Bank Shot (the Android and iOS app and the website bankshot.monryte.com) is provided by MONRYTE S.R.L., a Romanian limited liability company with its registered office at Str. Baia nr. 10, Sector 1, 013496 București, Romania, Trade Register no. J2026032634002, fiscal code (CUI) 54716131, VAT no. RO54953006 ("Monryte", "we", "us"). We are the controller of the personal data described in this policy.
For anything about your data, write to bankshot@monryte.com. We have not appointed a Data Protection Officer because the law does not require one for our activities; this address reaches the people responsible for privacy at Monryte.
This policy explains what personal data we process when you use the Bank Shot app and this website, why we do it, and the rights you have under the EU General Data Protection Regulation ("GDPR") and other privacy laws.
Bank Shot is built local-first: it works without an account, and your progress is stored only on your device. Leaderboards, the Weekly Boss and cloud sync of your best scores are the only features that send data to us, and they use an anonymous identity — never your name or email.
1. What stays on your phone (not collected by us)
What: your campaign progress, stars, coins and gems, codex, achievements, owned skins, settings, and the display name you pick. Stored only in the app's local storage on your device (Capacitor Preferences).
Why: so the game works offline and remembers your progress.
Legal basis: not applicable — we do not process this data.
How long: until you reset progress in Settings or uninstall the app.
2. Anonymous cloud identity (leaderboards, Weekly Boss)
What: a random anonymous user ID issued by Firebase Authentication, created only when you open Rankings, play Endless, or hit the Weekly Boss. No email, password or real name is collected or required.
Why: to let you post a score to a shared leaderboard and to track your contribution to the community Weekly Boss fight.
Legal basis: performance of our contract with you, i.e. providing the leaderboard feature you opened (Art. 6(1)(b) GDPR).
How long: the identity persists on your device until you clear app data or reset progress; the linked leaderboard entries are described below.
3. Leaderboard entries
What: your display name, best score, and the time it was posted, stored against your anonymous ID in our Firestore database. Entries are publicly readable by anyone using the app (that's what a leaderboard is).
Why: so Rankings, Endless and Daily leaderboards can show where you stand.
Legal basis: performance of our contract (Art. 6(1)(b)).
How long: your entry is overwritten whenever you beat your own score. It is deleted if you reset progress and submit again, or on request to us.
4. Weekly Boss damage
What: a running damage total tied to your anonymous ID, added to a shared, publicly readable weekly pool.
Why: to run the community boss fight.
Legal basis: performance of our contract (Art. 6(1)(b)).
How long: kept for the active week, then superseded by the next week's pool.
5. Purchases and entitlements
What: a purchase user ID, the product bought (gems, starter pack, season pass), transaction identifiers and receipts, and entitlement status. Payments are handled by Google Play or the App Store — we never see your card or bank details.
Why: to unlock purchased items, restore them on your other devices, and meet accounting duties.
Legal basis: performance of our contract (Art. 6(1)(b)); legal obligation for tax and accounting records (Art. 6(1)(c)).
How long: for as long as the purchase gives you the entitlement, and afterwards as required by tax and accounting law.
6. Anonymous usage events (you can switch this off)
What: events such as "level complete", "shot fired" or "purchase viewed", with small technical details (level id, score, plan viewed), app version, platform, language and time. Never your name, email or leaderboard identity is attached.
Why: to understand which levels and features work and to fix what doesn't.
Legal basis: our legitimate interest in improving the game (Art. 6(1)(f)).
How long: up to 24 months, after which events are deleted or aggregated.
7. Crash reports (same switch as above)
What: if the app crashes: the error, where it happened, app version, device model and OS.
Why: to find and fix bugs and keep the app stable.
Legal basis: our legitimate interest in a working, secure app (Art. 6(1)(f)).
How long: up to 90 days.
8. Age and consent choices
What: the age band you fall into (adult / under 13) based on the birth date you enter once, and your choices for personalised offers, analytics and friends & sharing. The exact birth date is not sent to us or stored beyond your device.
Why: to apply the right protections automatically — players under 13 never see personalisation, chat/sharing or tracking, regardless of toggle state.
Legal basis: legal obligation (children's privacy laws) and your consent for the optional toggles (Art. 6(1)(a) and (c)).
How long: stored locally until you reset progress.
Contract (Art. 6(1)(b)): leaderboards, Weekly Boss, purchases.
Legitimate interests (Art. 6(1)(f)): anonymous usage events, crash reports.
