Privacy Policy — Cannons & Canyons
Made by Abara Brothers · Last updated: 30 September 2026
Abara Brothers is a small Australian business. This policy is written to meet Australian privacy law, the EU and UK GDPR where they apply to you, and the app stores' own privacy rules.
The short version
Cannons & Canyons is an online artillery game for up to four players. There are no ads, no analytics, no trackers, no chat, and nothing to buy. The game keeps a small cloud save so your progress can follow you between devices, and — only if you turn them on — push subscriptions so we can tell you when it's your turn. If you sign in you can choose your own callsign and add friends: the only things another player sees about you are your callsign, the tank paint you are using in a match with them, and — if they are a friend — whether you are online. Reporting or blocking another player does not need a signed-in account. You can download the data attached to your account, or delete all of it, from inside the game. We never sell your data and never share it for anyone else's purposes.
Who is responsible
Abara Brothers (ABN 92 261 932 217) is the data controller for Cannons & Canyons. We are an independent two-person game studio on the Gold Coast.
| Post | 11 Anne St, Southport QLD 4215, Australia |
|---|---|
| support@abarabrothers.com | |
| Web | abarabrothers.com/support |
Every request about your data — access, correction, deletion, objection, or a question about this policy — can go to any of those. We aim to respond within 30 days.
Your account
Playing creates a guest account: a random identifier with no name, email or password attached. It exists so your progress has somewhere to live. You can optionally link a Google account ("Keep my progress") so you can sign in from another device. When you do, Google gives us the basic profile information covered by its standard email and profile permissions — your email address, your Google account identifier, your name, and your profile picture — and our sign-in provider stores it against your account. We use the email address to identify you at sign-in; we do not display or otherwise use your Google name or picture in the game. Linking is never required to play.
What the game stores, and why
| Data | Why | Where |
|---|---|---|
| Account identifier (random) | Ties your save to you | Our database |
| Email address (only if you link Google) | Signing in from another device | Our database |
| Google account id, name and profile picture (only if you link Google) | Returned by Google with the sign-in and kept by our sign-in provider as part of that record | Our database |
| Callsign — rolled from the game's word lists, or one you choose | Shown on your profile, in matches, and to your friends | Our database |
| Friend code (6 characters, generated for you) | So someone can add you without searching for your name | Our database |
| Friends and friend requests (which accounts, and when) | Your friends list, and adding or accepting a friend | Our database |
| Blocks (which accounts you blocked, and when) | Keeping a blocked player away from you, both ways | Our database |
| Name reports (who reported whom, the callsign as it was seen, and when) | So we can act on an offensive callsign | Our database, and our game server's log |
| Match results of ONLINE matches (which accounts played, who won, the mode, the player count, whether a computer opponent was involved, and when it ended) | A record of what was actually played online, so that anything you earn by playing online can be verified | Our database, kept permanently — see How long we keep it |
| Progression (wins, achievements, unlocks) | Your career, synced across devices | Our database |
| Push subscription (only if you enable nudges) | Delivering notifications: your turn in a match, and squad invites from friends | Our database |
| Crash reports (no account identifier, no IP) | Finding and fixing faults | Our database, 30 days |
Legal bases. Running the game and its cloud save, including sign-in: performance of the contract you enter into by playing. Your friend code, your friends and your friend requests: the same contract — they are how the feature works at all. Blocks and name reports: our legitimate interest, and yours, in a game free of abusive names; a block exists to protect you, so we keep it for exactly as long as you want it. Notifications (your turn, and squad invites from friends): your consent, which you can withdraw at any time. Crash reports: our legitimate interest in keeping the game working and diagnosing faults — the data is not linked to your account and you can object at any time (see Your rights and controls).
Notifications
Off unless you turn them on, and one switch covers both kinds: a nudge when it is your turn in a match, and a notification when a friend invites you to their squad while you are away from the game. An invite notification shows your friend's callsign and how many are in their squad. If you enable nudges, your browser or device issues a push subscription — a delivery address plus encryption keys — which we store against your account so notifications work in every future match and on every device you enabled them on. Delivery goes through your platform's push service — Firebase Cloud Messaging (Google) in the Android app, and your browser's own push service on the web: Apple for Safari, Google for Chrome, Microsoft (Windows Push Notification Services) for Edge, and Mozilla for Firefox. You can revoke notifications in your browser or device notification settings at any time, which withdraws your consent for future ones. A subscription your push service reports as expired is deleted the next time a turn nudge finds it so (an invite never deletes one), and every subscription is deleted with your account.
