Roaring Trades
Version 1.2.1 | Effective Date: 9 August 2026
Roaring Trades ("the Game") is published by MidMightBit Games, based in Australia. The Game is built with privacy as a core principle. We store your game data on your device, use no advertising services and no third-party analytics or tracking SDK, and build no profile of any player. We do send anonymous, aggregate usage counts to an endpoint of our own — an event name and nothing else — which you can switch off in the Game; it is described in full under “Anonymous analytics” below.
Nothing about how you play leaves your device unless you ask it to. Your cash, inventory, trades, heat, achievements, scores and settings are stored on your device. Two optional actions — buying or restoring the Syndicate Pass, and putting a cleared target on the blockchain — send data only when you tap them, and are described below.
The Game makes these kinds of network request, and no others:
app_open, sent to an endpoint of ours. It carries no score, no trade, no wallet address and no identifier of any kind. Switch it off at Settings > Privacy > Anonymous analytics, and nothing is sent. Described in full under “Anonymous analytics” below.Under the EU General Data Protection Regulation (GDPR) and UK GDPR, the legal basis for processing your wallet public address is legitimate interest (Article 6(1)(f)) — specifically, the legitimate interest in providing leaderboard functionality that you voluntarily opt into by connecting your wallet. This processing is minimal, expected by the user, and proportionate.
Under the Australian Privacy Act 1988 and Australian Privacy Principles (APPs), the wallet public address is collected in accordance with APP 3 (collection of solicited personal information) for the primary purpose of leaderboard identification.
We do not collect, log or store your IP address. Note that if you connect a wallet, the RPC provider used for the Seeker Genesis Token check necessarily sees your IP address, as it would for any internet request. That is a transfer to a third party, not a collection by us — see "Cross-Border Data Transfers".
Your wallet connection and leaderboard are stored on your device using Android EncryptedSharedPreferences with AES-256-GCM encryption. Your Syndicate Pass entitlement and career are stored unencrypted so Android's Auto Backup can preserve a purchase across a reinstall — see below. Nothing you create in the Game is transmitted unless you take one of the optional actions listed at the top of this policy.
Your data is retained locally on your device for as long as the Game is installed. Data is automatically deleted when you uninstall the Game or clear its data through Android settings.
Connecting a wallet enables a bonus for holders of a Seeker Genesis Token (SGT). To determine whether your wallet holds one, the Game sends your wallet's public address to a Solana RPC provider and reads the token accounts owned by that address. Your private key is never accessed, and no transaction is created.
The result is cached on your device for 24 hours, so the check runs at most once a day while you keep a wallet connected. The Game does not store the response anywhere except on your device, and does not send your game data, scores or any personal information with the request.
Your game data — scores, results and settings — stays on your device. There is no game server, cloud storage or remote database of ours, and we hold no account or profile for you. The one endpoint we run, described under “Anonymous analytics” below, holds nothing but counts of event names by country and day.
Two deliberate exceptions. Your public wallet address is sent to a Solana RPC provider when the Game checks for a Seeker Genesis Token, and when you buy or restore the Syndicate Pass — see “Blockchain transparency” below. And your Syndicate Pass entitlement and career progress are kept in a small unencrypted file so Android’s Auto Backup can include it, which is what lets a pass you paid for survive a reinstall or a new device; Auto Backup copies that file to your own Google account, not to us. It holds your pass status, your purchase’s transaction signature, the wallet address that paid, and your career statistics — never any private key. Your wallet connection and leaderboard are encrypted and excluded from backup.
Three things do go offshore. The Seeker Genesis Token check sends your wallet's public address to a Solana RPC provider, which may be located outside Australia (Helius Labs, Inc. is based in the United States); as with any internet request, the provider also receives your IP address. That happens only if you connect a wallet. If you buy or restore the Syndicate Pass, your wallet's public address and IP address are likewise sent to the public Solana RPC endpoints listed under “Third-Party Services”, which may also be outside Australia. Separately, the anonymous event counts described below are handled by our hosting provider (Vercel) and may be processed in the United States; they contain no personal data to transfer.
