Hold the Line: Privacy Policy

Hold the Line is published by Karan Rajput, an individual developer, Chandrangan Phase 1, Ambegaon Bk, Pune 411046, Maharashtra, India (“we”, “us”). We are the data controller under the EU and UK GDPR, the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), and the operator under the US Children’s Online Privacy Protection Act (COPPA) for the data our own server handles.

Privacy contact: support@callmissed.com. This address also reaches our grievance officer (see Grievance officer and contact).

On first launch the game asks for your birth year from a list. No year is preselected, and there is no “I’m over 18” button. Your answer is stored only on your device and is never sent to us or to anyone else. Until you answer, the game treats you as a child.

The game uses the answer to put you in one of two groups:

• Under 18 (under 13, or 13 to 17) and unanswered: no online features (no leaderboards, no player created, local bests only).
• 18 and over: optional online leaderboards, off by default.

You can change your answer at any time in Settings → Privacy.

The game saves the following only in the app’s private storage on your phone. We cannot see it.

• Game progress: coins, levels, stars, cards, chests, skins, statistics and achievements.
• Settings, including whether reminders are on.

The game’s online features also keep a few things on your phone:

• Your age group answer.
• The last settings downloaded from our server, so the game works offline.
• Adults with leaderboards on: your random player ID, the secret token that proves it is yours, and any scores waiting to be sent.

If Android’s backup is turned on for your device (for example, backup to your Google account), Android may include this data in your device backup so it can be restored on a new phone. That backup is managed by Android and your Google account under your own settings, and we have no access to it.

Uninstalling the app, clearing its storage, or using Settings → Reset progress deletes this data from your phone. Reset progress does not delete your online leaderboard data. For that, see Delete your online data.

The game plays offline. When it is online, it talks to our game server for settings, updates and (for adults who switch them on) leaderboards. Every connection uses HTTPS.

• Settings check, for every player: when the game starts it sends the game, app version and platform (Android) to get its settings and to learn whether an update is available. No identifier is sent and nothing is stored.
• Update check, for every player: the update plugin sends a random install ID it creates on your phone, plus the package name, versions and Android version (see Updates). Our server does not store the install ID.
• Your IP address reaches the server with every request, because the internet needs it to send the answer back. We use it only in memory to limit abuse (for example, too many sign-ups from one address) and never write it to the database or to logs.
• Server logs record errors and start-up messages, never IP addresses or player data. We keep them for one year.
• Online leaderboards, adults only and only if you switch them on. See the next section.

Leaderboards are off by default and are not available at all to players under 18. If you are 18 or over, you can switch them on in Settings → Privacy. The switch explains what is shared before you turn it on.

When you switch leaderboards on, our server stores:

• a random player ID created for this install of the game;
• a generated display name, such as "Speedy Otter 42" (you never type a name);
• a hashed version of the secret token that proves the player ID is yours;
• your platform (Android) and app version;
• your scores: Endless high score (all-time and this week) and campaign stars (all-time);
• when the player was created and last seen, and whether it was banned for cheating.

It stores no email, no real name, no free text, no device identifiers and no advertising ID. Your generated name and scores are public: anyone playing the game can see them on the leaderboards. The random player ID appears in leaderboard data too, but means nothing outside our server.

We use this data only to run the leaderboards and keep them free of cheating. Our legal basis is your consent (GDPR Article 6(1)(a); DPDP Act section 6). You can withdraw it at any time by switching leaderboards off, which stops all sending. To remove what is already on our server, use Delete my online data.

Hold the Line shows no ads of any kind. It contains no ad SDK (no Google AdMob or any other ad network), no analytics, attribution or crash-reporting SDK, and no tracking. It does not use the Android advertising ID. No advertiser receives any data from the game.

The game checks our server for updates when it starts or resumes. Small updates (new levels, fixes) download directly from our server and apply the next time you start the game; bigger ones need a Google Play update, and the game may show an “Update available” card or, rarely, a “Please update” screen. Updates from our server only change the game’s levels, look and logic; they never add ads, data collection, permissions or online features beyond what this policy describes.

The update check sends the app’s package name, its versions, your Android version, whether it runs on an emulator, and a random install ID that the update plugin creates on your phone. The install ID is not your advertising ID or any hardware ID, and our server does not store it: we use only the package name and versions to pick the right update. The update plugin contacts only our server, and its usage statistics are turned off.

