Portbound Privacy Policy
Last updated: 2026-10-20
Portbound ("we", "us") respects your privacy. This policy explains how we collect, use, and protect personal data when you use Portbound (Traditional Chinese name: 回港; the "App"). It follows the notice requirements of Article 8 of Taiwan's Personal Data Protection Act and describes the rights you may have under the GDPR and the CCPA/CPRA.
1. Who We Are
- Name: Portbound (developer of the App)
- Contact: portbound.esquire481@passinbox.com
- Website: https://portbound.cc
2. Overview
- You must sign in to play, and there is no guest mode: the iOS version offers only Sign in with Apple, and the Android version offers only Sign in with Google.
- With Sign in with Apple, we ask Apple only for your email address, not your name.
- After you sign in, your account data and saved game progress are stored on our server (provided by Cloudflare), so you can continue whenever you sign in with the same account. Signing in and saving progress both require an internet connection, and all data is sent over encrypted connections (HTTPS).
- The App has no ads, usage analytics, or tracking.
- The iOS version offers in-app purchases (diamonds); the Android version does not. Apple takes the payment. We never receive or store your payment method, card number, or billing address.
3. Personal Data We Collect, and Why
| Data | Purpose | Source |
|---|---|---|
| Email address | Account management: identifying your account and verifying your identity when you ask to delete it or exercise your rights | Provided by Apple or Google when you use Sign in with Apple or Sign in with Google |
| User IDs: your player ID, your sign-in method (Apple or Google), and the account identifier provided by Apple or Google | Account management and app functionality: keeping you signed in and linking game progress to your account | The player ID is generated by our server for your account; the account identifier is provided by Apple or Google |
| Saved game progress: sea coins, raffle tickets, gear levels, codex, raffle pity count, character outfits, claimed quests, daily play counts, control layout, and similar game data | App functionality: saving your game progress on our server (cloud save) | Uploaded automatically by the App as you play |
| Apple refresh token (Sign in with Apple users only) | Account deletion: used only to revoke the App's authorization with Apple when you delete your account | Issued by Apple when you use Sign in with Apple |
| Account creation time and last save time | Account management and service operations | Recorded by our server |
| Purchase records (iOS only, and only if you buy something): App Store transaction ID, product ID, the number of diamonds granted, the purchase and crediting times, and the environment (production or sandbox) | App functionality: granting the diamonds you bought, handling refunds, and checking the record if you tell us you paid and received nothing | Sent to our server by Apple, through RevenueCat, when your purchase completes |
| Server logs: event names, player ID, sign-in method, and error reasons, plus connection metadata recorded by the Cloudflare platform (such as IP address, request time, and request path) | Operating, debugging, and securing the service | Generated automatically when your device connects to our server |
If you use Apple's Hide My Email when signing in, we receive the relay address Apple provides, not your actual email address.
We do not store your name or profile photo. With Sign in with Apple, we do not ask Apple for your name. With Sign in with Google, the sign-in credential (ID token) Google provides also contains your Google Account name and profile photo URL; our server processes that credential only to verify your sign-in and does not store the name or photo URL.
The App does not collect: precise or approximate location (the App does not use location services, and IP addresses in server logs are not used to infer location), contacts, photos or videos, microphone recordings, device identifiers, advertising identifiers (IDFA / AAID), usage analytics, crash diagnostics, or any payment details (card numbers, billing addresses and the like stay with Apple). We do not use your data to track you across other companies' apps or websites, and we do not sell or share your personal information.
4. Third-Party Services
The only third-party components in the App are Apple's and Google's official sign-in features; it includes no advertising, analytics, tracking, or crash-reporting SDKs. We use the following services to process your data:
- Apple (Sign in with Apple, for sign-in on iOS): verifies your identity and provides your account identifier and email address (or relay address). When you delete your account, our server revokes the App's authorization with Apple. Privacy policy: https://www.apple.com/legal/privacy/
- Google (Sign in with Google, for sign-in on Android through Android's Credential Manager): verifies your identity and provides your account identifier and email address. When you delete your account, the App disconnects itself from your Google Account. Privacy policy: https://policies.google.com/privacy
- RevenueCat, Inc. (United States; iOS only): processes in-app purchases on our behalf, as our processor. It confirms with Apple whether your payment succeeded and tells our server the transaction ID, product ID and purchase time, which is what we use to grant your diamonds. The only identifier we give it is your player ID (used as its app_user_id); we do not give it your email address. Privacy policy: https://www.revenuecat.com/privacy
- Cloudflare, Inc. (United States): hosts our game server (Cloudflare Workers) and database (Cloudflare D1), and stores and processes the data listed in Section 3 on our behalf and under our instructions, as our processor. Privacy policy: https://www.cloudflare.com/privacypolicy/
How Apple and Google handle your data is governed by their own privacy policies.
