BidLore — Privacy Policy
BidLore is a free single-player mobile game for Android, distributed on Google Play (application identifier: pl.vertias.bidlore). This policy explains what data the game handles, what the advertising software built into the game does, and what choices you have.
1. In short
| Topic | Summary | Details |
|---|---|---|
| Data types | Game data kept only on your device (save, settings, a local diagnostics file). Data collected by Google's advertising software (Google Mobile Ads and Google's consent tool UMP): IP address, interactions with the app and ads, diagnostic information, device and account identifiers (advertising ID, app set ID), technical data about the app and the device and error reports sent by Google's advertising plugin (for example the app's name and version, the device model, the system version), and your consent choices (stored on the device by Google's consent tool and read by Google's advertising software). If you write to us or share feedback or diagnostics with us: your contact address, your message and whatever you attached. | Sections 3, 5, 10, 12 |
| Purpose | Running the game and keeping your progress. Showing ads (the game's only source of revenue), ad measurement and analytics by Google, fraud prevention. Answering your messages and fixing problems. | Sections 3, 5, 10, 12 |
| Third parties and what is shared | Google (AdMob) and its advertising technology partners receive the data collected by Google's software. For the fact that Google's software collects that data in the game and sends it to Google we are responsible as the game's publisher; after that Google processes it under its own rules. We do not send them your save, your diagnostics file or your game results. We run no server of our own and keep no database of players. If you write to us, your message is handled by our mail provider — Gmail (a Google service); when we use an assistant based on artificial intelligence on it, it may also reach Hostinger or OpenAI (section 10). | Sections 2, 5, 6, 10 |
| Retention and deletion | Local data stays on your device until you delete it or uninstall the game. Google keeps its data according to Google's own policy. How the data is protected is described in section 20. | Sections 10, 11, 20 |
| How you are told about changes | A new version and date at the public address of this policy; a link to it in the game. The game itself shows no notice of a change. | Section 18 |
| Your rights | Access, correction, deletion, restriction, portability, objection, withdrawal of consent, complaint to a supervisory authority. We answer a request within one month at the latest. | Sections 15, 16 |
2. Who is responsible for your data
The publisher of BidLore and the controller of personal data for the purposes described in this policy is:
- Dominik Trojanowski Vertias
- sole proprietorship (jednoosobowa działalność gospodarcza) entered in the Polish Central Register and Information on Economic Activity (CEIDG); entrepreneur: Dominik Trojanowski
- country: Poland
- business address: given on the page Publisher and contact
- contact for privacy matters: kontakt.vertias@gmail.com
In this policy "we" means the controller named above.
It was our decision to build Google's advertising software into the game. We are responsible for that decision: for the fact that this software collects data in the game and sends it to Google, for telling you about it in this policy, and for making sure that the consent the law requires is asked for by Google's form (section 6). Google describes itself as an independent controller of the data it receives: what Google and its advertising partners do with the data afterwards they decide on their own (see section 5.5). You can send a request about this data to us or to Google (section 15).
3. What the game stores on your device and why
Everything below is stored locally, on your device, in storage set aside for the game. The game does not upload it to us.
Other apps that you granted storage access (on older Android versions, 9–10) or a computer connected by cable may be able to read the save file and the diagnostics file.
| What | What it contains | Why |
|---|---|---|
Save file (business.json and a backup copy) | Your game state only: cash in the game, stock, reputation, licences, the Dealer Journal (collection, knowledge, records), progress. | So you can continue your game. |
Local diagnostics file (analytics.jsonl) | One line per event: event name, local time, a random session tag created anew each time the game starts, app version, file format version, this build's configuration flags (country status and whether purchases and ads are switched on in it), and gameplay details of the event (for example run number, prices and limits in in-game cash, tool used, session length, whether an ad was offered and, if not, why). No name, no device or advertising identifier, no hidden truth about the objects in the game. The file is trimmed to the newest 20,000 lines each time the game starts. | So that you can, if you choose, share diagnostic information with us when reporting a problem. The game itself never uploads this file. |
| Preferences | Language (the one you pick from the game's list; until you pick one, the game follows your device's language setting and stores no language), haptics, sound, a few small flags (for example that a hint was already shown), ad pacing: the time of the last ad and the run number, and the tester code you typed in the feedback form, if any (kept until you empty that field and then share feedback; emptying the field alone does not erase the stored code). | To remember your settings, to limit how often ads are shown, and so you do not have to retype the tester code. |
| Copy of the "Dealer Showcase" picture | One copy of the picture in the game's cache, overwritten each time you share. | To hand the picture to the system share sheet (section 12). |
| Consent information | Your advertising consent choices, stored by Google's consent software in the standard format (keys starting with IABTCF_). | So the consent form does not have to be shown again each time and so that Google's advertising software can read your choice. |
The game does not ask for your name, e-mail address, phone number, date of birth or location. It has no account and no login.