• Local only. Reminders are scheduled on your phone by the game itself. There is no push service, no device token, and nothing is sent to our server or anyone else to deliver them.
• Off until you say yes. The game asks only after a good moment (such as a win), never when you first open it and never on the age question. Android 13 and later also asks for permission. You can turn reminders off any time in the game’s Settings or in Android’s notification settings.
• Gentle and rare. At most one a day, never between 22:00 and 09:00, and never within 15 minutes of playing. The game asks once, after you win a level (from level 3).
• Players under 18 (and anyone who has not answered the age question) get gentle reminders only, such as: your daily reward is ready; a free chest is ready. Never streak warnings, come-back sequences, countdowns or fear-of-missing-out messages.
• Adults may also get: a reminder to keep a daily streak; after a while away, two "fancy a quick round?" reminders, then nothing more.
• Never promotional. A notification never contains an ad, a purchase prompt or anything from a third party. Occasionally it may tell you about new levels in this game, which still counts toward the one-a-day limit. We can switch reminders off for every player from our server.

These are all the Android permissions in the app, and why:

• Internet (INTERNET): to check for settings and updates, and to send scores for adults who switch online leaderboards on.
• Network state (ACCESS_NETWORK_STATE): added by Android's WorkManager library, which the update plugin uses for background downloads, to check whether your phone is online. Nothing about your network is sent to us.
• Vibration (VIBRATE): for optional haptic feedback, which you can turn off in Settings.
• Notifications (POST_NOTIFICATIONS): Android 13 and later asks you first. Used only for the optional local reminders described in Notifications.
• Run at startup (RECEIVE_BOOT_COMPLETED): lets Android restore reminders you already allowed after your phone restarts. Nothing else runs in the background.
• Keep awake and background work (WAKE_LOCK, FOREGROUND_SERVICE): added automatically by Android's WorkManager library, which the update plugin uses to finish downloading a game update if you leave the game mid-download. They don't track you, show notifications, or run anything else in the background.

Android also adds an internal permission that keeps the app’s own components private to the app. The game does not use your camera, microphone, contacts, location, photos or files, and it does not use the advertising ID.

Real names, typed names or chat (you never type anything in the game), email addresses, phone numbers, location from your device, contacts, photos, files, audio, the advertising ID, or any account login. The game has no accounts and no sign-in. We do not sell personal data, and we do not use it for profiling or behavioural or targeted advertising.

• Microsoft Azure hosts our server, database and update files in the Central India region (Pune) as our service provider (processor). It processes data only on our instructions.
• Cloudflare provides DNS for our domain only. Game traffic does not pass through it.
• Other players see the generated names and scores of adults who switched leaderboards on.
• Authorities, only if the law requires us to disclose data.

Google Play, which installs and updates the app, is covered by Google’s privacy policy. The open-source libraries the game uses (three.js, postprocessing, ZzFX, Capacitor and the bundled fonts) run on your device. Their licences are listed in the game under Settings → Licenses & Credits.

Our server, database and update files stay in India, on Microsoft Azure’s Central India region. If you play from outside India, the data our server receives is processed in India.

Players under 18 (and unanswered age)

Nothing is stored. See Children under 13 and the children's data retention statement.

Your player ID, generated name, platform, app version and timestamps (adults with leaderboards on)

Until you delete them, or automatically after 12 months with no activity.

Daily leaderboard scores

60 days.

Weekly leaderboard scores

26 weeks.

All-time leaderboard scores

As long as the player exists (see the row above).

Database backups

7 days. Deleted data is gone from backups within 7 days.

Server logs (errors and start-up messages, no IP addresses or player data)

1 year, as India's DPDP Rules ask for processing logs. Deleting a player does not remove log lines, but they contain no player data.

IP address of a request

Only in server memory for the rate-limit window (up to 10 minutes). Never written to the database or logs.

The update plugin's random install ID

Only in server memory while the update request is answered. Never stored.

Settings and update requests

Not stored.

Emails you send us

As long as needed to answer and to keep a record of a privacy request.

All traffic uses HTTPS, and the connection to our database is encrypted and protected by a firewall. Player tokens are stored only as hashes. We follow a written information security program covering access control, patching, backups, logging and breach response, and review it at least once a year. Above all, we keep as little data as possible: what we do not collect cannot leak. If a breach ever affected stored data, we would tell players in the game and on this page, and notify the authorities the law requires.

• In the game: Settings → Privacy → Delete my online data, then confirm. This deletes your player and all your scores on every leaderboard from our server, and removes the player ID and token from your phone. It needs an internet connection.
• On the web: karan.dev/games/hold-the-line/delete-data/ explains both ways step by step.
• By email: support@callmissed.com with your player ID, which is shown on the Settings → Privacy screen. We answer within 30 days.