The Game uses the following third-party services and libraries:
roaringtrades-analytics.vercel.app): not a third party — we run it ourselves. The anonymous usage counts described above send one event name per request and nothing else. See “Anonymous analytics” below.mainnet.helius-rpc.com): A Solana RPC provider, used only for the Seeker Genesis Token check. It receives your wallet's public address and your IP address. If no API key is configured, the Game falls back to the public Solana RPC endpoint (api.mainnet-beta.solana.com) instead, which receives the same information.api.mainnet-beta.solana.com, operated by the Solana Foundation, and solana-rpc.publicnode.com, operated by Allnodes): used only for the Syndicate Pass — to prepare a payment, and to look up a previous payment when you restore it. They receive your wallet's public address and your IP address. Both may be located outside Australia.The Game does NOT include any:
The Game sends anonymous, aggregate usage counts to a single endpoint we operate, roaringtrades-analytics.vercel.app. We use them to see which parts of the Game are actually played and roughly where it is played, so we know what to improve.
What is sent. The entire request body is one event name, for example
{"event_type":"app_open"}. That is the whole payload. It contains no cash figure, no
score or net worth, no trade, good, neighborhood or vehicle, no achievement, no wallet address, no
device or advertising identifier, no install id, no session id and no location.
What is derived. Our host records the request's approximate country (derived by the hosting provider from the connection) and the date, and keeps a running count per event name, per country, per day. IP addresses are not stored. Because the request carries no identifier, the counts cannot be tied to you, to your device, or to each other — two events from one phone are indistinguishable from two events from two phones.
How to switch it off. Settings > Privacy > Anonymous analytics. While it is off, the Game sends nothing to this endpoint at all. No part of the Game depends on it.
Legal basis (GDPR). Legitimate interest (Art. 6(1)(f)) in understanding aggregate product usage. The data is anonymous rather than pseudonymous — it carries no identifier that could single you out, so it is not personal data within the meaning of Art. 4(1). The off switch is provided regardless.
Retention. Aggregate counts are kept indefinitely, since they describe events rather than players. No raw request log is retained.
When you connect your wallet, your public wallet address is used for leaderboard purposes. Note that Solana wallet addresses are inherently public on the blockchain.
The Game creates a blockchain transaction in exactly one case: when you choose to buy the Syndicate Pass. That transfer is prepared by the Game, then shown to you and submitted by your own wallet — the Game never signs anything itself. Like all Solana activity, that payment is permanently and publicly recorded on the blockchain, linked to your wallet address, and it is not something we can erase. Connecting your wallet, playing, and viewing the leaderboard create no transactions at all.
To restore a Syndicate Pass you have already bought, the Game reads your wallet's public transaction history from a Solana RPC provider and looks for that payment. This is a read-only lookup and signs nothing.
Putting a result on the record (optional). If you reach a board's target, the Game offers to write that result to the blockchain as a short note signed by your own wallet. This is entirely optional, is never done automatically, and the Game works exactly the same if you decline. If you accept, the note contains only: which board you played, that board's target, your final net worth, the number of days played, and a short code derived from those same values. It contains no name, no device information, and nothing about how you played. Like all blockchain activity it is permanent and public, and it is linked to the wallet that signs it — we cannot delete or amend it afterwards, and neither can you. You pay only the network fee, a fraction of a cent.
You can delete all Game data at any time by:
This satisfies the right to erasure under GDPR Article 17, UK GDPR, and the Australian Privacy Act.
All data stored by the Game is visible on the Status screen (wallet address and leaderboard scores). You may also contact us to request a summary of data associated with your wallet address.
You may object to the processing of your wallet address at any time by disconnecting your wallet in the Game's Status screen, which removes your wallet address from local storage.
As all data is stored locally on your device, you have full control over your data at all times.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority:
The Game is intended for users 21 years and older. We do not knowingly collect data from anyone under 21. The Game's content (historical alcohol trade themes) is not directed at children or minors. If we become aware that we have collected data from anyone under 21, we will take steps to delete that information.
We may update this Privacy Policy from time to time. Changes will be reflected in the version number and effective date above.
For questions about this Privacy Policy, data protection inquiries, or to exercise your data rights, contact:
MidMightBit Games
Email: midmightbit@proton.me