4. What never happens
- No account. You do not register or log in.
- No server of ours and no player database of ours. We do not run a game server or any database of players, and we do not receive your save or your results.
- No upload of our own analytics. The local diagnostics file stays on your device unless you share it yourself (section 12) or Android's backup copies it to your Google account (section 11).
- No crash-reporting service of our own. Google's advertising software does send its own technical and error reports to Google — see section 5.3.
- No access to location, contacts, camera, microphone, photos or files outside the game's own storage.
- No purchases. The game has no shop, no in-app purchases and no subscriptions.
- The game works offline. Without an internet connection the game runs normally and no new ad is fetched. An ad that was already loaded while you were online may still be shown after the summary of a run.
5. Advertising (Google AdMob)
The game is free and is financed only by advertising. Ads are delivered by Google AdMob. We use one advertising network and no mediation.
5.1 Software used
| Component | Version |
|---|---|
Google Mobile Ads SDK for Android (play-services-ads, standard SDK) | 25.4.0 |
| Google Mobile Ads Unity Plugin | 11.5.0 |
| Google User Messaging Platform (UMP) SDK — the consent form | 4.0.0 |
5.2 When ads appear
- Only one kind of ad is used: a full-screen ad shown at the transition after the summary of a completed run, after your result has been saved.
- At most one ad per run, and not more often than once every 8 minutes.
- Never in the tutorial, never during an auction, never when the game starts, resumes or closes.
- No banners and no rewarded ads.
- If there is no ad, no internet connection or an error, the game simply continues.
- Ads never change your results, your Intel, your in-game cash or the randomness of the game.
These are the rules for when an ad is displayed. Data can reach Google earlier than that — see section 5.3.
5.3 What Google's software collects
According to Google's own disclosure, the Google Mobile Ads SDK automatically collects and shares:
- IP address — which may be used to estimate the general location of the device;
- User product interactions — for example app launches, taps and video views;
- Diagnostic information — for example app launch time, hang rate and energy usage, used to measure the performance of the app and the SDK;
- Device and account identifiers — the Android advertising ID, the app set ID and, if applicable, other identifiers related to accounts signed in on the device.
According to Google, this data is encrypted in transit.
To have an ad ready, once the introductory first run is over the game asks Google for an ad in advance: on the home screen (HOME), when a run begins, and again when you close the privacy options form opened from Settings (section 6.3) — each time only if the consent check allows it; it can allow this after a refusal of personalisation as well (section 6.2). The ad request goes to Google at those moments — with at least your IP address and, according to Google's disclosure, also the other data listed above — even if no ad is shown later. Google's advertising software itself may be started earlier, with no ad requested at that moment: when the game starts, if the answer stored from your previous session allows it — and, where Google's consent software reports that no consent form is required where you are, already at the very first start of the game, during the introductory first run.
Technical and error reports sent by Google's plugin. Besides the data above, the Google Mobile Ads plugin for the Unity engine (the layer between the game and Google's SDK) sends its own reports to Google (pagead2.googlesyndication.com), in batches roughly every two minutes. We know this from the log of a test device and from the plugin's code (version 11.5.0); we did not capture the network traffic itself. It starts when Google's advertising software is started — that is, only once the consent check allows ad requests, but whichever answer you gave to the consent form, so also after a refusal of personalisation. The plugin has no documented switch to turn it off, and the game does not turn it off:
- records of the plugin's own operations (for example "the advertising software was started", "an ad was loaded"): the name of the operation, its time and duration, whether it succeeded, the version of the advertising software (SDK), the platform, the app's package name and version, the version of the Unity engine, the Android version and system build, the device model and — where the operation involves them — the AdMob app ID, the ad unit ID and the ad format;
- error reports: when any part of the app logs an error of the exception kind — including an error in the game's own code, not only in Google's — the type of the error, the first line of its description, the list of places in the code where it happened (a stack trace) and a hash of that trace. Such a description is technical text produced by the code in which the error happened; it can contain, for example, a file path on your device.
