Empty Heart GamesBakuhatsu

Effective 12 September 2026 · Revised 9 October 2026

Privacy policy

Operator postal address: 655 12th St, APT 205, Oakland, CA 94607, United States.

Operator support telephone: +1 628 502 5810.

This policy covers Bakuhatsu, its online services, this website and support correspondence. The operator is Laszlo David Vari, California, United States. Contact contact@emptyheartgames.com for privacy questions or requests.

EU and UK representatives

For matters concerning our processing of personal data, individuals and supervisory authorities may contact:

A quick guide for families

Bakuhatsu is free and has no ads. Local play stores data on your device. When an eligible Game Center account synchronizes, our server receives account and game information, including progress earned against CPU players. Other players can see your chosen name during online play. You can delete your server account and ask us for privacy help. Apple family settings do not delete your account or give consent to every use of your information.

Information on your device

The app keeps settings, local game saves, progression and access preferences on your device. Apple device backups may include local app data according to your settings. When an eligible account synchronizes, progression and CPU game-completion proofs can reach our server even if you have not played an online match.

Online accounts and gameplay

Game Center supplies identifiers, your chosen display name and authentication information. Our server uses account and session records to authenticate players, reconnect games and protect accounts. Other participants can see your displayed name and the game information intended for them.

Online services store progression, earned Leaf Coins, cosmetic ownership, match records and accepted actions needed for play, recovery and reward validation. Hidden cards are not intended to be disclosed to other players. Preset messages and reactions are delivered to participants; ordinary messages are transient, but information connected to a safety report may be retained.

We also process block/mute choices, reports, enforcement information and correspondence to investigate abuse and respond to appeals. Service diagnostics and network information support reliability, security and fraud prevention. Logs may contain identifiers; we do not describe them as anonymous.

Apple age information and family settings

Apple may provide multiplayer/communication restrictions, an age range with lower or upper bounds, and whether age disclosure is required or completed. Bakuhatsu does not request a birth date or precise location. Optional age sharing is offered in Family access help; it is not a normal sign-in requirement. Required disclosures and Apple restrictions are handled separately.

Apple app-transaction information helps verify access to the app. Our restricted access records keep account associations, protected transaction/notification identifiers and withdrawal information. It does not retain the raw signed receipts or verification documents in that store. Limited withdrawal records are retained to prevent withdrawn access from being re-enabled by an old receipt or backup. See Family access.

Website and email

This website has no contact form, newsletter or player sign-in. We add no advertising analytics, tracking cookies or cross-site tracking. Hosting providers process normal request information, which can include IP address, requested URL, browser information and time, to deliver and protect the site. Their infrastructure and security practices are separate from developer-added analytics.

If you email us, we receive your email address, message and any information or attachments you choose to send. The operator uses Apple iCloud Mail to handle messages sent to contact@emptyheartgames.com. Privacy correspondence may also be shared with the relevant EU or UK representative to handle your request. Please send only what is needed; avoid passwords, authentication proofs, identity documents, payment details and children's birth dates.

If you choose to leave a message on our support number, we retain the voicemail to handle your request. Visible (Verizon Value, Inc.) provides our phone and voicemail service and stores voicemail in its cloud. Carrier handling follows Visible’s privacy information. No fixed deletion period or exclusive storage country is promised for carrier copies.

Purposes and providers

For players covered by EU or UK data-protection law, we rely on legitimate interests to authenticate accounts, deliver requested gameplay and progression, prevent cheating or abuse, protect access, operate essential diagnostics, serve this website and answer support messages. These interests are providing the game you request and keeping it safe; we limit collection and balance them against your rights, especially children’s rights. We rely on legal obligations when handling legally required privacy requests or preserving records required by applicable law. We do not rely on a child’s acceptance of a contract as the universal basis for these uses. Apple permissions and optional age sharing are separate from consent to our data uses. If a future optional use requires consent, we will explain and request it before that use; consent can be withdrawn. You may object to processing based on legitimate interests. Other countries’ applicable rules and rights also apply.

