Arrowbound privacy policy

Last updated: September 26, 2026

NR Games, operated by Nalla Rajesh in India, provides Arrowbound. This policy explains the information used by the game, its online multiplayer service and these Arrowbound website pages. Contact us at rajeshnalla96@gmail.com.

Information stored on your device

Arrowbound saves campaign and daily puzzle progress, earned coins and rewards, puzzle attempts, selected themes, sound and language preferences, a multiplayer nickname, your chosen built-in portrait, a random installation identifier and a separate random multiplayer profile credential on your device. These let the game remember your progress and settings. A portrait is a selection from the game's artwork, not a photo upload.

Any advertising age band selected in the game stays on your device and is excluded from cloud saves. Arrowbound does not ask for or store your date of birth.

We do not need your contacts, photos, microphone, camera or precise device location. The game chooses an initial language from device locale settings; this does not require location permission. You can change the language in Settings.

Online multiplayer information

When you connect, the service receives your multiplayer nickname and portrait, a randomly assigned guest identity and temporary reconnection information. It processes room membership, puzzle actions, released-arrow and red-arrow counts, taps, remaining lives, connection status and race results to operate and validate the match.

Your nickname, portrait and match progress are visible to other participants in your room. Depending on the game version, you can choose a game-provided nickname or save an editable nickname after accepting the nickname rules. Where available, your Google Play Games display name can be suggested for you to review and edit. An explicitly saved nickname is included in your optional cloud save. Players can share a nickname; a nickname does not prove a real-world identity. Arrowbound does not offer free-text chat or photo uploads.

Players can send game-provided emojis and short phrases to others in the same room. The service stores the latest 12 quick-chat exchanges with the sending player ID and time in the room record, and includes them in the room history shown to participants. Quick chat is cleared when a new race starts in that room.

The service uses Google Cloud Firestore to store rooms, sessions and match progress. The multiplayer application runs on an Oracle Cloud Infrastructure server in Hyderabad, India. Network infrastructure receives connection information such as an IP address. The service uses limited connection/admission records to control abuse and service load. Raw reconnection tokens are not stored in the database; the service stores a hash.

Older versions may replace custom names with a game-provided nickname. Historical multiplayer records follow the retention and deletion practices below.

Nickname reports and player blocking

Versions with editable public nicknames provide Report nickname and Block player from another player's profile. A report stores the name shown, private hashed identities for the reporter and reported player, room and match identifiers, a fixed report reason, review status and server timestamps. Reports are visible to authorized moderators, not other players. A private safety profile stores your accepted nickname-rules version and time, blocked-player identifiers, limited report-rate counters and any nickname restriction applied by a moderator.

Blocking leaves your current room and prevents future pairing or private-room entry between those saved multiplayer identities. A replaced or reset guest identity may bypass an earlier block. These controls do not identify a person across every account or device. Reports are reviewed through the developer's moderation process; abusive names may be replaced with game-provided names.

Reports become eligible for scheduled cleanup 90 days after submission, including reviewed reports. Cleanup may be delayed by service interruptions. Block lists and nickname restrictions have no scheduled expiry and persist until removed or the associated guest identity is deleted. Contact support to request help managing a block list. In-game cloud-account deletion does not remove these separate guest records.

Hosting connection data

Vercel hosts these Arrowbound website pages. Oracle Cloud Infrastructure hosts the multiplayer application server in Hyderabad, India, while Google Cloud Firestore continues to store the multiplayer database records described above. When you visit the website or connect to multiplayer, the applicable hosting and network providers process connection and service metadata such as your IP address, request date and time, requested resource, response status, system or browser information, and diagnostic, performance and security data. This supports service delivery, troubleshooting, security and abuse prevention. Arrowbound does not request GPS access or use your IP address to choose the game language.

Vercel processes website hosting information under its privacy notice. Oracle processes multiplayer server hosting information under its privacy policies. Google processes Firestore information under its privacy policy. These hosting practices are separate from the room information shown to other players.

Daily multiplayer entries and earned coins

A separate anonymous multiplayer profile keeps your daily race allowance, any verified extra entries and cumulative race-coin rewards. Your device holds its random profile credential; the server stores a hash as the profile identifier, never the raw credential. This profile is separate from a temporary room or reconnection session and is not a Google account.

The allowance is three free races per UTC day, used when a race starts. The profile lets the service enforce that allowance and avoid paying the same prize again after a restart. It remains until a verified deletion request is handled; it does not expire with a room.

When rewarded race-entry videos become available, the game will send a server-issued reward challenge and the hashed multiplayer profile ID to Google Mobile Ads. Google sends a signed completion callback containing reward and transaction information so our server can verify the video and grant one extra entry only once. A challenge is valid for 24 hours. Challenge and duplicate-prevention receipt records become eligible for cleanup after seven days; routine cleanup can be delayed. Test ads cannot grant production multiplayer entries.

Optional notifications

If you opt in to notifications, Arrowbound can schedule a daily puzzle reminder on your device around 7 p.m. local time and send occasional game announcements through Google Firebase Cloud Messaging (FCM). Notifications require Android notification permission where requested and remain off unless you opt in. FCM processes app installation identifiers, registration tokens and a topic matching your selected game language to deliver announcements in that language. This notification feature does not enable Firebase Analytics.

You can turn Notifications off in the game's Settings or block Arrowbound notifications in Android settings. Turning them off in the game stops local reminders and requests removal of the language-topic subscription and FCM registration token. Server-side removal requires connectivity, so a previously queued announcement may still arrive while that request is pending; Android notification settings block delivery immediately.

Optional account, advertising and purchase services

The services below apply when they are available in your version of Arrowbound. Sign-in, watching rewarded videos and buying coin packs are choices. The service providers may process connection, consent and diagnostic information when their services start or prepare content, before you choose to sign in, watch a video or make a purchase.