The consent software (UMP SDK) contacts Google when the game starts and you are online, to check whether a consent form is required where you are. If that check did not succeed — for example because there was no connection when the game started — it is repeated each time you are on the home screen after the introductory first run, until it succeeds. This contact involves at least your IP address.
5.4 Purposes
According to Google, the data is collected and shared for advertising, analytics and fraud prevention.
On our side, the purpose is to show ads in the game so that the game can remain free.
5.5 Who receives the data
- Google. According to the data protection terms Google publishes for its advertising services (Google Ads Controller-Controller Data Protection Terms), for people in the European Economic Area the Google company concerned is Google Ireland Limited, and Google acts as an independent controller of the data it receives, not as our processor. For the fact that the data is collected in the game and sent to Google we are responsible as the game's publisher (section 2).
- Google's advertising technology partners. Other advertising companies may take part in selecting, delivering and measuring ads through Google and may also act as independent controllers. The current list of partners is shown in the consent form.
How Google uses this data is explained by Google on its own page:
Google's page: How Google uses information from sites or apps that use our services.
Google's privacy policy is on the page Google Privacy Policy.
We do not sell your data. We do not send Google or its partners your save, your diagnostics file or your game results.
6. Consent and your choices
6.1 The consent form
Where the law requires consent, the game shows a consent form provided by Google (Google UMP). The form is requested only from the home screen (HOME), once the introductory first run is over — never before that; if it cannot be loaded, or arrives after you have left the home screen, the game asks for it again the next time you are there.
The language of the form is chosen by Google's tool from the language of your device, not from the language set in the game; the form and the game can therefore be in different languages.
Whether a form is required where you are is reported to the game by Google's consent software. Where it reports that no form is required, the game shows none, Settings has no "Ad privacy" row (section 6.3), and the game requests ads without asking.
In the form you can:
- consent to personalised ads,
- refuse (directly or under Manage options, depending on the form),
- or manage your choices purpose by purpose and partner by partner, including objecting where a partner relies on its legitimate interest.
6.2 What your choice means
- Refusing does not block the game. You can play the whole game without consenting to anything.
- Refusing personalisation is not treated as consent to anything else. We do not interpret a refusal as agreement to any other processing; the game itself sets no consent signal — only Google's form writes one.
- Personalisation of ads and the technical processing of data are two different things. Your choice in the form is about whether data may be used to personalise ads and for the other purposes listed in the form. It does not switch Google's advertising software off. After a refusal, Google's consent tool may still allow ad requests; Google's advertising software is then started, requests ads and sends Google what an ad request sends — at least the IP address and, according to Google's disclosure, also device identifiers (as far as the consent signals allow), diagnostic information and interactions — together with the plugin's technical and error reports described in section 5.3. This is what happened in our tests of 2026-10-01 and 2026-10-08 (test versions of the game, Google's test form, Poland): after "Do not consent" Google's consent tool still allowed ad requests and a test ad was loaded; in the test of 2026-10-01 the record written by Google's form held no consent for any purpose.
- Without consent, ads may be limited or absent. According to Google, if you do not consent to storing or accessing information on your device, Google may serve only "limited ads", which do not use personal data to personalise ads, or no ads at all; data such as the IP address is still used to deliver the ad to the device, and — depending on a setting of the publisher's advertising account — Google may still use local storage on the device solely to detect invalid traffic.
- Non-personalised ads still use identifiers. According to Google, non-personalised ads do not use the advertising ID for targeting, but still use it for limiting how often an ad is shown and for aggregated reporting; where the law requires consent for this, it is asked for in the form.
