Buddy Flight — Privacy Policy

Last updated: 2 September 2026

Buddy Flight is a small arcade game. You can install it and play without creating a Buddy Flight account or sending your local score, theme or photo to our servers. Google Play, the install-referrer service and — in builds that contain advertising — Google's consent and advertising SDKs may still exchange the technical data described below. This page explains exactly what changes if you choose to use the optional online features, and what happens to that data afterwards.

Who is responsible for your data

Buddy Flight is published by PB Fun Gaming, IČO 01033450, Czech Republic. That is the data controller for everything described below. You can reach us at info@pbfungaming.cz about anything on this page, including access, correction, export and erasure requests.

Playing without an account

Tapping to fly, taking a photo, cutting out your buddy, changing the theme or the language and beating your own best score all happen entirely on your device. None of it is sent anywhere and none of it needs an account. There is no sign-in wall anywhere in the game.

What stays on your device

• Your best score, the selected theme and the selected language.
• Your hero photo: the cut-out image you made in the photo editor, kept in the app's private storage. It is excluded from Android cloud backup and from device-to-device transfer, so it does not follow you onto a new phone unless you make it again there.
• The camera or gallery picture you started from is not uploaded to Buddy Flight. A temporary camera file created for the app is removed once the cut-out is saved.
• If you use the online features, the sign-in tokens for your account, held in Android's encrypted secure storage.

Uninstalling Buddy Flight removes all of this.

Once, on the very first run after installation, the game asks Google Play for the install referrer. That is how a challenge link you tapped before installing still opens the right challenge afterwards. The only thing kept from it is a first-party challenge code, and only when the referrer actually contains one. There is no attribution or install-tracking service in Buddy Flight.

When an account is created

An account on our server is created at exactly one moment: the first time you open Social or accept a challenge link and complete the Google Play Games sign-in that we then ask you for. Nothing earlier in the game — not the first launch, not the photo editor, not the store screen — creates one. If you never open Social, we hold no account for you.

What an account contains

• Identity. An internal account identifier we generate, the display name Google Play Games provides for you, and the timestamps of creation and last change.
• The link to Google Play Games. Your stable Play Games player identifier and, when Google supplies one, the verified email address of that Google account. The email address is stored as recovery metadata only; no part of the service ever looks an account up by it.
• Sessions. Records of your sign-in sessions, storing only a SHA-256 hash of each refresh token together with issue, expiry and revocation times. The tokens themselves exist only in your device's secure storage.
• Ranked results. Each accepted run: its score, the course seed, the rules version, the simulated run duration, the theme and the time the server accepted it. These are what the daily, weekly and all-time leaderboards are built from.
• Your social graph. Friendships, friend requests you send or receive, accounts you block, and reports you file or that name you (the reason, the screen it came from and the time).
• Challenges. Challenge invitations you create or join, the participants, the responses, and a hash of the secret in each share link. The share link itself is never stored.
• Purchases. Which one-time products you own, and a purchase ledger row per honoured Google Play purchase holding a SHA-256 hash of the Play purchase token, the product identifier and the verification timestamps. We never receive or store your payment details, and we never store the raw purchase token or the Play order identifier.
• Your online photo, if you send one. See the next section.
• Notification registrations, if you turn notifications on. For each installation of the game that has them enabled, a Firebase Cloud Messaging registration token — a device identifier Google issues so a message can reach that one installation — together with a keyed one-way digest of an opaque installation identifier generated by the app, and the times the registration was created, changed or withdrawn. That app-generated value is not Google's Firebase Installation ID. Your on/off choice for the notification is stored beside it.
• Play Games friend matches, if you use that import. Only the internal identifiers of Buddy Flight accounts that both sides' Play Games friends lists confirmed, and when each side last confirmed them. See below.

Your photo, and the optional online cut-out

The photo feature has two clearly separate halves.

On the device

Taking or picking a photo, cropping it and erasing the background all happen on your phone. The cut-out is produced on the device by Google's on-device ML Kit subject segmentation. Nothing is uploaded at this stage. The original camera or gallery picture stays on the device, and the finished cut-out is kept in the app's private storage.

Sending it online

Every new cut-out starts Private. Saving it, editing it or merely opening Social does not upload it. A cut-out leaves the device only after you deliberately use the Share action for that cut-out and choose Friends or Everyone. If needed, the game first asks you to accept the current user-content terms for the account and terms version. That acceptance does not turn on automatic uploads: each later cut-out starts Private again and needs its own Share action and audience choice.

