Buddy Flight — Privacy Policy

Last updated: 18 October 2026

Buddy Flight is a small arcade game with a server account for each player. At startup the game silently tries Play Games first and otherwise creates or restores an automatic account tied to a random installation credential stored on the device. A new player needs a connection to start; a player who already has an account may play offline and unranked while the server is unavailable. An accepted ranked flight sends its score to our server; a photo is sent only when you choose to publish it. Google Play, the install-referrer service and — in builds that contain advertising — Google's consent and advertising SDKs may still exchange the technical data described below. This page explains when the game uses online features and what happens to that data afterwards.

Who is responsible for your data

Buddy Flight is published by PB Fun Gaming, IČO 01033450, Czech Republic. That is the data controller for everything described below. You can reach us at info@pbfungaming.cz about anything on this page, including access, correction, export and erasure requests.

Playing online and offline

Tapping to fly, taking a photo, cutting out your buddy, changing the theme or the language and beating your own best score use the device. A new launch without a server connection shows Connect to play; it does not create a local-only guest account. A player who already has an account may play offline and unranked while the server is unreachable. Only a flight with a valid online ranked ticket is submitted to our server; an offline flight is not uploaded or ranked later.

What stays on your device

• Your best score, the selected theme and the selected language.
• Your hero photo: the cut-out image you made in the photo editor, kept in the app's private storage. It is excluded from Android cloud backup and from device-to-device transfer, so it does not follow you onto a new phone unless you make it again there.
• The camera or gallery picture you started from is not uploaded to Buddy Flight. A temporary camera file created for the app is removed once the cut-out is saved.
• If an account is created or restored, the sign-in tokens and, for an installation account, its random UUID and 256-bit secret, held in Android's encrypted secure storage. This installation credential uses no hardware identifier or advertising identifier.

Uninstalling Buddy Flight removes all of this.

Once, on the very first run after installation, the game asks Google Play for the install referrer. That is how a challenge link you tapped before installing still opens the right challenge afterwards. The only thing kept from it is a first-party challenge code, and only when the referrer actually contains one. There is no attribution or install-tracking service in Buddy Flight.

When an account is created

At startup the game first silently tries Play Games. If that does not provide a session, it creates or restores a server account from the random installation credential. This happens without opening Social. There is no accountless local play for a new player. An unlinked installation account survives app updates but can be lost after a reinstall, clearing app data or losing the device. In Settings, Save progress can link Play Games or email; Use another account is an explicit choice and does not merge accounts. Google Credential Manager and a browser Google link are not available in this version.