6.3 Changing your choice later
You can change or withdraw your choice at any time:
Settings > Ad privacy
Tapping this row (it reads "Ad privacy — CHANGE CHOICE") opens Google's privacy options form again. The row is shown when Google's consent software reports that privacy options apply where you are.
Withdrawing consent does not affect processing that took place before the withdrawal.
7. Advertising ID
The Android advertising ID is an identifier provided by Android that you control. You can reset it or delete it in your device's system settings — usually in the part of the settings that deals with privacy and ads, or in the Google settings (the exact path and names differ between devices and Android versions). Look for the option to reset or delete the advertising ID.
8. Legal bases
| Processing | Legal basis |
|---|---|
| Save and settings kept only on your device | Storing them on the device is necessary to provide the game you asked for, so we do not ask for consent. We do not receive this data, so we do not process it ourselves. |
| Local diagnostics file | It stays on the device and is kept for troubleshooting; unless you share it, we do not receive it and do not process it ourselves. If you send it to us, the basis is our legitimate interest in fixing the problem you reported (Article 6(1)(f) GDPR). The game has no off switch for this file today — after deletion it starts a new one. |
| Ad-pacing values (time of the last ad, run number) | Used to limit how often ads are shown; they stay on the device and we do not receive them. |
| Storing information on your device or reading it for advertising (for example the advertising ID) | Your consent (Article 6(1)(a) GDPR and your country's rules on storing information on a device and reading it). |
| Personalised advertising | Your consent (Article 6(1)(a) GDPR). |
| Basic ad delivery, measurement and fraud prevention by Google and its partners | Your consent (Article 6(1)(a) GDPR) or, where a partner declares it, that partner's legitimate interest (Article 6(1)(f) GDPR) as shown in the consent form — you can object there. |
| Technical processing of data by Google's advertising software that does not depend on personalisation (the ad request, the plugin's technical and error reports — sections 5.3 and 6.2) | It takes place after a refusal of personalisation as well, so it does not rest on your consent to personalisation. For the fact that this data is collected in the game and sent to Google we are responsible as the game's publisher (section 2); after that Google processes it as an independent controller, under its own rules (section 5.5). |
| Storing your consent choice | Necessary to remember and respect the choice you made. Google's consent tool stores it on your device; we do not receive it. |
| Answering messages you send to us (complaints, feedback, questions) | Our legitimate interest in answering the person who writes to us and dealing with their matter (Article 6(1)(f) GDPR). On the same basis we use an assistant based on artificial intelligence when doing so (section 10). You can ask us how we weighed that interest, and you can object (section 15). |
| Answering requests about your rights over your personal data (section 15) | A legal obligation (Article 6(1)(c) GDPR). |
Providing data is not a legal or contractual requirement. If you do not consent to advertising-related processing, the only consequence for you is that ads may be limited or absent. This does not mean that nothing reaches Google after a refusal — see section 6.2.
9. Transfers outside the European Economic Area
Google is an international group and may process data outside the European Economic Area, including in the United States. For the United States the European Commission has adopted an adequacy decision — Implementing Decision (EU) 2023/1795 of 10 July 2023 on the EU–U.S. Data Privacy Framework; according to Google, Google LLC is certified under that framework. For other transfers Google, by its own account, relies on the Commission's adequacy decisions for other countries or on standard contractual clauses. Google describes these mechanisms, and how to obtain a copy of the clauses, on its page Legal frameworks for data transfers. The same applies to our mailbox, which is handled by Gmail (section 10).
If you write to us and we use an assistant based on artificial intelligence on your message (section 10), its content may reach OpenAI. According to the terms for users in the European Economic Area, the service is provided by OpenAI Ireland Ltd. OpenAI describes any onward transfers, including to the United States, in its privacy policy. The Commission decision named above applies to organisations certified under the EU–U.S. Data Privacy Framework; the current list is maintained by the U.S. Department of Commerce at dataprivacyframework.gov.
We ourselves do not transfer your game data anywhere, because we do not receive it.
10. How long data is kept and how to delete it
Data on your device
- It stays on your device until you delete it or uninstall the game.
- Diagnostics file: delete it at any time in the game: Settings > PRIVACY & DATA > DELETE DIAGNOSTICS FILE. The game starts a new file after deletion. The file is also trimmed to the newest 20,000 lines each time the game starts.