The audience belongs to one cut-out. Everyone may be chosen for a cut-out that has not been checked yet, as part of the same single Share confirmation, or afterwards for a cut-out that is already approved. In both cases it takes effect only once that cut-out has been checked, nothing is shown to anybody before that, and the choice you made for one photo is never carried over to the next.

When you explicitly share a cut-out:

• Only the processed cut-out the Share action was about is sent. The original camera or gallery file never leaves your device.
• Our server re-encodes what it receives into a new 512×512 PNG on a transparent canvas. That re-encoding drops every piece of metadata the source may have carried, including any location, camera and timestamp fields, and only the re-encoded derivative is stored.
• That derivative — and nothing else about you — is sent to Google Cloud Vision SafeSearch for an automated safety check before it can be shown. It may also be reviewed manually by an authorized moderator, including after a report. Nothing is visible while the first check is outstanding.
• Friends means accepted Buddy Flight friends. The approved cut-out may appear beside your name in Social and on the score marker their game draws for you. A challenge link alone does not grant access.
• Everyone has a narrow meaning: the approved cut-out may also appear beside you in leaderboard rows returned to signed-in players on Global. You give that permission for one specific cut-out — either in the short confirmation that accompanies the Share action sending it, or, for a cut-out that is already approved, in a separate short confirmation for that exact version. Each row uses short-lived authorization that is re-checked before the image is served. There is no public profile-photo directory, and knowing an account identifier does not grant access.
• Other players' cut-outs are delivered with private, non-shared cache instructions. The app keeps them only in memory for the current view and discards them on the relevant block, account switch, account deletion or refresh.
• We store the terms version and acceptance time for an upload, and the Everyone consent — its own version identifier, the audience and the time it was given, for the exact version it was given for, whether that was with the upload or afterwards — so we can show what was agreed to and enforce it.

Control, safety and removal

• A player can report another player, report the exact photo they actually received, or block that player. Reports can lead to manual review and moderator removal. Automated and manual moderation may refuse a submission before publication or remove it later.
• Blocking prevents the pair from receiving each other's cut-outs, including Everyone cut-outs. Unfriending immediately prevents any further authorized Friends serving; it does not by itself remove a valid Everyone cut-out from a signed-in Global leaderboard. Choosing Private, withdrawing the online photo, deleting it, or deleting the account stops further serving and destroys the server image bytes.
• The original cut-out on your own device is not removed when you withdraw its online version. A copy that had already been delivered to another device may remain visible there while that device is offline; no online service can retroactively erase pixels already delivered. Authorization is checked again on the next request, and the receiving app discards its in-memory copy on refresh.
• If automated or manual moderation rejects an original photo change the account was entitled to use, the account may receive exactly one replacement for a different cut-out. Owner withdrawal, deletion, supersession, cancellation, moderator removal and rejection of that replacement do not issue another replacement. This is a bounded remedy, not an endless replacement chain.
• If the user-content terms change, the previous acceptance is not used for a new upload. A different account must make its own choices, and a later cut-out never inherits an earlier cut-out's Everyone confirmation.

Finding friends from Play Games

Buddy Flight can suggest friends from your Google Play Games friends list, and only from there. This is optional, it is never started on its own, and Google shows you its own permission screen first.

• No contacts and no phone numbers. The game asks for no contacts permission, reads no address book, has no access to your accounts list, and never matches anybody by email address or telephone number. There is no code path in the app or on our server that could.
• Only players who are already here are kept. The app sends us the Play Games player identifiers your own friends list returned. We compare them against the Play Games identities already linked to Buddy Flight accounts and keep only the internal account identifiers that matched. Anything that did not match is discarded immediately: it is not stored, not counted back to you, and not mentioned in the answer.
• Both sides have to agree. A friendship appears only when the most recent import from both accounts named the other. Your import on its own adds nobody, tells nobody you exist, and tells you nothing about whether somebody on your list plays this game.
• It never overrides what you did by hand. Friends you added by request stay friends even if the Play Games match later disappears. A Play Games friendship goes away when both sides' lists have stopped naming each other, or as soon as either of you removes or blocks the other.
• Removing somebody sticks. If you remove a friend, this import will not quietly add them back on its next run, even while you both still have each other in Play Games. It stays that way until you deliberately become friends again by accepting a friend request. Blocking is stronger still: a blocked pair is refused before anything is even recorded.

Notifications when a friend passes your score

If you turn it on, we can send one kind of notification: a friend's new all-time best has gone past yours. It is optional in two independent ways — Android asks for its own notification permission, and the game has its own switch that stops us queueing anything at all.

