Privacy Policy — Ludo Arena

This policy explains what Ludo Arena collects, why, and what it does not collect. It describes the app as it actually behaves. If we change what the app collects, we change this page and the date above with it.

In short: You can play as a guest with no sign-up, and the app never asks for your email address, phone number or a password. Your account, progress and virtual coins are kept on our game servers. If you save your progress with Google, Facebook or Apple, we keep the account identifier that company gives us and the first name it shares, never your email address. Usage statistics go to Google Analytics only if you say yes, and you can change that at any time. There are no ads and no free-text chat. If you buy an optional coin pack, Google Play or the App Store handles the payment: we receive a purchase reference from the store, never your card or payment details. Coins and diamonds have no cash value and cannot be withdrawn.

1. Who we are

Ludo Arena is an online Ludo and Snakes & Ladders game published by Sun Game Studio, India. For anything in this policy, write to [email protected].

2. What we collect

What	Why	Kept
An account number our server creates when you first play, and for guest play a secret key that stays in your phone's secure storage	To keep your coins, progress and friends with your account	Until your account is deleted. The guest key is never stored as given: our server keeps only a one-way hash of it (`SHA‑256`).
A device identifier: on Android 8 or later, the Android ID that the system gives this app; on an iPhone or iPad, a random identifier the app creates and keeps in the device's keychain	Only to bring your account back on the same device after an update or a reinstall. It is never used for analytics or ads and never shown to other players.	Never stored as given. It is hashed with a secret key (`HMAC‑SHA‑256`) the moment it arrives, and only the hash is written down; we cannot recover the original from it. Kept until your account is deleted, or until you choose to forget a guest account when you sign out of it.
If, and only if, you save your progress with Google, Facebook or Apple: the account identifier that company issues, and the first name on that account (with Apple, only if you choose to share your name)	So the same account finds you on a new phone. The first name becomes your display name until you choose your own.	Until your account is deleted. We never see your password, and we do not store your email address or profile picture. The sign-in token is verified and then discarded.
Your display name: a name you choose, the first name from Google, Facebook or Apple, or a generated name such as “Player 7K2Q”	So other players can see who is playing: at the table, in friend lists, invitations, the weekly ranking and recent players. Names you choose are checked against a list of offensive words.	Until your account is deleted
Game data: your coins and diamonds, XP and level, mission progress and the rewards you claimed, the items in your collection and what you have equipped, and your friends and friend requests	To run the game, give rewards exactly once, and show your progress and friends	For the life of your account. Mission progress and claims are deleted 60 days after their last update; the record that a finished match was counted is deleted after 14 days. We do not keep a history of your matches.
Live game data: the match you are playing, quick-chat phrases and emotes you send, invitations, whether you are online, the players you recently played with, and your weekly ranking score	To run matches and show your friends when you can play	Held briefly in our servers' memory store, not in our database. A match is removed minutes after it ends; quick chat is passed to the table and not stored; invitations last up to 30 minutes, online status 60 seconds, recent players 14 days and weekly ranking scores 21 days.
Reports you file: who you reported, in which match and game, the reason you picked (cheating, offensive name, abusive behaviour, leaving or stalling, or other), when, and our team's review status and notes. There is no free-text field.	To review reports and keep games fair. Only our team sees reports, and the reported player is never told who reported them. If someone reports you, the same kind of record is kept about you.	Until the account of either player is deleted
Purchases, only if you buy a coin pack: the store (Google Play or the App Store), the pack you bought, the coins and diamonds it gave, when, whether it was refunded, and the purchase reference the store gives us (a Google Play purchase token and order number, or an App Store transaction ID). A purchase token is stored only as a one-way hash (`SHA‑256`).	To check the purchase with Google or Apple before giving you anything, to give the coins and diamonds exactly once, and to take them back if the purchase is refunded	Until your account is deleted. We never receive your card, bank or other payment details or your billing address.
Usage statistics, only if you say yes: which features you use (for example the game and mode you play, how a match ends and roughly how long it took, missions, items, level-ups, sign-in method and language), together with what Google Analytics collects by itself: an identifier for this installation of the app, your device model, operating system, app version, language and an approximate location such as your country	To understand how the game is played and improve it. These statistics never include your name, account number, friend code, room codes or chat. Section 3 says who processes them.	Kept by Google Analytics for at most 14 months. Off until you agree; you can change it at any time in Settings → Privacy → Share anonymous usage stats.
Service counts: how many players were active on a day or in a month, counted with a keyed one-way hash of the account number, and totals of app errors and reconnections with no identifier at all	To keep the service running and size it. These counts contain no name or account number.	Active-player counts for 40 days; error and reconnection totals are kept only as totals
Connection data: your IP address and basic request details, as with any internet service	To connect you to the game and to limit how often requests can be made, which protects the service from abuse	Our game server does not write your IP address to its logs or database. Short-lived counters used to limit requests expire within an hour.

