This policy covers the Would You Rather mobile app and the online services behind it. It does not cover any other app. It also does not cover the website this page is published on. That site is separate from the game, and browsing it is not described here.
europe-west1 region, in Belgium). Some Google services that support the app, such as ads and crash reporting, also process data outside the EU.When you first open the app, we create an anonymous account for you automatically, before you do anything. This account is a random identifier (a "user id") issued by Firebase Authentication, a Google service. We need it so your gems, streaks, unlocked categories, submitted questions and votes can be saved and returned to you.
This anonymous account holds no name, no email address and no phone number. It is not linked to your identity unless you choose to sign in with Google.
You can link your anonymous account to a Google account so your progress survives reinstalling the app or moving to a new device. If you do:
If you never sign in, we never hold an email address for you.
Rooms and Duels ask you to type a display name. It is free text, whatever you type.
This name is public to other players. In a Room, everyone in that Room sees it.
Every Duel you start is open to strangers. When you create a challenge it goes into a shared pool, and the first player who picks it up sees the name you typed before they decide to accept. There is currently no friends-only Duel and no setting that keeps a challenge private.
If you answer someone else's challenge, the name you typed appears in the push notification sent to the player who set it. A challenger's own name is not pushed to anyone.
Please do not use your real name, your email address, or anything else you would not want a stranger to read. In Duels the name is optional and defaults to "Player". In Rooms a name is required to join.
Your display name is never attached to questions you submit.
Questions you submit. When you submit a "would you rather" question, we store the two options, your account id, a moderation status and vote tallies. Submissions are screened and rate-limited. Once approved, a question becomes readable by every player in the app. It is attributed to an internal account id only, never to your display name and never to your email address. The rules for what you may submit are in the Terms of Use.
Votes. We record which option you chose on each question, tied to your account id. Individual votes are not shown to other players. You can read your own vote records, and our moderators can read them when investigating abuse. What everyone sees is the anonymous total, the percentage split, which carries no account ids at all.
Duel and Room answers. In a Duel, the answers you give are shown to your opponent when the Duel is scored, and both players' answers are stored on the Duel record until it expires. In a Room, your answers for each round are visible to the other players in that Room. These are not private in the way your solo votes are.
Reports. Questions submitted by other players can be reported from the Community feed. If you report a question, we store what you reported, why (chosen from a fixed list, there is no free-text box), and your account id. Reports are readable only by our moderators. If you delete your account, the report survives but your account id is replaced with a placeholder, so the moderation record stays honest without pointing at you.
There is no way to report a player directly. Report one of their questions, block them, or write to support@blmapp.se. The questions that come with the app are not player-submitted and have no report button.
Blocking. If you block another player, we store that block under your account only. The blocked player cannot see it.
The app has an in-app currency ("gems") and optional one-time purchases, handled entirely by Google Play Billing. We never see, receive or store your card number, bank details or billing address. Google Play handles payment.
When you buy something, the app sends the Google Play purchase token, the product id and the platform to our server. Our server sends that token to Google's Play Developer API to check the purchase is genuine, then credits your gems or removes ads. We keep a purchase record containing a one-way hash of the purchase token, your account id, the product id, the platform, the gems granted and the date. If a purchase is moved to another account, the receipt also keeps a reference to the previous account id.
We keep purchase records for seven years, counted from the end of the financial year in which the purchase was made. That is not a free choice: Swedish bookkeeping law (bokföringslagen) requires accounting records to be kept for seven years, and a purchase receipt is an accounting record. The obligation outlives your account, so a purchase record is not deleted when you delete your account, and it keeps the account id the purchase was made under. It holds no name, no email address and no payment details. Section 13 states the same period.
Notifications are used for one thing: telling you when someone has answered a challenge you left. The notification names the player who answered. There is no notification for anything else, and no notification is sent when someone challenges you.
We only ask for notification permission when you set up your first Duel, not at launch. If you allow it, Firebase Cloud Messaging issues a registration token for your installation, and we store that token against your account so we know where to send the alert. If the token stops working, we delete it. If you sign out or delete your account, the token is removed.
