Privacy Policy
Last updated: 14 September 2026
This is not legal advice. It is an honest, specific description of what the game actually does, written from the database schema rather than from a template.
1. Who is responsible for your data
Broadside: Blackpowder & Iron is made and operated by Brad Gehrke, an individual developer.
- Contact for anything on this page:
support@broadside.au - There is no company, no advertising network, and no data broker involved.
2. The short version
- The game needs an account so your ship survives you closing the app. You sign in with Google, which is how the same captain reaches you on a new phone.
- Everything else stored is the game itself: your ship, your crew, your purse, the fights you fought.
- Nothing is sold, and nothing is shared with advertisers. There are no third-party ads and no analytics SDKs inside the app.
- You can delete your account from inside the game, and it is a real deletion.
- The game is for players aged 16 and over.
3. What is collected, exactly
3.1 Your account
| What | Why | Where it comes from |
|---|---|---|
| An account identifier | To know which ship is yours | Supabase (our authentication provider) |
| Your email address | To know the account is yours, and to reach the same captain on a new phone | Google, when you sign in |
| Your captain's name | It is shown to other players on the raid slate | You type it |
Signing in with Google is required to play. We receive your email address and an account identifier from Google — not your password, and nothing else from your Google account.
3.2 The game itself
Your ship and its rooms, guns, fittings, crew and officers; your resources and currencies; your Infamy and level; your daily and weekly task progress; your sign-in streak; your inbox; your hunt slate; your shields and cooldowns; the duels you fought and their replays; crates you own or opened; and the Articles version you signed and when.
Some of this is visible to other players by design: your captain's name, your hull class and your ship's approximate strength appear on other captains' raid slates, and a snapshot of your ship can be fought by them while you are offline. Your email address is never shown to anyone.
3.3 Purchases
If you buy Gold Doubloons, we record the Google Play purchase token, the product bought, what was granted, and the reference price. We never see your card, your name or your address — Google handles payment and tells us only that a purchase happened.
3.4 Diagnostics and measurement
| What | Why |
|---|---|
| Crash reports — the error, the stack trace, the screen you were on, the app version, the platform | To fix the crash. There is no over-the-air update for this game, so knowing which build crashed is the only way to tell a fixed bug from one nobody has updated past |
| Which days you played | To understand whether the game is worth coming back to |
| How far you got in the opening | To find where new captains give up |
| Duel outcomes and durations | To balance the game |
| Every movement of every in-game currency, and why | To keep the economy from inflating |
| An audit record of things that create value | To detect cheating and to resolve a dispute about a purchase |
All of this is recorded on our own server. There is no third-party analytics or advertising SDK in the app, so none of it goes anywhere else.
3.5 Technical information
Our server logs ordinary web-server information about requests, which includes your IP address. This is used to operate and secure the service and is not used to build a profile of you.
3.6 What is NOT collected
No contacts, no photos, no location, no microphone, no advertising identifier, no cross-app tracking, no health data, no precise device fingerprinting. The game asks for no Android runtime permissions beyond network access.
4. Who it is shared with
Only the services needed to run the game:
| Who | What they get | Why |
|---|---|---|
| Supabase | Your account record and authentication | Sign-in and the database |
| Fly.io | Server hosting; traffic passes through it | The game server |
| Google Play | Purchase verification | To confirm a purchase is real |
| Only if you choose Google sign-in | Authentication | |
| GitHub | Encrypted database backups, for up to 30 days | So your progress survives a failure |
Nobody on that list is an advertiser, and none of them are paid for your data. We do not sell, rent or trade personal information, and there is no "legitimate interest" advertising arrangement hiding in this document.
Data is stored in the United States (Supabase us-east-1, Fly.io iad). If you are in the UK, EU or another region with transfer rules, playing the game involves that transfer.
5. How long it is kept
| Your account and game state | Until you delete it |
| Duel replays | A limited retention window, then swept automatically |
| Database backups | Up to 30 days |
| Crash reports and measurement data | Retained while useful, and not tied to you after deletion |
| Purchase records | Kept as long as needed for refunds, tax and dispute resolution, even after deletion, because a receipt you can no longer prove is a refund you can no longer get |
6. Deleting your account
Inside the game: open the ledger and choose to strike your name. It is not a hidden setting.
What happens:
- Immediately — you can no longer sign in, your ship leaves every raid pool, and your captain's name is replaced everywhere it appeared.
- Within 14 days — the duels you appeared in other players' histories age out normally.
- Then — your row is removed for real.
You may also write to the address in §1 and ask.
Two honest caveats. Purchase records survive (see §5). And backups may hold a copy of your data for up to 30 days after deletion, because a backup you can edit is not a backup.
7. Your rights
Depending on where you live you may have the right to ask for a copy of your data, to correct it, to delete it, to object to processing, or to complain to a regulator. Write to the address in §1 and we will do it. For a solo developer that is a person reading your email, not a ticket system.
8. Age
Broadside is intended for players aged 16 or over, and you confirm this when you sign the Articles of Agreement on first launch. The game is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to the address in §1 and it will be deleted.
9. Keeping it safe
We take reasonable steps to protect your information: every connection is encrypted (HTTPS), sign-in goes through a trusted provider rather than a password we store, and access to the servers is restricted. No online service can promise to be completely secure, but if a serious data breach happens we will notify the people affected and the authorities, as the law requires.
10. Paid random items
The game sells crates whose contents are random. The odds are published inside the game before you buy, the prices are shown in your own currency, and nothing in the game can only be bought with real money — every item is obtainable with in-game currency.
11. Governing law
This policy is governed by the laws of Queensland, Australia.
12. Changes
If this policy changes materially, the Articles version in the game is raised and you are asked to sign again — so an agreement to terms that have since changed is not silently treated as agreement to the new ones. The date at the top is always the truth about which version you are reading.