• What it takes to send one. A registration token issued by Google's Firebase Cloud Messaging for that one installation of the game. We store it only to deliver these messages, never share it, and never use it to identify you anywhere else. Withdrawing the notification, signing out, deleting the account, or Google telling us the token is no longer valid all remove it. After 90 days without the app refreshing it, the registration becomes eligible for removal by periodic bounded cleanup.
• What Firebase processes after opt-in. When you turn notifications on, Firebase Messaging and Firebase Installations automatically process Google's own Firebase Installation ID, the app version, and Firebase user-agent/SDK metadata needed to operate messaging. These are Google's Firebase identifiers and technical metadata, separate from the opaque app-generated installation identifier whose keyed digest our server stores.
• What is in the message. The friend's display name, their new score, and which screen to open. Nothing else — no photograph, no avatar, and no account identifier — so nothing on a lock screen says more than the leaderboard already shows that player.
• It is checked again before it is sent. Between the flight and the delivery we re-check that you are still friends, that neither of you has blocked the other, and that you have not switched the notification off. Any of those means the message is dropped and never sent.
• Delivery is best-effort. A message that Google could not accept is retried a few times and then given up on. Because a network can lose an acknowledgement, a notification may very occasionally arrive twice; there is no way to guarantee otherwise.

Inviting a friend

You can share an invite link. If somebody installs Buddy Flight from it and then plays their first online flight and scores at least one point, you receive one photo change — the same unit the Photo Studio purchase gives. Nothing is rewarded for a rating, a review, an advertisement or installing a different app, and the person you invited receives nothing and is never told who invited them.

• The link itself contains a random capability we only ever store as a one-way digest. Sharing it, withdrawing it or replacing it is up to you, at any time, from the Friends screen.
• When somebody taps the link, the page exchanges it for a short-lived, single-use install code and hands that code to Google Play as the install referrer. Google Play reports it back to the freshly installed app once, and the app sends it to us so we know which invite the install came from. It expires by itself and cannot be reused.
• We record that one account arrived through one invite. We do not record who you shared the link with, and the counts on your Friends screen never name anybody.
• Before the reward is granted, the invited player's device asks Google for a Play Integrity verdict about that one flight, and we ask Google to decode it. The verdict tells us whether the app is a genuine Play install on a genuine device with a licensed Google account. We store no part of it: we keep only the moment it was checked. It exists to stop one person rewarding themselves with fabricated installs.
• If Google cannot be reached, or the check does not pass, nothing happens: the game keeps working normally, the flight still counts on the leaderboard, and the reward simply waits.

Why we use this data

• To create and operate your account and to keep you signed in.
• To run ranked leaderboards, friends, blocks, reports and challenges.
• To grant, restore and protect one-time purchases, and to make sure a purchase is honoured exactly once.
• To check submitted photos for prohibited content before other players can see them, and to act on reports.
• To suggest friends from your Play Games friends list when you ask for it, and only where both sides confirm each other.
• To deliver the one notification you can switch on, and to stop delivering it as soon as you switch it off, remove the friend, block them, or the device stops accepting messages.
• To attribute an invite to the account it came from, to reward it exactly once, and to keep that reward from being farmed — which is what the install referrer, the Play Integrity check and the limit on how many invites are rewarded in a week are for.
• To keep the service working and to prevent abuse — rate limiting, anti-replay of purchases and anti-fraud checks on ranked submissions.

Where the GDPR applies, we rely on performance of a contract with you for operating the account and its features, on your consent for sending an optional photo online and for personalised advertising where consent is asked for, and on our legitimate interest in a service that is not abused for the moderation, rate limiting and anti-fraud measures.

Who else processes it

We do not sell your data. The Google Mobile Ads SDK collects and shares the technical advertising data described in the next section for Google's advertising, analytics and fraud-prevention purposes when advertising is enabled. We use these providers to run the rest of the service:

• Google Play Games Services — the identity you sign in with, and the display name we receive.
• Google Play Billing — processes every purchase. Google sees the transaction; we do not. Each purchase is stamped with a one-way hash of your internal account identifier so we can check the buyer without exporting the identifier itself.
• Google AdMob, with Google's User Messaging Platform for consent — serves the occasional interstitial advertisement. See the next section.
• Google Cloud Vision (SafeSearch) — our processor for the automated safety check; it receives only the re-encoded cut-out derivative described above.
• Google Play Install Referrer — reports, once per installation, the single-use code an invite link handed to Google Play, so an install can be attributed to the invite it came from.
• Google Play Games friends — the friends list your own device asks Google for, under Google's own permission screen, when you use the friend import.
• Firebase Cloud Messaging — delivers the optional notification to your device. It uses Firebase Installations, issues the registration token described above, and carries the message; after opt-in it automatically processes its own Firebase Installation ID, app version and Firebase user-agent/SDK metadata. It receives no photograph and no account identifier of ours.
• Google Play Integrity — checks that a rewarded invite came from a genuine Play install of this app on a genuine device with a licensed Google account. It is asked only about an account that is actually carrying an unclaimed invite, and only about the one flight being rewarded.
• Google Cloud Run — hosts the server that answers the app.
• Neon — hosts the managed PostgreSQL database the account data lives in, in the European Union.