If you turn notifications off in your device settings, or uninstall the app, we stop being able to reach you.
We use Firebase Crashlytics (Google) in release builds to find and fix crashes. When the app crashes or hits a handled error, Crashlytics sends Google a report about the failure: the error type, message and stack trace, together with the device and app information Crashlytics collects automatically, such as an installation identifier it generates, device model, operating system version, app version and timestamp. The precise list of fields is defined by Google, not by us; Google documents it on the Firebase Crashlytics documentation and the Firebase privacy and security page.
We do not attach your account id, your email address or your display name to crash reports, and we deliberately do not forward the app's own diagnostic context (which can contain question ids). In rare cases, an error message generated by the app could include text from a question being displayed at the moment of the failure.
Crash reporting is always on in the released app and cannot be switched off from inside it.
The app shows banner, interstitial and rewarded ads through Google AdMob. Rewarded ads are optional and only play if you choose to watch one.
Google AdMob receives, from your device: your Android advertising ID, your IP address (from which Google works out an approximate location, such as your city or region), device model, operating system version, screen size, language, and events about the ads themselves, such as which ad slot was requested, whether it filled, whether it was shown or dismissed, and whether it earned you a reward. The app declares the com.google.android.gms.permission.AD_ID permission for this purpose.
Google's advertising SDK also ships the ability to measure whether an ad led to an install or a purchase, and, where you have consented, to help select ads using interest categories your device reports. These capabilities are part of Google's advertising infrastructure and are controlled by Google. We do not operate any separate advertising or install-tracking service, and no other advertising, analytics or attribution company receives anything from this app.
That is measurement of the ads themselves, inside Google's advertising system. It is not app analytics, and this app performs no analytics collection at all. Google Analytics for Firebase is not in the app, and neither is the app-measurement component that would carry it: the released build includes only two shim libraries from that family and none of the code that does the collecting, and the app's released Android manifest declares no app-measurement service or receiver. Nothing here records an app-instance id, screen views, session counts or automatic events. The Firebase Analytics package was deliberately left out of this app rather than merely unused.
We tell Google's ad system to serve only ads rated suitable for a teen audience or below, to match the app's minimum age of 13. See section 17.
Where Google's consent framework requires it, and Google determines that from your location, the app shows Google's consent form (the Google User Messaging Platform) before any ad code starts. No ad request and no ad SDK start-up happens until you have answered. Your consent choice is stored on your device and sent to Google.
A consent message is published for this app, and it is being shown and answered. It covers the regions in Google's EU user consent policy: the European Economic Area, the United Kingdom and Switzerland. If you are in one of them, you are asked before any personalised ad is served.
The app does not decide who sees the form. It asks Google whether a form is required for your location and shows whatever Google returns, so the regions above are Google's determination rather than ours. The consent message published for this app is in English only, so if your device language is something else, the form you are shown is still in English.
Where Google says a privacy option is required for you, the app shows an "Ad privacy options" row in its Settings screen, under "About". Opening it re-opens Google's form, so you can change or withdraw your consent at any time. If you withdraw it, ads stop in that session immediately, including any ad already loaded in the background. Google decides where that option is required, not us; where it is not required for you, or where that answer does not reach the app, the row is not shown at all. The Android setting below works either way.
Where that row is not shown, you can limit ad personalisation using your Android device setting "Delete advertising ID" or "Opt out of Ads Personalisation", under Settings → Privacy → Ads on recent versions of Android or Settings → Google → Ads on older ones — the exact wording varies by phone manufacturer — and through Google's own ad settings.
You can also buy the ad-removal product in the shop. That permanently stops banner and interstitial ads on the account holding it. It does not stop the rewarded ads you choose to watch for gems, and Google's ad code still starts with the app, so it is not a way to stop the data sharing described above.
Two separate Google anti-abuse mechanisms are built into this app.
