Privacy Policy
Last updated 2026-08-04
About this policy
This policy is written by Blitzmate, the operator of the Blitzmate app and the blitzmate.co website. It covers the Blitzmate app on iOS and Android and the blitzmate.co website. It explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have.
Coins have no cash value and cannot be withdrawn or exchanged for money. Play responsibly.
By creating an account or continuing to use Blitzmate, you accept this policy and our terms of use.
Information you give us
When you create an account with an email address, we collect that email address and your password. Your password is stored hashed by our authentication provider and is never readable by us.
If you sign in with Apple or Google instead, we receive your email address (or a private relay address, if you choose to hide it) and basic profile information from that provider. We do not receive your provider password.
We also collect the username and country you choose at signup, and an optional profile photo. You can upload a photo from your device, or import the photo from the account you signed in with.
If you use in-game chat or send a friend a direct message, we store the text of those messages on our servers.
If you report a player or a message, we store your report, including a copy of the reported message or profile as it looked when you reported it, so our moderation team can review it.
If you invite someone to a game by email, we use the address you enter only to send that invitation.
Information created by playing
Playing Blitzmate creates game records: the moves you make, the results of your games, and your rating.
We also store your coin balance and your full coin ledger, and your matchmaking activity.
For anti-cheat, anti-fraud, and multi-account detection, the app generates a random identifier for your installation, stores it in your device’s secure storage, and sends it to our game server together with your network (IP) address when you connect. This identifier is created by us; it is not your device’s hardware or advertising identifier.
Purchases
In-app coin purchases are processed by Apple or Google. RevenueCat, our purchase-validation provider, receives your Blitzmate account identifier and your purchase history, validates the purchase receipt on our behalf, and tells our server to credit your coins.
We never see or store your card details.
Coins you purchase do not expire.
Free coins and third-party offers
Offers and surveys are provided by third-party partners.
Our offerwall partner is BitLabs, a service operated by Prodege GmbH. When you open Free Coins, the app requests available surveys and offers directly from BitLabs, and BitLabs receives your Blitzmate account identifier (so a completed offer can be credited to the right account), your device type and platform, and — because the request comes from your device — your IP address and connection data. We do not send BitLabs your name, your email address, or your device’s advertising identifier.
When a partner confirms you completed a survey or offer, BitLabs reports the completion back to our server so we can credit your coins. That report includes your account identifier, a transaction identifier, the reward amount, and related metadata such as the offer or survey involved, your country, and your IP address.
If you answer surveys, your answers go to BitLabs and its survey partners under their own privacy policies, not ours.
Opening an offer loads that advertiser's own web page inside the app. Those pages may set cookies, including third-party cookies, and collect data under their own privacy policies, not ours. We do not receive your name, email, or payment details from them.
If you ask us to, we will forward a request to delete or access the data BitLabs holds about your Blitzmate account identifier — contact us at the address below.
Profile photo moderation
If you upload a profile photo, it is screened by an automated image-safety service, Google Cloud Vision, before it becomes visible to other players. Google acts only as our processor for this screening: it does not use your photo to train its services and does not keep it after processing. We may also review photos manually.
Approved photos are stored with our hosting provider and are visible to other players in the app. Photos that fail screening are not shown to anyone, and you can try a different photo.
If you import your photo from your Apple or Google sign-in account, we copy that photo from the provider you signed in with.
Chat, messages, and moderation
Game chat and direct messages pass through our servers, which apply automated content filtering and rate limits before a message is delivered. Messages that are blocked by the filter are not delivered.
You can report players and messages and block other players from inside the app. Reports are reviewed by our moderation team, and we may remove content or restrict accounts that break our rules. Blocking someone stops all contact between you and them.
Tracking and advertising choices
On iOS, we ask for App Tracking Transparency permission when you open Free Coins, before any partner content is requested. Declining this permission does not block your access to Free Coins.
On Android, the equivalent choice is made through your system Advertising ID settings rather than an in-app prompt.
The Blitzmate app does not read or share your device’s advertising identifier on either platform; on Android, the app is built without the advertising-ID permission entirely. Advertisers whose pages you open from Free Coins may still use cookies and similar technologies within their own pages, as described above.
How your data travels
Traffic between the app and our servers is encrypted.
On Android, a named, limited set of 30 survey-partner domains (including their subdomains) is permitted to load over plain HTTP, because those partners do not serve their pages over HTTPS. No Blitzmate account data is sent to those domains by us; this exception exists only so that partner survey pages load correctly.
Our service providers process data in the European Union and the United States. Where personal data is transferred internationally, we rely on our providers’ safeguards, such as the EU Standard Contractual Clauses and equivalent mechanisms.
Service providers we share data with
We share data with a small set of service providers, each for a specific role: Supabase (database, authentication, file storage, and hosting), Fly.io (our realtime game service), RevenueCat, Apple, and Google (purchases), BitLabs / Prodege GmbH (the offerwall), Google Cloud Vision (photo screening), and Resend (transactional email, such as game invites).
Each provider processes data on our instructions and for the role described. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
Why we process your data (legal bases)
Where laws such as the EU and UK GDPR apply, we process your data on these bases: to perform our contract with you (running your account, games, coin balance, purchases, and messages); our legitimate interests (keeping the game fair and secure, preventing fraud and multi-accounting, moderating content, and defending legal claims); your consent (App Tracking Transparency on iOS, and any other choice we ask you to make expressly); and compliance with legal obligations (such as financial record-keeping).
Where we rely on consent, you can withdraw it at any time — in your device settings for tracking permissions, or by contacting us — without affecting processing that happened before you withdrew it.
Keeping and deleting your data
We keep your data while your account exists. You can delete your account at any time from Profile → Delete account, or start from https://blitzmate.co/delete-account. Deletion cannot be started during a live match; finish or resign the match first.
Deletion signs you out immediately and permanently removes your ability to sign back in. It also erases your username, profile photo, and country.
Your coin ledger entries, completed game records, offerwall conversion records, and moderation reports are retained, because we need them for financial audit, anti-fraud, and safety purposes. Once your account is deleted, those records are no longer linked to a usable account.
On request, we will also forward a deletion request for your account identifier to our offerwall partner, as described above.
Your rights
You can access and correct your account information from the app, and you can delete your account as described above.
Depending on where you live, you may also have the right to ask us for a copy of your personal data, to correct or delete it, to receive it in a portable format, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, contact us at the email address below; we will respond within the time required by law.
If you are in the EU, EEA, or UK, you also have the right to complain to your data protection authority. If you are a California resident, you have the rights to know, correct, and delete personal information, and the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined in California law.
Children
Blitzmate is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it. Where the law in your country sets a higher minimum age for consenting to online services, you need your parent or guardian to agree on your behalf.
Coins
Coins exist only inside Blitzmate and cannot be transferred off the platform, sold, or redeemed for money or anything of monetary value.
Changes to this policy
When we change this policy, we update the "Last updated" date shown at the top of this page, and we announce material changes in-app.
Contact us
If you have questions about this policy or your data, contact us at support@blitzmate.co. This address is also the fastest way to reach us about content moderation and reports.