Hoverbandit privacy policy

Hoverbandit privacy policy Effective date: 27 October 2026 · Publisher: BlueOrbit · Contact: blue0orbit@gmail.com

Hoverbandit is a game for VR headsets, Android phones and web browsers. You can play it without an account, and we do not want to know who you are. This policy explains what the game keeps on your device, what it sends online when the online features are on, and how to switch them off or delete your data.

Short version

• No accounts and no selling of data. We never ask for your real name, email, phone number or location.
• Ads only in the Android phone app, and only when you choose to watch one (a video that gives you a "second chance" after a crash). Personalised ads are off unless you switch them on. VR headsets, the PC / web version and the Meta Quest app have no ads at all (see "Ads" below).
• Online features are on by default and can be switched off in Settings > Online. When they are off, the game sends nothing (no leaderboards, no crash reports, no statistics).
• If you use the leaderboards, other players see the name you picked from our word lists (like "Neon Comet 482"), your scores and your best runs as ghosts.
• Play statistics (Google Analytics) are only sent if you say yes. Crash reports (Android app) are on by default and can be switched off.
• Settings > Online > Delete my online data removes everything stored online about you, at once.

What the game stores on your device

To keep your progress, Hoverbandit saves the following in the app's own storage on your device:

• progress: scores, coins, unlocks, missions, route stars, daily-run results and statistics;
• settings: volume, comfort and control options, accessibility options, your online choices;
• run recordings: your inputs during recent runs (lane, boost, brake and similar), used for replays and to race your own ghost;
• activity estimate (optional): if you enter a body weight in Settings, the game uses it on the device to estimate calories for your runs. It is never sent anywhere and is not medical advice;
• online copies: your leaderboard name, scores waiting to be sent, and the leaderboards you looked at recently;
• streamer options (only if you use them): your streamer mode settings, the Twitch channel name you typed and, only if you use the optional Twitch sign-in, a Twitch token (see "Twitch" below); in VR, the run codes you saved to make a clip later;
• an error log (the last 30 errors) to help with support; it stays on the device.

You can delete all of it at any time by clearing the app's data or uninstalling the game (in a browser: clearing the site's data). If you have turned on your device's own backup (for example Android backup), your device provider may include the app's storage in that backup under its own privacy terms.

What is sent online, and why

Hoverbandit uses Google Firebase, a service of Google, for its online features. Google processes this data for us as our service provider. When the online features are on:

• Anonymous ID. Firebase Authentication gives your copy of the game a random ID (an "anonymous account"). It is not linked to your name, email, phone number or store account. It lets you update your own scores and nobody else's.
• Leaderboard name. A name you build from two preset words and a number the game picks (for example "Neon Comet 482"). There is no free text, so it cannot contain personal information.
• Scores. For each leaderboard you play (Daily Run, endless zones, Radio Hits songs, route challenges): your best score, when you set it, the game version, the kind of device (VR, phone or PC) and whether that run used its second chance (shown as a mark next to the score).
• Ghost recordings. For your best score on each leaderboard, a recording of your inputs in that run (lane position, boost, brake, duck and similar, many times a second), so other players can race your run as a ghost. In VR your steering comes from how you lean, so the recording reflects the lane you steered to; it does not contain raw head or hand tracking, voice or images.
• Shared run codes (optional). When you share a run's code (like "HL-HGKX-W9YX"), the code, your score, the game mode, your leaderboard name and that run's ghost recording are stored so friends who type the code can race your ghost on the same road.
• Ghost Raid (optional, for streamers and their viewers). A streamer can open a raid on one of their run codes for a few hours. If you ride a raided code, your score, leaderboard name, device kind (VR, phone or PC) and a compact recording of your ride (where you were on the road over time) are added to that raid, so the streamer can race up to 200 viewers' ghosts and show "Chat vs Streamer" results. Raid entries are visible to everyone who opens that raid.
• Game settings from us (Remote Config). The game asks Firebase now and then (at most twice a day) for settings such as a message of the day or whether leaderboards are open. This uses a Firebase installation ID (a random ID for this copy of the app) and basic app information (app version, language).
• Crash reports (Android app; on by default, Settings > Online > Send crash reports). If the game crashes or hits an error, Firebase Crashlytics sends a report: what went wrong (error message and stack trace), the game version and what it was doing (for example "in a run"), the device model, Android and WebView version, free memory and disk space, a Crashlytics installation ID, your anonymous ID and a short list of recent game events (such as "run started"). We use it only to find and fix bugs.
• Play statistics (optional; only if you say yes, Settings > Online > Share play statistics). Google Analytics for Firebase receives events such as "run started / ended" (mode, zone, run length, a score range, crashed or not), tutorial progress, garage purchases (which item), which setting was changed, which leaderboard was opened and how a second chance was used (an ad, a token, coins or none), with an app-instance ID, device and operating system type, app version, language and the country / region Google derives from your IP address. Advertising features, ad personalisation and Google signals are off. We use it to see which parts of the game are fun or too hard.
• Network data. Like any online service, Google receives your IP address and basic technical data when the game connects. We do not store your IP address in our data.

Everyone who plays Hoverbandit online can see the leaderboards: names, scores, when they were set, and the ghosts of the best runs. Nothing else about you is visible to other players. We do not sell your data or use it for advertising ourselves, and we share it with no one except Google as our service provider (and authorities where the law requires it). The ads in the Android phone app come from Unity, as described in "Ads" below.

Legal bases (EU / UK). Leaderboards, ghosts and game settings: to provide the online features you use (contract / legitimate interest); you can switch them off at any time. Crash reports: our legitimate interest in a game that works; you can switch them off. Play statistics: your consent, which you can withdraw in Settings at any time. Personalised ads (Android phone app): your consent, given and withdrawn in the "Ad privacy" switch. Ads that are not personalised: shown because you asked to watch one (to give you the second chance you chose).