Play Integrity. When the app starts, it asks Google Play for an integrity check. Google receives the package name, the app's signing certificate digest and the app version, and returns a verdict about whether the device and the install look genuine. This produces a token that is attached to our server requests. The check covers the device and the installation. No gameplay data and none of the content you submit is included.
reCAPTCHA. Firebase Authentication and Firebase App Check ship a Google reCAPTCHA component, and we may use Google's reCAPTCHA anti-abuse checks on sign-in and on the app attestation described above. Where such a check runs, Google receives device and interaction signals for that purpose, and Google is the recipient of them. The check looks at the device and at the request. It does not look at your gameplay, at the questions you submit, or at how you vote.
The app has an optional rewards area where you can earn a separate currency called coins by completing surveys and offers from partner companies, and exchange coins for real-world rewards such as gift cards. Nothing in this section happens unless you open that area and use it. Coins are not gems: the two are separate, and gems are unchanged by anything here.
Surveys and offers are provided by partner companies, named in the app on the Earn screen at the point where you open each one. When you open a partner's wall you are using that company's service: it is a separate company with its own privacy policy, shown before you start, and it reports completions back to us so we can credit your coins. We send a partner a pseudonymous player id so it can attribute your completions — never your name, email or payout details.
We process rewards data to credit what you earn, deliver what you withdraw, and keep the system honest. Reward systems attract organised abuse, so earnings are held for a period before they become withdrawable, withdrawal requests pass automated checks (for example limits on how many accounts may share one payout identity, and daily earning caps), and a request these checks flag is frozen for review by a person — it is never silently deleted. If we refuse a request, the app shows you the named reason, and you can write to us about any decision at the contact address in section 21.
Rewards data is stored on our servers in the European Union, alongside the rest of the app's data as described in section 12. Ledger and payout records are bookkeeping records of real value: we keep them for as long as your account exists, and records of completed payouts for as long as bookkeeping law requires even if you delete your account — after deletion they are kept only in the form that accounting requires, no longer tied to a playable account.
We do not share your data with advertising networks, analytics companies, attribution companies or data brokers, other than as described below.
Outside the optional rewards area (section 10), the only company that receives data from this app is Google, through the services in the table below. Google's handling of that data is covered by the Google Privacy Policy and by How Google uses information from sites or apps that use our services. The Google services we use as our infrastructure are also covered by the Firebase privacy and security page and the Firebase data processing and security terms.
Google runs the infrastructure this app is built on, and for those services it processes data on our instructions rather than for its own purposes. The one place data is used by another party for its own purposes is advertising, through Google AdMob. Purchase data is a third case: the purchase token goes back to the platform that issued it, Google Play, so that Google can confirm the purchase we are being asked to credit.
| Service | What it receives | Their policy |
|---|---|---|
| Firebase Authentication | Your account id; the email, Google account id, name and photo URL if you sign in with Google; sign-in IP, device and timestamps | Firebase privacy, Google Privacy Policy |
| Google Sign-In | The app's package name and signing-certificate digest for OAuth matching, and, if you sign in, the email, account id, name and photo URL of the account you pick | Google Privacy Policy |
| Cloud Firestore | Your profile, gems, streaks, unlocks, submitted questions, votes, reports, blocks, Room and Duel state, your display name, your push token, plus the IP and timing of each request | Firebase privacy, Firebase data processing terms |
| Cloud Functions | Your requests to our server logic, together with your account id, integrity token, source IP, and payloads such as purchase tokens and submitted questions | Firebase privacy, Firebase data processing terms |
| Firebase Cloud Messaging | Your push registration token, app version, package name, device model, OS version, and delivery and open events | Firebase privacy |
| Firebase Crashlytics | Crash and error reports as described in section 7 | Crashlytics documentation, Firebase privacy |
| Firebase App Check and Google Play Integrity | The device and install integrity signals described in section 9 | Google Privacy Policy |
| Google reCAPTCHA | Device and interaction signals, where a Google anti-abuse check runs for Firebase Authentication or App Check | Google Privacy Policy, Google Terms of Service |
| Google AdMob | The advertising data described in section 8 | How Google uses advertising data, Google Privacy Policy |
| Google User Messaging Platform | Your IP address, to work out which consent rules apply, and your consent choices | Google Privacy Policy |
| Google Play Billing and the Play Developer API | Product ids, and your purchase tokens for verification | Google Play Terms of Service, Google Privacy Policy |
We may also disclose information if we are legally required to, or where it is necessary to investigate abuse of the service or protect our rights.
