Privacy Policy

Last updated · applies to the Cohort game on iOS, Android and the web · בעברית

Cohort has an optional account and no advertising. It sends anonymous usage data, which you can switch off in Settings. Five things leave your device: the account and the record it keeps, if you make one; anonymous usage data — when the game is opened, how far into it you get and how its matches go, never who played them; the lobby and the moves of each match, which the other players in it see; the boards you build, recorded so other players can fight them later, if you registered; and your reaction to a match, if you tap to send it. This page lists every field in each, where each is held, and how to delete them.

Builds released before 20 September 2026 have no account system at all; for those, only the section on reactions applies. Builds released before 28 September 2026 send no usage data.

The account

The first screen is the log-in form, with two more doors beside it: register and play as guest. Every match is online and ranked, whichever door you came through.

If you register, you choose a username to log in with and a nickname other players see, and give an email address and a password. You can change the nickname in Settings at any time. The email is required, and it is kept for the password reset alone: it is never shown to anyone. The email and the password go to Firebase Authentication, a Google service that keeps accounts for us. Google holds:

Google runs Firebase Authentication from data centres in the United States, so that is where the account is processed and held.

If you play as a guest, the game still opens an account with Google, but an anonymous one: an account number and nothing else — no email, no password, no name. Google logs the IP address of a guest sign-in the same way, for the same few weeks. A guest's progress stays on the device and is not written to our database. If you register later, the same account number is kept, so nothing you earned is lost.

Telling the game from a script

On the web, the game proves to Firebase that each call comes from the real game and not from a script pretending to be it. It does this with two Google services: reCAPTCHA Enterprise and Firebase App Check. reCAPTCHA Enterprise reads signals from the browser and the device it runs on — the browser and its settings, the screen, how the page is being used, and the connection's IP address — and tells the game how likely it is that a real visitor is playing. App Check turns that answer into a short-lived token that goes with each call to Firebase. We see the token, never the signals.

This is done to stop abuse — fake accounts, automated play and floods of calls — and the costs that abuse causes us. Google processes these signals under its own Privacy Policy and Terms of Service, which apply to them. The sign-in screen on the web says so too. The iOS and Android apps do not use reCAPTCHA.

The record

A registered player has one record in Cloud Firestore, a Google database, stored in the eur3 region — Belgium and the Netherlands, in the European Union. It is written whenever the game saves, and it is read back when you log in on another device. It contains:

The database also keeps two lists of taken names, each name pointing at the account number that owns it. The game shows your username to no one. An account made before nicknames existed was given its username as its nickname, which its owner can change in Settings. Older versions of the game still read the list of usernames, so for now it stays readable by anyone, as it always has been; once every player's game has been updated, only the account that owns a username will be able to read its entry, and nobody will be able to list them. When you log in with your username, our server at cohort-game.com looks up the email that belongs to it and logs you in with it; the email never comes back to the device, and a name that does not exist is answered exactly like a wrong password. The list of nicknames is readable by anyone: a nickname is public by design — it is the name other players see — and the number beside it opens nothing on its own.

Beside the record sits one more document, and it is the only one anybody can read: your rank. It holds your nickname, the season, your tier, division and LP, and the time it was written — the row a leaderboard shows. Nothing else of yours is in it: no email, no match history, no record. It is written in the same moment as the record and removed in the same moment as it, so deleting your account takes you off the leaderboard.

The record carries no email address. The email lives only with the account, above.

Ranked matches

Every match is ranked. It seats you with up to seven other people, and their phones have to play the same match yours does. So when you tap PLAY, your phone joins a lobby in the same database as the record. The lobby holds, for each player in it, the account number, the name you play under (your nickname, or the name you gave the game as a guest), your portrait and the cosmetics you wear. When too few people are waiting, the empty seats are filled by recorded boards (below) and then by the game's own bots; the lobby then also lists, for each recorded board it seats, the account number of the player who recorded it.