What an account contains

• Identity. An internal account identifier, provider subject or internal installation identifier, a display name from Play Games or Settings, and creation and update timestamps. A Play Games verified email is optional provider metadata; it does not establish an email link and is not used to match or merge accounts across providers.
• Installation credential. For an automatic account, a random public UUID and a SHA-256 verifier of its 256-bit device secret. We retain the verifier, not the secret.
• Optional email link. When you expressly ask for an email sign-in or link code, Resend receives your normalized email address and the one-time code solely to deliver that transactional message from the Buddy Flight sender at pbfungaming.cz; it is not marketing. We store a keyed recipient fingerprint and keyed code verifier for the challenge, never a plaintext code or mailbox in the challenge. A verified email link stores the canonical email address and a keyed email fingerprint as its provider subject. Proving that email can identify the account linked to it; it does not automatically merge with a Play Games account.
• Sessions. Records of your sign-in sessions, storing only a SHA-256 hash of each refresh token together with issue, expiry and revocation times. The tokens themselves exist only in your device's secure storage.
• Ranked results. Each accepted run: its score, the course seed, the rules version, the simulated run duration, the theme and the time the server accepted it. These are what the daily and all-time leaderboards are built from. Your display name and accepted score can appear on the Global leaderboard even if you never open Social.
• Your social graph. Friendships, friend requests you send or receive, accounts you block, and reports you file or that name you (the reason, the screen it came from and the time).
• Challenges. Challenge invitations you create or join, the participants, the responses, and a hash of the secret in each share link. The share link itself is never stored.
• Purchases. Which one-time products you own, and a purchase ledger row per honoured Google Play purchase holding a SHA-256 hash of the Play purchase token, the product identifier and the verification timestamps. A transferred permanent entitlement records the prior internal account identifier and transfer time only with that receipt. We never receive or store your payment details. We receive the purchase token for verification but never store it raw or store the Play order identifier.
• Your online photo, if you send one. See the next section.
• Notification registrations, if you turn notifications on. For each installation of the game that has them enabled, a Firebase Cloud Messaging registration token — a device identifier Google issues so a message can reach that one installation — together with a keyed one-way digest of an opaque installation identifier generated by the app, and the times the registration was created, changed or withdrawn, and the app version if the installation reports it. Older installations have no version recorded. That app-generated value is not Google's Firebase Installation ID. Your one on/off choice covers both notification categories described below and is stored with your account.
• Play Games friend matches, if you use that import. Only the internal identifiers of Buddy Flight accounts that both sides' Play Games friends lists confirmed, and when each side last confirmed them. See below.
• Cosmetic points and owned cosmetics. Your cosmetic point balance and the hats and trails you own. If an old local wallet was transferred into the account, a fingerprint of that source wallet is kept with the account so the same wallet is not transferred into a second account while this one exists. See the next section.

Cosmetic points, hats and trails

Cosmetic points and owned hats and trails are stored with your Buddy Flight account. New points require an online flight accepted by the server; purchases with points require an online connection. You can still play offline and use already-owned cosmetics. On upgrade, one eligible existing local wallet is transferred automatically to the first successfully signed-in account. Another phone's old wallet is not added to it. If a transfer cannot be completed safely, the original local data is retained.

The record of a transferred old local wallet, including its fingerprint, belongs to the account that received it and is deleted together with that account.

Your photo, and the optional online cut-out

The photo feature has two clearly separate halves.

On the device

Taking or picking a photo, cropping it and erasing the background all happen on your phone. The cut-out is produced on the device by Google's on-device ML Kit subject segmentation. Nothing is uploaded at this stage. The original camera or gallery picture stays on the device, and the finished cut-out is kept in the app's private storage.

Sending it online

Outside the first-photo offer described below, every new cut-out starts Private. Saving it, editing it or merely opening Social does not upload it. A cut-out leaves the device only after you deliberately use the Share action for that cut-out and choose Friends or Everyone. If needed, the game first asks you to accept the current user-content terms for the account and terms version. That acceptance does not turn on automatic uploads: each later cut-out starts Private again and needs its own Share action and audience choice.

The one exception is the optional first-photo offer after your first flight (the first-run tutorial in older versions). There, the photo editor's main button is Save & publish, and the editor links these terms with a short acceptance line before you save. Tapping it is your explicit Share action for that first cut-out with the audience Everyone: the game signs you in with Google Play Games if needed, records your acceptance of the current user-content terms and sends that one cut-out for the automatic check. It is shown to anybody only after it has been approved. This happens only while the account's free first online photo is still available; otherwise the cut-out stays on your phone. The ordinary editor's Save still saves locally and does not upload a photo. Every other cut-out follows the rules above.

The audience belongs to one cut-out. Everyone may be chosen for a cut-out that has not been checked yet, as part of the same single Share confirmation, or afterwards for a cut-out that is already approved. In both cases it takes effect only once that cut-out has been checked, nothing is shown to anybody before that, and the choice you made for one photo is never carried over to the next.