Processor personnel and our administrators or moderators may access account or cut-out data only to operate, secure and moderate the service, answer a report or support request, or comply with law. Access is limited to people and systems that need it; we do not provide a public browsing or download surface.

Buddy Flight does not include Firebase Crashlytics, Firebase Analytics, Google Analytics or a first-party analytics or attribution SDK. The only Firebase component in the game is Cloud Messaging, used solely to deliver the notification described above; it is not analytics and collects no usage measurement for us. It sends no crash report or gameplay analytics event to our server. Google's advertising SDK has its own diagnostic and interaction collection, described below.

All traffic between the app and our server is HTTPS. Every request is authenticated with a short-lived bearer token, and refresh tokens rotate on every use.

Advertising

When advertising is enabled, Buddy Flight shows one kind of advertisement: an occasional full-screen interstitial after a run has ended. There are no banners, no rewarded videos and no ads during play. Google states that its Mobile Ads SDK automatically collects and shares the device IP address (which can estimate general location), product interactions such as app launches, taps and ad views, diagnostic information, and device or account identifiers. Google uses that data for advertising, analytics and fraud prevention, and encrypts it in transit. This is independent of whether you create a Buddy Flight account. See Google's Privacy Policy.

In the European Economic Area, the United Kingdom and Switzerland, Google's User Messaging Platform checks whether a privacy message or choice is required before any ad request is made. You can change an available choice at any time in the game under Settings → Ad privacy options. Buying Remove Ads turns interstitials off entirely.

Children

Buddy Flight is not directed to children under 13, and the online features are not intended for them. We do not knowingly collect personal data from a child under 13. If you believe a child has created an account, write to info@pbfungaming.cz and we will delete it.

How long we keep it

Account data is kept for as long as the account exists. Ranked runs remain so that historical leaderboards stay correct. Session records expire on their own and are removed when they are revoked or rotated. The pending queue for photo review is bounded. Choosing Private, owner deletion, moderation refusal or moderator removal destroys the stored image bytes and stops further serving. The avatar version's status, consent and moderation record — and reports tied to that exact version — may remain with the account for enforcement, audit and to prevent repeated free submissions; account deletion removes them. Install codes expire by themselves within a day. A notification registration is kept while it works and is removed when you withdraw it, when a different account signs in on that installation, when Google tells us the token no longer exists, or by periodic bounded cleanup once 90 days have passed without a refresh from the app; a queued notification stops being retried within hours. A Play Games friend match is kept while both sides keep confirming it. Our app server keeps no separate archive or backup copy that survives a deletion; Firebase's own service-side records follow Google's retention policies.

One record about invites outlives an account, and it holds no readable data about anybody: when an invite has actually been rewarded, the fraud record of it keeps one-way keyed fingerprints of the two accounts involved instead of their identifiers. It is the same kind of fingerprint, kept for the same reason and with the same retention, as the one described on the account deletion page — it is what stops the same reward being claimed twice by deleting and starting again.

Deleting your account

You can delete your account and everything listed above at any time, from inside the game under Settings → Delete online account. If you have already uninstalled the game, you can ask us by email instead. Both routes and the exact list of what is removed are on the account deletion page.

Deleting your account does not affect the photo stored on your own device, which is yours and stays there until you remove it or uninstall the game. It removes server authorization and image bytes, but cannot retroactively erase pixels that another device already received while it was authorized and then kept in an offline in-memory view.

International transfers

Our server and database run in the European Union. Google, as a provider, processes some data outside the European Economic Area, including in the United States. Those transfers rely on Google's own compliance framework — European Commission adequacy decisions such as the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

Your rights

Where the GDPR applies you have the right to access your personal data, to have it corrected, to have it erased, to receive a copy of it, to restrict or object to certain processing, and to withdraw a consent you gave. Account deletion in the game exercises the right to erasure directly; for anything else write to info@pbfungaming.cz and we will answer within one month. You may also complain to your local supervisory authority — in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz).

This page

This page and the two beside it set no cookies, run no scripts, load nothing from another server and use no analytics. They use your device's own system fonts.

Changes

If this policy changes, the updated version appears here with a new date. A change that materially affects how your data is used will also be announced in the game.