Crash reports
If the game hits an error, a crash report is sent so we can fix it: the technical error text, where in the code it happened, the game version, and your browser's user-agent string. Crash reports are anonymous — they carry no account identifier, and we do not store your IP address with them. They are deleted automatically after 30 days.
During a match, and after it
Your callsign, tank paint, shots, aim and movement are relayed between the players in your room to run the match. Match state lives in server memory only and is discarded when the room ends or times out.
The result of an online match is kept. When the match ends we write one row holding the mode, the account identifier of every player who had one — the automatic guest account counts — who won, how many played, whether a computer opponent was involved, the golf card where the mode has one, and the time it ended. That row is the record we keep so that anything a player earns by playing online can be verified; it is written by our server, and no player can read another player's rows. Matches you play offline — against the computer, or solo Golf — never reach a server and leave no row at all. Your own win/loss counters are also part of your progression, written by your device.
Friends, blocking and reporting
If you sign in, you can set your own callsign instead of rolling one. We check it on our server against a list of banned terms before we store it, so a name that fails the check is never shown to anyone. Your callsign and your 6-character friend code are the only things another player can use to find you — never your email address, never the name or picture Google returned when you signed in, and never your account identifier. Friends can see whether you are online; nobody else can.
Report a callsign. Wherever another player is shown — your friends list, a search result, a seat in a lobby, a card in a match — there is a menu with Report name. Reporting records the reported account, your account, and the callsign exactly as you saw it, so we can act on it. Nothing is emailed anywhere: the report is written to our database for us to read, and the same three details are also printed to our game server's log, which our hosting provider keeps under its ordinary log retention. We read new reports as part of our routine checks and aim to act within 7 days. You can also write to support@abarabrothers.com.
Block a player. The same menu has Block. A blocked player cannot find you in a search, cannot add you by your friend code, cannot send you a friend request, cannot see whether you are online, and disappears from your friends panel — it works in both directions. It does not keep the two of you out of the same battle, and the game says so when you block rather than letting you assume otherwise. The Friends screen lists everyone you have blocked, with Unblock.
You do not need to sign in to report or block. Choosing a callsign and using friends need a signed-in account; reporting and blocking do not — the automatic account the game gives you when you start playing is enough — because the player who most needs to report a name is usually a stranger in a lobby.
On your device
Your device's local storage holds your callsign, preferences (paint, mute, difficulty, tees), your progression, a match-resume token, and your sign-in session. Your callsign and progression are also sent to us as described above, and your sign-in session is exchanged with our sign-in provider; your preferences and resume token stay on your device.
What we do NOT do
- No advertising, advertising identifiers, or ad SDKs
- No analytics or third-party trackers
- No selling of personal data, and no sharing of it for anyone else's purposes — the providers named below act only on our instructions
- No location data, contacts, photos, or device files
- No chat, no messages, and no message field of any kind — the only things other players see about you are your callsign, the tank paint you are using in a match with them, and, if they are a friend, whether you are online
- No payment details — the game is free, with nothing to buy
Where your data lives, and transfers
The game server runs on Render and the database and sign-in service run on Supabase, both hosted in Singapore. Notifications are delivered by Firebase Cloud Messaging (Google) in the Android app, and by your browser's push service (Apple, Google or Mozilla) on the web. These providers are our processors: they handle the data to run the service on our behalf and for no other purpose.
Singapore is not covered by a UK or European Commission adequacy decision, so if you play from the EEA or UK your data is transferred outside that area. Those transfers are made under the European Commission's Standard Contractual Clauses (with the UK Addendum where UK law applies), which are incorporated into our data-processing agreements with both Render and Supabase. You can ask us for details of these safeguards through the support page.
How we protect it
Everything travels over encrypted connections (HTTPS and secure WebSockets), and the database is hosted by Supabase with encryption at rest. Your account row can only be read or written by you: access is enforced by database-level row security tied to your signed-in identity, not by the app asking nicely. Push subscriptions and crash reports sit in tables no player can reach at all — only the game server, holding a key that never ships inside the app, can touch them. We hold no passwords (sign-in is handled by Google or by an anonymous token), no payment details, and no IP addresses against your account or your crash reports. We keep as little as the game needs, for as long as the section below describes.
