Privacy Policy
Break & Run, the 8-ball pool game at playbreakandrun.com and in the Break & Run app for iPhone. Last updated November 5, 2026.
You can play against the computer, or a friend on the same device, without an account. This page covers what we keep when you do, and when you play online.
What we keep
- Your account. If you save your account, the email address you give us, or the one on the Apple, Google or Facebook account you sign in with. If you set a password, only a secure hash of it is stored.
- Your profile. Your username, avatar and country, if you choose one, when you were last online, and your rank (the # beside your name) once you have played a ranked game. Other signed-in players can see these, and the Rankings list also shows them how many ranked games you have played and how many online games you have won. They never see your email. If you sign in with Google or Facebook, the profile photo on that account is shown to other players as your picture; you can turn it off in Profile, and we never upload or copy the photo itself, only keep its address. If you signed in with Google or Facebook before November 5, 2026, or in a version of the app before 1.0.4, your photo stays off until you turn it on in Profile or sign in with Google or Facebook again on the website or in the app from 1.0.4, which say so when you do. A photo is loaded straight from Google's or Facebook's servers by each device that shows it, so when your device shows another player's photo, Google or Facebook sees your device's internet address, as they would for any image of theirs on the web; we send them nothing else.
- Your player card. Other signed-in players can tap your name to see your player card: your username, avatar (or your Google or Facebook photo, while you show it), country and rank, the month you joined, the cue you use, your online wins, losses, win rate and streaks, your wins and losses against the computer, and their own record against you. It never shows your email, where you connect from, when you were last online, your tokens or the cues you own. In an online game you and your opponent can also send each other quick chat: one of a few preset phrases or emoji, passed straight to the other player and never stored; nothing you type is ever sent.
- Photo reports and hidden photos. If you report another player's photo, that you reported it, when, and the photo's address, for us to look at; reporting it also hides it for you. If you hide another player's photo (Hide photo on their player card), that you hid it, until you show it again; you then see their avatar instead. The player isn't told who reported or hid their photo. If we hide a photo, every player sees that player's avatar instead.
- Messages. If you send or get messages from other players, what you write, who it went to, when, and whether it has been read. We keep them so they can be delivered and read later, and only you and the player you're writing to can read them in the game. You can block a player from messaging you, and report a message you got to us: we then keep a copy of that message, who sent it and who reported it, so we can look into it and, if it breaks the rules, stop the sender messaging anyone. If you delete your account, the messages you sent and got, and the reports you made or that name you, are deleted with it.
- Your games. The online games and games against the computer that are saved to your profile, the shots in them, your stats and your rating.
- Where you connect from. The IP address you connect from each time you sign in or your sign-in is renewed, the name your browser or the app gives itself, and the country and approximate city worked out from the address. We use this to stop abuse, to see where players are, and to keep paid league tables closed where they aren't allowed. The location lookup runs on our own systems (the country in our database, the city on our own computer), so your IP address is not sent to anyone else for it.
- Tokens and cues. If you have a saved account, your token balance, the cues you have and which one you use (other signed-in players see which cue you use), and a record of each change to your tokens: what it was for (a ranked win, with the game and the opponent; a cue; a welcome gift; a league entry, refund or prize; a gift or correction from us, with our note) and when. If you delete your account, your balance and cues are deleted with it, but the record of changes is kept under your account's random ID, with no name or email, so our accounts add up. A win someone had against you stays in their record the same way, under your random ID.
- Leagues. If you sit at a league table, your seat there, your results in its games and any prize you win. League standings (your name, results and prizes at each table you sit at) are visible to other signed-in players.
- Friends. The players you add as friends, the friend requests you send and get, and when each was sent and answered. Only you and the other player see a friendship or a request, and your friends see when you're online. If you decline a request, the player who sent it isn't told. If you delete your account, your friends and requests are deleted with it.
- Notes. If we've asked you to send us notes on the game, the notes you write, and with each one the part of the game you wrote it from, the game's version and the name your browser or the app gives itself. Only we read them, and you can see your own and what we've made of them. If you speak a note rather than type it, your browser's own speech service (Apple's in Safari, Google's in Chrome) turns your voice into text: we get only the text, never the sound.
