Flick Home Run Privacy Policy

Updated September 25, 2026 · Infinity Pocket

This page covers Flick Home Run and Flick Home Run! FREEdom, published by Infinity Pocket. The FREEdom section applies only to the free iOS app. All sections after the Paid Flick Home Run heading apply only to the paid game. Features described for an upcoming version apply when that version and the relevant service become available.

Paid Flick Home Run — iOS and Android

What the game stores on your device

Single-player levels, experience, scores, mode unlocks, gold bat ownership and collected pieces, Called Shot inventory, achievements, settings and local purchase-recovery records are stored in the app's private storage. We do not upload the complete single-player save file. The operating system may back up or restore this data according to your device, Apple or Google backup settings.

An iOS update may keep a one-time private local copy of legacy settings and game saves for migration recovery. It is not sent to our server. Clearing scores does not necessarily erase purchase-recovery or migration-backup records.

Google Analytics for Firebase

Firebase Analytics is used from Android 1.9.1 (21) and iOS 1.9.1 (10). It processes an app-instance identifier, app/device information, lifecycle and usage events, general location information derived from IP addresses, and supported app-store purchase events. We use these reports to understand usage, improve game balance and investigate unusual progress changes.

Game events include numeric Power, Contact and Batting Eye levels, experience and experience requirements, changes from a previous observation, monitored experience and level-up credits, highest unlocked Minor/Major/Called Shot steps, mode unlock status and the mode played. Monitoring counters begin from an installation's observation baseline, not necessarily the first time a player ever installed the game. An unexplained experience change may produce a low-confidence diagnostic flag. A high level alone does not prove cheating, and such flags do not automatically ban players.

We do not send a name, email, platform gaming ID, Firebase login UID, EOS Product User ID, raw purchase receipt/token or complete save file to Analytics. We do not set an Analytics user ID. The game has no advertising SDK, does not use Apple IDFA or Android advertising IDs, disables Analytics IDFV collection on iOS and default advertising-personalization signals, and does not use this data for cross-app tracking or personalized advertising.

Global Derby: identity, competition and purchases

Global Derby in version 1.9.3 uses Firebase Authentication, Cloud Functions, Cloud Firestore and App Check. Firebase creates an anonymous player account; it does not ask you to register with an email, password or social account. This identity is separate from your Analytics identifier and from Apple, Google Play Games and Epic accounts.

The service stores the anonymous identity and account mapping, your selected country/city, generated display label or your chosen public Game Center / Google Play Games nickname, competition dates, attempts and run IDs, rule versions, scores, pitch counts and duration, reported ability levels, validation reason codes, daily bests, weekly standings, participation days and visual trophy results. Country/city are self-selected profile labels, not GPS readings. Reported levels and basic score checks are not independent verification of the complete single-player history.

The profile screen lets you choose whether to use your public platform gaming nickname. When that choice is off, or the nickname is unavailable, an anonymous label is used. We do not publish your platform account identifier, email or legal name.

Other leaderboard viewers may see that display label, selected country/city, reported ability levels, score, rank and visual trophy. Raw Firebase UID, validation reasons and attempt counts are not shown in the public leaderboard. Ranking does not award items or currency in this release. Small-group leagues, career rankings and Player Feedback collection are not enabled by this release. Player-state copies and replay evidence in updated version 1.9.4 builds are described below.

App Check uses Apple App Attest and Google Play Integrity in production. Google and the relevant platform process technical and integrity information to help protect requests. These checks do not guarantee that every modified client or fraudulent score is detected.

Apple or Google processes in-app payments. We do not receive your full card details. For Derby tickets, the app temporarily stores the pending Apple receipt or Google purchase token privately and sends it over an encrypted connection to our authenticated, App Check-protected verification service. The service checks it with the store, updates your server ticket balance, and records a transaction digest and grant/spend result rather than the raw receipt.

Google ticket purchases include an obfuscated identifier derived from the anonymous player UID to bind the purchase to that player. Successfully verified pending proofs are removed from the queue. Rejected proofs may remain in private on-device recovery storage for a user-requested recheck, which does not create a new charge. Deleting the Derby account removes these Derby proof/recovery records. In updated TestFlight builds, Apple still processes test payments in its sandbox, while verified ticket credits, profiles and competition use the same service as released builds. Other purchase recovery is handled separately.

Player-state copies and Derby replay evidence

In updated version 1.9.4 builds with this feature enabled, the app sends a limited gameplay snapshot after loading its saved progress and after committed progress changes, even without opening Derby. It uses an anonymous Firebase account and a server-side player mapping. The snapshot contains experience, Power/Contact/Batting Eye levels, Called Shot quantities and progression, mode progress and unlocks, collected gold bat pieces and achievement counters/distances/heights, together with observed experience-accounting values. It does not contain your entire settings file, passwords, device files or raw purchase receipts.

The server keeps the latest reported state and a limited change history. These copies help us investigate bugs, analyze balance and test future services. They do not replace your local progress, guarantee account recovery or prove that a reported level is legitimate. Opening a leaderboard player's details retrieves only their current reported Power, Contact and Batting Eye levels from that state; private inventories and history are not public.

For completed Derby submissions, replay evidence may include the starting ability and inventory state, normalized flick-input samples, pitch types and timing, outcomes, scores, life values, pauses and performance counts. It is linked on the server to the player and server-issued game, rule/physics/app versions and seed. These are numeric gameplay records, not screen recordings, microphone recordings or access to device files. Sampling is bounded; incomplete data is not treated as an exact reconstruction or conclusive cheating evidence.