Server logs. Our servers keep technical logs of requests, which include your account id, IP address, timestamps and error details. These are held in Google Cloud Logging and are kept for 30 days. That is the retention on the default log bucket, confirmed on the live project on 21 August 2026. A separate bucket holds Google’s own audit records of administrative changes to the project for 400 days; it records what the operator does to the project configuration, not what players do in the game.
Your game data is stored in the European Union. The Cloud Firestore database that holds your profile, gems, streaks, unlocks, submitted questions, votes, reports, blocks, Rooms and Duels is located in Google's europe-west1 region, in Belgium. The server logic that reads and writes it, our Cloud Functions, runs in the same region.
Not everything stays there. The following are Google services whose processing is not confined to that region and can involve infrastructure outside the EEA and the UK:
Where that happens, the transfer is covered by Google’s Cloud Data Processing Addendum, which incorporates the European Commission’s standard contractual clauses and applies to our use of Google Cloud and Firebase.
| Data | How long |
|---|---|
| Your account, profile, gems, streaks, unlocks | Until you delete your account. If you never delete it, we keep it indefinitely. There is no automatic expiry for inactive accounts |
| Your personal vote history (the copy stored under your account) | Deleted with your account |
| The vote record stored against each question | Kept after account deletion, identified by your internal account id |
| Questions you submitted and had approved | Kept after account deletion, with your account id replaced by a placeholder, because other players have voted on them |
| Questions still pending, rejected or hidden | Deleted with your account |
| Reports you filed | Kept, with your account id replaced by a placeholder |
| Your push notification token | Until it stops working, you sign out, or you delete your account |
| Rooms, and the answers and names inside them | The Room record itself, which is where the display names are held, is deleted automatically 6 hours after the Room was created. Each answer runs on its own separate 6-hour clock, counted from the moment you sent that answer rather than from when the Room started, so answers can outlive the Room they belong to. An answer given five hours into a Room is kept until about eleven hours after the Room was created, roughly five hours after the Room record itself is gone. In the worst case an answer survives about 12 hours from the Room's creation. This applies after account deletion too: a Room you took part in keeps your account id, chosen name and answers until each of those clocks runs out. Both clocks are enforced by the database itself, under automatic expiry policies that are active on the live project. |
| Duels, and the answers and names inside them | The Duel record itself, which is where both display names and the final result are held, is deleted automatically 7 days after the Duel was created, counted from when the Duel was created rather than when it finished. Each player's answers run on their own separate 7-day clock, counted from the moment that player answered, so answers can outlive the Duel they belong to. The challenger answers as they create the Duel, so their clock matches the Duel's; but an opponent who picks up a challenge on day 6 has their answers kept until about day 13, roughly six days after the Duel record itself is gone. In the worst case an answer survives about 14 days from the Duel's creation. This applies after account deletion too. Both clocks are enforced by the database itself, under automatic expiry policies that are active on the live project. |
| Anti-abuse, reward-claim and short-lived join-code records, which include your account id | Deleted automatically within 30 days: rate-limit records at twice the relevant limit window, reward-claim and join-code records within 7 days, event records within 30 days. Each of these expiries is enforced by the database itself, under automatic expiry policies that are active on the live project. |
| Purchase records | Seven years, counted from the end of the financial year in which the purchase was made, because Swedish bookkeeping law requires it. Kept after account deletion, with the account id the purchase was made under. See section 5 |
| Server request logs | 30 days, the Google Cloud Logging retention that applies to this project. See section 11 |
| Crash reports | Retained by Google on Google's own schedule for Crashlytics, described on the Firebase privacy and security page |
| Data stored on your device | Until you delete your account, sign out, or uninstall the app |
The app stores game state, your settings and your consent answer in its own private storage. A copy of your game data is cached on the device, up to 20 MB, so the app works offline. The app also remembers up to 2000 recently seen questions locally, and never uploads that list. Signing out or deleting your account clears the keys tied to your account, while device settings such as sound and haptics remain. Ads and the consent form are displayed inside a system web view, and Google's ad code may store cookies or similar identifiers there under Google's own policies. Android cloud backup and device-to-device transfer are both switched off for this app, so none of this is copied into your Google backup.
