Privacy Policy

Last Updated: April 03, 2026

Summary

Capone’s Bones uses account data, gameplay data, analytics, and limited device information to operate the game, support multiplayer and progression features, measure performance, and provide advertising where applicable. This policy is the official public version published at https://capones-bones.pages.dev/privacy-policy/. You can contact us at jakesorce@gmail.com for privacy questions, data access, correction, or deletion requests.

Retention (headline): After a verified account deletion request, we aim to remove personal data from our live database within about 30 days (backups may persist for a short rolling window—see Data Retention). PostHog product analytics events are typically retained about 12 months on our current plan (replay shorter).

International transfers (headline): Where GDPR/UK GDPR applies and data is sent to the US or other non-adequate countries, we rely on Standard Contractual Clauses (SCCs) in vendor DPAs, including Supabase and PostHog (see International Data Transfers).

Children: The app is not for under-13 account holders; creating or using an account requires you to confirm you are 13+ and agree to our Terms (see Children’s Privacy).

iOS ads — App Tracking Transparency: On iOS, we may request App Tracking Transparency permission before initializing advertising SDKs when the system status is undetermined, so personalized ads and ad measurement align with Apple’s rules and your device settings (see Permissions and Google AdMob).

Introduction

Welcome to Capone’s Bones (“we,” “our,” or “us”). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our mobile application.

When you visit our public documentation website (this policy, support pages, changelog, and related pages hosted with our infrastructure provider), we may collect basic technical and usage statistics about that visit—for example through Cloudflare (hosting and web analytics) and, if enabled, PostHog page analytics described under Third-Party Services below. That helps us keep legal pages reliable and understand traffic to the public site.

Information We Collect

Personal Information

Automatically Collected Information

Third-party processors (summary)

We integrate the following categories of services that may collect or process information on our behalf:

Details for each appear under Third-Party Services below.

How We Use Your Information

We use the collected information to:

Where applicable, we process personal data on one or more of the following bases:

Permissions and Device Features

Depending on your platform and how you use the app, we may request permission for:

If you deny a permission, related features may be limited or unavailable.

Production and beta builds

We may distribute beta or preview builds through TestFlight, Play testing tracks, or similar channels, and when we publish a general-public release, production binaries on the App Store and Google Play. The same privacy practices in this policy apply to those builds unless we tell testers otherwise in writing (for example in TestFlight notes).

Typical differences in beta: Beta pipelines sometimes use Google test advertisement identifiers instead of live ad inventory, or connect to backend environments labeled for testing. Those choices affect how ads behave, not whether we respect this policy or your rights requests.

Data Storage and Security

Third-Party Services

PostHog

Google AdMob

Supabase

Your Rights

Depending on your location, you may have the following rights:

To exercise these rights, contact us at: jakesorce@gmail.com. We will respond to verified requests within 30 days, or as required by applicable law.

Account Deletion and Data Requests

If you want to request account deletion, data access, or data correction, email us at jakesorce@gmail.com. To protect account security, we may request information needed to verify the request before acting on it.

Children’s Privacy

Capone’s Bones is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13.

Store age rating vs. account rule: Apple and Google assign an age rating for the app based on their questionnaires (for example, themes or simulated gambling with virtual currency may produce a 12+, 17+, or other calculated rating on a given store). Regardless of that badge, you must be at least 13 years old to create an account and use account-based features: our Terms of Service require this, and by signing up or signing in you represent that you meet the age requirement.

Account creation — age confirmation: To create or access an account you must use the in-app sign-up or sign-in flow (email, Google, or Apple). By completing that flow and using account features, you represent and confirm that you are at least 13 years old and you agree to our Terms of Service, which state this age requirement. (OAuth providers do not pass your date of birth to us; this is a declared confirmation, not ID verification.)

How we limit under-13 sign-up (in practice):

Parents and guardians can use platform parental controls (for example Apple Family Sharing or Google Family Link) to restrict installs, purchases, or accounts. If you believe a child under 13 has given us personal data, contact us at jakesorce@gmail.com and we will take appropriate steps, including deletion where required.

Data Retention

The default retention periods below apply unless a longer period is required by law, a legal hold, or an active security or fraud investigation. We do not keep personal data indefinitely “just in case” beyond these categories.

If we add new analytics or logging processors, we will list their published retention (or our configured caps) in an update to this policy.

You may request deletion of your account and associated data at any time (see Account Deletion and Data Requests).

Advertising and Analytics Choices

International Data Transfers

Your information may be transferred to and processed in countries other than where you live, including the United States, where our service providers host data or operate services.

Where GDPR or UK GDPR applies and we transfer personal data to countries without an adequacy decision, we rely in practice on the EU Standard Contractual Clauses issued 4 June 2021 (2021 SCCs, Commission Implementing Decision (EU) 2021/914) as incorporated in our vendors’ Data Processing Agreements (DPAs), and, where applicable, the UK International Data Transfer Addendum to the EU SCCs (UK Addendum) or equivalent UK-approved tools. These instruments are the appropriate safeguards required by law for those transfers.

Processors where we rely on SCC-based (or equivalent) transfer terms today include at least:

You may contact us for a short summary of the transfer mechanisms we rely on for your data, or with questions about a specific vendor.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by updating the “Last Updated” date and, where appropriate, through in-app notifications.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us:

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

If you are a resident of Virginia, Connecticut, Colorado, or Utah, you may have additional rights under your state’s privacy law. Contact us for details.

European and UK Privacy Rights (GDPR/UK GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR: