Privacy policy
Last updated: 25 October 2026
The short version. You can play Batmash without giving us your name, email or phone number. If you sign in with Google, we keep only Google's ID for your account, never your email. Players under 18 get no game stats collected, no personalised ads and no tracking. We never sell your data. You can delete your account and everything it made from inside the game, at any time.
Who we are
Batmash is made and published by INCUBICS, the games brand of IQLEXA Technologies Private Limited, a company registered in India ("we", "us"). We decide how the data in this policy is used, so we are its data fiduciary under India's Digital Personal Data Protection Act, 2023 and its data controller under the GDPR.
This policy covers the Batmash game for Android and iPhone (the "game"), the Batmash online service the game talks to (the "service"), and this website, batmash.com (the "site").
Questions, requests and complaints: support@batmash.com. Our Grievance Officer can be reached at the same address with "Grievance" in the subject line.
How your age changes things
The first time you open the game, it asks for your year of birth. That answer stays on your phone and is never sent to us. It decides what the game does:
| Under 13 | 13 to 17 | 18 and over | |
|---|---|---|---|
| Google sign-in and online play | Not offered. The game asks a parent to sign in. | Yes | Yes |
| Game stats (analytics) | Never collected | Never collected | Only if you say yes |
| Ads | Non-personalised, suitable for all ages | Non-personalised, suitable for all ages | Personalised only if you allow it |
| Crash reports | No player ID | No player ID | With your player ID |
| Notifications | Never | Only friend challenges, booked matches and the daily, never between 10 pm and 7 am India time | If you turn them on |
If you don't answer, the game treats you as under 18.
What we collect and why
Kept only on your phone
Your year of birth, your privacy choices, your settings, your players and teams, career stats, coins, items, missions and best scores are stored on your phone so the game works offline. We can't see them unless you sign in and back up your career (below). Clearing the game's storage or uninstalling it deletes them.
Your player account
When you first use something online, such as the daily challenge, a friend challenge, a live race, a booked match or a league, the service creates a player account for you. It holds:
- a random player ID that we make up, which isn't linked to your phone's identifiers;
- your display name, which we pick at random until you choose one (3 to 16 letters, digits, spaces or underscores, checked against a list of rude words in English and Hindi);
- sign-in tokens, stored only as one-way hashes;
- when the account was made.
Google sign-in
If you sign in with Google, Google tells us your Google account ID and email address (the openid and email permissions). We store only the account ID, so the same account can find your career on a new phone. We never store your email address, name or photo. See Google's privacy policy.
Signed-in players get their career (players, teams, stats and awards) backed up to the service after each change, so it can be restored on a new phone.
Online play
For each online match we store its random seed, your swings ball by ball, and the score the service works out from them, so every result can be checked fairly. Depending on what you play, we also store:
- Daily challenge: your score on that day's leaderboard.
- Friend challenges: the challenge code and who has tried it. Challenge links stop working after 7 days.
- Live races: the lobby code, who joined and each player's balls as they are played.
- Booked matches: the start time you chose, who is in or out, and whether it was called off.
- Weekly leagues: the league name you chose, its members and the weekly table.
Notifications
If you turn notifications on, we store your phone's push token, whether it's Android or iPhone, the app version, which topics you want (friend challenges, the daily, booked matches, news) and whether you get the adult or the teen set. We keep tokens for your 5 most recent phones. On Android, notifications are delivered by Firebase Cloud Messaging from Google; on iPhone, by Apple's Push Notification service. You can turn them off in the game or in your phone's settings.
Purchases
Coin packs, the Supporter pack and the Coin Pass are sold through Google Play or the App Store. Google or Apple takes your payment; we never see your card, UPI or bank details. The game receives a receipt saying which item you bought, so it can give it to you and restore it on a new phone.
Ads
Batmash shows rewarded ads only: you choose to watch one for coins or to double the coins from a match. There are no banner ads and no ads that interrupt play. Ads are served by Google AdMob, which receives your phone's advertising ID (on Android) or, only if you allow tracking, its IDFA (on iPhone), your IP address and basic device information, to show the ad, count it and prevent fraud.
- Ads are personalised only for players 18 and over who have said yes to game stats and, on iPhone, allowed tracking when Apple's prompt asks. Everyone else gets non-personalised ads.
- For players under 18, or whose age we don't know, every ad request is marked as child-directed and under the age of consent, and limited to content suitable for all ages.
- Buying the Coin Pass gives you the ad rewards without watching ads.
See how Google uses information in ads. You can reset or delete your advertising ID in your phone's settings.