When you explicitly share a cut-out:

• Only the processed cut-out the Share action was about is sent. The original camera or gallery file never leaves your device.
• Our server re-encodes what it receives into a new 512×512 PNG on a transparent canvas. That re-encoding drops every piece of metadata the source may have carried, including any location, camera and timestamp fields, and only the re-encoded derivative is stored.
• That derivative — and nothing else about you — is sent to Google Cloud Vision SafeSearch for an automated safety check before it can be shown. It may also be reviewed manually by an authorized moderator, including after a report. Nothing is visible while the first check is outstanding.
• Friends means accepted Buddy Flight friends. The approved cut-out may appear beside your name in Social and on the score marker their game draws for you. A challenge link alone does not grant access.
• Everyone has a narrow meaning: the approved cut-out may also appear beside you in leaderboard rows returned to signed-in players on Global. You give that permission for one specific cut-out — either in the short confirmation that accompanies the Share action sending it, or, for a cut-out that is already approved, in a separate short confirmation for that exact version. Each row uses short-lived authorization that is re-checked before the image is served. There is no public profile-photo directory, and knowing an account identifier does not grant access.
• Other players' cut-outs are delivered with private, non-shared cache instructions. The app keeps them only in memory for the current view and discards them on the relevant block, account switch, account deletion or refresh.
• We store the terms version and acceptance time for an upload, and the Everyone consent — its own version identifier, the audience and the time it was given, for the exact version it was given for, whether that was with the upload or afterwards — so we can show what was agreed to and enforce it.

Control, safety and removal

• A player can report another player, report the exact photo they actually received, or block that player. Reports can lead to manual review and moderator removal. Automated and manual moderation may refuse a submission before publication or remove it later.
• Blocking prevents the pair from receiving each other's cut-outs, including Everyone cut-outs. Unfriending immediately prevents any further authorized Friends serving; it does not by itself remove a valid Everyone cut-out from a signed-in Global leaderboard. Choosing Private stops the approved cut-out being served to anybody else and keeps it stored for you alone; it does not delete it. Deleting the online photo in Settings, deleting the account, or a moderation refusal or removal destroys the server image bytes.
• The original cut-out on your own device is not removed when you withdraw its online version. A copy that had already been delivered to another device may remain visible there while that device is offline; no online service can retroactively erase pixels already delivered. Authorization is checked again on the next request, and the receiving app discards its in-memory copy on refresh.
• If automated or manual moderation rejects an original photo change the account was entitled to use, the account may receive exactly one replacement for a different cut-out. Owner withdrawal, deletion, supersession, cancellation, moderator removal and rejection of that replacement do not issue another replacement. This is a bounded remedy, not an endless replacement chain.
• If the user-content terms change, the previous acceptance is not used for a new upload. A different account must make its own choices, and a later cut-out never inherits an earlier cut-out's Everyone confirmation.

Finding friends from Play Games

Buddy Flight can suggest friends from your Google Play Games friends list, and only from there. This is optional, it is never started on its own, and Google shows you its own permission screen first.

• No contacts and no phone numbers. The game asks for no contacts permission, reads no address book, has no access to your accounts list, and never matches anybody by email address or telephone number. There is no code path in the app or on our server that could.
• Only players who are already here are kept. The app sends us the Play Games player identifiers your own friends list returned. We compare them against the Play Games identities already linked to Buddy Flight accounts and keep only the internal account identifiers that matched. Anything that did not match is discarded immediately: it is not stored, not counted back to you, and not mentioned in the answer.
• Both sides have to agree. A friendship appears only when the most recent import from both accounts named the other. Your import on its own adds nobody, tells nobody you exist, and tells you nothing about whether somebody on your list plays this game.
• It never overrides what you did by hand. Friends you added by request stay friends even if the Play Games match later disappears. A Play Games friendship goes away when both sides' lists have stopped naming each other, or as soon as either of you removes or blocks the other.
• Removing somebody sticks. If you remove a friend, this import will not quietly add them back on its next run, even while you both still have each other in Play Games. It stays that way until you deliberately become friends again by accepting a friend request. Blocking is stronger still: a blocked pair is refused before anything is even recorded.

