Privacy Policy

NOCTULE · effective 20 August 2026

NOCTULE is a game made by Bendigo Games, an independent developer based in Australia. This policy covers the NOCTULE mobile app for iOS and Android (com.chan.games.noctule). Contact: support@bendigogames.com.

The short version

NOCTULE asks you for nothing. No email address, no account, no password, no advertising, no tracking of any kind. It does count anonymous usage — how the game is played, never who is playing it — and that is spelled out below.

There is one thing it publishes, and you should know about it before you play: when a run is good enough for the global top 100, it is published automatically — the distance, the time, and a short name your device carries. There is no prompt, and there is no setting that turns it off.

That is the whole of it, and the rest of this page explains it in detail — because “we collect nothing” is the sort of claim that deserves specifics, and because there is one exception it would be dishonest to gloss.

At a glance

The table scrolls sideways on a narrow screen.

What	Leaves your device?	Visible to others?	Why
The short name your device carries	Yes, when a run makes the top 100	Yes — publicly	To label your row on the board
Your distance and the time you set it	Yes, when a run makes the top 100	Yes — publicly	To rank the board
An anonymous identifier	Yes — whenever the global board is opened, and with a submission or a report	No	To sign your device in so the board can be read and written
Your settings, your own best runs, a cached copy of the board	No	No	So closing the app does not lose them
Anonymous usage events (app opened, a run started, a run ended and how far it got)	Yes	No	To see how the game is played and improve it
An approximate location (country, sometimes region), derived by Google from a masked IP address	Yes — as part of analytics	No	To know roughly where players are; never precise, never from location services
Contact details, precise location, contacts, photos, audio, advertising identifiers, crash reports	Never collected at all.

Information the app collects

None, in the sense that matters: NOCTULE never asks for your email address or any other personal detail. It does not read your contacts, your photos, your location, your calendar, or your files, and it does not record audio. It does not create an account for you in any sense you would recognise as one — you are never asked for a password and there is nothing to log into.

One honest footnote on the audio, because the evidence is public and looks like a contradiction: the iOS app declares a microphone purpose string. Apple requires one from any app whose binary references the microphone APIs, whether or not it ever calls them, and the sound engine NOCTULE uses ships with recording support built in. The game never uses it, the permission prompt can never appear, and nothing in the app is able to start a recording.

The name on your scores

The app invents a name for you the first time it runs — three to eight characters, letters and digits only, drawn from a fixed word list. It is not derived from you, your device, or anything you have ever typed. It is a label, and it is the name your scores go up under if you never change it.

You can change it at any time from the board screen. If you do, invent something. Do not use your real name, your email address, or anything else you would not put on a public wall, because that is what the board is. The app has no way of knowing whether you did.

Information the app sends anywhere

Only what reaches the global leaderboard, and it goes there by itself. When a run beats the hundredth-best distance on the board, it is published immediately, with no prompt and no confirmation step. Runs that do not beat it never leave your phone.

Three things are published:

the short name your device carries,
the distance you flew, as a whole number,
the time you finished the run.

They are stored in a Google Firestore database and are visible to everyone who opens the board inside the game. Assume anything in the name field is public and permanent.

There is no way to switch the leaderboard off from inside the app, and no offline mode you can toggle. If you would rather nothing of yours were on it, the honest options are not to install a build with the board configured, or to ask for a row to be removed once it is up — see Removing your data.

The anonymous identifier

The app holds an anonymous identifier issued by Firebase Authentication. It is a random string. It is not linked to your email address, your phone, your device, an advertising ID, or anything about you — the app never asks for any of those and could not link them if it wanted to.

It has three jobs: it signs your device in so that the board can be read at all, it lets the server tell one submitting app from another, and it lets you flag a name for review without that report being anonymous to the point of uselessness. It is created the first time the app talks to the server, which for most people is the first time they open the leaderboard. It is never written into the leaderboard, so no other player can see it.

Usage analytics

The app counts anonymous usage events through Google Analytics for Firebase: that the app was opened, that a run started, that a run ended and the distance it reached, and the standard session information that service records. These events describe the game being played, not the person playing it: advertising-identifier collection is switched off in the app’s configuration on both platforms, the events are not linked to your name, email, or any account (there is none to link to), and they are used for exactly one thing — understanding how the game is actually played so it can be improved.

What is not sent

Nothing else leaves your device. Not your settings, not the runs that did not make the board, not a crash report — there is no crash-reporting library in the app.

As with any request over the internet, your device’s IP address is visible to Google’s servers while it is talking to them. The app itself never reads or stores it, and it never reaches the leaderboard. Analytics does use it for one thing: Google masks the address and derives a general location from it — country, and sometimes region or city — so the usage counts can be broken down by place. That approximate figure is all the developer sees. NOCTULE never uses your device’s location services, never asks for location permission, and never collects a precise location; there is no GPS reading anywhere in this app.

If a score cannot be sent

A run that qualifies while you are offline is kept on your own board but is not published later. There is no queue that retries it on the next launch. The board display retries and will show the global list again once the connection is back; the score does not go with it.

If the leaderboard is not switched on in your build

Some builds of NOCTULE are compiled with no leaderboard server configured at all. In those builds the board is a private list on your own phone, no network connection of any kind is made, nothing is ever published, and the game works identically in aeroplane mode. You can tell which one you have: open the leaderboard, and the line under the title says LOCAL BOARD - THIS DEVICE ONLY.

Why we are allowed to do this

For anyone covered by the GDPR: the leaderboard is processed on the basis of legitimate interests — running a global high-score table is the feature, and it cannot work if a score has to be negotiated. The data involved is a self-chosen or machine-generated label, a number, and a timestamp, which is about as little as a public scoreboard can be built from. You can object at any time by asking for your row to be removed, and it will be.