What stays on your phone

The app keeps your sign-in tokens, the guest key and, on an iPhone or iPad, the device identifier in the phone's secure storage (the Keychain on iOS, the Android Keystore on Android), and your settings, such as sound, language and your usage-statistics choice, in the app's own storage. On Android the app's data is excluded from phone backups, and on iOS its keychain items stay on this device only.

In-app purchases

Ludo Arena offers optional in-app purchases of virtual coins and diamonds (coin packs in the Shop). You never have to buy anything to play. Payments are processed by Google Play or the App Store under their own terms; we receive only the purchase token or transaction ID, the product, the amounts and the time, never your card or payment details. Coins and diamonds are virtual game items: they have no cash value and cannot be withdrawn, cashed out, transferred or exchanged for money. Refunds are requested from Google Play or Apple under their refund policies; when a purchase is refunded, we take back the coins and diamonds it gave (never more than your balance).

3. Who we share it with

We do not sell your data, and we do not share it with advertisers. There are no ads in the app.

Other players see your display name, avatar, level, title and the cosmetic items you have equipped, at the table and in friend lists, invitations and the weekly ranking. Other players never see your account number, sign-in details or device identifier.
Google, Facebook (Meta) and Apple, only if you sign in with them. They handle the sign-in under the Google Privacy Policy, the Meta Privacy Policy and the Apple Privacy Policy. The Facebook sign-in library in the app is set not to send app events or advertising identifiers to Facebook.
Google Analytics for Firebase, only if you agree to share usage statistics. Advertising features are switched off: the app does not let Google Analytics collect the advertising ID, and ad storage and ad personalisation are always denied. Google processes the statistics under the Google Privacy Policy; see also how Google uses information from apps that use its services.
Google Play and the App Store, only if you buy a coin pack. They take the payment under their own terms and the Google Privacy Policy or the Apple Privacy Policy. So that a purchase can only be credited to the account that made it, the app gives the store a code derived from your account number with a one-way function (not the account number itself); our server then asks the store to confirm the purchase.

Your account and game data are stored in our own databases on servers operated by Sun Game Studio.

4. What we do not collect

No email address, phone number or password, and no real name beyond the first name a sign-in service shares.
No location permission, contacts, photos, camera or microphone. The app needs only network access.
No advertising ID, no ads and no tracking across other apps or websites.
No payment details: purchases are paid through Google Play or the App Store, and we never see your card, bank or billing details. Coins and diamonds are virtual, have no cash value and cannot be withdrawn, cashed out, transferred or exchanged for money.
No free-text chat: players talk with ready-made phrases and emotes, which are not stored.
No crash-reporting service and no history of your matches.

5. How we protect it

The app talks to our servers over encrypted connections (HTTPS). Guest keys, sign-in refresh tokens and device identifiers are stored on our side only as one-way hashes. Dice rolls, moves, results, coins and rewards are decided on our servers, so they cannot be changed from a phone. Purchases are checked with Google or Apple by our servers before any coins or diamonds are given, and each purchase is credited only once.

6. Deleting your account

You can delete your account at any time in the app: Settings → Delete account. It happens straight away and signs you out. If you no longer have the app, use our account deletion page or write to [email protected] with the subject Ludo Arena account deletion, telling us your friend code (shown on your Profile, starting with u_) and your display name; the app never asks for an e-mail address, so that is how we find the account. We answer and complete e-mailed requests within 30 days.

Deleting removes your account, your linked sign-ins, device link and sessions, your display name, coins and diamonds (including any you bought), purchase records, progress, collection, friends, and reports filed by you or about you. Deleting your account does not cancel or refund a purchase; refunds are handled by Google Play or Apple. Statistics that do not identify you (section 2) are not affected. Deletion is permanent and cannot be undone.

Uninstalling the app or signing out does not delete your account, because it lives on our servers. If you sign out of a guest account without saving your progress, you can no longer reach it, but it still exists until you delete it as described above.

7. Children

Ludo Arena's content is rated for everyone (3+). It is a general-audience game and is not directed primarily at children under 13. We do not knowingly collect personal information from children under 13 beyond what the game needs to run, such as an account number and game progress, and usage statistics are collected only with consent (section 2). Purchases go through Google Play or the App Store, where parents can require approval for purchases. If you are a parent or guardian and believe your child has given us personal information, write to [email protected] and we will delete it.

8. Your rights and choices

You can change your display name in the app, turn usage statistics on or off in Settings → Privacy, and ask us for a copy of your data, a correction, or deletion of your account (section 6 and our account deletion page). For data that Google, Facebook or Apple process for sign-in, or Google for analytics, see their privacy policies. You can write to us with any request; we answer within 30 days. These rights apply wherever you live, including under India's Digital Personal Data Protection Act, 2023 and the EU and UK GDPR.

9. Changes

When the app starts collecting something new, or stops, we update this page and the dates at the top.