5. Retention, Location, Recipients, and Processing
- Retention: we keep your account data and saved game progress for as long as your account exists. When you delete your account, we delete them from our database immediately. Purchase records are the exception: when you delete your account we unlink the record from you by removing the player ID, but keep the transaction ID, product ID and the number of diamonds granted. This stops anyone from deleting an account and claiming the same purchase again, and it lets us answer refund notices and keep our books; once unlinked, the record can no longer be tied to you. the database's point-in-time recovery backups (Cloudflare D1 Time Travel) are kept for up to 30 days and then overwritten automatically. Server logs are kept for at most 7 days (Cloudflare Workers Logs retention) and then deleted automatically. Where the law requires a longer retention period, we follow it.
- Location: our server and database are provided by Cloudflare, so your data may be stored and processed outside Taiwan, in the countries or regions where Cloudflare's global network operates. We apply appropriate safeguards to cross-border transfers as required by applicable law.
- Recipients: us (Portbound) and Cloudflare, which processes data on our behalf. When you sign in or delete your account, we exchange the necessary sign-in or authorization credentials with Apple or Google (see Section 4). Other than that, we do not provide your personal data to advertisers, data brokers, or other third parties, except where required by law or by a lawful request from a court or government authority.
- Processing: automated processing within the purposes above, for example verifying your Apple or Google sign-in credential and matching your account identifier when you sign in, and saving your progress automatically as you play. We do not use it for advertising, marketing, or behavioral analytics.
6. Your Rights
Under Taiwan's Personal Data Protection Act, you may ask to inquire about or review your personal data, obtain a copy, supplement or correct it, stop its collection, processing, or use, and delete it. If you are in the EU/EEA, the GDPR gives you the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. If you are a California resident, the CCPA/CPRA gives you the rights to know, delete, and correct, and to opt out of the "sale" or "sharing" of personal information, without discrimination for exercising them (we do not sell or share personal information).
How to exercise them: you can delete your account and data directly in the App (see Section 7). For any other request, or if you cannot sign in, email portbound.esquire481@passinbox.com with how you signed in and your account email address (or Apple relay address) so we can verify your identity. We will respond within the period required by law.
If you choose not to provide personal data: you must sign in with an Apple Account (iOS) or a Google Account (Android) to play, and there is no guest mode. If you do not allow Apple or Google to provide the data listed in Section 3, you will not be able to sign in or use the App. If you ask us to stop processing or using your data, you will no longer be able to use the App; if you ask us to delete it, your game progress is deleted along with your account and cannot be recovered.
7. Account and Data Deletion
You can delete your account in the App at any time: on the harbor screen, tap the gear icon at the top right to open Settings (設定), scroll to the Account (帳號) section, tap Delete Account (刪除帳號), and tap Delete (刪除) to confirm. Deletion requires an internet connection.
When you delete your account:
- We immediately delete your account data (player ID, sign-in method, account identifier, email address, Apple refresh token, and creation and update times) and your saved game progress from our database.
- If you signed in with Apple, our server also revokes the App's authorization with Apple; on Android, the App removes its Google authorization. If Apple or Google cannot complete the revocation at that moment, your account data is still deleted; you can also remove the App's access yourself under Sign in with Apple in your Apple Account settings, or under third-party apps and services in your Google Account.
- Database backups are kept for up to 30 days and then overwritten automatically; server logs are deleted automatically after at most 7 days.
- Your Apple Account or Google Account itself is not deleted.
- Deletion cannot be undone. If you sign in again later, you start over as a new player.
If you cannot sign in, you can request deletion by email by following the steps on our account deletion page:
https://portbound.cc/delete-account.en.html
Tapping Sign Out (登出) in the Account section only clears the sign-in on your device; it does not delete your account or game progress.
8. Children and Teens
The App is rated 12+ (輔12級) under Taiwan's game software rating system and is not directed to children under 12. Users under 18 should use the App only after a parent or guardian has read and agreed to this policy. If you are a parent or guardian and believe your child gave us personal data without your consent, contact us and we will delete it promptly.
9. Security
We protect your data with the following measures:
- All data between the App and our server is sent over encrypted connections (HTTPS).
- The game session token on your device is stored in the iOS Keychain or Android's encrypted storage and is valid for 30 days, after which you need to sign in again.
- Apple refresh tokens are stored encrypted with AES-GCM.
- Our server logs do not record email addresses, sign-in credentials, or save contents.
- We protect our server and database with access controls and other reasonable technical and organizational measures.
10. Changes to This Policy
We will post changes on this page and update the "Last updated" date. Changes to what data we collect will be published before that version is released; material changes will also be announced in the App or by other appropriate means.
11. Contact
Questions? Email portbound.esquire481@passinbox.com.
繁體中文版：https://portbound.cc/privacy
Drafted with ShipReady based on an actual scan of the App. Please have legal counsel review before publishing.