Privacy policy

Nitro Troopers (Android app com.nitrotroopers.game) · effective 2026-09-30

1. Who we are

Nitro Troopers is a 2D shooter game published by Tuvezo (“we”, “us”). We are the controller of the data described here. To reach us: email tuvezogame@gmail.com. Questions about your data are welcome. This policy is for the game. For our website see the Tuvezo privacy policy.

2. The data we collect

The game works without an account for its offline modes. Online features need an account, and the server only sees data when the game goes online. This is everything the game sends to our server or keeps there:

Account

• Guest account: a random guest ID and a secret guest key. The key stays on your phone; we keep only a one-way hash of it.
• Email login: your email address. We send you a 6-digit code to prove it is yours; we keep only a hash of the code, for 10 minutes (it is deleted soon after).
• Google sign-in: the game asks Google to check who you are. We receive a signed token from Google and keep only the verified email address. We never see your Google password, contacts or profile.
• Name: your soldier name. For email and Google accounts, the first part of your email address (letters and numbers only) is used as the starting name until you choose another one.
• Totals: kills, deaths, wins, matches and score of your account.

Your phone (device code)

• A device code: a one-way SHA-256 hash of your phone’s Android ID mixed with a fixed text of ours. We cannot turn it back into the Android ID. It ties your login and licence to your phone, and it is how bans and cheat checks find a phone again.
• The game version, the build date, the sales channel (Google Play or other) and the platform (Android). The time of your phone’s last check-in with the server.

Playing

• Match records: for each match you play online (and the single-player matches the game uploads): the match ID, mode, start and end time, and for every human player the name, the device code, team, kills, deaths and result.
• Leaderboards: your name, score, kills and the first 6 characters of your device code are shown to other players on the leaderboards and match lists.
• Friends and invites: an online player ID (like NT-XXXX-XXXX) with its secret, your friends list, friend requests and game invites. While you are online the game tells the server every few seconds that you are online and in which room you are. Any player can search for your name or player ID and then see your name, stats and whether you are online.
• Rooms: the name of a room you host, its map and the number of players. While your room is open the server also holds the network address of the host’s phone; it is never shown to other players when the room uses our relay (the normal case).

Chat and voice

• Text chat and voice chat go live to the other players in your room (text can go to everyone or to your team; voice in team matches goes to your own team). The game passes them through the room host’s phone (who is another player) and through our relay server, which forwards small network packets. We do not record, store or listen to chat or voice. Anyone in the room can read what you type and hear what you say.
• Microphone: voice chat is off by default. Android asks for the microphone permission the first time you turn the microphone on. You can turn it off again, and mute any player’s voice.

Safety and fair play

• Reports: when you tap REPORT on a player we store the reason (cheating or abusive), the reported player’s name and device code, the match ID and your own device and account. A report contains no chat text. Reports never ban anyone by themselves; a person decides.
• Cheat flags: the game that hosts a match can flag a phone that behaves like a cheat (a reason code, the device code, the match ID). Several flags from different hosts can block a phone automatically.
• Device check: the game looks for signs of rooting, an emulator, hooking or cheat tools and copies of the game. It sends only a short result (clean, emulator, root, hook, clone) and short signal codes with each request. It does not send a list of your apps, files or any personal data. The result can stop online play on that phone.
• Bans: if a device or account is banned we keep the device code and account ID, the reason and the length of the ban.

Notifications

• If you allow notifications, the game registers a Firebase Cloud Messaging token with our server, linked to your online player ID, so friend requests and game invites reach you while the game is closed. The notification shows the sender’s name.

Internet address (IP address)

• Every internet service sees the IP address of the phone that connects. Our server uses it for rate limits and abuse protection, in memory, for a short time. Our server does not write IP addresses into its own log. It stores an address in only two cases: the address of an open room’s host phone (see Rooms), and, for builds that use a product key (not the Google Play version), only the network part (the first 3 numbers of an IPv4 or the first 3 groups of an IPv6 address) to detect a shared key. The web proxy in front of the server and our hosting provider may also process IP addresses as part of normal operation.

