Privacy Policy
RicoShot (com.brugn.ricoshot) — last updated 19 August 2026
RicoShot is made and published by one independent developer
(brugnarc@gmail.com). This policy says what the game
handles, who holds it, and how to get rid of it.
The single most important thing to know is that the game is split in two. The
campaign, speedrun and survival modes are entirely offline: nothing about you leaves the phone
except an optional Play Games save. Ranked matches are different — they need an
account on a server I run, and they show your name to other players. Everything below is organised
around that line.
1. Playing offline — the campaign, speedrun, survival, and link duels
No account, no sign-up, nothing sent anywhere. Your progress, settings, records and purchases
are stored on the device. A shared duel link contains only a code describing the arena; it carries
nothing about you, and opening one does not create an account.
The game writes an anonymous local diagnostic file (telemetry.jsonl) with recent
in-game events. It is never transmitted, and it is deleted when you delete your data.
2. Playing ranked — what leaves your phone
The first time you enter the Arena, the game creates an account on
api.ricoshot.app, a server I rent and administer in France. It exists for one
technical reason: a score a phone reports about itself cannot be trusted, so the server
re-simulates your run from the shots you fired and checks that it really reached
the depth claimed.
| What is stored | Why |
|---|
| Your Google Play Games player id | To recognise you as the same player across sessions and devices. It is the only identity used; there is no password and no email. |
| The display name Google publishes for your Play Games profile | So an opponent sees who they are playing. See the note below. |
A friend code generated by the server, e.g. RICO-7K2P-9X | So a match can be referred to without exposing anything you did not choose. |
| Your rating, and how many ranked matches you have played | Matchmaking and the ladder. |
| The identifiers of the ball and ambiance you are wearing | So your opponent sees the cosmetics, which is the only reason they exist. |
| Each ranked match: the arena seed, the depth each side reached, the outcome, and the recorded shots of the run | The shots are what makes verification possible. They describe aim, power and spin — nothing about you or your device. |
Entering ranked shows your Play Games display name to strangers. That is the
point of a match against a named opponent, but it is worth stating plainly: whoever you are
matched with sees the name Google publishes for you, your rating, and your cosmetics. If that
name identifies you and you would rather it did not, change it in the Google Play Games app
before playing ranked — the server copies whatever Google reports at the time you sign in.
The server holds nothing else. There is no analytics service, no advertising code and
no third party of any kind on the server side, and none of the above is sold, shared or
sent anywhere.
Addresses and logs
The web server in front of the game is not configured to log requests, so no record of
IP addresses and visited paths exists. Rate limiting counts recent requests per address in
memory only; those counts are never written to disk and disappear when the process restarts. The
application's own journal records numeric account numbers — lines like
account 12 opens match 40 — never a name, a friend code or an address, and it rotates
after roughly a week.
How long it is kept
Until you delete it. There is no automatic expiry: an account that stops playing is an account
somebody may come back to. The machine is imaged daily by the hosting provider on a seven-day
rolling window, so deleted data survives inside those images for at most seven days, and they are
only ever restored wholesale after a failure.
3. Google's services
Four Google services are involved, and what they collect is governed by
Google's own privacy policy, not by this one.
Ads (Google AdMob)
Ads in RicoShot are opt-in and rewarded only — one appears when you choose to
watch it in exchange for levels or ranked tokens. There are none during play. To serve them, AdMob
may process your device advertising identifier and related technical data
(device type, an IP address used to infer approximate region, ad interactions) for showing and
measuring ads and preventing fraud. In the EEA, the UK and Switzerland the game asks for consent
through Google's User Messaging Platform before personalised ads are used, and you may choose
non-personalised ones. See
how Google uses information from apps
that use its services.
Purchases (Google Play Billing)
The one-time "unlock all levels" purchase is processed entirely by Google Play. I never see or
store payment details; Google only tells the game whether the purchase exists.
Saved progress (Google Play Games)
If you sign in to Play Games, your unlocks, coins and owned cosmetics are saved to a snapshot on
your own Google account so they follow you between devices. Google stores it; you can delete it
from the Play Games app.
Leaderboards (Google Play Games)
Submitting a speedrun or survival score to a leaderboard publishes it, under your Play Games
name, to everyone. That is Google's leaderboard, on your Google account, and it is not part of the
ranked server described above.
4. Children
RicoShot is not directed at children under 13 and I do not knowingly collect anything from
them. Ads are configured for a general audience. Ranked matches show a name chosen on a Google
account to other players, which is one more reason the mode is not aimed at children.
5. Your choices
- Delete everything — one button inside the game erases the phone, the Play
Games snapshot and the server account together. See
how to delete your data.
- Never create a server account at all — it is created when you first enter
the Arena and never before, so playing the campaign leaves no row in any database of mine.
- Leave the ranked roster without deleting anything, from the Arena. You stop
being matched; matches already owed are still owed.
- Reset or remove your advertising identifier — Android: Settings → Google →
Ads.
- Change your ad-consent choice at any time, in the EEA/UK/Switzerland, from
the game's consent option.
6. Security
Everything the game sends travels over HTTPS. The server holds no password — there is nothing
to steal that would let anybody log in as you beyond a session token stored on your own phone, and
deleting your data invalidates it.
7. Changes
This page is versioned alongside the game's source code and updated in the same change that
makes it necessary. Material changes move the date at the top.
8. Contact
Questions, or a deletion request you cannot make from inside the game:
brugnarc@gmail.com. I answer every message.