During the match your phone writes, round by round, every move you made (what you bought, sold, rerolled and placed) beside the lobby, with a checksum the phones use to check they are playing the same match. The other players' phones read it to play the same round. A nickname and boards are shown to other players: yours to the seven you play with, and theirs to you. The game only reads the lobby it is looking for or playing in, but the database lets anyone signed in to the game, guests included, read any lobby and its rounds. A lobby holds no email and no record; a started one and its rounds do amount to an account of that one match: who played it, and every move each of them made.

A ranked match also writes your rank row twice: once as it starts, as if you finished last, and again with where you really finished. Closing the game partway through a ranked match therefore counts as last place.

Recorded boards

If you registered, the game records your boards in each ranked match you play, so that it can stand in for you later: when too few people are waiting, a recording fills an empty seat in someone else's match, and they fight your boards under your name — the game shows it as your ghost. A match's recording is one document in the same database as the record, started after the first round you fight and added to after each round after it, and holds:

A guest's boards are not recorded. A recording carries no email, no rating and nothing else from the record. Anyone signed in to the game, guests included, can read the recordings, because any player's phone may need one to fill a seat. Each recording is deleted automatically 30 days after its match started, by the storage itself; deleting the account removes every one of them at once.

Earlier versions of the game recorded each round as a document of its own, with the same fields and no expiry. Those are kept until you delete the account, which removes them, or until we delete them all once no version of the game that writes them can still play.

The reaction

When a match ends, the result screen asks how it was. If you tap one of the three faces, the game sends a short record to cohort-game.com, our own server. If you never tap, nothing is sent. The record contains:

That is the whole record. It carries no email address, no account number, no device identifier, no advertising identifier and no location. For the reaction, the server does not store your IP address, the country it resolves to, or anything else about the connection. Because a registered player's name is their nickname, a reaction from a registered player can be matched to their account; a guest's cannot.

Reporting and blocking a player

Hold another player's name — on the leaderboard, in a lobby, on the rail in a match or on the result screen — and the game offers to report or block them.

Only a registered player can report; a guest can block but not report. A report is one document in the same database as the record, and holds:

Beside it, a counter filed under your account number holds how many reports you have sent and when today's count began, so that no account sends more than ten a day. Nobody can read a report from inside the game: the player you reported is never told who reported them, and you are not told what came of it. We read reports to decide whether to rename a player or delete an account. A report is deleted automatically 180 days after it was sent; the counter has no expiry. Neither is removed when you delete your account: after that, the account number in them names no one.

Blocking sends nothing. The account number of the player you block, and their name as it was shown, are kept on your device only; from then on the game shows blocked player in place of their name, and when your phone picks the recorded boards for a match it never picks theirs. Settings lists the players you blocked and unblocks them.

Anonymous usage data

So we can tell how many people play, on what, from roughly where, whether they come back, and where on the way in the game loses them, the game sends small events to cohort-game.com, our own server. Every kind of event it sends is listed here with what that kind adds. The server accepts no other kind, and a test in the game's own code holds this list to the server's, so one cannot change without the other. An event is sent:

Every event also carries:

The game also sends a heartbeat, every three minutes while the game is open in the foreground, and whenever you move between the lobby, the queue and a match: which of the three you are in, in a match how many of its players are people, the random number above, the platform, the game's version and the test-device flag. It is not an event and is never queued: the server keeps only the latest heartbeat per random number, with the country it came from and not the city, and drops that row the day after the last one. What it keeps for longer is a count, taken every five minutes, of how many devices are connected and how many of them are in the lobby, in the queue and in matches, which names nobody. The heartbeat stops while the game is in the background, and for good when you switch usage data off.

Our server adds the day and hour the event arrived, by its own clock (Israel time), and the country and approximate city that Cloudflare, which runs the server, works out from the connection. The IP address itself is not stored — not by us, and the event record has no place for it. The city is often wrong on a mobile network, which tends to resolve to the carrier's nearest hub, so we treat it as approximate.

