Privacy Policy

This Privacy Policy explains how Ikon Media Indonesia ("ikonmedia", "we", "us") handles information when you play Blast Squad (app ID id.ikonmedia.blastsquad on Android and iOS) and when you visit blastsquad.ikonmedia.id (together, the "Service"). We wrote it in plain language. If anything is unclear, contact us at ikonmedia.id.

1. Who we are

Blast Squad is developed and published by Ikon Media Indonesia, Indonesia (ikonmedia.id). We are responsible (the "controller") for the personal information described in this policy. You can reach us at ikonmedia.id.

2. Information stored only on your device

The game saves the following data locally on your phone or tablet (in the app's private storage). It is not sent to us:

• settings: language, music and sound volume, vibration, control size and opacity;
• Story progress: selected character, unlocked stages, a saved run, high scores;
• your last Player vs AI settings;
• rewarded-ad bonuses: the date of your last daily gift, the gift waiting for your next Story stage, and which bonuses you already used in the current run;
• for Battle Online: a random guest identifier, a random guest secret and your current session token (see section 3);
• for Google Play Games: your achievement counters and a queue of achievements and scores not yet sent to Google (see section 6).

You can erase Story progress with Reset progress in Settings. Uninstalling the app or clearing its data removes everything stored on the device. Because this data never reaches our servers, we cannot restore it for you.

3. Information we process when you play online

Battle Online needs a small amount of data so that we can match you with other players, run fair matches on our server, and show results. You do not need to sign up — the first time you open Battle Online, the app creates a guest account automatically.

Data	What it is	Why we need it
Guest identifier	A random code created by the app on your device. It does not contain any information about you or your device.	To recognise your account when you come back.
Guest secret	A random password created by the app. Our server stores only a one-way hash of it, which cannot be turned back into the secret.	To make sure only your device can sign in to your account.
Display name	The name other players see. By default it is "Pemain" ("Player") followed by a random number; you can change it (2–20 characters, offensive words are blocked).	To show who is playing in matches and in match history.
Online stats	Number of online matches played, matches won and rounds won.	To show your profile and progress.
Match history	For each finished match: date and time, arena, number of rounds, rankings, and the display names and characters of the players (including bots).	To show you and the other players in that match their history.
Account dates	When your account was created and when you last signed in.	To operate and secure the service.
Session token	A signed token stored on your device that expires after 30 days.	To keep you signed in to the API and game server.
Gameplay input	Your moves and button presses during an online match.	Sent to our game server in real time to run the match. Only the final result is saved.
Technical data	Your IP address and basic connection data (time, requested address, app/browser type), as with any internet service.	To deliver the service, limit repeated sign-in attempts (rate limiting), prevent abuse and fix problems. It may appear in server logs.

Please do not use your real name or other personal details as your display name.

4. What we do not collect

• No real name, email address, phone number, date of birth or postal address (unless you choose to email us — then we use your email only to reply).
• No precise or approximate location from GPS, no contacts, photos, files, camera or microphone access.
• No chat or user-to-user messages.
• No payment information. Blast Squad currently has no in-app purchases.
• No social media sign-in. The only third-party sign-in is the optional Google Play Games profile described in section 6, and we do not receive its data.
• No third-party analytics SDK. We may count anonymous, aggregate ad events (for example, how often a reward offer is shown or accepted) to tune ad frequency; these counts are not linked to your account.

5. Advertising

Blast Squad is free. To support it, the game may offer rewarded video ads provided by Google AdMob (Google LLC / Google Ireland Limited):

• An ad plays only when you tap a button marked with a video icon, for example to revive after losing a life, to continue after Game Over, or to claim a daily gift. You can always decline and keep playing.
• There are no banner ads, no pop-up (interstitial) ads, and no ads during Battle Online. Ad rewards never give an advantage in online matches.
• Because Blast Squad is designed for players aged 10 and up — including children — we tag every ad request for child-directed treatment (or "under the age of consent") and limit ads to content rated G. Ads are therefore not personalized: they are not based on your interests or past behaviour, and Google's remarketing features are disabled.
• Where the law requires it (for example in the European Economic Area, the United Kingdom, Switzerland and some US states), the app shows a consent message from Google's User Messaging Platform (UMP) before any ad is loaded. You can change your choice later through the privacy options in the app where available.
• To show an ad, measure that it was displayed and prevent fraud, the Google Mobile Ads SDK processes limited device and app information such as device identifiers (including the Android advertising ID or app set ID where available), your IP address (from which an approximate location may be derived), device model and operating system, app version, diagnostics and ad interactions. For child-directed requests Google does not use this information for personalized advertising.

Learn more in the Google Privacy Policy and How Google uses information from sites or apps that use its services. On iOS we do not request App Tracking Transparency permission and do not track you across other companies' apps or websites.

6. Google Play Games

On Android, Blast Squad supports Google Play Games Services (provided by Google LLC / Google Ireland Limited) for achievements and leaderboards. Using it is optional: the whole game works without it.

• When the game starts, Android may sign you in automatically with your existing Google Play Games profile. If you are not signed in, you can sign in later with Sign in: Play Games in Settings, or skip it.
• When you are signed in, Google receives and stores your Play Games player ID, your Play Games profile name (gamer tag) and avatar, the achievements you unlock and your progress on them, and the scores you submit to leaderboards (Story high score per difficulty, enemies defeated in Story, and your number of Battle Online wins). Other Play Games players may see your profile name and scores on leaderboards, according to your Play Games profile settings.
• The game keeps a small queue on your device of achievements and scores that have not been sent yet (for example while you are offline or signed out) and sends it the next time you are signed in.
• We do not receive your Play Games player ID, profile name or Google account details on our servers, and your Play Games profile is not linked to your Battle Online guest account.

