Privacy Policy
This policy covers the Bazar Blot website and mobile app. It explains the data we receive, its use and sharing, retention, and how to request deletion.
1. Who we are
Bazar Blot is an online Blot game operated by Mher Bokhyan, Republic of Armenia. For privacy and personal-data enquiries, contact bazarblotarm@gmail.com.
2. Data we collect
- Account data: name, avatar, email or social network identifier.
- Game data: chip balance, VIP status, rating, XP, wins, losses and leaves.
- Match data: game mode, bet, score, participants, round and tournament results.
- Technical data: IP address, device, operating system, browser or app version, connection sessions, and diagnostic error messages.
- Purchase data: store or payment provider, product and transaction identifiers, amount and currency where available, purchase status and time, verification information, and the association with your game account.
3. Social login
When you sign in with Apple, Google, Telegram, VK or OK, we receive the data needed to create and access your account: the provider identifier, name, avatar and email, where supplied. Available sign-in methods depend on the platform. We do not receive passwords for these services.
Google sign-in: Bazar Blot requests only basic profile and email access (profile and email permissions). We receive and store your Google account identifier, name, email address and profile photo URL, when provided. We use them to create your account, recognize returning users and populate your game profile. We do not request access to Gmail, Google Drive, contacts or calendars, and do not store Google OAuth access or refresh tokens.
Other players may see your game name, avatar, game ID, rating, VIP status and game statistics. Your initial name and avatar may come from Google. Your email and Google account identifier are not displayed to other players in your game profile.
Sign in with Apple
On iOS, you can sign in with Apple. We use the Apple identifier for our app, and any name and email Apple provides, including a Hide My Email relay address, to create your account and authenticate you. Apple normally supplies your name only on the first authorization; if it is missing, new players choose their own game name. The server stores a protected Apple token to validate access and revoke authorization when the game account is deleted. It is not public and is not used for advertising. Bazar Blot account deletion revokes access through Apple. You can also revoke authorization in Apple Account settings; doing so alone does not request deletion of your game account. Apple policy: apple.com/legal/privacy.
4. Why we use data
- To create accounts and authorize users.
- To run games, rooms, tournaments and reconnect unfinished games.
- To calculate balance, rating, XP, VIP status, rewards and game history.
- To prevent fraud, multi-accounting, abuse and technical errors.
- To process payments and show purchase results.
5. Payments
Android app purchases use Google Play Billing; iOS app purchases use App Store in-app purchases. The website may use separate payment providers. To verify a purchase, the app sends store confirmation, product and transaction identifiers or a purchase token to our server. The server checks with the relevant store and retains a verification and entitlement record. We do not receive your store password, full bank card number or CVV. The store or payment provider handles those payment details.
6. Cookies and local storage
The website uses cookies and localStorage for login, language, sound and interface state. The mobile app stores session information and settings locally, including in secure device storage; images and informational documents may be cached for reuse and offline reading. Signing out, clearing app data or uninstalling does not request deletion of your server account.
- Required cookies are used for authorization, security and session operation.
- Functional cookies and localStorage save language, sound, fullscreen and interface settings.
- Connection technical data is used for Socket.IO, reconnection and stable game operation.
- The sections below describe data handling by advertising and notification SDKs. Changes to these features require updates to this policy and the app stores’ data disclosures.
7. Socket.IO and gameplay connection
During gameplay the site uses a persistent connection for moves, bidding, messages, reconnection and table state updates. This data is needed to synchronize the game between participants.
8. Data sharing
We share data only when necessary for service operation: payment providers, authorization services, hosting, technical monitoring tools and cases required by law. We do not sell users' personal data.
Login information is exchanged with your chosen authentication provider. For mobile purchases, Google or Apple handles payment and verifies it with our server; a technical identifier associated with the game account links the purchase. Website payments using Xsolla share the game identifier, name and email with Xsolla. Bazar Blot data is hosted on server infrastructure, public profile information is visible to other players, and authorized administrators access data for support and security. We do not sell Google data or use it for advertising targeting.