- Save and preferences: remove them with Clear data for BidLore in your device's system settings, or by uninstalling the game. This removes the data from the device, including your progress; we do not have a copy. If Android backup is on, a copy may remain in your Google account and may be restored on reinstall — see section 11.
- Consent choice: change it in the game (section 6.3); it is also removed from the device by Clear data or uninstalling.
Data held by Google
- Google keeps the data it collects for the periods described in Google's own policy (see the links in section 5.5). We do not control those periods.
- On your side you can reset or delete your advertising ID (section 7) and change your consent choice (section 6.3). This does not delete data Google has already received and does not switch off the technical processing described in sections 5.3 and 6.2.
Messages you send to us
- If you write to us, we receive your e-mail address and your message. We keep the correspondence in our mailbox for as long as it is needed to handle the matter and to show how it was handled. We do not delete messages automatically after a set time. You can ask us to delete your correspondence; we will handle such a request as the law requires (section 15). Our mail is handled by Gmail (a Google service), which may process data outside the European Economic Area as well — see section 9.
- When handling correspondence we also use our own assistant based on artificial intelligence. It runs on a server in Vilnius (Lithuania) that we rent from Hostinger (Hostinger International Ltd.) and has access to our mailbox. The assistant reads messages on our instruction and does not reply to them automatically. In the current configuration confirmed by the publisher, the assistant uses an OpenAI model. When it reads a message, its content, the sender's address, the headers and earlier correspondence in the same matter may be sent to OpenAI. Attachments are sent only when the assistant opens them. Data from the messages it has read may remain in the assistant's history, memory and diagnostic records on that server; it is not deleted from there automatically. According to the terms for users in the European Economic Area, the service is provided by OpenAI Ireland Ltd. The publisher has turned off the option to use conversations for model training in the settings of the owner's ChatGPT account. This does not mean that the provider does not otherwise process or retain data. OpenAI may process data outside the European Economic Area — see section 9.
11. Android backup
Android has its own backup feature. If backup is switched on for your device, Android may copy the game's data (save, preferences — including your consent choices and the ad-pacing values — and the diagnostics file) to your own Google account, under Google's terms, and restore it when the game is reinstalled. This is controlled by you in the Android system settings, not by the game. We have no access to such backups.
You can delete such a copy in the Android backup settings or in your Google account.
12. Sharing from the game
The game can open the Android share sheet in three situations, and only when you tap the corresponding button:
- sharing the diagnostics text,
- sending feedback (an idea or a problem report, optionally with diagnostics attached),
- sharing the "Dealer Showcase" picture.
What the shared content contains:
- Diagnostics text: a line with the app version, build number, platform and game language, and up to 60,000 characters from the end of the diagnostics file (section 3).
- Feedback: the same version line, the report type, the tester code (if you typed one), the text you typed and — only if you switch it on for a problem report — up to 30,000 characters from the end of the diagnostics file.
- "Dealer Showcase" picture: the picture itself; if it cannot be handed over, a text is shared instead.
You choose the app and the recipient. The game does not pre-fill any recipient — it sets only the subject and the content. The game does not send anything by itself. What happens to the shared content afterwards depends on the app and recipient you chose.
If you send feedback or diagnostics to us, we use it only to answer you and to improve the game.
13. Permissions
The game declares the following permissions:
- internet access — fetching ads and the consent check;
- network state — lets software check whether the device has a connection; added by Google's advertising software;
- vibration — haptic feedback on touches in the game;
- the advertising ID permission — reading that identifier by Google's software;
- three permissions related to Android's advertising services (advertising ID, attribution, topics) added by Google's software — they let it use those system services;
- wake lock and foreground service — added by AndroidX WorkManager, a library that Google's SDK depends on, for its background tasks;
- an internal permission of the app itself (
DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION), added by an Android support library — it gives access to no user data.
The game's own code adds only the vibration permission; the others come from the game engine, Android's support libraries and Google's software. The game asks for none of them while it runs, so there is no permission prompt.
14. Children
- The game is not directed at children.
- We do not knowingly collect personal data from children.
- If you are under 16, or are not sure whether you may decide on your own, ask a parent or guardian to make the consent choices in the consent form with you.