Google handles this data under the Google Privacy Policy. You can manage your Play Games profile, its visibility and its data (including deleting it) in the Google Play Games app or at myaccount.google.com. For children, Google's own rules for Play Games and Family Link apply.

7. How we use information

• to provide Battle Online: sign-in, matchmaking, private rooms, running matches, stats and history;
• to keep the service secure and fair: rate limiting, detecting cheating or abuse, enforcing our Terms of Service;
• to fix bugs, maintain the servers and answer your support requests;
• to show optional rewarded ads as described above;
• to comply with the law.

Where data-protection laws such as the GDPR or Indonesia's Personal Data Protection Law (Law No. 27 of 2022) apply, our legal bases are: performing our agreement with you (providing the online features you choose to use), our legitimate interests (security, abuse prevention, keeping the service running), your consent (where required for ads), and compliance with legal obligations.

8. Who can see or receive your information

• Other players see your display name, character and results in matches you play together and in their match history.
• Hosting provider: our API, game server and database run on a virtual private server (VPS) that we manage. The provider stores the data on our behalf and may not use it for its own purposes.
• Google receives the information described in section 5 when rewarded ads are requested or shown, and the Play Games data described in section 6 if you sign in to Google Play Games.
• App stores: Google Play and the Apple App Store handle downloads and updates under their own privacy policies.
• Authorities, if we are required to by law, or to protect the rights, safety and property of players, the public or us.
• A successor company, if Blast Squad is ever transferred, in which case this policy continues to apply to your data.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

9. Children's privacy

Blast Squad is suitable for players aged 10 and up and its audience includes children under 13. We follow the Google Play Families Policy and design the game so that children can play without giving us personal information:

• We do not knowingly collect personal information from children beyond what is strictly needed to play online: a random guest identifier and a display name. We never ask for a child's real name, contact details or location, and we do not require a child to disclose more information than is reasonably necessary to take part.
• There is no chat, and display names pass an offensive-word filter.
• Ads are child-directed, non-personalized and limited to G-rated content, and are provided through Google's ad network, which is certified for use in apps for families.
• Parents or guardians can ask us to review or delete a child's online account at any time by contacting ikonmedia.id, or by using the in-app deletion option. If we learn that a child has entered personal information (for example their full name as a display name), we will remove it.

We handle children's data in line with applicable laws such as the US Children's Online Privacy Protection Act (COPPA), the GDPR and Indonesian law.

10. How long we keep data

• Data on your device: until you reset progress, clear the app's data or uninstall it.
• Online account (guest identifier, hashed secret, display name, stats, account dates): until you delete your account.
• Match history: kept for as long as the service runs so players can see their past matches. When you delete your account, your entries in other players' history are anonymized (your name is replaced with "Pemain dihapus" — "Deleted player" — and the link to your account is removed).
• Backups: we make daily database backups and automatically delete each one after 14 days. Deleted data can therefore remain in a backup for up to 14 days before it disappears for good. Backups are used only to recover from failures.
• Server logs (which may contain IP addresses): kept only for security and troubleshooting, and deleted automatically after 7 days.
• Session tokens expire after 30 days.
• Google Play Games data (achievements, leaderboard scores, profile) is kept by Google until you delete it in your Play Games or Google account settings.
• Support emails: kept as long as needed to help you, then deleted.

11. Deleting your data

You can delete your online account in the app or by email. Deletion removes your account immediately and anonymizes your name in match history. Full steps and timelines are on the Delete account page. To remove offline data, use Reset progress in Settings or uninstall the app.

12. Security

We protect data with reasonable technical and organisational measures: connections to our API and game server are encrypted (HTTPS / secure WebSocket), guest secrets are stored only as one-way hashes, session tokens are signed and expire, the database is only reachable from our own server and requires authentication, and access is limited to the people who run the service. No system is perfectly secure, but we work to fix any issue quickly. If we become aware of a breach that affects you, we will notify you and the authorities where the law requires.

13. International transfers

Our servers are hosted on a VPS operated by a hosting provider, and Google processes ad data on its global infrastructure. This means your information may be processed in a country other than the one you live in, including Indonesia, where data-protection rules may differ. Where required, we rely on appropriate safeguards (such as the provider's contractual commitments and Google's standard contractual clauses) to protect it.

14. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent at any time. In practice:

• Correct your display name with Change name in Battle Online.
• See your stats and match history in the app.
• Delete your account in the app or as described on the Delete account page.
• Ads consent: change your choice in the app's privacy options where available, or simply never tap an ad button.
• For any other request, contact ikonmedia.id. We will answer within 30 days. Because accounts are anonymous, we may ask for details (such as your display name and a screenshot of your online profile) to find the right account.

You also have the right to complain to your local data-protection authority.

15. This website

blastsquad.ikonmedia.id does not use analytics, advertising or tracking cookies. It sets one functional cookie, bs_lang, to remember your language choice for up to one year. Like any web server, ours processes your IP address and request details in server logs for security. Links to app stores and Google pages are governed by those companies' own policies.

16. Changes to this policy

We may update this policy when the game or the law changes. We will change the effective date at the top and, for significant changes, tell you in the app or on this website before they take effect.

17. Contact

Ikon Media Indonesia — Blast Squad team
Contact: ikonmedia.id
Website: ikonmedia.id