Names other people can see, and what to do about one

A leaderboard shows names typed by strangers. NOCTULE filters them in three places — as you type, on the server before a name is stored, and again when the board is drawn — and no filter catches everything.

Hold your finger on any row of the global board to report it. That sends the row and your installation’s anonymous identifier, and nothing else; there is no free-text box, deliberately. A person reads the reports and removes names that should go. The score keeps its place — it is the name that is at issue, not the run.

Removing your data

Ask, and it goes. Email support@bendigogames.com with the name and the score, and the row will be deleted from the board. There is no automated deletion flow because there is no account to log into and nothing that could authenticate a request — which cuts both ways, honestly: it also means anyone could ask for a row’s removal, and the worst that a bad-faith request can achieve is the deletion of a score.

Deleting the app removes everything stored on your phone. It does not remove a row you already published, because that row is on a server rather than on your phone, and it does not delete the anonymous account that identifier belongs to, which stays with Google until it is removed by hand. Email the address above for either.

How long any of it is kept

A published row stays on the board until a hundred better runs push it off, or until somebody asks for it to be removed. There is no other expiry, and the board is not archived anywhere once a row falls off it. The anonymous identifier lasts as long as the installation does, and its account persists on Google’s servers until deletion is requested.

Information the app stores on your device

The game saves your progress so that closing the app does not lose your scores. Stored on your phone, and only on your phone:

your best runs, as a distance and a date,
the short name your scores go up under,
your settings — sound, music, wall thickness, and the three colour options,
how many runs you have played, which the game uses to decide when to show one hint,
a cached copy of the global board, so it can be drawn before the network answers — that is other players’ names and scores, exactly as the board shows them,
the anonymous identifier and the sign-in token that goes with it, so you are not signed in afresh on every launch.

This is kept in your device’s standard private app storage, inside the app’s own sandbox, where other apps cannot read it. None of it is transmitted anywhere except as this policy describes.

Security

Everything the app sends travels over HTTPS. There is no exception to App Transport Security on iOS and no cleartext traffic permitted on Android, so there is no path by which the app sends anything unencrypted.

Advertising, analytics, and tracking

Advertising: none. NOCTULE contains no advertising and no crash reporting. Tracking: none. It does not read your advertising identifier — identifier collection is explicitly disabled in the analytics configuration on both platforms — and it does not track you across apps or websites. Nothing here profiles you, and nothing here follows you to another app, which is also why the app never shows an App Tracking Transparency prompt: there is nothing to ask permission for.

Analytics: yes, anonymous and minimal. As described above, Google Analytics for Firebase counts usage events — app opened, run started, run ended with its distance — not linked to any identity, used only to understand and improve the game.

Beyond Flutter itself, the app’s dependencies are: one that plays sound, one that tells the operating system how the game’s sound should behave, one that saves your settings to your own device, and Google’s Firebase libraries — authentication and the leaderboard’s data store, plus the analytics counter described above.

If advertising is ever added to a future version, this policy will be updated before that version is released, and the app stores will show the change on the app’s listing.

Third parties

One: Google. The leaderboard is stored in Google Firestore, its anonymous identifiers are issued by Google Firebase Authentication, and the anonymous usage events are counted by Google Analytics for Firebase — so a published score, the identifier attached to your installation, and those usage events are processed by Google as the developer’s service provider, under Google’s own privacy policy at policies.google.com/privacy. Google is given nothing else, and nothing is shared with anyone else at all — no advertisers, no data brokers.

This means the data is held on servers outside your country, and may be held outside Australia. Google operates the regions those servers sit in; the developer chooses a region and nothing more.

In a build with no leaderboard server configured, not even that happens; see the section above on how to tell which one you have.

The app stores themselves — the Apple App Store and Google Play — may collect information about downloads under their own policies. That is between you and them; the developer of NOCTULE receives no personal information from either.

Children

NOCTULE has no advertising, no in-app purchases, no chat, no friend list, and no way for players to send each other anything. It asks nobody, of any age, for personal information.

It does have a leaderboard, and a leaderboard is a public place. A good run is published under a short name and every other player can see it. That is user-generated content, and it is why NOCTULE is not directed to children and is not enrolled in Google Play’s Families programme: it is rated for a general audience, and declares that users interact and that user content is shared.

NOCTULE is not intended for children under 13. Nothing is collected from a child that is not collected from anybody else, and that is a name the app invented, a distance, and a timestamp. If you believe a child under 13 has a name on the board, or you see a name on the board that looks like a real child’s, hold the row to report it or email the address below and it will be removed.

Your rights

Data-protection laws give you rights over personal data held about you. The only data NOCTULE holds that could be connected to you is a leaderboard row published from your device and the anonymous identifier attached to your installation.

To exercise any of them, email support@bendigogames.com. A person reads it. There is no form and no account, so requests are handled by hand.

Access, correction, erasure, objection, portability — ask, and say which row you mean. A row will be removed on request; so will the anonymous account behind an identifier, if you can tell us which one.
California residents: NOCTULE does not sell or share personal information, and has never done so. There is no advertising and no data broker in this app. You will not be treated differently for making a request.
Complaints: if you are not satisfied with how a request was handled, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the EU, the UK, or anywhere else with a data-protection authority, you may complain to yours instead.

Changes to this policy

If this policy changes, the updated version will be posted at this address with a new effective date, before the version of the app it describes is released.

Contact

Questions about this policy, or about privacy in the app, can be sent to support@bendigogames.com. It reaches a person.