Privacy policy
Effective 12 July 2026. This is the canonical policy, rendered at tenpin.app/privacy. The short version, which will not change: your scores are yours; nothing is public unless you make it so; no ads; no sale of data; no third-party trackers.
What we collect
Everything below exists to make the app work — there is no collection beyond it.
Account. Your email address and a display name. If you sign in with Google, we receive your name, email address, and profile picture from your Google account. If you sign in through our hosted sign-in page, our identity service handles your credentials; we never see your password.
Your bowling. Games, frames, and rolls you score; series, seasons, and league nights you take part in; win/loss/draw results you record; badges you earn; callouts and challenges you join; the balls you add to your arsenal; and, if you set one, your home centre.
Social graph. Who you follow, who follows you, and props you give or receive.
Photos. If you add a photo to your player card, we store the image you chose. The photo cut-out effect runs entirely on your phone — the processing happens on-device before anything is uploaded.
Push notification tokens. If you allow notifications, we store the device token needed to deliver them. You control which categories you receive in the app’s notification preferences. Delivery goes through your device platform’s push service (Firebase Cloud Messaging on Android).
Product usage events. First-party only: the app reports events such as “first game synced” to our own servers so we can tell which features earn their keep. Events carry your player ID and feature-level facts (never message content, never precise location — we don’t collect location at all). No third-party analytics SDK is embedded in the app, and there are no advertising identifiers.
Operational telemetry. Our servers record request traces and error diagnostics (which may include your player ID) to keep the service healthy.
What we don’t collect
No precise or approximate location. No contacts. No advertising ID. No browsing history. No microphone or camera access beyond the photo you explicitly pick. The marketing site (tenpin.app) sets no cookies at all.
Offline data on your phone
The app is offline-first: your scores live in a local database on your device and sync to our servers when you’re online. Uninstalling the app deletes the local copy; synced data remains in your account.
How your information is used
To run the product: scoring, sync, stats, feeds, leagues, notifications. To improve it: aggregate usage of features. To keep it up: debugging and operations. That’s the list. We do not sell your data, we do not share it with data brokers, and we show no ads.
What other people can see
- Scores marked verified were scored live, frame by frame.
- People you allow to follow you see your games in their feed; night-room and callout members see the scores you put into those spaces.
- Public sharing is opt-in per item. A share link, a public live-watch page, or a TV-mode board is visible to anyone with the link or code — that’s the point of them. Don’t share what you want private.
Who processes data on our behalf
We run our own servers and databases. Limited service providers act as processors under our instructions: cloud infrastructure that hosts the service and stored images, an observability service that receives operational telemetry, and device platform push services for notification delivery. None of them may use your data for their own purposes.
Retention, export, and deletion
Your data is kept while your account is active. Export my data in Settings hands you your full archive (JSON and CSV) via a link that works for 24 hours. Delete account in Settings schedules a full erase after a 14-day grace window — signing back in during those 14 days cancels it. After the window, everything you own is permanently erased: profile, sign-in (including at our identity provider), games, frames, rolls, series, league seasons, arsenal, badges, stats, follows, push registrations and share links. Records that belong to other bowlers and merely reference you survive on their side with your identity removed. No app access? Email us and we run the same deletion for you. Residual copies in encrypted backups age out on the backup rotation schedule. See also: tenpin.app/delete-account.
Security
Transport encryption (TLS) everywhere, encryption at rest for stored data, and scores signed into a verification chain so nobody — including us — can quietly rewrite a game.
Children
Tenpin is not directed at children under 13. Junior bowlers should use the app under a parent’s or guardian’s account supervision.
Changes
If this policy changes materially, we’ll say so in the app and on this page before the change takes effect, with the date updated above.
Contact
Privacy questions and deletion/export requests: privacy@tenpin.app.