xaploreThis policy describes how Xaplore LLC ("Xaplore", "we") handles information in its apps, currently Buddy Duo Walkie-Talkie (shown on your Home Screen as "Walkie Talkie") for iPhone and iPad, and in its free browser games listed on our Games page. We collect as little as possible, keep it only as long as it's needed to make the app work, and never sell it or use it for advertising.
No accounts, no audio on our servers
Buddy Duo has no sign-up and no account system. Once two devices are connected, voice audio flows directly between them (peer-to-peer via WebRTC). Audio is never sent to, recorded by, or stored on our servers.
What our signaling server sees
To help devices find each other, the app sends the following to our signaling server:
- The room code you enter (chosen by you or your family, not an account identifier).
- The display name you enter and a randomly generated device/session ID.
- WebRTC connection handshake data (offers, answers, ICE candidates) needed to open a direct audio connection.
- Your device's IP address, as part of any network request. It is not logged separately or linked to an identity.
- An Apple VoIP push token, used only to wake the app when someone is trying to reach you.
This data is short-lived: presence entries expire after 15 seconds of inactivity, queued handshake messages expire after 60 seconds, and push tokens expire after 30 days of inactivity. Nothing is used for analytics, advertising, or profiling.
Background wake-up (VoIP push)
If the app has gone idle in the background, we use Apple's push notification service to wake it so you don't miss someone trying to talk to you. The push only tells your device to reconnect; it carries no audio or message content.
TURN relay (connectivity fallback)
When two devices cannot connect directly (for example, on different home networks), the connection is forwarded through a TURN relay. Media sent through the relay is encrypted end-to-end by WebRTC (DTLS-SRTP); the relay operator cannot read it.
Microphone
The app uses the microphone only while you are holding the push-to-talk button. It does not use the camera, contacts, photos, or location.
Subscriptions and payments
Subscriptions are purchased and managed entirely through Apple's App Store. We never see or store your payment details. The app receives only the subscription status from Apple to unlock features.
Browser games
Our browser games (Bamboo Pairs, Bamboo Table, US Road Trip, Ochre Line, Ember Abyss, Black Box, Undo My Life, My AI Co-Founder, Merge! Resolve Conflicts and Boss Is Coming!) have no accounts, no ads and no third-party analytics. Your saves and settings are stored only in your own browser's local storage and never leave your device; clearing your browser data deletes them. Ember Abyss can export a character to a file that you keep and import yourself.
Anonymous play counts: to know which games people enjoy, each game sends one anonymous count per page load when you start playing. The count contains only the game's name, the event "play", the date (UTC) and where the game was opened from, as one of three broad labels (our itch.io page, xaplore.dev, or anywhere else; never the full address); our service adds it to that game's daily totals and keeps nothing else. It runs on our own service on Cloudflare (Cloudflare Workers), not a third-party analytics product. It uses no cookies, no local storage, no device or advertising identifiers, no user IDs and no fingerprinting. Your IP address is not stored: like any web request, it reaches Cloudflare, and our service uses it only momentarily in memory to limit abuse before discarding it. Only the daily totals per game are kept; no per-visitor data exists, so there is nothing about you to look up or delete. xaplore.dev shows these totals on the game cards by fetching the public totals; the site itself sets no cookies.
App downloads: download numbers for our iPhone and iPad apps come from Apple's own App Store Connect reporting, which gives us aggregated daily totals per app. We receive no personal data about who downloaded an app.
Apart from these counts, the one exception is the Black Box daily puzzle: when you finish it, the game sends the date, whether you solved it, how many probes you used, and a random ID generated in your browser, so it can show you how other players did. The random ID only prevents counting the same browser twice and is deleted after 3 days; the daily totals are kept for about 13 months and contain nothing that identifies you. To stop spam, the server also counts submissions per IP address for one minute; that counter then expires.
Online rooms (Ochre Line, US Road Trip races, Bamboo Table, Ember Abyss): when you create or join a room, the game connects to our room server on Cloudflare and sends the name you typed and your moves for the length of the match — in Ochre Line your movement, aim, shots and purchases; in US Road Trip your car choice, position and finish time; in Bamboo Table your chosen tile actions; in Ember Abyss the character you bring (class, level, stats, gear and inventory) and your moves, attacks and item actions. The server keeps the room only in memory while someone is connected; nothing is saved after the room closes, and there are no accounts. Everyone in the room sees your name.
The games are served by Vercel, which, like any web host, processes your IP address to deliver the pages. If you play on itch.io, itch.io's own privacy policy applies to that site.
Third parties
We do not sell or share data with advertisers or data brokers. The only third-party infrastructure involved is our hosting provider (Vercel), Cloudflare (online game rooms and the anonymous play counts), our database provider for temporary signaling data and the Black Box daily totals (Upstash), the TURN relay provider (Metered) used only when a direct connection fails, and Apple (push notifications and in-app purchases).
Children
Buddy Duo is designed for families. We do not knowingly collect personal information from children beyond the short-lived connection data described above, which is the same for every user.
Changes
If this policy changes, the updated version will be posted at this address with a new effective date.
Contact
Questions about privacy: support@xaplore.dev
Xaplore LLC, North Carolina, USA