Privacy

You need an account to make a card. You never need one to play somebody else's. The free app shows one banner — a recommendation for another app on iPhone and iPad, an advert from Google on Android — and Pro removes it. Here is everything we hold and why, on both.

What the app collects

An account, if you make a card

Creating or generating a card requires signing in with Apple or Google. We receive a stable identifier from them and, if you allow it, an email address. We never receive your password. If you use Sign in with Apple and choose to hide your address, we get the relay address and never see the real one — that works fine and we would rather you did.

We store the identifier, the email address if we were given one, and nothing else from your account. No name, no photo, no contacts, no friends list, no access to anything else in your Apple or Google account.

Playing someone else's game needs no account at all. Open a shared link, type a name, play. That path is anonymous and we intend to keep it that way.

An anonymous device identifier

The first time the app runs it creates a random identifier and a token. We store the identifier and a hash of the token — never the token itself, so a copy of our database is not a list of working credentials. The row also holds the platform and the device's language, and is linked to your account once you sign in. It holds no email address and no password. It exists so activity can be attributed to a device rather than to an IP address a whole school shares, and it is what lets you play without an account.

The topics you type

When you ask for a card, the text you typed is sent to Anthropic, which generates the squares. This is the one place your input leaves our servers, and we are stating it plainly because it is the thing you would most want to know. Anthropic processes it to produce the card and does not use it to train models. We keep the resulting squares in a shared cache so the same topic does not have to be generated twice — that cache is keyed on the topic, not on you.

We also log each request for a card: the topic text (its first 200 characters), the language, whether you have Pro, how it was answered and how long that took. For a pasted link we log the channel handle, never the URL. The log carries no account and no device identifier, and is deleted after 180 days.

Anonymous usage statistics

The app sends us anonymous usage events: a random install identifier, a session identifier, which steps you reach (for example card shown, paywall shown, purchase result), the app version, the platform and your country. They hold no account, no device identifier and nothing you type, and they go to our own server, not to an analytics company. They are kept for 180 days. Turn them off in Settings and the app stops sending them and forgets the install identifier. (iPhone and iPad only; the Android app sends none.)

A display name, if you join a game

Whatever you type when you join someone's game, so other players can see who got a line. Type anything you like — it is not checked against anything and does not have to be your name. It is deleted when the game closes — twelve hours after its last move — along with everything you marked.

A push token, if you allow notifications

Used only to tell you that someone in your game got a bingo. One token per install, replaced rather than accumulated, with the language the message should be written in. On iPhone and iPad it comes from Apple; on Android from Firebase Cloud Messaging, Google's notification service, which the app only turns on the first time you join or host a game. Turn notifications off in your phone's settings and it stops being used.

The evening reminder is different: your phone schedules it itself, and nothing about it is sent to us.

Your purchase, if you buy Pro

Payment is handled entirely by Apple or Google; we never see a card number, a name or a billing address. The app forwards the purchase record Apple or Google signed, we check the signature, and we keep what Pro needs: which plan, until when, and the identifier they gave the purchase (for Google, only a one-way hash of it), linked to your account or device. We also keep the notifications Apple or Google send us about that purchase — a renewal, a cancellation, a refund request, a refund — tied to it by the same identifier and kept as long as the purchase record.

Your logo, if you add one (Pro, iPhone and iPad)

The image you choose for the centre square. It is re-encoded on our server, which removes anything embedded in the file such as location, and checked by a person before it appears to anyone else. Removing it in the app stops it being used; to have our copy deleted too, write to us (see support).

What you report

If you report a player's name or a square, we keep a copy of what you reported — the name as it was shown, or the square with its topic and language — and the anonymous identifier of the device that sent the report, so the same report is counted once. A person reviews it. Nothing about it is shown to the player you reported.

A banner for another app, on iPhone and iPad, unless you have Pro

On iPhone and iPad, the free app shows one banner at the bottom of the Create screen, recommending another independent app. It comes from Kickstart Exchange, a cross-promotion service for independent apps, which matches apps rather than people. To fetch it, the app tells Kickstart Exchange about the app: which app it is, the platform, the app and SDK versions and your App Store country. To show it is a genuine install, it also sends Apple's signed record of the app's download, which Kickstart Exchange checks and then discards without keeping, hashing or logging it. Like any web request, this passes through their network provider, which sees your IP address in transit; Kickstart Exchange does not store it.