Game stats (adults who say yes)
If you are 18 or over and say yes to game stats, the game sends events to Google Analytics for Firebase, such as a match starting or ending, a challenge being sent or opened, a race being joined, an item being bought, and an ad reward being given. Firebase also records an app instance ID, your phone model, operating system, app version, language and approximate country. We use this to see which parts of the game people enjoy and where they get stuck. You can change your answer any time in Settings > Privacy and data.
Crash reports
When the game crashes, Firebase Crashlytics sends us the error, your phone model, operating system and app version, so we can fix it. For players 18 and over the report includes your player ID; for everyone else it includes no ID.
Server logs
Our servers see your IP address with each request. We use it only to limit abuse (for example, how many accounts can be made from one address in an hour) and to keep the service secure, and we don't use it to work out where you are.
Emails to us
If you email us, we keep the email and our reply so we can help you.
This website
batmash.com uses no cookies, no analytics and no trackers. Our web server logs each request (IP address, page, browser) for security.
What we don't collect
The game doesn't ask for your contacts, location, camera, microphone, photos or files, and it has no chat. The only permission it asks for is notifications, and only after you've played a friend challenge or the daily.
What other players see
Your display name and scores appear on the daily leaderboard, on the top 10 of a challenge you've played, in race lobbies, on matches you're booked into and in league tables. Invite links for challenges, booked matches and leagues show the sender's display name and score to anyone who has the link, including people who don't have the game yet. Nobody sees your Google account, email or real name.
Who we share it with
We don't sell your personal data or share it for anyone else's advertising. We use these service providers, who process data for us under contract:
| Provider | What for |
|---|---|
| Google (Google Sign-In, Firebase Analytics, Crashlytics and Cloud Messaging, AdMob, Google Play) | Sign-in, game stats, crash reports, Android notifications, rewarded ads, purchases |
| Apple (App Store, Apple Push Notification service) | Purchases and iPhone notifications |
| Our cloud server provider | Hosts the service, its database and backups |
| Our email provider | Support emails |
We may also disclose data if the law requires it, to protect players or the service from fraud or abuse, or to a buyer if INCUBICS or Batmash is sold, who would have to keep to this policy.
Some of these providers store data outside India, including in the United States. Where that happens, we rely on the transfer rules that apply to us and on the providers' contractual safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Player account, career backup, matches, booked matches and league places | Until you delete your account. We may delete accounts that haven't been used for 2 years. |
| Friend challenges | The link works for 7 days; the record goes when your account does. |
| Push tokens | Until you turn notifications off, the token stops working, or you delete your account. |
| Sign-in sessions | Up to 90 days without use. |
| Database backups | 14 days, then overwritten. |
| Server logs | Up to 14 days. |
| Support emails | Up to 2 years after the conversation ends. |
| Game stats and crash reports | Under Google's retention settings: game stats for 14 months, crash reports for 90 days. |
Deleting your account
In the game, go to Settings > Privacy and data > Delete my account and data. This deletes your account and everything it made from our database straight away, and clears the game's data on your phone. Copies in our backups are gone within 14 days. You can also ask us by email. See Delete your account.
Your rights
You can ask us to:
- tell you what personal data we hold about you and who we've shared it with;
- correct it, or change your display name (you can do that in the game);
- delete it;
- stop using it for game stats or personalised ads (you can do that in the game too).
Under India's DPDP Act you can also nominate someone to exercise these rights if you die or can't do so yourself, and complain to our Grievance Officer. If we don't resolve your complaint, you can go to the Data Protection Board of India. If you live in the European Economic Area or the UK, you also have the rights to data portability and to object, and you can complain to your local data protection authority.
Email support@batmash.com. Because we don't store your email, we may ask you for your display name and a challenge, match or league code so we can find your account. We reply within 7 days and complete requests within 30 days.
Children
Batmash is a cricket game that people of all ages play, so we've built it to be safe for children. Under-13s can't sign in or play online, and get no notifications. Players under 18 get no game stats collected, no tracking and no personalised ads, and crash reports carry no ID for them. Display names and league names are filtered, and there is no chat.
If you're under 18, please ask a parent or guardian before you sign in. If you're a parent and think your child has given us personal data, email us and we'll delete it. See our child safety standards.
Security
Everything between the game and the service is encrypted with HTTPS. Sign-in tokens are stored as hashes. The database is reachable only from our own server, and access to it is limited to the people who run Batmash. No system is perfectly secure, so if a breach affects your data we'll tell you and the authorities as the law requires.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell you in the game before it takes effect.
Contact
IQLEXA Technologies Private Limited (INCUBICS), India
Email: support@batmash.com