Optional score notifications

If you turn on the game's single notification switch, we can tell you when a friend passes your score, and when your place drops from the Global Top 10 in Daily or All-time rankings after another accepted online flight. The Global messages collect changes for ten minutes and are limited to at most one Daily and one All-time summary in each rolling 24 hours after a confirmed handoff to Firebase. The friend alerts have no such 24-hour limit. Android separately asks for its notification permission; either permission or the game switch can stop display. You can turn the game switch off in Settings.

• What it takes to send one. A registration token issued by Google's Firebase Cloud Messaging for that one installation of the game. We store it only to deliver these messages, never share it, and never use it to identify you anywhere else. Withdrawing the notification, signing out, deleting the account, or Google telling us the token is no longer valid all remove it. After 90 days without the app refreshing it, the registration becomes eligible for removal by periodic bounded cleanup.
• What Firebase processes after opt-in. When you turn notifications on, Firebase Messaging and Firebase Installations automatically process Google's own Firebase Installation ID, the app version, and Firebase user-agent/SDK metadata needed to operate messaging. These are Google's Firebase identifiers and technical metadata, separate from the opaque app-generated installation identifier whose keyed digest our server stores.
• What is in the message. A friend alert contains that friend's display name and new score. A Global summary contains the ranking period, your earlier and current place, the number of opponents involved, and one opponent's display name only when there was exactly one. Each also names the screen to open. No message contains a photograph, avatar, account identifier or token.
• It is checked again before it is sent. Friend alerts require an accepted friendship with no block in either direction. Global summaries require your account to have no active block in either direction, a still-current ranking, and an updated app that understands the message. Both require your game switch to remain on and a live installation. Otherwise the message is dropped.
• Delivery is best-effort. A message that Google could not accept is retried a few times and then given up on. Because a network can lose an acknowledgement, a notification may very occasionally arrive twice; there is no way to guarantee otherwise.

Optional reminder on your device

Separately from score notifications, you can choose a gentle reminder to fly again after at least 48 hours away from the game. It is off by default, including after an update. After you first score a point, the game presents one combined invitation at a quiet game over; if another card blocks it, the invitation can appear at a later quiet game over. Choosing Yes enables all described notification categories, subject to Android's notification permission. You can turn each category off individually under Settings, Notifications. The app stores that reminder choice and the time you last left the game only on this device and schedules one local Android notification for that period away. It does not send your play time, inactivity, or individual reminder setting to our server or to Firebase. Separately, if anonymous usage analytics is enabled, the response to the combined notification invitation can be measured as described below; notification permission does not enable analytics. No account is needed. Opening the game cancels a pending reminder; another can be scheduled only after you leave again. Android may deliver it later than 48 hours or not at all if notifications are disabled or the app is force-stopped.

Inviting a friend

You can share an invite link. If somebody installs Buddy Flight from it and then plays their first online flight and scores at least one point, you receive one photo change — the same unit the Photo Studio purchase gives. Nothing is rewarded for a rating, a review, an advertisement or installing a different app, and the person you invited receives nothing and is never told who invited them.

• The link itself contains a random capability we only ever store as a one-way digest. Sharing it, withdrawing it or replacing it is up to you, at any time, from the Friends screen.
• When somebody taps the link, the page exchanges it for a short-lived, single-use install code and hands that code to Google Play as the install referrer. Google Play reports it back to the freshly installed app once, and the app sends it to us so we know which invite the install came from. It expires by itself and cannot be reused.
• We record that one account arrived through one invite. We do not record who you shared the link with, and the counts on your Friends screen never name anybody.
• Before the reward is granted, the invited player's device asks Google for a Play Integrity verdict about that one flight, and we ask Google to decode it. The verdict tells us whether the app is a genuine Play install on a genuine device with a licensed Google account. We store no part of it: we keep only the moment it was checked. It exists to stop one person rewarding themselves with fabricated installs.
• If Google cannot be reached, or the check does not pass, nothing happens: the game keeps working normally, the flight still counts on the leaderboard, and the reward simply waits.

