Privacy Policy
1. Who we are
Robot in Jail is made by Tilanka Dahanayake, publishing as Colombo Dreams, Sri Lanka. We are the controller of the data described here. Contact: [email protected]. We have not appointed a Data Protection Officer, because our processing is small; privacy questions go to the same address.
2. What stays on your device
Your robot name, your birthday month and year, your town and your settings are saved in your browser or app storage on your device. Your birthday is used only to check that you are 13 or over, and it never leaves your device. We cannot see any of this unless you turn on cloud save.
3. What we store if you turn on cloud save
| Data | Why |
|---|---|
| A random account ID, and a one-way protected hash of your secret code (we never store the code itself) | To recognise your town without an email or password |
| For each device you link: a one-way hash of that device's own key | So the device can open your town, and so you can sign it out at any time |
| Your robot name and your town save (and the one before it, as a safety copy) | To back up your town and move it between devices |
| A version number and the times your town was created and last saved | To stop two devices overwriting each other |
| Your Harmony score, stars, a JEY total and your Circle (if any) | For the ranking and Circles, if you choose to show your name |
| Whether you chose to show your robot name | So your town stays private unless you say otherwise |
| For players under 16: the time a parent or guardian agreed | To record their consent |
| A one-way purchase reference made from your account ID | To link a Remove Ads purchase to your town without sharing your ID |
4. Purchases
The only purchase is Remove Ads. Google Play (in the app) or Paddle (on the website, if offered) take the payment; we never see your card or bank details. We receive a purchase confirmation, which we keep only until Google confirms it and then store only as a one-way hash, with the product, its status (for example, refunded) and the time.
5. Security and abuse prevention
Our host, Cloudflare, handles your IP address to deliver the game and block attacks. To limit how many new towns can be made, we keep a one-way hash of your IP address for at most one day. When enabled, Cloudflare Turnstile runs a bot check when a new cloud account is made. We use encryption in transit (HTTPS) and Cloudflare encrypts the database at rest.
6. What other players can see
Nothing, unless you choose Show my robot name. Then your robot name, Harmony score, stars and Circle name appear in the Harmony ranking and Circles. You can make your town private again at any time. There is no chat.
7. Our legal grounds (Sri Lanka's Personal Data Protection Act, No. 9 of 2022)
- Running the cloud save you ask for: performing our agreement with you (Schedule I(b)).
- Showing your robot name: your consent (Schedule I(a)), which you can withdraw by making your town private.
- Players under 16, a "child" under section 56 of the Act: the consent of a parent or legal guardian (Schedule II(a)).
- Security and preventing abuse: our legitimate interest in keeping the game safe (Schedule I(f)).
- Purchase records: our agreement with you and legal duties such as tax law (Schedule I(b) and (c)).
8. Who helps us
- Cloudflare: hosting, database, email forwarding and bot checks. Its servers may be outside Sri Lanka; Cloudflare is bound by its data processing terms.
- Google: Play purchases, if you buy in the Android app.
- Paddle: purchases on the website, if offered.
We do not sell your data, we do not use it for advertising profiles, and we make no automated decisions about you with legal or similar effects. The game does not show ads yet; if ads are added, this policy will be updated first and you will be told in the game.
9. How long we keep it
- Cloud town: until you delete it, or automatically after 2 years with no save.
- Database backups: up to 7 days.
- A one-way marker that a town was deleted (so it cannot come back): 400 days.
- IP address hashes: at most 1 day.
- Device-link codes: 10 minutes, then deleted.
- Purchase records: only as long as needed to honour refunds and meet tax law.
10. Your rights
You can ask to see your data (Cloud save → Download my data), correct it (change your robot name), withdraw consent (make your town private), erase it (Cloud save → Turn off and delete, or the delete page) and object to processing. For anything else, email [email protected]. We reply within one month, as section 17 of the Act requires. A parent or guardian can act for a child. You can also complain to the Data Protection Authority of Sri Lanka. If you live elsewhere, your local privacy law (for example the UK GDPR) also protects you.
11. Children
Robot in Jail is for players aged 13 and over; the game will not open for anyone younger. Players aged 13 to 15 can play fully on their device, but cloud save and showing their robot name need a parent or guardian to agree. If we learn that a player under 13 has stored data with us, we delete it.
12. If something goes wrong
If a data breach puts players at risk, we will tell the Data Protection Authority and affected players as the Act and its rules require.
13. Changes
We will post any change here with a new date, and ask you to agree again in the game if it matters.