9. Retention period
Profile, balance and statistics records support your account until deletion. Under the current cleanup rule, completed game histories and balance change logs older than three months are removed; this does not delete the account or all payment records. Purchase confirmations may be retained longer to account for entitlements, prevent payment reuse, resolve disputes and meet legal requirements. Technical logs are retained as needed for diagnostics and security. When processing deletion, we explain which information must be retained, why and for how long; other personal data associated with the account is to be deleted.
Your Google identifier, name, email and avatar data are kept in your account record to support future sign-ins and your profile. Signing out or revoking access in Google does not by itself delete your Bazar Blot account record. You must submit a deletion request. After the request is verified, account data, including stored Google data, is deleted; information needed for mandatory payment records, dispute resolution or abuse prevention may be retained to the extent necessary.
10. Your rights and account deletion
The user may request access to data, data correction, account deletion or processing restriction. Send requests to bazarblotarm@gmail.com from the account linked to the profile.
Delete your account using 'Delete account' in the app menu or at bazarblot.am/delete-account after signing in. A separate confirmation is required. Once accepted, sessions end immediately and the server automatically removes associated data. If you cannot access your account, email bazarblotarm@gmail.com with the subject 'Delete Bazar Blot account' and your game ID; do not send passwords or login codes. Revoking Google access or uninstalling the app does not delete your Bazar Blot account. To prevent repeated introductory and referral bonuses after account deletion, we retain a separate marker for 180 days: an HMAC of the sign-in identifier and an expiry date. It contains no original identifier, name, email or past statistics; the technical link to the profile ID is also removed on deletion. This is pseudonymised, not fully anonymous data. It is used only to protect bonuses, not for advertising or restoring profiles, and is automatically deleted on expiry. Re-registering through the same sign-in service within this period does not award introductory chips or a referral reward again. Account deletion remains available.
11. Security
We apply technical measures to protect accounts, payments and game data. No internet service can guarantee absolute protection, so users should not share account access with others.
The production website and app use HTTPS to transmit data. Google login does not disclose your Google password to Bazar Blot. The server checks authenticated actions against your session; data access is intended for authorized service administration and support.
Push notifications
Push notifications on Android and iOS use Firebase Cloud Messaging (Google); delivery on iOS also uses Apple Push Notification service (APNs). Providers process device tokens, technical information and notification content to deliver messages. Our server stores an encrypted binding between the token, account and notification preferences. Permission is optional: iOS may ask on your first lobby visit. Refusing does not prevent play; you can change your choice in device settings. Disabling notifications or signing out disables the binding; account deletion removes it. Policies: policies.google.com/privacy and apple.com/legal/privacy.
Advertising in Android and iOS apps
Advertising uses Google AdMob (Google Mobile Ads SDK). Ad requests may involve Google processing your IP address, device information, advertising identifiers where available and permitted, ad interactions and diagnostics for delivery, measurement and invalid-traffic prevention under policies.google.com/privacy. Availability depends on country, consent choices, app version and provider inventory.
Rewarded video starts only when you choose it. The reward amount and availability are shown before viewing; the server enforces a three-hour interval. Google receives a random viewing identifier to verify the reward, not your game name or email. Chips are credited after verification of Google’s signed confirmation; closing early or an unavailable ad does not guarantee a reward. A separate ad break may appear when returning to the lobby after finishing or leaving a game. Active VIP players do not receive these ad breaks; optional rewarded video remains a separate feature.
Before requesting ads, the app checks consent requirements with Google UMP and presents required forms. Where the “Privacy and advertising” item is available in the menu’s information section, it lets you change advertising choices. On iOS, the app requests non-personalized ads and does not request ATT permission for cross-app tracking or IDFA access. Android personalization depends on consent and device settings. Notifications and optional rewarded video are not requirements for playing.
12. Policy changes
We may update this policy. The new version is published on this page and applies from publication.