Why we use this data

• To create and operate your account and to keep you signed in.
• To run ranked leaderboards, friends, blocks, reports and challenges.
• To grant, restore and protect one-time purchases, and to make sure a purchase is honoured exactly once.
• To keep your cosmetic points and the hats and trails you own with your account, and to stop one old local wallet being transferred into more than one existing account.
• To check submitted photos for prohibited content before other players can see them, and to act on reports.
• To suggest friends from your Play Games friends list when you ask for it, and only where both sides confirm each other.
• To deliver the optional friend and Global Top 10 score notifications covered by one switch, and to stop them when you turn it off or the relevant relationship, ranking or installation is no longer eligible.
• To attribute an invite to the account it came from, to reward it exactly once, and to keep that reward from being farmed — which is what the install referrer, the Play Integrity check and the limit on how many invites are rewarded in a week are for.
• To keep the service working and to prevent abuse — rate limiting, anti-replay of purchases and anti-fraud checks on ranked submissions.
• When anonymous usage analytics is enabled under the regional choices described below, to understand which game and social features are used and where players leave a flight or photo-sharing flow, so we can improve the game.

Where the GDPR applies, we rely on performance of a contract with you for operating the account and its features, on your consent for sending an optional photo online and for personalised advertising where consent is asked for, and on our legitimate interest in a service that is not abused for the moderation, rate limiting and anti-fraud measures.

Who else processes it

We do not sell your data. The Google Mobile Ads SDK collects and shares the technical advertising data described in the next section for Google's advertising, analytics and fraud-prevention purposes when advertising is enabled. We use these providers to run the rest of the service:

• Google Play Games Services — the identity you sign in with, and the display name we receive.
• Resend — sends an email sign-in or link code only when you request one. It receives the normalized recipient address and the one-time code for that delivery.
• Google Play Billing — processes every purchase. Google sees the transaction; we do not. Each purchase is stamped with a one-way hash of your internal account identifier so we can check the buyer without exporting the identifier itself.
• Google AdMob, with Google's User Messaging Platform for consent — serves the occasional interstitial advertisement. See the next section.
• Google Cloud Vision (SafeSearch) — our processor for the automated safety check; it receives only the re-encoded cut-out derivative described above.
• Google Play Install Referrer — reports, once per installation, the single-use code an invite link handed to Google Play, so an install can be attributed to the invite it came from.
• Google Play Games friends — the friends list your own device asks Google for, under Google's own permission screen, when you use the friend import.
• Firebase Cloud Messaging — delivers the optional notification to your device. It uses Firebase Installations, issues the registration token described above, and carries the message; after opt-in it automatically processes its own Firebase Installation ID, app version and Firebase user-agent/SDK metadata. It receives no photograph and no account identifier of ours.
• Google Analytics for Firebase — after Analytics Storage is granted through Google's privacy choices, after Google freshly reports that consent for that purpose is not required (enabled by default unless you have declined), or through the game's Analytics switch where Google says that purpose is not applicable or not configured. The regional default persists until you turn it off or a fresh Google evaluation requires consent, refuses it or no longer configures that purpose. It receives a random app-instance identifier, basic app/device and session information, coarse country derived from the connection, documented automatic lifecycle events, and the bounded game events described below. We do not send it your Buddy Flight account identifier, Play Games identity, display name, photo, purchase identifier or free text.
• Google Play Integrity — checks that a rewarded invite came from a genuine Play install of this app on a genuine device with a licensed Google account. It is asked only about an account that is actually carrying an unclaimed invite, and only about the one flight being rewarded.
• Google Cloud Run — hosts the server that answers the app.
• Google Cloud SQL — hosts the managed PostgreSQL database the account data lives in, in the European Union.

Processor personnel and our administrators or moderators may access account or cut-out data only to operate, secure and moderate the service, answer a report or support request, or comply with law. Access is limited to people and systems that need it; we do not provide a public browsing or download surface.