Open Settings → Delete account. This removes your profile, gems, blocks, push tokens and your personal vote history from our servers, deletes any of your questions that are not publicly approved, anonymises the ones that are, anonymises any reports you filed, and then destroys your login. Your local data is cleared and the app starts you again with a fresh anonymous account. The vote record held against each question you voted on is kept and is keyed to your account id, as described in section 12.
Rooms and Duels you took part in are not deleted immediately. They keep your account id, the name you chose and your answers until they expire automatically. The Room or Duel record, which is where the name you chose is held, expires 6 hours or 7 days after that Room or Duel was created. Your answers expire on a clock of their own, counted from when you gave them, so they can outlive the Room or Duel they belong to. An answer sent late in a Room can last until about 12 hours after the Room was created, and answering someone's challenge on day 6 keeps your answers until about day 13, six days after the Duel record has gone. Anti-abuse and reward-claim records keep your account id for similar short periods.
If you cannot use the in-app route — because you have already uninstalled the app, or it will not open — you can ask us to delete your account at dreamlabapps.com/delete-account. You do not need to install anything and you do not need to sign in.
Accounts are anonymous, so a request made from outside the app has to give us enough to identify the account: the device, and any Google account linked to it. Without that we may not be able to find it. A request made on that page is handled in the same way as the in-app deletion described above, and the same records survive it.
Uninstalling the app does not delete your account or any of the data described here. Because your account is anonymous, we cannot find it for you once the app is gone, and reinstalling creates a brand-new account rather than restoring the old one. Delete your account from Settings before uninstalling, or use the deletion request page above.
You can also ask us at support@blmapp.se to confirm what we hold about you, correct it, receive a copy of it, or restrict how we use it.
BL Apps Management AB (Swedish company registration number 559275-3932) is the data controller for the data described in this policy.
If you are in the EEA or the UK, you have the right to ask us for access to your data, correction of it, deletion of it, a copy of it in a portable form, and restriction of or objection to how we use it. Write to support@blmapp.se. The legal bases we rely on are:
You can withdraw consent at any time without affecting what happened before. Withdrawing ad consent is described in section 8; notifications can be turned off in your device settings.
You also have the right to complain to a data protection supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY). You may also complain to the authority where you live.
We do not sell your personal information, and we do not share it with data brokers, list vendors or any company that would use it for its own marketing. Nobody pays us for your data and we have never offered it to anyone.
One transfer does happen, and we would rather name it than let a promise hide it: this app sends an advertising identifier and ad-request data to Google so it can choose which ad to show you, and that can include ads chosen from what you have seen in other apps. You can turn that off, and the rest of this section is how.
The advertising data described in section 8 — that identifier, your IP address, and the device and ad-request details listed there — is the only thing another party receives from this app for its own purposes, apart from the rewards-partner data described in section 10 if you use the rewards area, and the purchase token that goes back to Google Play so it can confirm a purchase, as described in section 11. Everything else Google holds for us — your account, your game data, crash reports, anti-abuse checks — it processes on our instructions, as section 11 describes, and the app performs no analytics collection at all. This section does not attach a statutory label to that advertising transfer. What it gives you instead is exactly what is transferred, to whom, and how to stop it.