Consent (Art. 6(1)(a)): the analytics toggle on the age gate, notification permission.
Legal obligation (Art. 6(1)(c)): accounting and tax records, children's privacy compliance.
We do not use your data for advertising, we do not build advertising profiles, and we do not make decisions about you based solely on automated processing.
We never sell your personal data and never share it with advertisers or data brokers. We use the following service providers, acting only on our instructions:
| Provider | Role | Data | Location |
|---|---|---|---|
| Google LLC (Firebase) | Anonymous authentication, leaderboard & boss database (Firestore) | Anonymous ID, leaderboard entries, boss damage | EU/US, Google Cloud |
| RevenueCat, Inc. | Purchase validation and entitlement status | Purchase user ID, product, receipt | USA |
| Functional Software, Inc. (Sentry) | Crash reporting | Crash reports (see 3.7) | EU/US |
| PostHog, Inc. | Anonymous product analytics | Usage events (see 3.6) | EU/US |
| Google Play, Apple App Store | Independent controllers — payments, refunds, subscriptions | Your store account and payment | Under their own privacy policies |
We may also disclose data if required by law or a binding order of an authority, to protect our rights in a legal claim, or to a successor if Monryte's business is transferred.
Some providers above are based in the United States or may access data from there. When personal data is transferred outside the European Economic Area, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework (for certified recipients) and/or Standard Contractual Clauses, together with additional safeguards such as encryption in transit. You can ask us for a copy of the relevant safeguards at bankshot@monryte.com.
| Data | Kept |
|---|---|
| Data on your phone (progress, settings) | Until you reset progress or uninstall |
| Leaderboard entries | Until beaten by a new score, reset, or deletion request |
| Weekly Boss damage | For the active week |
| Purchase records | While they give you the entitlement, then as required by tax law |
| Anonymous usage events | Up to 24 months |
| Crash reports | Up to 90 days |
Under the GDPR you have the right to access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21), to withdraw consent at any time (Art. 7(3)), and not to be subject to solely automated decisions with legal effects (Art. 22) — we make none.
In the app, instantly: reset local progress (Settings → Reset Progress), stop usage events and crash reports (Settings → Privacy).
By email: write to bankshot@monryte.com and tell us what you would like, including your anonymous player ID if you know it (Profile screen). We answer without undue delay and within one month.
If you think we have not respected your rights, please tell us first — we will try to fix it. You also have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro. You may also go to court.
Bank Shot can be played by children. Players who enter a birth date making them under 13 are automatically placed in a protected mode: no personalised offers, no analytics, no friends & sharing features, regardless of any toggle. We do not knowingly collect personal data from children under 13 beyond what is described above. If you believe a child has given us personal data beyond this, contact us and we will delete it.
We protect data with encryption in transit (TLS) and at rest, Firestore security rules that let each anonymous account write only its own leaderboard and boss-damage entries, and minimal access for our staff. No system is perfectly secure; if a personal data breach is likely to put you at risk, we will tell you and the authority as the GDPR requires.
This website does not use advertising or analytics cookies, tracking pixels or third-party trackers. Our web host keeps standard server logs (IP address, time, page requested) for security and to keep the site running — our legitimate interest (Art. 6(1)(f)).
In the last 12 months we collected identifiers (anonymous ID, purchase user ID), commercial information (purchases), and internet/network activity (usage events, crash diagnostics), only for the purposes explained above. We do not sell personal information and do not share it for cross-context behavioral advertising. You have the right to know, access, correct and delete your personal information. To make a request, email bankshot@monryte.com.
| Data type | Collected | Shared | Purpose | Optional |
|---|---|---|---|---|
| Device or other IDs (anonymous ID, purchase user ID) | Yes | No | App functionality | Yes — only if you open leaderboards |
| Purchase history | Yes, if you buy gems/pass | No | App functionality | Yes |
| App interactions | Yes | No | Analytics | Yes — can be switched off |
| Crash logs and diagnostics | Yes | No | App stability | Yes — can be switched off |
| Name, email, photos, location, contacts | No | — | — | — |
We will update this policy when Bank Shot or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app before it takes effect.
MONRYTE S.R.L., Str. Baia nr. 10, Sector 1, 013496 București, Romania. Trade Register no. J2026032634002, fiscal code (CUI) 54716131, VAT no. RO54953006.
Email: bankshot@monryte.com
This policy is available in English and Romanian; both versions are equally valid.
Bank Shot