The latest player-state copy is retained while the account exists and is updated with new reports. Past state changes expire after 90 days; raw Derby replay evidence expires after 30 days. Expired evidence is excluded from service reads while automated physical deletion completes, typically within a further 24 hours. These time limits do not erase current levels, inventories, purchased entitlements or standings. Purchase-validation and duplicate-grant-prevention records follow the separate policy below.

Other platform and network services

Optional Apple Game Center and Google Play Games authenticate players and process platform profiles and leaderboard scores under their policies. With the profile nickname choice on, the public gaming nickname is sent to our Derby server for display; platform account IDs and gaming names are not sent to Analytics. Platform leaderboard records are managed through the relevant Apple or Google account controls.

Supported iOS and 64-bit Android online multiplayer uses Epic Online Services Connect, Lobbies and peer-to-peer networking with a device-based pseudonymous Product User ID; an Epic account is not required. Epic may process IP addresses, device credentials and technical information (including iOS IDFV), lobby metadata and connection data. Game packets may travel directly between players or through Epic relays. Updated multiplayer builds wait for both peers to be ready before play. Global Derby rankings are separate and use Firebase.

First-party recommendations for other Infinity Pocket games download a common catalog and images from our hosting/CDN providers. These providers receive the IP address and ordinary request information needed to deliver content. These requests do not include your account identifier, advertising ID, purchase data or gameplay history, and are not personalized from a user profile.

This release does not activate advertising, voice/text chat, Firebase Remote Config or push notifications, and does not request camera, microphone, contacts, photo-library, Bluetooth or precise-location access. Android includes normal network, billing, vibration, wake-lock, install-referrer and Firebase dependency permissions. Dependency messaging permissions do not mean the app offers push notifications.

Crash diagnostics (paid Flick Home Run)

The paid app uses Firebase Crashlytics to diagnose crashes and Android application-not-responding events. Reports may include stack traces, device model, operating-system and app versions, technical device state, a randomly generated app-installation identifier, session identifiers, and limited recent gameplay events such as the selected game mode. These identifiers are not a hardware UDID, but reports can be associated with an app installation; they are not completely identifier-free anonymous data.

We do not explicitly attach your name, email, public profile photo, Game Center or Play Games identity, Derby player ID, purchase receipts, or saved-game contents to crash reports. Diagnostics are used for app reliability, not advertising or cross-app tracking. Crashlytics may receive Analytics event breadcrumbs described above. We do not record screen video, microphone audio, or every-frame touch trajectories for this purpose.

Firebase retains Crashlytics crash traces and associated identifiers for 90 days before beginning removal from live and backup systems. See Firebase privacy and retention. This section does not enable Crashlytics in the separate FREEdom app.

Retention and deletion

In-app deletion: open Derby → profile → Delete Derby account and confirm both warnings. This removes the anonymous Derby account, associated profile and competition records, server-side player-state copies and change history, associated replay evidence, remaining Derby tickets (including purchased tickets), and Derby-specific local online data. Remaining tickets cannot be restored. Deletion does not automatically issue a refund; store refund requests are handled separately by Apple or Google.

Single-player data is preserved: this action does not reset your levels, experience, gold bat, collected pieces, Called Shot inventory, mode unlocks or achievements. It does not delete your Apple, Google or Epic account, platform-held transaction/leaderboard records or independently identified Analytics data.

Deletion runs on the server even if you close the app. You can check progress from the same profile screen and keep playing single-player while Derby is blocked. Normal automated requests are expected to finish within 24 hours. If processing is delayed or status cannot be confirmed, contact us below. We will confirm the outcome after checking the request.

To prevent reusing a previously credited purchase, an account deletion replaces the ticket grant with only the transaction hash and limited policy/review metadata; the UID, profile, amounts and raw proof are not retained in that record. We retain this minimal anti-duplication record while it is needed to prevent another grant, review necessity at least every 90 days, and remove it when replay prevention no longer requires it. Ninety days is a review interval, not an assertion of a legal retention period or an automatic expiration date.

During processing, the deletion job retains the account references needed to complete it. After completion, the job contains only a hash of the random private confirmation code and completion status. The app acknowledges completion after recording it locally; the server then expires the response record after seven days. Unacknowledged completion status remains available for recovery without a UID, profile or purchase proof. A short-lived hash blocking old account requests expires after seven days.

Outside the app, use our deletion request page or email infinitypocket002@gmail.com. We may need proportionate information to locate the anonymous account and verify that you are authorized to request deletion. A public nickname alone is not proof of ownership. Do not send passwords, card details or raw receipts/tokens. If the identifying information has been lost, we will explain what we can verify rather than delete another player's data.

Uninstalling alone does not delete the Firebase account or server records. Local data may be removed by clearing storage or uninstalling, subject to operating-system backups and credential storage. Prior anonymous account recovery after reinstalling is not guaranteed. Analytics and platform service records have their own retention and deletion controls. We may be unable to identify a particular Analytics record from an email alone.

Security, sharing and children

We use data for gameplay, requested online services, delivery/recovery of purchases, analysis, support and fraud prevention. Service providers process the information described above on the applicable terms. We do not sell personal information or share it with advertisers or data brokers. Derby clients cannot directly access the underlying Firestore records. Deletion status uses App Check and a strong private confirmation code because the original login may already have been deleted. No security measure is infallible.

We do not knowingly ask children for names, contact details or payment credentials. The pseudonymous Analytics, player-state, platform and Derby processing described above still applies. Store purchases and platform services are subject to parental and family controls. A parent or guardian may contact us with a privacy concern or deletion request.

Provider information: Google privacy, Firebase privacy, Apple privacy, Epic privacy.

Contact and updates

For questions or requests, email Infinity Pocket at infinitypocket002@gmail.com. We will update this page and its date when our data practices change. Additional future features will be reviewed and disclosed before their collection is activated.