The server files the events under two short summaries per random number: one line for each day it was seen — that day's events themselves, with its platform, version and tier that day, the country and city, and how many events arrived — and one line for the device itself: the day it was first seen, its platform and place then, how many seconds its first load took, when it first passed the name screen and which way, when it first searched for a match, when its first match started and ended and how far that match got, how many matches it has started and finished, the days of its first, second, third, fifth and tenth finished match, the highest tier it has reached, the day a guest first saw the registration form, and the day it registered, if it did, and whether as a guest. That is what the counts of new and returning players, and of how many reach their first match, are read from.

Events and the daily lines are kept for 13 months and then deleted automatically; the device's line goes when its last daily line does, so 13 months after it was last seen; the heartbeat's row goes the day after the last heartbeat, and the five-minute counts, which name no device, are kept for 13 months like the rest. We use all of this only in totals: how many played today, how many came back after a week, which platform, which tier, how many reached their first match. It is never used for advertising and never shared.

To switch it off: Settings → share anonymous usage data. Switching it off sends one last event saying so, then deletes the random number and any waiting events from your device, and nothing is sent after that — no event and no heartbeat. If you switch it back on, the game makes up a new random number, so what was sent before and what is sent after cannot be joined.

What is not collected

The game contains no analytics SDK — the usage data above goes to our own server, not to an analytics company — no advertising SDK and no crash reporter. It does not ask for contacts, the camera, the microphone or the photo library, and it never reads your location: the country and approximate city in the usage data are worked out on our server from the connection, not on the device. It reads no device identifier and no advertising identifier. The random number in the usage data is made by the game, not read from the device, and is deleted when you switch usage data off or remove the game. Nothing is joined with any other company's data, and nothing is used to track you across other apps or sites.

Why, and for how long

The account exists so you can log in, and the record exists so your progress follows you between devices. Both are kept until you delete them — there is no expiry. When you delete, your recorded boards, the record, the username, the nickname and your rank row are removed at once and the account with them; Google's own backup copies are purged within 180 days, under its data-processing terms.

Reactions exist so we can find out which matches felt bad and why, and replay them from their seed. Each one is deleted automatically 180 days after it was sent; the deletion is enforced by the storage itself, not by a policy someone has to remember.

A ranked lobby exists so eight phones can play one match. The lobby and the rounds written beside it are deleted automatically about a week after the lobby opened, by the storage itself, whether or not you still have an account. Deleting your account does not remove them sooner.

Recorded boards exist so a match can start when too few people are waiting. A match's recording is deleted automatically 30 days after the match started, or with the account if that comes first; the per-round recordings of earlier versions are kept as the section on them says.

If you add friends, your friends list, the friend requests you send and receive, and whether you are online or in a match are stored in the same database, shown only to you and your friends, and deleted with your account.

Usage data exists so we can see how many people play, on what and from where, and where the game loses them. It is kept for 13 months, as the section on it says, and deleted by the server itself.

So that one connection cannot flood our server, it counts how often each connection logs in with a username, sends a reaction and sends usage data. The count is filed under a scrambled form of the IP address, never the address itself, and covers ten minutes for logging in and one hour for reactions and usage data; it is deleted after its window closes and used for nothing else.

What is stored on your device

The game keeps a copy of your profile in its own app storage (the browser's local storage on the web). Next to it sit your username and the version of the terms this device accepted — for a guest, that is the only record of it. The session token that lets the game log you back in without asking for the password again is kept in the phone's protected storage: the iPhone's Keychain, or on Android encrypted with a key that stays in the phone's Keystore. On the web, where a browser has no such store, it sits in the browser's local storage with the rest. For the usage data: the random number, the position of its switch, up to fifty events waiting to be sent, a note of the last match it reported, so a result screen opened twice is counted once, and this session's number and how long it has run. The players you blocked, by account number and the name they were shown under, are kept here too. Nothing on the device is readable by us or by anyone else.

