Privacy Policy
Last updated:
Hamza Hannad (“we”) operates the mobile game Balote and the website balote.ma. This policy explains what the game collects, why, who else sees it, and how you get it removed. The website itself is covered in its own section below — it collects nothing beyond a language preference you set.
We do not sell your personal data. We do not use analytics or crash-reporting SDKs — at the time of writing the app contains none.
Who is responsible
The data controller is Hamza Hannad, N 276 Rue 12, Lot Anbra S1, Zouagha, Fez 30000, Morocco. For any privacy question or request: support@pocketoak.com.
What we collect, and why
Account
If you sign in, we receive from your chosen provider a user ID, and depending on the provider your email address, display name, and profile picture. You can also play as a guest, which creates an anonymous ID with no email attached.
Sign-in options: Apple, Google, email + password, or anonymous guest. Purpose: to identify your account, sync progress across devices, and seat you at online tables. Legal basis: performance of our contract with you.
Game progress
Your level, experience, coins, win streak, matches played, win/loss record, and the cosmetic items and entitlements you own. Stored on your device and, when you are signed in, in our database so it survives a reinstall. Purpose: to run the game. Legal basis: contract.
Online matches
When you play online we store the seats at the table, the players’ user IDs and display names, the state of the current game, and a periodic “still here” signal. Match records are short-lived and expire automatically. Purpose: to run a multiplayer game. Legal basis: contract.
Voice chat
Balote uses Agora for real-time voice in online matches. Audio is transmitted live between players. The app itself calls no recording API, and we do not store any voice audio. Agora processes the audio stream in transit in order to deliver it to the other players.
If you block a player, we store that player’s ID against your account so the block persists between matches. If you report a player, we store your user ID, the reported player’s ID, the match ID, the reason you selected, and any note you type. Purpose: to make voice chat safe and to act on abuse. Legal basis: our legitimate interest in preventing harassment on our service.
Notifications
If you enable notifications, we store a push token for your device along with your language and your notification preferences. Purpose: to tell you it is your turn, that someone joined your table, or that an offer is available. Legal basis: your consent, withdrawable at any time in your device settings or in the game’s settings.
Advertising
Balote shows rewarded and interstitial ads through Google AdMob. Google, not us, collects advertising identifiers, device information, approximate location, and IP address for this purpose, and we do not receive that data.
If you are in the EEA, the UK, or Switzerland, you will see a consent form the first time ads can be shown. You can reopen it at any time from the game’s privacy options. Legal basis: your consent, where required.
You can remove ads permanently by purchasing the ad-removal product.
Purchases
In-app purchases are available on iOS only. They are sold and processed by Apple, who is the merchant of record. We never see your card details. We receive a purchase receipt, which we verify to grant you what you bought. The Android version of Balote does not offer in-app purchases. Purpose: to deliver purchases and handle refunds. Legal basis: contract.
Prayer-time reminders
If you turn on prayer-time reminders and let the app detect your city automatically, your device contacts ipwho.is, a third-party service, which reads your IP address and returns an approximate city and its coordinates. That result is stored on your device only and used to calculate prayer times locally. We do not receive or store it.
You can avoid this entirely by choosing your city manually, or by leaving the feature off. Legal basis: your consent.
This website
This page is part of balote.ma, which is separate from the game. The website uses no analytics, no advertising and no tracking of any kind, and its Content Security Policy blocks it from loading anything from a third party.
It sets one cookie, and only if you ask it to. When you pick a language from
the language switcher, your choice is stored in a cookie named
__session — it holds one value, fr, en or ar, for one year, and nothing
else. Visiting balote.ma afterwards then takes you straight to that language.
If you never use the switcher, no cookie is ever set.
Without it, the site reads the Accept-Language header your browser already
sends with every request and redirects you accordingly. That header is used for
the redirect and not stored.
Legal basis: a preference you set yourself. This is a functional cookie, not a tracking one, and you can delete it at any time from your browser’s site-data settings.
Who else sees your data
| Service | What it handles |
|---|---|
| Google Firebase | Sign-in, database, cloud functions, push notifications |
| Google AdMob | Advertising and ad consent |
| Agora | Real-time voice audio |
| ipwho.is | IP-to-city lookup, only if automatic city detection is on |
| Apple | Sign in with Apple and in-app purchases (iOS only) |
These providers process data on servers outside Morocco, including in the European Union and the United States. Where personal data of EEA/UK users is transferred, it is done under the transfer mechanisms those providers make available (such as the European Commission’s standard contractual clauses).
We do not sell personal data and we do not share it with data brokers.
How long we keep it
- Account and progress: for as long as your account exists. Delete your account and it goes — see Deleting your account.
- Online match records: become eligible for automatic deletion 30 minutes after the match ends, or 6 hours after creation. Firestore usually deletes expired records within 24 hours of expiry; deletion is not immediate. Private hands are removed by a cleanup function after the match record is deleted.
- Blocks: until you unblock the player or delete your account.
- Abuse reports: retained for 12 months. Reports are kept even if you delete your account, in anonymised form, because we need them to act on repeated abuse.
- Purchase records: as long as tax and accounting law requires.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. If you are in the EEA or the UK you also have the right to complain to your national data protection authority. In Morocco, the competent authority is the CNDP.
To exercise any of these, email support@pocketoak.com. We will respond within one month. The fastest route for deletion is the account deletion page.
Children
Balote is not directed at children. It contains real-money purchases, advertising, and open voice chat with strangers. You must be at least 13 years old — or 16 if you are in the European Economic Area — to create an account. If you believe a child has created an account, contact us and we will remove it.
Security
Access to your account data is restricted to you by server-side rules. Traffic is encrypted in transit. No system is perfectly secure, but we do not store payment details, and we do not store passwords ourselves — authentication is handled by Google Firebase.
Morocco
Processing of personal data in Morocco is governed by Law 09-08 and overseen by the CNDP. If you believe your data has been handled unlawfully, you may lodge a complaint with them.
Changes
If we change this policy we will update the date at the top of the page, and for significant changes we will tell you in the game.
Contact
Hamza Hannad, N 276 Rue 12, Lot Anbra S1, Zouagha, Fez 30000, Morocco — support@pocketoak.com
Hamza Hannad — support@pocketoak.com