- The game asks Google to limit ad content to the "G" category (content suitable for general audiences) and passes Google no information about your age; which ads are shown is decided by Google.
- Parents and guardians can contact us at the address in section 2.
The age from which you can give this consent on your own is set by each country. As far as we could establish on 8 October 2026 from national laws and the pages of the national data protection authorities, it is:
| Age | Countries |
|---|---|
| 13 | Belgium, Estonia, Finland, Latvia, Norway, Portugal, Sweden |
| 14 | Austria, Bulgaria, Italy, Lithuania, Spain |
| 15 | Czechia, Denmark, France, Greece |
| 16 | Croatia, Germany, Hungary, Ireland, Luxembourg, the Netherlands, Poland, Romania, Slovakia |
A country can change this age; the law of your country decides.
15. Your rights
If the General Data Protection Regulation (GDPR) applies to you, you have the right to:
- access your data and receive a copy,
- correct inaccurate data,
- delete your data,
- restrict processing,
- data portability,
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting earlier processing,
- lodge a complaint with a supervisory authority (section 16).
How to use these rights
- Data on your device: you control it directly — see sections 10 and 11. We do not have a copy and cannot identify you from it.
- Consent for ads: change it in the game — see section 6.3.
- Data held by Google or its partners: use the tools and contact channels described in Google's documents linked in section 5.5 (among others, Google names the tools Ad Settings and My Activity there). You can also send the request to us: we will answer and explain what we can and cannot do — we hold no copy of this data and cannot identify you in Google's systems, so we cannot look it up or delete it there on your behalf.
- Anything else, and any request to us: write to kontakt.vertias@gmail.com — we reply without undue delay and no later than one month after receiving your request; in complex cases the law allows that period to be extended by two further months, and we will tell you if that happens.
16. Complaint to the supervisory authority
You can lodge a complaint with a data protection authority. We are established in Poland, where that authority is:
Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa — website uodo.gov.pl.
If you live in another country of the European Economic Area, you can also contact the authority of your country. The authorities of all countries of the European Economic Area, with their addresses, are listed by the European Data Protection Board on the page Our members.
17. Automated decisions
We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Which ad is shown is decided by Google's systems; if you consented to personalised ads, this may involve profiling by Google and its partners as described in their documents.
18. Changes to this policy
We may update this policy, for example when the advertising software, the law or the game changes.
- The current version is available at vertias.pages.dev/bidlore/en/privacy/, and the Polish version at vertias.pages.dev/bidlore/polityka-prywatnosci/. In the game, under Settings, there is a "PRIVACY" link that opens the policy in the browser; opening it needs an internet connection. The policy exists only in Polish and English: when the game is set to Polish, the link opens the Polish version, and with any other language the English version; the other version is at the address given above. The page with the policy is served by a hosting provider (Cloudflare); how the data of people who visit it is processed is described on the page Privacy on this website.
- This is the first version of this policy; there are no earlier versions.
- Each version has a version number and an effective date.
- If a change is significant, we publish the new version at the address above no later than the day it takes effect. The game itself shows no notice of a change.
- The game has no consent mechanism of its own. Consent for advertising is asked for only by Google's form (section 6.1). The game shows that form again on the home screen when, at a later start of the game, Google's consent software reports that an answer is owed again, and you can change your choice at any time (section 6.3). When Google's software asks again is decided by Google.
19. Contact
- Dominik Trojanowski Vertias
- publisher's address: the page Publisher and contact
- e-mail: kontakt.vertias@gmail.com
20. Data security
- The game's data (save, preferences, diagnostics file) is kept on your device, in storage set aside for the game. The game has no server and sends this data nowhere.
- The game does not encrypt these files itself; they are protected by Android, which keeps each app's data apart, and by your device's screen lock. The two known exceptions are described in section 3 (access by other apps on older Android versions and by a computer connected by cable) and section 11 (Android backup).
- According to Google, the data sent by its advertising software is encrypted in transit (section 5.3).
- Messages you send to us are kept in the publisher's mailbox, which is handled by Gmail (section 10). Data from messages read by the assistant based on artificial intelligence may also be stored on the server it runs on (section 10).