Information may be processed outside your country, including in the United States. Apple describes Standard Contractual Clauses for its transfers of personal data collected in the EEA, UK and Switzerland. Google's Cloud Data Processing Addendum provides for Standard Contractual Clauses or alternative lawful mechanisms where applicable. For the private review copy, OpenAI's privacy policy describes adequacy decisions, Standard Contractual Clauses and the UK transfer addendum for transfers within its scope. Cloudflare's customer Data Processing Addendum describes Standard Contractual Clauses and the UK addendum for covered services. These are the providers' published safeguards; their application depends on the service and transfer. The linked documents provide the terms and contact information for further details or copies; you may also contact us about your data. We do not sell personal information or use it for targeted advertising. This game release has no advertising SDK, real-money purchases or optional usage analytics. Ordinary security and service diagnostics still operate.

OVHcloud’s published US Data Processing Agreement includes Standard Contractual Clauses and UK transfer provisions for covered transfers. Which safeguards apply depends on the service and transfer; a published document alone does not establish that it covers our account.

Retention and deletion

Account progression and preferences are kept to provide the account until removed through the applicable account process. Gameplay records are retained as needed for active games, recovery, rewards and safety. Eligible completed-match cleanup, backup expiry and log rotation are different processes; there is no single seven-day deadline for all information.

The following log, backup and recovery arrangements concern our game-server infrastructure. Server logs rotate within bounded storage. Backup snapshots follow their configured expiry process, which is asynchronous. Limited records that prevent deleted accounts from being restored are retained separately so an older backup cannot restore deleted account access or undo a recorded withdrawal. Limited account identifiers, deletion dates, affected-match references and withdrawal records can therefore remain after ordinary account data is deleted. These records are restricted to recovery, security and compliance purposes.

The included OVHcloud system backup is enabled and configured to retain one daily copy for 24 hours in the same datacenter; we have not verified a current restore point. Encrypted recovery material is stored on the operator’s Mac in the United States, outside iCloud Drive, with no other copies or sync destinations. Exports reflect their capture time and may lag subsequent account, deletion and access-withdrawal recovery records. Daily Mac exports and automated retention of seven snapshots are deferred. Restricted Google Cloud recovery records remain necessary to prevent deleted accounts or withdrawn access from being restored; their retention remains subject to necessity review.

Support correspondence is reviewed monthly to decide what to retain or delete; this is a retention review, not a schedule for responding to requests. Resolved correspondence is removed when it is no longer needed; relevant information may remain for an ongoing safety investigation, dispute, rights request or legal obligation. No fixed retention promise is made for every record or provider copy.

Your choices and rights

Use Privacy choices for in-app account deletion and email assistance. Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection, and withdraw consent where processing relies on it. We may need proportionate verification of account ownership or parental authority. Email receipt alone does not complete that verification or deletion.

We handle privacy-rights requests without undue delay and within the deadlines required by applicable law. If a permitted extension is needed, we will notify you within the applicable deadline and explain the reasons for the extension.

You may contact the relevant data-protection authority where applicable. Game Center/Apple account deletion is managed separately by Apple. Removing the app or restricting multiplayer does not itself delete our server account.

Changes

We will publish material changes here with an updated version date and a summary on the game’s help page before they take effect. Where additional notice or consent is legally required, we will provide it through the app or the verified contact channel available for the affected account before starting the changed use. Continuing to play does not replace consent where consent is required.

Use the authenticated in-app account export and deletion controls for basic account records. For other privacy or guardian requests, contact contact@emptyheartgames.com. Before disclosing private records, we verify account ownership or parental authority as appropriate and choose a protected response method suited to the request. No separate privacy portal or automatic guardian-verification service is provided.

Apple crash reports

If you enable Apple’s sharing of app diagnostics with developers, Apple may make crash reports available to us. Apple controls collection and sharing under its own settings and privacy information. We use the reports only to find faults and improve reliability; we do not try to identify you or combine them with your game account. No third-party crash-reporting SDK is included. Information you send to support yourself is handled as support correspondence.

A separate personal game summary keeps a match reference, recording time and outcome for up to 30 days. It excludes cards, other players’ identifiers, messages and sign-in credentials. It is removed with account deletion. This summary does not mean that all gameplay or recovery files are kept for 30 days.

Closed safety reports are deleted after a 30-day appeal window. A documented, time-limited extension can cover a continuing appeal, safety investigation or legal obligation. Open cases are reviewed for necessity; they are not used for advertising or player profiling. Downloaded Apple crash reports are restricted to fixing the reported fault and removed within 30 days after that work closes, unless a documented security or legal need continues.