Where the data is stored

Leaderboards, names and ghosts are stored in Google Cloud Firestore in the European Union (multi-region "eur3", Belgium and the Netherlands). Firebase Authentication, Remote Config, Crashlytics and Google Analytics may process data in the United States and other countries where Google operates; Google protects such transfers with the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. See Google's Firebase privacy information.

How long it is kept

• Leaderboard name, scores and ghosts: as long as the leaderboard exists, or until you delete them. We may remove old Daily Run leaderboards after 90 days.
• Anonymous ID: until you delete your online data (it is not deleted automatically).
• Crash reports: 90 days (Crashlytics).
• Play statistics: 2 months (Google Analytics data retention), then only aggregated totals remain.
• Remote Config / installation ID: until you clear the app's data; Google deletes unused installation data on its own schedule.

Your choices and deleting your data

• Switch off the online features: Settings > Online. The game then sends nothing at all; your progress on the device is not affected.
• Switch off crash reports or play statistics separately in the same place, at any time.
• Delete your online data: Settings > Online > Delete my online data. This deletes, right away, your scores and ghosts on every leaderboard, your shared run codes, the raids you opened and your entries in other raids, your leaderboard name and your anonymous ID, and clears the online copies on your device. Do this before uninstalling: uninstalling or clearing the app's data makes the game forget its anonymous ID, after which it cannot prove the scores are yours. If that happened, email us at blue0orbit@gmail.com with your leaderboard name (and roughly when and what you played) and we will remove the entries by hand.
• Crash reports and play statistics already sent are kept only for the periods above; email us to have them deleted sooner.

Ads (Android phone app only)

The Android app for phones and tablets can show a short video ad, but only when you tap "Watch an ad to continue" on the screen that offers a second chance after a crash. You never have to: a second chance can also be paid with a token you earn by playing, or with coins, on every platform. There are no banner ads and no ads that start on their own. The ads come from Unity Ads (Unity Technologies), which acts as an independent advertising company.

• When Unity's software starts. Only on an Android phone or tablet, and only after you have used your first (free) second chance: from then on, when a run that can be revived starts (Endless, Pursuit or Nights), the game asks Unity to have an ad ready. Never on VR headsets, never in the PC / web version or the Meta Quest app (those builds do not contain Unity's software).
• What Unity collects to show and measure the ad and to prevent fraud: your device's advertising ID (Android advertising ID) and other device identifiers, the IP address and the approximate location Unity derives from it, device and app information (model, operating system, language, app version, screen, network), what you do with the ad (seen, skipped, tapped) and diagnostics. Unity describes it in its Game Player and App User Privacy Policy.
• Personalised ads are off by default. The "Ad privacy" button on the second-chance screen has a "Personalised ads" switch. Off: we tell Unity you have not consented to personalised ads (and, for US state privacy laws, that you opt out of the sale or sharing of your data for advertising); you still see an ad when you ask for one, chosen without your activity in other apps. On: Unity may use your activity in other apps and sites to pick the ads. You can change it at any time, and you can reset or delete your advertising ID in Android's settings (Settings > Privacy > Ads).
• We receive no personal data from Unity: only totals (how many ads were shown and what they earned).
• Unity processes the data in the United States and other countries, with its own safeguards for international transfers, and keeps it under its own policy.

Head and hand tracking (VR)

In VR the game reads your headset and controller or hand positions through the headset's standard WebXR interface, in real time, to steer, duck, grab and show your gloves. Raw tracking data is not recorded, stored or sent anywhere.

Twitch (optional, streamer mode)

If you turn on streamer mode and connect Twitch for Chat Chaos (your viewers vote on events in your run), you type your Twitch channel name. That needs no sign-in and no token: the game reads the public chat of that channel anonymously, directly from Twitch's chat server, like any viewer who has not logged in (Twitch sees the connection, for example your IP address). It counts votes such as "!1"; messages are counted only on your device and are not stored, shown or sent anywhere. The channel name is kept on your device so you do not have to type it again. Disconnecting in Settings closes the connection.

If the optional Twitch sign-in is offered and you use it instead, you approve it on Twitch's own site; the game then keeps a token that can only read chat on your device (and in your device backup, if you use one), never sends it to us, and ends it at Twitch when you disconnect. Twitch processes your account and connection under its own privacy notice. Chat runs never go on the normal leaderboards; they go on a separate daily Chat leaderboard, with your leaderboard name like any other score.

Clips

The 9:16 highlight clip of a run (phone and PC) is made on your device. It leaves your device only if you share or save it yourself, through your device's share sheet or a download.

No camera, microphone or precise location

Hoverbandit does not access them.

Stores and the web version

When you download or buy Hoverbandit, the store you use (PICO Store, Meta Horizon Store, Google Play) processes your account and purchase details under its own privacy policy; we receive only anonymous sales and install totals from them. If you play the web version (also used by the Meta Quest app), our web host (GitHub Pages, a service of GitHub, Inc.) receives standard technical data needed to deliver the game files, such as your IP address and browser type, and may keep it in short-lived server logs for security; we do not use it to identify or track you. After the first start the game runs from your device's cache.

Children

Hoverbandit is not directed at children under 13. The online features ask for no personal information: names come from preset words, and play statistics are only sent with consent. Our Unity Ads project is marked as not directed at children.

Your rights

You can ask us for a copy of your data, to correct or delete it, or object to its use: blue0orbit@gmail.com. Because we only know your anonymous ID, please send your leaderboard name so we can find your entries. If you are in the EU/EEA or UK you may also contact your data protection authority.

Changes

If a future version changes what the game sends, we will update this policy before that version is released and change the effective date above.