No advertising identifier and no user or device identifier is sent. Kickstart Exchange keeps a record of which banners were shown and tapped, tied to no person or device, for about 30 days. Tapping the banner opens the App Store; Apple may tell that app's developer, in aggregate and without identifying you, that the visit came from the banner. With Pro the banner is never shown and nothing is requested. The full detail is in Kickstart Exchange's own privacy notice.

An advert from Google, on Android, unless you have Pro

On Android, the free app shows one banner at the bottom of the Create screen, served by Google AdMob. Google, not us, chooses and measures it. To do that, Google's ad library in the app collects what an ad network collects: the device's advertising ID, the IP address (from which it estimates an approximate location), information about the device and the app, how the banner was shown and tapped, and diagnostics. Google uses it to serve and measure ads and to prevent fraud, as its notice on partner apps describes. We send Google nothing of ours — no account, email address, name or anything you type.

Ads are personalised only if you agree. In the European Economic Area, the UK and Switzerland the app asks first, through Google's consent form, and saying no still lets you use the app, with ads that are not personalised. You can change your answer at any time from Settings → Ad privacy choices, and reset or delete the advertising ID in your phone's settings. With Pro the banner is never requested and nothing is sent.

What this website collects

The pages you are reading set no cookies and load nothing from anyone else — no fonts, scripts, pixels or embeds from a third-party server. Our web server keeps standard request logs.

Two things are collected only if you do them:

• A channel or video link you paste, so we can build a card for it. We keep the link and a count of how many people asked for it, which is how we decide what to build next. We do not record who pasted it.
• An email address, if you give us one to be told when a card is ready or when the app is out. Used for that and nothing else, never sold or shared, and removable by replying to any message.

To stop one person exhausting a shared daily limit, we count requests against a hash of your IP address. The address itself is not stored.

How long we keep it

• Player names and marked squares — deleted when the game closes, 12 hours after its last move. A game nobody else has played yet stays open for up to 30 days, so it can be set up ahead of time; it never stays open longer than that. This is the only thing anyone types about themselves, and it does not outlive the broadcast.
• A game's code, title and topic — kept for up to a year with no player data attached (the title is whatever the host typed), so a link somebody shared months ago still opens a page saying what it was about instead of an error. Then deleted.
• Device rows — kept while the app is installed. Delete the app and the token stops working.
• Account rows — kept until you delete the account, then removed.
• Usage statistics and the log of card requests — deleted after 180 days.
• Generated squares — kept and reused. They are about a topic, not about a person.
• Purchase records and the store notifications about them — kept as the record of what was paid for, including after an account is deleted. They hold no name, email address or payment details.
• Reports — kept until they have been reviewed and for as long as the decision needs a record.

What we never do

No third-party analytics or attribution SDK. On iPhone and iPad the only third-party code in the app is the Kickstart Exchange banner above, and no advertising identifier is used. On Android the third-party code is Google's: AdMob for the free app's banner, as described above, and Google's own libraries for signing in with Google, buying Pro through Google Play, and notifications through Firebase Cloud Messaging, each for that purpose only. We do not sell or share your data, and we do not track you across other apps or websites ourselves. No location from your phone's GPS, no contacts or microphone; a photo only if you pick one as your logo.

Children

Bingo Factory is not directed at children under 13 and we do not knowingly collect anything from them. It has no wagering, no currency, no prizes and no chance — it is a checklist of things to spot.

Your rights

You can delete your account from inside the app, which erases the identifier, the email address if we hold one, and every game you created. It takes effect immediately and needs no email exchange with us. The steps, and what to do if you no longer have the app, are on deleting your account.

If you only ever played somebody else's games, there is no account to delete — removing the app erases everything tied to your device.

For anything else — a copy of what we hold, or deletion of an email address or a pasted link — write to us and we will do it. See support.

Changes

If we start collecting something new, this page changes before the feature ships. Last updated 3 November 2026.