BACKFIREBOTS

BACKFIRE BOTS

Privacy

Updated 2 November 2026

Sandbox and player-created levels

Sandbox setups and drafts are stored only on your device and are not included in private iCloud backups. Browsing and playing published levels does not require a public profile. Publishing, recording results, rating, reporting and hiding authors use the same optional public profile as the leaderboard.

After you confirm publication, the server receives the name, mode, starting board and recorded winning solution. It replays the solution and derives the move limit from its length. The name, board, author nickname, limit and aggregate results and ratings are available to other players. The author’s recorded solution is not provided to other players.

For completed community attempts, the server stores difficulty, actions, outcome and the link to your public profile for verification. It also stores your ratings and private reports and hidden-author preferences. These records provide and protect the community feature. Do not include personal information, contact details, advertising or abusive content in titles. You can report a level and hide its author; contact support@backfirebots.com for questions or review requests.

You can withdraw your level from the public catalogue; withdrawal alone does not erase server records. Deleting your public profile also deletes its published levels, community attempts, ratings, reports and blocks. Local drafts and private iCloud data remain separate. Infrastructure backups follow the providers’ practices described below.

Operator and contact

Backfire Bots is created and operated by Tomáš Golovach. Contact for support and privacy: support@backfirebots.com.

Gameplay and local data

Levels are bundled with the app. You can play offline without a mandatory player account. Your phone stores progress, unfinished levels, difficulty, results, move recordings, hint-use marks, skipped levels, assist balances and replenishment timestamps. Language, appearance, sound and confirmation that you are at least 16 are also device preferences; the app does not request your date of birth.

Deleting the app may delete local progress. Offloading an app in iOS may preserve its data. System device backups depend on your settings and Apple services.

Optional Sign in with Apple and iCloud

You can choose Sign in with Apple for backup and progress transfer. The app does not request your full name or email address from Apple. It stores the technical sign-in identifier in the device's secure Keychain and uses it to associate a game save; it is not a public nickname.

After sign-in, the app loads and saves progress, results, gameplay recordings and the shared hint/skip wallet in a private CloudKit database. It uses the iCloud account signed in on the device. Language, colour theme, sound and age confirmation are not part of this cloud game-save package.

Private saved games are neither a public leaderboard nor an all-player database available to an administrator. Private data counts toward the player's iCloud storage. iCloud, system backups and Apple's related processing are also governed by Apple's privacy information.

Offline changes stay on the phone. When saves differ, the app may ask you to choose a local or cloud version; assist balances are never added together. Cloud saving is not a guarantee that every older version can be recovered.

Optional public player profile and leaderboard

From iPhone build 16, the game offers one public leaderboard shared by the app and backfirebots.com/rankings. This feature uses a nickname and password, without Apple sign-in or email registration. Guest play remains available without a public profile.

When you choose a nickname and password and confirm public participation, your nickname, combined score, rank and number of completed levels become public on the app and website. The nickname is checked for uniqueness without regard to letter case. The app then sends new winning results automatically while this public profile is active. Before confirmation, no public profile is created.

You choose a password of 8–128 characters. The native app derives a strong access key using PBKDF2-HMAC-SHA256 with 600,000 iterations and an application-specific nickname salt. The raw password is not sent to our server or saved by the app. The derived key and access session are kept in the phone’s secure Keychain. The server receives the derived key over HTTPS and stores only its derived identifier and hashed session credentials. Your nickname cannot be renamed because it is also used to derive access. On another phone, use the same nickname and password.

A private recovery code can be displayed in the native app as a fallback for a forgotten password. Anyone who knows the code can control the public profile, so keep it private. Knowing a nickname alone is not enough. Without your password, a valid recovery code or the already-connected original phone, support may not be able to restore the profile. Recovery restores the public profile and its leaderboard results; it does not restore private game recordings or an unfinished level.

To check points, the game sends the level identifier, difficulty, actions from winning attempts and hint-use marks to our server. The server replays eligible solutions against the current campaign and stores the best per-level scoring result and persistent hint flag. Move-by-move recordings are not shown publicly or retained as leaderboard replay history. The full private iCloud save, unfinished games, hint/skip balances, Apple account, email and full name are not part of this public profile. This service is operated by Tomáš Golovach using the production Sites/Cloudflare infrastructure described below.