• Google Play Games and Firebase: Where enabled, optional sign-in uses a Google Play Games identity and Firebase Authentication to associate a cloud save with your Arrowbound account. The saved-game snapshot contains progress, settings, your chosen built-in portrait and earned coins. The advertising age band stays on your device and is not included. Google Play Games processes your player identity, service analytics and diagnostics, and Firebase Authentication processes account identifiers, connection IP addresses and app/device information to operate and protect sign-in. The game does not ask you to give NR Games your Google password. This cloud account is separate from your anonymous guest multiplayer profile.
• Rewarded advertising: When available, you can choose to watch a video for the displayed benefit. Google Mobile Ads collects and shares device or advertising identifiers, IP addresses that may be used to estimate approximate location, app interactions, diagnostics and ad activity for advertising, analytics and fraud prevention under Google's privacy policy. Advertising data may be processed when ads are prepared, before you press Watch. The game sends Google Mobile Ads and Google’s User Messaging Platform a derived age-related privacy setting (under-age-of-consent treatment), based on the locally stored age band. The full age-band choice is not included in your cloud save. The game applies age-related advertising settings using the locally stored age band, and Google's User Messaging Platform presents applicable consent and privacy choices. Test ads are not proof that live advertising is available.
• Google Play purchases: Where products are available, Google Play handles payment details. Purchase verification uses the product, purchase token, account binding, transaction status and coin entitlement to credit purchases and handle refunds. Purchased coins are credited only after server verification confirms a valid purchase. NR Games does not receive your card number. Coin packs may be unavailable while purchase services are being set up. Available products and prices are shown through Google Play.

Why information is used and who receives it

We use information to save your choices and cloud progress, manage optional accounts, run and reconnect matches, show standings, validate game actions, deliver and verify optional rewards and purchases, send opted-in notifications, prevent abuse and respond to help or deletion requests. Advertising providers also use the information described above for advertising, analytics and fraud prevention. We do not sell player information. Service providers process information needed to deliver their services; other players see the room information described above.

• Google privacy policy — Google Play services, Firebase, including Cloud Firestore and Cloud Messaging, and Google Mobile Ads.
• Oracle privacy policies — multiplayer application server hosting.
• Vercel privacy notice — Arrowbound website hosting.

These Arrowbound website pages do not add advertising or analytics scripts. Opening the trailer takes you to YouTube, which applies its own privacy choices. Hosting providers can process normal request and security logs. Emailing support shares your message, email address and any attachments you choose to include.

How long information is kept

• Device saves: Remain on your device until you clear the game's storage or otherwise delete them.
• Multiplayer rooms: Normally expire after one hour without room activity. Quick-chat history is stored with its room until it is cleared for a new race or the room is deleted. Individual race progress is kept while its matching room and participant remain active.
• Guest sessions: Expire after 24 hours. Shared admission-budget records have a two-day expiry.
• Expired server records: Are eligible for scheduled daily cleanup. Expiry does not mean immediate physical deletion; processing delays or service interruptions may extend cleanup time.
• Anonymous multiplayer allowance/reward profile: Persists independently of rooms until a verified deletion request is handled. Video reward challenges and receipts are eligible for scheduled cleanup after seven days, as described above.
• Hosting logs and backups: Provider-managed connection, diagnostic, security and backup records follow the provider's retention practices and applicable obligations. Their exact retention periods are not specified here. A short runtime-log viewing window does not mean that all hosting records are erased at that time; the room expiry periods above do not apply to these records.
• Support messages: Are used to resolve your request. You can ask us to delete the correspondence. We may retain the minimum records needed for unresolved disputes, security or a legal obligation, and will explain any applicable exception when responding.
• Optional cloud account data: Cloud saves remain until replaced or deleted. Cloud account deletion removes the account's saved game and Firebase Authentication account. A minimal private deletion record remains, keyed to the former Firebase account ID and containing only the server-recorded deletion time. It prevents old sign-in credentials from recreating that account's cloud save. This security record has no scheduled expiry; it does not contain your saved game.
• Purchase data: Where purchases are available, transaction and fraud-prevention records may need to be retained for refunds, disputes or legal obligations. Deleting a cloud account does not automatically erase records that must be kept for these purposes.

Your choices and deletion requests

You can use solo play without connecting to multiplayer. Change your selected nickname or portrait before joining a room, and clear device storage to remove local progress. Clearing local data or uninstalling does not automatically delete server records or support emails.

In a build with cloud saves enabled, use Cloud save → Delete Arrowbound cloud account and authenticate again to delete the signed-in account's cloud save and Firebase Authentication account. This keeps local progress on your device and does not delete your separate guest multiplayer profile, financial records or Google account. The minimal deletion record described above remains. If deletion is interrupted or only partly completes, retry the deletion after authenticating again or contact support.

Use the Arrowbound data deletion page to request deletion of identifiable server data, support correspondence or an Arrowbound account if one exists. You can also ask to access or correct information. We may request enough information to verify ownership, but never your password, sign-in code, payment card details or a reconnection token. Removing Arrowbound data does not delete your Google account.

Security and international processing

Online connections use encrypted transport. Access controls restrict database access to the services that need it. No online system can guarantee perfect security. The current game database is hosted in India, and our hosting and Google service providers may process information in other countries under their own policies.

Children and policy changes

If you believe a child has provided personal information through Arrowbound, contact us so we can investigate and remove information where appropriate. We will update the date and content of this page when our practices change. Features and data disclosures must match the version you are using.

Contact NR Games

Developer: NR Games (Nalla Rajesh)
Email: rajeshnalla96@gmail.com
Location: Warangal, Telangana, India