Optional anonymous usage analytics

Buddy Flight includes Google Analytics for Firebase. Where Google requires privacy choices, Analytics starts only when Analytics Storage is granted there. After a successful Google evaluation says that consent for that purpose is not required, anonymous usage analytics is enabled by default unless you have already declined. This regional default stays enabled between launches, including while offline or waiting for Google's next evaluation, until you turn it off or a fresh evaluation requires consent, refuses it or no longer configures the purpose. If you travel to a region where consent is required, that change takes effect when Google successfully evaluates the new requirement. Where Google does not configure the purpose, there is no new default activation; you may choose it under Settings → Anonymous usage analytics. You can decline without losing any feature. Turning it off through the same Settings card stops future Analytics collection and resets the Analytics data and random app-instance identifier held locally by the SDK.

When enabled, Firebase automatically measures lifecycle and session events such as first open, app update, session start and engagement. We additionally send only bounded events for flight start/end, an accepted ranked score, opening Social, saving a local photo, the result/audience of an online photo action, your answer to the optional photo offer after a flight (shown, camera, gallery, mascot, back or dismissed), and the optional notification invitation (shown, yes, no or back). For that invitation we can measure Android's permission result and whether notification registration completed, is pending sign-in or is unavailable. These results do not show that a notification was delivered. Their parameters are short categories and bounded numbers such as local/ranked, mascot/photo, scene, score, duration, starting and remaining lives, collisions, the number of flaps after take-off and the position of the flight since this installation (capped at 50). To know that position, the app keeps a count of flights started on this installation. The count stays on the device, is excluded from backups and device transfers, and is cleared when you turn Analytics off or delete your account. Automatic screen reporting is disabled.

Analytics uses a random identifier for this installation. We never set a Firebase user ID or user property and never join Analytics to a Buddy Flight account. Analytics advertising-ID collection is disabled. The Analytics integration changes only Analytics Storage and never changes Ad Storage, Ad User Data or ad-personalization choices; those remain under Google's advertising-consent flow. Product events are used only for measurement, never personalized advertising. Google derives coarse country from the connection; Google states that Analytics does not log or store the IP address itself. User-level event data is kept for two months in our Analytics property. Aggregate reports may remain longer under Google's retention rules.

Buddy Flight still does not include Firebase Crashlytics and sends no crash report or gameplay analytics event to our own server. Google's advertising SDK has its separate diagnostic and interaction collection described below.

All traffic between the app and our server is HTTPS. Every request is authenticated with a short-lived bearer token, and refresh tokens rotate on every use.

Advertising

When advertising is enabled, Buddy Flight shows one kind of advertisement: an occasional full-screen interstitial after a run has ended. There are no banners, no rewarded videos and no ads during play. Google states that its Mobile Ads SDK automatically collects and shares the device IP address (which can estimate general location), product interactions such as app launches, taps and ad views, diagnostic information, and device or account identifiers. Google uses that data for advertising, analytics and fraud prevention, and encrypts it in transit. This is independent of whether you create a Buddy Flight account. See Google's Privacy Policy.

In the European Economic Area, the United Kingdom and Switzerland, Google's User Messaging Platform checks whether a privacy message or choice is required before any ad request is made. You can change an available choice at any time in the game under Settings → Privacy choices. Buying Remove Ads turns interstitials off entirely.

Children

Buddy Flight is not directed to children under 13. A supported Play Games sign-in may create an account without opening Social, and an accepted ranked flight may publish a name and score. If you believe a child has created an account, write to info@pbfungaming.cz and we will delete it.

How long we keep it

Account data is kept for as long as the account exists; while it exists, its accepted ranked runs are kept so that historical leaderboards stay correct.

We may remove an abandoned installation-only account after more than 180 days without activity. We do not include linked accounts, accounts with purchases or entitlements, remaining photo credits, cosmetic points or owned cosmetic items, pending rewards, or accounts for which remaining value or activity cannot be established safely. Such removal happens only after this cleanup has been enabled. Deleting an account removes its account-linked progress and may change historical leaderboards. Your local game photo remains on your device unless you remove it there.

