see “Changes”).
3. Why we process your data
| Purpose | What it covers |
|---|---|
| Running the game | Creating your account, matching you into games, running gameplay, showing your profile to other players |
| Your balance and purchases | Maintaining your coin balance, crediting purchases, preventing duplicate or fraudulent transactions |
| Competition | Leaderboards, leagues, tournaments and their results |
| Service integrity | Rate limiting, preventing abuse and fraud, diagnosing errors |
| Support | Answering you at [email protected] |
| Legal obligations | Keeping records the law requires, responding to lawful requests from competent authorities |
Your consent. By creating an account and using BlotX, you consent to the processing described in this policy. Your consent remains valid for as long as your account exists. You may withdraw it at any time — by deleting your account in the app or writing to [email protected]. Because we cannot run the game without your account data, withdrawing consent means closing your account. Records we are legally required to keep survive withdrawal (see “How long we keep your data”).
4. What other players can see
BlotX is a multiplayer game, so parts of your profile are public to the people you play with:
- At the table — your username, avatar and level, your seat and team, and your gameplay (bids and cards) as the game unfolds.
- Leaderboards and leagues — your username, avatar, rank, points and league placement.
- Tournaments — your username, avatar, standing and results.
That is the whole list. Your phone number, email address, real name and sign-in method are never shown to other players. One thing to keep in mind: if you upload your own photo as an avatar, everyone you play with will see it.
5. Who we share your data with
We use a small number of service providers, each for one job:
| Provider | Job | What they receive |
|---|---|---|
| Supabase | Sign-in and account security | Your phone number, or your Google/Apple account details |
| Twilio | Verification codes by SMS | Your phone number and the code |
| Viva (Armenia) | Verification codes by SMS to Armenian numbers | Your phone number and the code |
| Meta (WhatsApp Business Platform) | Verification codes via WhatsApp | Your phone number and the code |
| Apple | App Store purchases; Sign in with Apple | Purchase confirmations; your Apple account details if you use Apple sign-in |
| Google Play purchases; Google sign-in | Purchase confirmations; your Google account details if you use Google sign-in | |
| Cloudflare | Storing and serving avatar images | Photos you upload |
| Sentry | Server error monitoring | Technical error reports from our servers, with identifying request details stripped |
Our game bots use AI providers to choose their moves; they receive only the state of the table — cards and bids — never who you are.
We do not sell your data. We do not share it with advertisers or data brokers. Beyond the providers above, we disclose personal data only where the law requires it, at the lawful request of a competent authority.
6. Where your data travels
BlotX’s own servers and database are hosted in the European Union (Frankfurt, Germany), and our authentication provider stores sign-in data in the same region.
Some of the providers listed above operate from other countries, including the United States. Armenian law permits transfers to countries that ensure adequate protection of personal data, per the list approved by Armenia’s data-protection authority — the EU/EEA and, for certified US organizations, the United States are on it. Where a transfer is not covered by that list, we rely on your consent and on contractual safeguards with the provider.
Wherever your data goes, this policy still applies to it.
7. How long we keep your data
| Data | Kept for |
|---|---|
| Account and profile data | While your account exists (plus the 14-day deletion grace period — see the next section) |
| End-of-game result screens | 24 hours |
| Detailed game and tournament records | Kept for game integrity and fraud prevention — but permanently unlinked from your identity when your account is deleted |
| Purchase and coin-transaction records | Up to 5 years after your account closes, as required for financial audit |
| Verification-code counters (phone, IP, device) | About one hour |
| Server logs | Short-lived and rotated automatically |
The app shows completed tournaments for 30 days after they end; that is a display window, not a deletion date — the underlying records follow the table above.
8. Deleting your account
You can delete your account at any time in the app: Settings → Edit Profile → Account Management. The web version at app.blotx.am has the same screens, so you can do this even without the app installed. You can also write to [email protected] and we will verify the request and process it for you. These instructions are also published at blotx.am/delete-account.
What happens next:
- Immediately — you are signed out everywhere and your account becomes inaccessible; if you are mid-game, you leave it.
- For 14 days — your account sits deactivated. Changed your mind? Sign in again and it is restored exactly as it was.
- After 14 days — deletion becomes permanent: your profile is anonymized, your sign-in account and uploaded avatar photos are erased, and historical game records are permanently unlinked from your identity (see the previous section).
Unused coins are not refunded on deletion — coins have no monetary value (see the Terms of Use). Purchase and transaction records are retained as the previous section describes.
9. Your rights
You can, at any time:
- See your data — ask what we hold about you.
- Correct it — your username and avatar you can fix yourself in the app; for anything else, ask us.
- Delete it — use the account-deletion flow (Section 8), or ask us to destroy specific data.
- Withdraw your consent — Section 3 explains what this means for your account.
- Object — if you believe our processing violates the law, tell us and we will review it.
We respond to these requests without undue delay, within the timeframes established by Armenian law. Write to [email protected], ideally from a channel connected to your account, or with enough detail for us to verify you — we cannot act on requests we cannot verify.
If you are not satisfied with our response, you can complain to the Personal Data Protection Agency of the Republic of Armenia (pdpa.am) or apply to court.
10. Security and breaches
What we do to protect your data:
- All connections to BlotX are encrypted (HTTPS/TLS).
- Sign-in is handled by our authentication provider — we never see or store passwords.
- Payment card data never touches our servers; purchases run entirely through Apple and Google.
- Sensitive actions are rate-limited and monitored for abuse.
- Error reports are stripped of identifying request details before leaving our servers.
No online service can promise absolute security. If a breach affecting your personal data ever occurs, we will act as Armenian law requires: contain it, inform affected users, and notify the competent authorities.
11. Cookies and local storage
Our website sets no cookies — no analytics, no trackers.
The app (including its web version) stores a small amount of data on your device to function: your sign-in session, your language choice, sound and vibration preferences, and the random device identifier described in Section 2. This is functional storage, not tracking, and it leaves your device only as this policy describes.
Because we use no non-essential cookies, there is no cookie banner to click through. If that ever changes, this policy changes first.
12. Age
BlotX is for adults — you must be 18 or older to create an account and play. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete the account and its data. If you believe a minor is using BlotX, write to [email protected].
13. Marketing
We currently send no marketing at all — no promotional emails, SMS or push notifications. Verification codes are the only messages you will receive from us.
If we ever introduce marketing communications, they will be strictly opt-in: we will ask you first, and every message will include a way to opt out.
14. Changes and contact
When we change this policy, we update the date at the top — and for meaningful changes, like a new data practice or a new provider, we announce it in the app before it takes effect. New practices never start silently.
This policy is published in Armenian, English and Russian; if the versions ever differ, the Armenian text prevails.
Blot X LLC («ԲԼՈՏ ԻՔՍ» ՍՊԸ) Paronyan St. 28A, apt. 36, Kentron, 0015 Yerevan, Republic of Armenia [email protected]