What we do not collect

No location, contacts, photos, files, calendar, health data, payment data or advertising ID. No analytics, ad or crash-reporting service is built into the game. If you have turned on “usage & diagnostics” on your Android phone, Google may show us anonymous crash statistics in Google Play Console; that is Google’s own collection.

3. Why we use the data

• To run the game: accounts, login, saving your totals, matches, leaderboards, friends, invites and rooms.
• To keep online play safe and fair: rate limits, cheat detection, reports, bans and moderation (see the community rules).
• To send you the login code by email and, if you allow it, notifications.
• To answer your questions, fix problems and follow the law.

We do not use your data for advertising, we do not build advertising profiles, and we do not sell or rent it.

4. Who gets the data

• Other players: your name, stats, online state, chat, voice and leaderboard entries, as described above.
• DigitalOcean, our hosting company: our server and its backups run on machines it rents to us.
• Google: Google Sign-In (if you use it), Firebase Cloud Messaging (notification delivery) and Google Play (installing and updating the app). Google’s own policy applies: policies.google.com/privacy.
• Twilio SendGrid, our email sender: it receives your email address and the login code to deliver one email.
• Authorities, only when the law requires it.

DigitalOcean and SendGrid process the data only to provide their service to us. Google also works under its own policy. Your data may be processed in a country other than yours.

5. How long we keep data

• Your account (email or guest ID, name, totals, the list of your phones): until you delete it. A guest account that was never used (no stats, no check-in) is deleted after 30 days.
• Match records and leaderboard lines: kept, because other players’ results depend on them. When you delete your account your name in them becomes “Deleted player”; the record keeps only the device code.
• Online player ID, friends, notification token: until you delete your account. An online player ID with no friends that is not used for 30 days is deleted. Friend requests: 7 days. Game invites: 2 minutes. Join requests: 1 hour. Rooms: about 10 minutes after the host leaves.
• Login codes: valid for 10 minutes and deleted automatically soon after. Login sessions: up to a year, or until you log out.
• Activation log: 180 days. Reports about a player: 180 days. Cheat flags: 90 days. Device-check result: 180 days after the last time the phone was seen. Networks seen for a product key (not in the Google Play version): 90 days.
• Bans: as long as the ban is in force.
• Server log: a short technical log (request type, page, result, duration, and the first 6 characters of a device code; no IP address, no name) kept in two small files that are replaced automatically, so it only holds the most recent activity.
• Backups: of the server database; they are overwritten within about 14 days.

6. Your choices and rights

• Delete your account: in the game tap ACCOUNT (also under SETTINGS > ACCOUNT), then DELETE ACCOUNT, then YES, DELETE. Without the app, use the delete account page. What is removed and what stays is listed there.
• Log out in the game to remove the notification token from the server for that phone. Uninstalling the game removes the local data on your phone but does not delete your account.
• Access, correction, objection: depending on where you live (for example under the GDPR or India’s DPDP Act) you may ask us for a copy of your data, to correct it, to limit its use, or to object. Please email tuvezogame@gmail.com. We answer within 30 days. You may also complain to your data protection authority.
• Microphone and notifications: switch them off any time in the game or in Android settings.

7. Children

Nitro Troopers is for players 13 years and older. It is not directed at children under 13 and we do not knowingly collect data from them. If you think a child under 13 has an account, tell us and we will delete it.

8. Security

• All traffic between the game and our web server (login, accounts, matches, friends, reports) uses HTTPS.
• Guest keys and login codes are stored only as hashes. Licences are signed by us. Requests are rate-limited. The database and backups are readable only by the server.
• Match traffic is not encrypted. The live game packets between players (including text chat and voice) go over UDP through the room host and our relay. They are signed so they cannot be changed unnoticed, but they are not encrypted. Do not share private information such as your address, phone number or passwords in chat or voice.
• No system is perfectly secure. If a data breach affects you we will tell you where the law requires it.

9. Changes

If we change this policy we will change the date at the top and, for important changes, tell you in the game or on the Google Play page.

10. Contact

Tuvezo · tuvezogame@gmail.com · Support page · Community rules · Terms of use