- Notifications. If you turn on notifications for your no-clock games, the address your phone or browser gives us to reach that device: a device token from Apple in the app, or a push subscription from your browser's maker (Apple, Google, Mozilla or Microsoft) on the website. We use it only to tell you it's your turn, how a game ended, or that a player has messaged you (with their name and the start of the message), and keep a note of each one we send for a day, so nobody gets too many. Turning notifications off, or signing out, removes the device.
- Players online. While the game is open, it tells our server every 45 seconds that it is, so the menu can show how many people are playing. It sends a random ID made for your device, and your account if you're signed in.
- On your device. Your settings, the games you've won, your sign-in session and games waiting to upload, kept in your browser's storage, or in the app's own storage on your iPhone. There are no advertising or tracking cookies.
Services we use
- Supabase stores accounts and game data.
- Cloudflare hosts playbreakandrun.com.
- Apple delivers the iPhone app through the App Store, and signs you in if you choose Continue with Apple in the app. Apple gives us an ID for you that only this game gets, and an email address: yours, or a private address that forwards to yours if you choose Hide My Email. If Apple's sign-in also shares your name, it stays on your iPhone; the app doesn't send it to us. When you delete your account in the app, our server asks Apple to end the game's access to your Apple Account; otherwise we don't send Apple anything about you or your games.
- Cloudflare Turnstile checks that you're not a bot before a guest profile is made, a sign-in code is sent, or you sign in with a password.
- Google signs you in, if you choose Continue with Google. Google gives us your Google account's email address, and your name and profile picture, which are stored with your sign-in record. Your name is not shown in the game; your profile picture is shown to other players as your picture unless you turn it off in Profile (see Your profile above). The picture itself stays with Google: the game shows it from Google's address.
- Facebook signs you in, if you choose Continue with Facebook. Facebook gives us your Facebook account's email address, your name and profile picture, and an ID for you that only this game gets. They are stored with your sign-in record. Your name is not shown in the game; your profile picture is shown to other players as your picture unless you turn it off in Profile, from Facebook's own address. That address includes the ID for you that only this game gets, so the devices of the players who see your photo can see that ID too. We don't post to Facebook or see your friends.
- An email delivery service sends your sign-in codes.
- Apple, Google, Mozilla and Microsoft deliver notifications, if you turn them on: Apple to the app and to Safari, and each browser's maker to that browser. A notification says whose turn it is or how a game ended, and which game; on the website it is encrypted so only your browser can read it.
We don't sell your data, show ads, or share your data with anyone else.
How long we keep it
- An unsaved guest profile is deleted after 30 days without use, unless it has online games or has sent us notes.
- Records of sign-in emails are deleted once they are a day old, the next time a code is sent, and hold only a scrambled form of the address.
- The players-online record of a device is deleted once it is more than 10 minutes old, the next time anyone opens the game.
- A device with notifications on is forgotten after 60 days without the game being opened on it.
- The record of changes to a saved account's tokens is kept after the account is deleted, under the account's random ID, with no name or email, so our accounts add up.
- Everything else is kept until you delete your account.
Deleting your account and data
Open Profile, then Delete account, on the website or in the app. Your account, profile, stats, rating, games against the computer, tokens and cues, notes, the photos you reported or hid, the messages you sent and got, devices with notifications on, sign-in IP records, and what Apple, Google or Facebook gave us are deleted immediately. If your account uses Sign in with Apple, the app asks you to confirm with it, and we ask Apple to remove Break & Run from the Apple Account you confirm with. Deleting on the website can't do that, so remove it yourself as below. Online games you played, and your results at league tables, stay in your opponents' history, without your account attached. The record of changes to your tokens is kept without your name or email (see Tokens and cues above). What is kept on your device stays there until you clear the browser's data for the site, or delete the app.
Can't sign in any more? Email us from the address on your account, and we'll delete it for you.
If you signed in with Facebook, you can also remove Break & Run from your Facebook account under Settings & privacy, Settings, Apps and websites. That stops Facebook sharing anything more with us; to delete what we already have, delete your account as above. The same goes for Google, under your Google Account's Security, Your connections to third-party apps and services, and for Apple, in your iPhone's Settings under your name, Sign-In & Security, Sign in with Apple.
Children
Break & Run is not aimed at children under 13, and we don't knowingly collect their data.
Contact
Questions or requests: [email protected].