Who we are
XO Arena is an Android board-strategy game developed and operated by RookDevStudio. This policy explains guest play, Google sign-in, online matches, optional rewarded ads and your privacy choices. It applies to the XO Arena app and these XO Arena information pages.
Contact us at rookdevstudio@gmail.com for privacy questions or requests. Effective date: 17 October 2026.
Guest play and device storage
You can play practice and same-device games without a Google account. Guest nickname, practice coins and gems, owned cosmetics, equipped styles, settings, rewards and saved offline matches are stored on your device.
This local progress is separate from your signed-in ranked wallet. Google sign-in does not automatically upload or merge the practice collection. Clearing app data, uninstalling the app or losing the device may remove local progress.
Google sign-in
If you choose Google sign-in, Google and our authentication provider, Supabase, process your account identifier, name, email address and profile information to authenticate you and maintain your account. The app requests basic identity scopes only: openid, email and profile.
XO Arena does not receive your Google password or request access to Gmail messages, Google Drive files, contacts or calendars. Your email is used for account identity; it is not part of the public game leaderboard.
Online matches and visible information
Supabase stores the account profile, player code, level, trophies, match statistics, ranked wallet, match moves, deadlines, outcomes, room membership, friend relationships, quick-chat messages and reward-verification records used by online features.
Other players can see the game profile information needed for matches, friend features and rankings, such as display name, player code, level, trophies and match statistics. Match participants can see quick-chat phrases and emoji sent in that match. Room codes you share allow another player to join the room.
How we use information
We use this information to provide sign-in, validate moves, find opponents, maintain sessions, settle matches and virtual rewards, recover interrupted games, deliver friend and room features, prevent duplicate rewards and investigate support or abuse reports.
Supabase and hosting providers may process service logs, IP addresses and technical request information needed to operate and secure the service. We do not use Google sign-in information to read other Google services.
Optional rewarded ads
XO Arena integrates Google AdMob rewarded video ads. Watching an ad is optional. Release builds use Google AdMob rewarded ads. Development builds can use Google test ads. Signed-in rewards are verified on the server; ad delivery depends on consent, app approval and available inventory.
The Google Mobile Ads SDK may process device and advertising identifiers, IP-derived location, app interactions, diagnostic information and ad-performance data under its settings and your available consent choices. Learn more in Google’s Privacy Policy and Google’s Mobile Ads data disclosure.
Use Settings → Ad privacy choices or the daily-ad reward panel to review choices where available. Google test-ad builds may not present publisher-managed consent choices. Completed test rewards stay in the local practice wallet; verified live account rewards are recorded with the account.
Optional Google Play purchases
Where available, optional gem packs use Google Play checkout. Google processes payment information under its own policies. XO Arena does not receive your card number or bank-account credentials. To verify and deliver a purchase, our Supabase backend processes your game-account identifier, product identifier, purchase token and Google order identifier. It retains a token hash, order identifier, credited gem amount, quantity, refund status and timestamps with the account. We use these records to deliver purchases, prevent duplicate credit, reconcile refunds and resolve purchase-support requests. Account cosmetic ownership and gem-to-coin exchanges are stored on the server so they can be recovered when you sign in again. Limited transaction records may be retained when needed to resolve refunds, disputes, fraud or legal obligations; deletion requests are handled through our existing account-deletion process.
Security and device permissions
Online traffic uses HTTPS. The game uses authenticated server access and database access rules to limit access to account and game records. No system can guarantee absolute security.
This version does not request camera, microphone, contacts or precise location permissions. Internet access is needed for sign-in, online play and ads. Vibration is used for optional haptic feedback.
Retention
Device-local data remains until you remove it or the app data. Online account and game records are retained while needed to provide your account, game history, rewards and service integrity.
When an account-deletion request is verified, we delete the account and associated personal data from active services. Limited records may need to be retained for security, fraud prevention, resolving disputes or legal obligations; we will explain any applicable retention when handling your request. Service backups may persist according to provider recovery cycles.
Request account and data deletion
Email rookdevstudio@gmail.com with the subject XO Arena account deletion request. Send from the Google email connected to your game account and include your player code if available. You can start the same request from Settings → Request account deletion in the app.
We may ask you to verify account ownership before deleting online records. Do not send passwords, sign-in codes or payment details. Signing out or uninstalling alone does not delete online data.
To remove guest progress, use Android’s app settings to clear XO Arena storage or uninstall it. You can revoke Google access through your Google Account connections; revoking access does not itself delete game records.
Your choices and younger players
You may use guest play, change your display name, mute chat and emoji, manage available ad privacy choices, sign out, or contact us about access, correction or deletion of your data. Contact support if you believe information about a child has been provided without appropriate permission.
If you cannot independently consent to online services in your location, involve a parent or guardian before using account or advertising features. This policy does not claim that the app is a verified child-directed service.
Updates and contact
We may update this policy as features or service providers change. The effective date above identifies this version. Material changes will be communicated through an appropriate app or website notice.
For privacy or deletion questions: rookdevstudio@gmail.com. Please identify XO Arena so your request reaches the correct project.