Privacy Policy
Locked Together · last updated 2026-10-08
Locked Together is made by Hello World Technologies LLC ("we", "us"). This policy says what the game collects, why, where it is kept, for how long, and how to have it deleted.
The short version. We keep what the game needs to work: your progress, your friends, and the messages you send them, for a limited time. We do not sell your data, we do not show ads, and nobody on our team reads your messages unless one of the two people in a conversation reports it. You can delete your account and its data at any time, in the game or on the web.
What we collect, and why
- Your Google Play Games player ID, and the player name you choose in the game (or your Play Games name, if you have not chosen one). The ID is what your progress, friends and messages are kept under, so they follow you to a new phone. Your name is shown to your friends, to a partner in a match, on leaderboards, and in notifications we send your friends.
- A Firebase user ID for each install of the game. Firebase Authentication (Google) creates it when the game first starts; it is how our server knows a request comes from the game on your phone.
- Your gender, if you choose to give it: male, female, non-binary, or "prefer not to say". The game asks once after you sign in, as a Play Games player or as a guest — Google Play Games does not tell us your gender, so we only know what you choose — and you can change it on your Profile at any time. It is optional and changes nothing about how the game plays. It is kept with your progress (below), so it follows your account to a new phone, and is shown only to you, on your profile: it is not shown to other players, not sent to our own server, not used for ads, and not shared with anyone. One thing follows from it: in a run with a partner you invited, chat is read aloud and the heroes call out ("Revive me!"), in a woman's voice, a man's, or the phone's own. Unless you pick a voice on your Profile (Voice → Your chat voice), yours follows the gender you gave. What is sent through our server to your partner's phone, when the run starts and with each chat line, is that voice and not your gender; the server passes it on and does not keep it. Pick "phone's own" and your gender is not reflected at all. In a quick match, which is played with a bot, a partner of the other gender is picked to fight beside you; that happens on your phone and nothing is sent.
- Your progress: stages cleared, coins, heroes and companions unlocked, settings, and a history of your recent runs (which stage, which hero, how long, won or lost). Kept in Google Cloud Firestore (part of Firebase) so it survives a reinstall.
- Leaderboard entries: your name, your hero and your best score in each ranked mode, overall and for each week. Anybody playing the game can see them.
- Your friend code, your friends, the friend requests you send and receive, and the players you block. Kept on our own server. You can change your friend code once a day.
- Messages you send to friends. Kept on our own server so your friend can read them: for at most 30 days, and only the latest 200 messages of each conversation. Links are removed and common profanity is masked before a message is stored. When you remove or block a friend, your conversation with them is deleted. When you delete a message, it disappears for both of you, but its text is kept on our server, hidden, until it would have expired anyway, so that a report of it can still be checked.
- Chat during a run. In a run with a partner you invited, the lines you send them — a quick phrase, or up to 60 typed characters — go through our server, which filters typed words the same way and passes them on to both of you. They are not stored: the last 20 lines of a run are held in the server's memory only while the run lasts, so that a report of the run's chat can quote them. In a quick match, chat is with the game's bot and never leaves your phone.
- Reports. When you report a player, we keep who reported whom, the reason, and — for a message — that message and up to 10 messages before it, or for a run's chat, the run's last lines. Reports are kept for 180 days, then deleted.
- Whether you are online, in a run, and when you were last online. Shown to your friends only.
- Notification tokens. If you allow notifications, Firebase Cloud Messaging (Google) gives the game a token for your phone; we keep up to 3 per player so we can tell you when a friend writes, asks you to play, or answers a friend request. A message notification shows the friend's name and the message text, and is delivered through Google's servers. Signing out or deleting your account removes the token.
- Voice. Voice chat only happens between the two players in a match, and only while both have it on. It is streamed through our own voice server (LiveKit, running on our server) and is never recorded or stored. The game asks for microphone permission only for this.
- IP addresses and technical logs. Our server's logs record the IP address and account ID of requests, and errors, so we can keep the service running and stop abuse. They are rotated and kept for about two weeks.
Who else handles it
- Google — Firebase Authentication, Cloud Firestore and Cloud Messaging, and Google Play Games services — under Google's own terms and privacy policy.
- Our hosting provider, whose server runs the game's own server and voice server.
- Revopush, which delivers updates to the game's code; when the game checks for an update it sees your phone's IP address, the game's version, and a random ID made for this install of the game.
We do not sell your data, share it with advertisers, or use it to show you ads. We disclose it to anyone else only when the law requires us to — including reporting child sexual abuse and exploitation to the authorities, as our community rules say.
Deleting your data
- In the game: Profile → Delete account. It deletes your progress (your profile, name and gender with it), run history and leaderboard entries from Firestore, and your friends, requests, blocks, messages and notification tokens from our server. If our server cannot be reached, nothing is deleted and the game tells you to try again.
- Without the game: use the account deletion page, or write to hello@helloworldtech.com. We delete the account and its data within 30 days and tell you when it is done.
- A report somebody else made about you is kept for its 180 days, and a moderation ban stays on the account ID, so deleting an account cannot be used to escape one. A report you made is kept for its 180 days too, as part of the moderation record, and a deletion request made on the web is kept as the record that it was carried out.
Children
Locked Together is for players aged 13 and over. We do not knowingly collect data from children under 13. If you believe a child under 13 has an account, write to hello@helloworldtech.com and we will delete it.
Security
Everything between the game and our servers is encrypted in transit (HTTPS and secure WebSockets). Our server is reachable only through that encrypted front door, and the data on it is readable only by the service itself and the people who run it.
Your rights
You can ask us for a copy of the data we hold about you, to correct it, or to delete it, by writing to hello@helloworldtech.com. Depending on where you live you may also have the right to complain to a data protection authority.
Changes
When this policy changes we update the date at the top, and for a significant change we tell you in the game.
Contact
Hello World Technologies LLC. Questions about this policy or your data: hello@helloworldtech.com.