Security

Indus Games never stores a password for your account. Signing in with Google or Apple means your credentials stay with them — we only receive a signed, verified token proving who you are.

All traffic between your device and our servers — including live multiplayer connections — runs over encrypted HTTPS/WSS. Nothing is sent in the clear.

Scores, ad rewards and biscuit balances are validated on our servers, not trusted from the app — a session token issued when you start a game is checked against what's actually achievable in that time before a score counts, and a rewarded ad can only be claimed once, after it has played. Every biscuit change is written to an append-only ledger alongside your balance, so it's always auditable.

Your account data is protected by database-level access rules (row-level security) in addition to application checks, and abusive request patterns are automatically rate-limited.

Found a vulnerability? We'd genuinely appreciate hearing about it before anyone else does. Email security@indusgames.app with details — we'll acknowledge reports promptly and keep you posted as we investigate and fix.