To delete what is stored on your phone, use Settings → Reset progress, clear the app’s storage, or uninstall the game.

Made for players of all ages, including children, and designed to follow Google Play's Families policy.Our games treat everyone under 18 as a child, as India’s DPDP Act does, and we design for them first:

• We store no personal data about children. No player is created for them, no scores are uploaded, and online leaderboards are not shown.
• There are no ads. We do no tracking, behavioural monitoring or targeted advertising of anyone, children included.
• There is no chat, no free text, no way to contact other players, and no advertising ID.
• Reminders for children are gentle only.
• The age question is neutral and its answer never leaves the phone.

Parents: you can delete everything the game stores on the phone with Settings → Reset progress, by clearing the app’s storage, or by uninstalling it. If you think your child used the online features (for example, by entering an adult birth year), use Settings → Privacy → Delete my online data, or email support@callmissed.com with the player ID shown on that screen. We will delete the data promptly and use your email only to reply. More on For parents.

We do not ask children for personal information, and we do not knowingly collect it. For players under 13 (and anyone who has not answered the age question), the only personal information that leaves the phone is two kinds of persistent identifier, used only to support the internal operations of the game, which COPPA allows without parental consent:

• The update plugin’s random install ID: used only to pick the right game update for the app.
• The IP address: used only to send the game its answer, to limit request rates and to keep the service secure.

How we make sure these are never used to contact a child, for behavioural advertising or to build a profile: our server stores neither the install ID nor the IP address and never links them to each other or to anything else; the game shows no ads and contains no ad, analytics, attribution or tracking SDK; and it does not use the advertising ID.

Third parties: Microsoft Azure, only as the host of our server. No other third party receives children’s data.

Children’s data retention policy: we store nothing about players under 18. Their IP address and the update plugin’s install ID are held only in server memory for the duration of the request (for the IP address, the rate-limit window of up to 10 minutes) and then dropped. They never appear in our database or logs. If we learn that we hold a child’s personal information anyway (for example, an email from a child, or a leaderboard player created after a wrong birth year), we delete it promptly.

Parents can ask what we hold, ask us to delete it, or stop all further collection by uninstalling the game. Contact: support@callmissed.com, +91 80802 47309, Karan Rajput, Chandrangan Phase 1, Ambegaon Bk, Pune 411046, Maharashtra, India.

EU and UK (GDPR and UK GDPR). You have the right to:

• access the personal data we hold about you and get a copy;
• rectification of inaccurate data;
• erasure of your data;
• restriction of processing;
• object to processing based on our legitimate interests;
• data portability (receive your leaderboard data in a machine-readable format);
• withdraw your consent at any time, without affecting processing before the withdrawal (switch leaderboards off, or delete your online data);
• lodge a complaint with a supervisory authority, for example the data protection authority where you live (list of EU authorities) or, in the UK, the Information Commissioner’s Office.

Our legal bases are consent for online leaderboards, and our legitimate interest in keeping the game working, up to date and secure for the settings and update checks.

India (Digital Personal Data Protection Act, 2023). You have the right to:

• obtain a summary of the personal data we process about you and of the processing, and the identities of anyone we have shared it with;
• correction, completion, updating and erasure of your personal data;
• withdraw your consent at any time, as easily as you gave it;
• grievance redressal: complain to our grievance officer and get a response;
• nominate another person to exercise your rights if you die or become incapable;
• complain to the Data Protection Board of India.

If you are in India and not satisfied with our answer, you can complain to the Data Protection Board of India.

How to use your rights. Most of them work directly in the game (Settings → Privacy). Otherwise, email support@callmissed.com with your player ID. Because we hold no names or emails, the player ID is how we find your data; we may ask you to confirm a detail from the game to check the request is yours. We answer within 30 days (India’s DPDP Rules allow up to 90). Players under 18 have no data on our server.

Grievance officer and privacy contact: support@callmissed.com
Postal address: Karan Rajput, Chandrangan Phase 1, Ambegaon Bk, Pune 411046, Maharashtra, India

We acknowledge grievances promptly and resolve them within 30 days. If you are in India and not satisfied with our answer, you can complain to the Data Protection Board of India. In the EU or UK, you can complain to your data protection authority.

If this policy changes, we will update this page and the dates above and ship the updated text with the app. We will never start collecting new kinds of data without first updating this policy and the game’s Google Play Data safety section, and we will tell players about important changes in the game’s release notes.