The control that works everywhere, and that does not depend on us, is Android's own: Settings → Privacy → Ads on recent versions of Android, or Settings → Google → Ads on older ones — the exact wording varies by phone manufacturer — where you can delete your advertising ID. Once you do, this app and every other app on the device receive a zeroed id in its place. You can also change what Google's ads use at Google's ad settings, or buy the ad-removal product in the shop, which stops banner and interstitial ads. It does not stop the rewarded ads you choose to watch for gems, and Google's ad code still starts with the app. And in the app itself, Settings carries an "Ad privacy options" row under "About" that reopens Google’s own choices screen, where you can withdraw permission for ads chosen from your activity. Turn it off there and Google stops using your identifier to target you across apps — you still see ads, but they are chosen from the screen you are on rather than from you.
If you want to make a request about your California privacy rights — to know what we hold about you, to have it deleted, or to opt out of the advertising use described above — write to support@blmapp.se and we will answer you. We will not charge you for asking, and we will not treat you any differently in the game because you did. You can also delete your account and your data yourself at any time, from inside the app, as described in section 14.
This app is for players aged 13 and over. It is not directed to children under 13, and we do not knowingly collect personal information from them. The content-rating boards agree with that minimum: the app is rated Teen by the ESRB, 12 by PEGI, 12 by USK and 12+ by IARC.
Because the app is for teenagers and adults, we do not use Google's child-directed advertising settings, and the app does use an advertising identifier, as described in section 8. We do tell Google's ad system to serve only ads rated suitable for a teen audience or below.
The app contains content submitted by other players. Submissions are screened and rate-limited before they become public, every player-submitted question can be reported from inside the app, and its author can be blocked. See section 4 for what reporting does and does not cover.
We do not ask for your date of birth, so we cannot verify anyone's age. If you believe a child under 13 has an account or has given us information, contact support@blmapp.se. If we can identify the account, we will suspend it, delete the account and the data held under it, and anonymise anything it submitted, in the same way as the account deletion described in section 14. Because accounts are anonymous, tell us as much as you can about the device and about any Google account linked to it — without that we may not be able to find it.
Traffic between the app and Google's services is encrypted in transit, and the app disables plain HTTP entirely. Access to our server data is restricted by security rules that limit each account to its own records, backed by the anti-abuse checks described in section 9. Purchase tokens are stored as one-way hashes. No system is perfectly secure, and we cannot guarantee absolute security.
Links and sharing. Links to Google Play, our website and support open in your browser and are governed by those sites' own policies. When you share a question card, the image is created on your device and handed to whichever app you choose; from that point that app's own policy applies. We do not upload shared images.
If we change this policy we will update the version and effective date at the top of this page, and list the change below.
| Version | Date | What changed |
|---|---|---|
| 1.1 | 3 November 2026 | Adds section 10, Coins, rewards and withdrawals, covering the optional rewards area: the earnings ledger, payout delivery details, the IP address and device-integrity verdict on withdrawal requests, the survey and offer partners and the pseudonymous id they receive, the anti-fraud holds and human review, and how long payout records are kept. Later sections are renumbered accordingly, and the statements that Google is the only recipient of data now carve out the rewards partners. |
| 1.0 | 21 August 2026 | First version of this policy. It is numbered 1.0 because it is written from scratch for the current version of the app rather than as a revision of anything earlier. It sets out the anonymous account created at first launch, optional Google sign-in, player-submitted questions and moderation, display names shown to other players, purchases, push notifications, crash reporting, ads and the advertising identifier, anti-abuse checks, the list of Google services that receive data, where data is stored, how long each kind of data is kept, and how to delete your account. It states which data this app collects and shares, that Google is the only company that receives data from it, and that the app performs no analytics collection. |
BL Apps Management AB
Swedish company registration number 559275-3932
Published on Google Play by BL Apps Management AB
Bagartorpsringen 78, Solna, Sweden
support@blmapp.se
Governing law. This policy is governed by the law of Sweden, and the Swedish courts have jurisdiction. If you are a consumer resident in the EU, this choice does not take away the protection of the mandatory law of the country you live in.