Deleting the app removes everything stored on the device, with one exception on an iPhone: the Keychain keeps the session token after the app is gone. No other app can read it, and if the game is installed again it erases the token the first time it opens, so a reinstall starts signed out. Deleting the app does not delete the account or the record — those live with Google until you delete them, below.

How to delete your account

From inside the game: Settings → Delete account → confirm. The game removes your recorded boards, the record, the username, the nickname and your rank row from the database, then the account itself, then the copy on the device, and returns to the first screen. This works for a guest account too. It cannot be undone.

By email: write to support@cohort-game.com from the address the account is registered under, and we will delete the account, its record and its recorded boards, and tell you when it is done. A guest account has no email and no username in our database, so there is nothing we could find it by; for a guest, the Settings row is the only path.

A reaction you sent is not tied to the account and is not removed with it. To delete one, write to us with the name you play under and roughly when you sent it.

The lobbies of ranked matches you played, and the rounds written beside them, are not removed with the account either. They go by themselves, about a week after each lobby opened (see above).

Usage data is not tied to the account and is not removed with it. The switch in Settings is its off switch, and the section on it says what switching off deletes.

Mail we send

Two kinds, both sent by Google on our behalf, to the address on the account:

There is no newsletter, no marketing and no other message, and your address is never given to anyone for that purpose. We will not send you marketing mail unless you have first ticked a box of its own asking for it — never the box that accepts the terms — and there is no such box, because there is no such mail.

Children

Cohort is for players aged 13 and over, whether they register or play as a guest, and a player under 18 plays with a parent's or guardian's agreement, as the terms say. We do not knowingly collect personal data from children under 13. If a parent learns that a child under 13 has registered, write to us from any address with the username, and we will delete the account and its recorded boards. A guest account has no email and no username we could find it by, so for a guest the way is Settings → Delete account on the child's device. For a reaction a child sent, write with the display name and the approximate time.

Third parties

Two companies hold data on our behalf, and neither uses it for anything of its own. Google runs Firebase Authentication (the account) and Cloud Firestore (the record), under Google's data-processing terms. On the web, Google also runs reCAPTCHA Enterprise and Firebase App Check, under its own privacy policy, as the section on telling the game from a script says. Cloudflare hosts this site and the server that receives reactions and usage data, and works out the country and approximate city of each connection for the usage data. Beyond them, the only people who see anything of yours are other players: your nickname and rank on the leaderboard, in a ranked match what the section on it lists, and your recorded boards, under your nickname, in their matches. No data is sold. The iOS and Android apps carry no third-party service that could collect data on its own; on the web, reCAPTCHA is the one, and the section on it says what it reads.

The app store you downloaded the game from — Apple's App Store or Google Play — has its own privacy practices covering the download and any purchase. Those are governed by their policies, not by this one.

Your rights

Under the GDPR, the CCPA, Israel's Privacy Protection Law and comparable laws you have rights of access, correction, deletion, portability and objection over personal data held about you. For a registered account we can act on all of them, because the account is tied to your email: write from that address and we will send you a copy of the record (it is one JSON document) and of your recorded boards, correct them, or delete them, and tell you when it is done. Deletion you can also do yourself, above. For a reaction, write with the name you play under and roughly when you sent it, and we will find it. Usage data is not linked to you, so there is nothing in it we could find by your name or email; switching it off in Settings is how you stop it and delete the number on your device.

If this changes

Server-checked matches are planned. If a future version of the game sends anything beyond what is listed above, this page will be updated before that version is released, the date at the top will change, and the privacy label on the app's store page will be updated to match. We will not quietly begin collecting data under a policy that says we do not.

Language

This policy is also published in Hebrew, with the same date. Where the two differ, the English text prevails.

Contact

support@cohort-game.com