Public participation is voluntary and based on your consent (Article 6(1)(a) GDPR). You can withdraw it and remove the profile and its public results through Delete public profile in the leaderboard. The server removes that profile, its scoring records and sessions; the nickname becomes available again. The local game and private iCloud save are kept separately. Signing out of private iCloud alone does not remove a public profile. Public profile/scoring records remain until deletion; access sessions expire within seven days. Hosting security records and backups may follow the provider’s retention arrangements. We do not promise immediate removal from third-party caches or screenshots.

Earlier development builds 14–15 offered Apple Game Center. Build 16 does not send new data to Game Center. Any results previously submitted there remain governed by Apple’s service and are not deleted by deleting this new public profile. Contact support@backfirebots.com for score or privacy questions.

Data controls and sign-out

The Apple profile lets you request synchronization or sign out. Signing out alone does not erase the local game or the cloud save.

Delete cloud profile first asks for confirmation. Delete profile and backup removes the cloud game save used by this version, the local sign-in identifier from Keychain, and metadata that links the local game to the Apple profile. Synchronization is disconnected. The game, results, recordings and assists remain on this phone as a separate guest game; the confirmation explicitly explains that the local copy is retained.

The app does not automatically revoke Sign in with Apple authorization. After deletion, it links to Apple's official instructions for removing this game's access in Apple Account settings. The guide remains available after relaunch until you hide it or the app detects authorization revocation. Hiding the guide does not remove Apple's permission.

When authorization is revoked or the account changes, the app ends its signed-in session and removes local synchronization-link metadata. Guest play can continue. Signing in again is a separate action; deleting the profile does not itself start a new upload.

Advertising, payments and analytics

The app has no advertisements, advertising/analytics SDKs, subscriptions or in-app purchases, and does not track players for advertising. The App Store manages the one-time purchase; you do not enter payment details in the game.

Website and support

Website links open an external browser. The informational website does not use advertising or analytics scripts, contact forms or cookies set by its application code. The dedicated leaderboard page uses a first-party script to load public results; it does not ask website visitors to sign in. The language is selected through the page URL. The hosting infrastructure receives technical request data needed to deliver and protect the website, such as an IP address, request time and requested address. This does not mean the infrastructure keeps no logs.

If you contact support, Tomáš Golovach receives your email address, message and any attachments you choose to send. Support messages help answer questions, resolve technical problems and handle privacy requests. Gameplay recordings are not automatically sent. Do not send passwords or payment details.

The basis for answering support requests and operating and protecting the website is the operator's legitimate interest in providing support and a functioning, secure website (Article 6(1)(f) GDPR). When processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR applies. Providing a support message is voluntary; without the information needed to understand a problem, it may not be possible to resolve it.

The website is provided through Sites hosting using OpenAI and Cloudflare infrastructure. Email to the public support address is forwarded by Porkbun to a Google Gmail mailbox. These services process the technical or message data necessary for their roles. Their relevant information is available from OpenAI, Cloudflare, Porkbun and Google.

Support messages are retained while needed to handle the request and reasonably related follow-up, or to comply with a legal duty or establish, exercise or defend a legal claim. Unneeded messages and attachments are deleted. Hosting and email providers may retain operational records and backups under their service arrangements; this policy does not promise immediate erasure of every infrastructure backup.

These providers operate internationally and data may be processed outside the European Economic Area, including in the United States. Google and Cloudflare describe their use of the Data Privacy Framework and standard contractual clauses for applicable transfers; Porkbun describes applicable transfer safeguards in its privacy policy and processing addendum. See Google transfer frameworks, Cloudflare privacy, Porkbun privacy and Porkbun processing addendum. These provider descriptions do not promise that every record is stored exclusively in the EU. You can request further information about the relevant safeguards at support@backfirebots.com.

Rights and contact

For personal data actually processed by the operator, you may request access, correction, erasure, restriction or portability, and object where applicable. Contact support@backfirebots.com. You may also complain to the Czech Office for Personal Data Protection.

The developer has no general administrative access to other players' private saved games. You therefore control local data and private iCloud saves through the app and Apple services. If data practices change, the relevant information will be updated before the new feature is enabled.