No system is perfect. If a breach ever affects your data and is likely to put you at risk, we will tell you and the relevant regulator — in Australia the Office of the Australian Information Commissioner (OAIC), and your supervisory authority in the EEA or UK — as quickly as we reasonably can.
How long we keep it
Your account and everything attached to it exist until you delete them — deleting your account (below) removes the account, cloud save, sign-in identity, push subscriptions, friend code, friends, friend requests, blocks and name reports immediately, in one action. A friendship, a friend request or a block lasts until you remove it or delete your account, whichever comes first; a friend request nobody answers stops counting after 30 days and is deleted. A name report is kept while we may still need to act on it, and is erased when either account involved is deleted. Crash reports are deleted after 30 days. Match state disappears with the room. Ordinary infrastructure logs (such as connection logs, and the line a name report writes to our game server's log) are kept only for as long as our hosting provider's ordinary log retention lasts, and are not used to build profiles.
The one thing deleting your account does not erase is the match-result rows described above. They are kept permanently, and they still carry the random account identifier you played under. Everything that could join that identifier to you — your account, the email address and Google profile held against it, your callsign, your progression, your friends, your blocks and your reports — is deleted with the account, so nothing we hold connects a surviving row back to you. If you would like us to go further than that, ask us through the support page.
Your rights and controls
- Download my data — in the game's account panel: your account identifier, linked email (if any), callsign, friend code, how many friends and how many blocked players you have, cloud save and this device's progression, as one JSON file. If a count reads null rather than a number, this device had not loaded that list when you exported; it does not mean zero, and the file says so. Friends and a friend code need a signed-in account, so for a guest those stay null until they sign in. For anything held about you that is not in that file — such as your stored push subscriptions, who your friends are, your match results, or the profile details Google returned at sign-in — ask us through the support page and we will provide it.
- Delete my account — in the same panel: erases the account, cloud save, sign-in identity, push subscriptions, friend code, friends, friend requests, blocks, name reports and this device's local progress. It cannot be undone. The match-result rows described under How long we keep it are the one thing it leaves behind, holding the random account identifier and nothing that can be joined back to you. If you no longer have the app, you can request the same deletion at this page.
- Correct or restrict — ask us through the support page.
- Object — to the crash reporting we run on legitimate interests, at any time.
- Withdraw consent — turn off notifications in your browser or device settings; withdrawing does not affect notifications already sent.
- Sign out — any time; your account keeps its progress for your next sign-in.
- Change your callsign — roll a new one whenever you like, or, if you are signed in, set one of your own, which you can change again a day later.
- You have the right to complain to your local data-protection authority. In Australia that is the OAIC; in the EEA or UK it is your national supervisory authority.
You do not have to give us anything to play: a guest account is created automatically and needs nothing from you. Linking Google is optional — without it, your progress simply stays on the device you played on. There is no automated decision-making or profiling of any kind in the game.
Children
The game is suitable for ages 9 and up. It has no chat, no ads, no tracking, and no way to send a message to another player. The one thing a player can type is their own callsign, which we filter against a list of banned terms on our server before anyone else can see it, and which any player can report or block without signing in. A guest account holds no personal details at all.
Before anyone can sign in with Google, the game asks for a birth year. It tells you why it is asking — signing in shares your email address and profile with us — but it never says which answer will let you through, so it cannot coach the response, and the field starts empty. The year you enter is never stored and never sent to us: it is checked once, on your device, and discarded. The only thing kept is a note on your device that the check was passed. If the answer indicates the player is under 13, the game says that signing in needs a grown-up, explains that their progress still saves on that device, and does not continue to Google. Guest play is never blocked or interrupted by this — the question only appears if someone chooses to sign in.
If a Google account is linked, that account's email address, Google identifier, name and profile picture are stored as described above — so if your child plays, we suggest leaving the game on its guest account. You can delete everything at any time from the account panel or the deletion page.
Changes
If this policy changes, the new version appears here with an updated date. Material changes will be called out in the game.
Contact
Questions? Contact Abara Brothers via the support page.