Session records expire on their own and are removed when they are revoked or rotated. The pending queue for photo review is bounded. Choosing Private stops further serving to anybody else while the approved photo stays stored for its owner; deleting the online photo in Settings, owner account deletion, moderation refusal or moderator removal destroys the stored image bytes. The avatar version's status, consent and moderation record — and reports tied to that exact version — may remain with the account for enforcement, audit and to prevent repeated free submissions; account deletion removes them. Install codes expire by themselves within a day. A notification registration is kept while it works and is removed when you withdraw it, when a different account signs in on that installation, when Google tells us the token no longer exists, or by periodic bounded cleanup once 90 days have passed without a refresh from the app; a queued notification stops being retried within hours. A completed Global rank summary and its short-lived opponent record are removed after seven days. A Play Games friend match is kept while both sides keep confirming it. The fingerprint of an old local wallet transferred into an account is kept only with that account and is deleted together with it. Our app server keeps no separate archive or backup copy that survives a deletion; Firebase's own service-side records follow Google's retention policies. An email-code challenge is valid for 10 minutes, allows at most five attempts, is subject to a 60-second per-recipient cooldown and three UTC-day sends per recipient, and is pruned when a later email admission removes challenge rows older than 24 hours. That pruning is not a promise of deletion exactly at 24 hours.

If anonymous usage analytics is enabled, its user-level event data is kept in Google Analytics for two months. Turning analytics off or deleting your Buddy Flight account stops future collection and resets the local random app-instance identifier. Earlier Analytics events contain no Buddy Flight account mapping, so they cannot be selected or deleted by your account identifier; they expire under the Analytics retention setting and may remain only in aggregate reporting.

One record about invites outlives an account, and it holds no readable data about anybody: when an invite has actually been rewarded, the fraud record of it keeps one-way keyed fingerprints of the two accounts involved instead of their identifiers. It is the same kind of fingerprint, kept for the same reason and with the same retention, as the one described on the account deletion page — it is what stops the same reward being claimed twice by deleting and starting again.

Deleting your account

You can delete your account and its account-scoped data at any time, from inside the game under Settings → Delete online account. If you have already uninstalled the game, you can ask us by email instead. Both routes and the exact list of what is removed are on the account deletion page.

Deletion removes the account, links, sessions and installation credentials with its account-scoped data, including cosmetic points, owned hats and trails and the record of any old local wallet transferred into it. It permanently retires one-way fingerprints of Play Games and installation identities to prevent re-registration with those identities. An explicit email link is not retired, so it may create a fresh account later, but cannot recover deleted progress.

Short-lived email-code challenges are not account-owned records; they follow the separate validity and pruning schedule described above.

Deleting your account does not affect the photo stored on your own device, which is yours and stays there until you remove it or uninstall the game. It removes server authorization and image bytes, but cannot retroactively erase pixels that another device already received while it was authorized and then kept in an offline in-memory view.

Account deletion also resets the random Analytics identifier on this device. Earlier anonymous Analytics events are not linked to the Buddy Flight account and therefore cannot be looked up by the deleted account identifier; they follow the retention described above.

International transfers

Our server and database run in the European Union. Google, as a provider, processes some data outside the European Economic Area, including in the United States. Those transfers rely on Google's own compliance framework — European Commission adequacy decisions such as the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

Your rights

Where the GDPR applies you have the right to access your personal data, to have it corrected, to have it erased, to receive a copy of it, to restrict or object to certain processing, and to withdraw a consent you gave. Account deletion in the game exercises the right to erasure directly; for anything else write to info@pbfungaming.cz and we will answer within one month. You may also complain to your local supervisory authority — in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz).

This page

This page and the two beside it set no cookies, run no scripts, load nothing from another server and use no analytics. They use your device's own system fonts.

Changes

If this policy changes, the updated version appears here with a new date. A change that materially affects how your data is used will also be announced in the game.