Player feedback
The optional feedback form sends your report category and message, plus any player name, app version and device details you choose to provide, to our service on AWS and database on Supabase. Reports are private to the Runbound team and used to investigate bugs and improve the game. No account or email address is required. Do not include passwords, recovery codes or sensitive information.
Reports older than 180 days are deleted from our primary system on the next feedback submission or admin inbox visit. Limited copies may remain temporarily in provider backups or security logs under documented recovery and security schedules. For earlier deletion, contact shashwatsingh0511@gmail.com with the report reference shown after submission.
Profiles and friends
Pass-and-play names are local scoreboard labels. Online profiles reserve a unique public Runbound name consisting of a chosen name, four digits and two symbols. This username is used for the leaderboard and online matches; a cached copy can be used in nearby matches. Anyone who knows your exact username can send a match invitation unless blocked. Invitations expire after ten minutes. Completed online matches automatically add human opponents to each other's friend lists. You can remove or block players from Profile.
We retain profile bot points, levels, per-mode results, friend links, block lists and invitation records to provide these features. Private recovery codes authenticate access; only their hashes are stored on the server. Delete your profile from Profile > Recovery & delete profile, or visit runbound.live/delete-account if you cannot access the app. Profile deletion removes its primary server records, including social records. Other players' historical match results are not erased. These profile records are separate from operational room retention. Runbound does not use advertising or social-login SDKs. It uses Google Analytics for Firebase as described below.
Global bot leaderboard
Solo bot attempts are registered online automatically. Moves are saved locally for offline play and completed histories upload automatically when connected while the app is open. We validate the history and retain profiles, registered configurations and scored results in Supabase. Uploaded histories are not retained in the leaderboard tables. Qualifying entries publicly show chosen names, random profile IDs, scores, wins, attempt counts and ranks. Only a hash of the recovery code is stored on the server.
Profile and result records persist until you delete your profile in Settings > Leaderboard profile > Delete my leaderboard profile. This also deletes your ranked attempts. The six-hour room retention below does not apply to leaderboard data. Ranked recovery credentials and journals are kept in private no-backup storage on your device.
Information used for online multiplayer
When you deliberately create or join an online room, Runbound sends information to the Runbound online service:
- Your chosen display name.
- Room configuration, including room code, seat count, chase target, bot settings, game number, and connection status.
- Gameplay actions and the authoritative match state required to operate and restore the room.
- Event timestamps, request and seat identifiers, and a cryptographic hash of the temporary membership token. The database does not store the plaintext membership token.
Usage and diagnostics
Runbound automatically collects limited usage and diagnostic information to operate, improve and troubleshoot the game. This includes first-party reporting sent over HTTPS to our service on AWS and database on Supabase, plus Google Analytics for Firebase.
Our first-party usage events may include a randomly generated installation identifier, session and pseudonymous match references, timestamps, app version and build type, app foreground time, screens visited, tutorial progress, match mode, player count, card interactions, rematches and connection results. These records can distinguish repeat activity from an installation. We do not intentionally associate the usage identifier with a Runbound profile, but infrastructure records such as request timing and network-address logs may be processed separately to operate and secure the service.
Google Analytics for Firebase automatically processes an app-instance identifier, app lifecycle and screen/session events, and coarse location derived from a masked IP address. Runbound disables Advertising ID collection, personalized-ad signals, Google Signals, Google Ads links and Firebase user-ID assignment. We do not send player names, recovery codes, room codes, membership credentials, feedback text or card-hand contents to Firebase Analytics.
We do not sell data or use it for advertising. First-party usage reports are available only to the Runbound team through a private admin dashboard. Firebase Analytics data is processed by Google under its applicable terms and configured retention settings.
The app can queue up to 2,000 first-party usage events on the device for up to 30 days and uploads them when the app process runs with a connection. Reporting failures do not block gameplay. Uploaded first-party usage records are deleted from our primary analytics system after 90 days. Limited copies may remain temporarily in provider backups or security logs under documented recovery and security schedules.
Clearing app data or uninstalling deletes the local first-party event queue and installation identifier; a fresh installation uses a new identifier. This does not immediately erase uploaded records. Profile deletion does not identify or remove separate usage records, which expire automatically. Contact us at shashwatsingh0511@gmail.com with questions.
Service providers
Mayukha uses Amazon Web Services (AWS) to host the Runbound service, Supabase to provide the PostgreSQL database, and Google Analytics for Firebase to measure app usage. These providers process the information described in this policy to operate, secure, maintain and improve Runbound.
Hosting infrastructure may transiently process standard network information, including an IP address, to deliver and protect connections. We do not use this information for advertising or profiling.
How online data is used
We use online data to operate private rooms and ranked profiles, synchronize matches, validate actions and results, publish leaderboard standings, recover profiles, reconnect interrupted players, prevent duplicate results, and diagnose service failures. We do not sell this information or use it for advertising.
Retention
Operational online-room records are scheduled for deletion from the primary database six hours after room creation. This deletion covers room members, match snapshots and accepted-action events. Limited copies may remain temporarily in provider backups or security logs under their documented recovery and security schedules.
Offline and nearby play
Pass-and-play match state remains on the device; separate usage events are uploaded as described above. Solo bot matches upload completed histories automatically when connected. Nearby multiplayer sends the chosen display name, room messages, and seat-specific game state directly between participating phones on the same Wi-Fi network or hotspot. Nearby game-state traffic is encrypted and is not relayed through the online service or stored in Supabase. Separate usage events are sent to our service.
Settings, a resumable match, local scorecards, and nearby recovery metadata can be stored on the device. Nearby guest tokens are protected with Android Keystore, and Android cloud and device-transfer backup are disabled for this data.
Security
Online traffic uses HTTPS and secure WebSockets. Nearby-room traffic is encrypted and authenticated. No storage or transmission method is completely risk-free, but access and retention are limited to the purposes described in this policy.
Deletion and contact
Uninstalling Runbound removes local app data. To delete a Runbound profile and its primary server records, use Profile > Recovery & delete profile in the app. If you cannot access the app, use our account-deletion page to request help. Never send a recovery code, membership token, password or other authentication secret.
For an active-room privacy request, email shashwatsingh0511@gmail.com with the room code and approximate creation time.
Children
Runbound is intended for audiences aged 13 and over and is not directed to children under 13.
Changes
We may update this policy when the game or its service providers change. The effective date identifies the latest version.
Effective date: 16 September 2026