Privacy Notice
1. Who we are
Controller: {{OPERATOR_NAME}}, {{OPERATOR_ADDRESS}}, {{OPERATOR_COUNTRY}} ("we", "us"). Contact for privacy matters: {{CONTACT_EMAIL}}.
Our representative in the European Union (Art. 27 GDPR): {{EU_REPRESENTATIVE}}. You may contact the representative instead of us on any data protection matter. We have not appointed a Data Protection Officer because we are not required to.
2. What we process, why, and on what legal basis
We collect only what an online game needs. We do not collect your real name, phone number, date of birth, ID documents, location, contacts, advertising identifiers or card details (payments are handled by Google Play).
| Data | Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Account ID, nickname, creation and last sign-in dates, record of accepted documents (document, version, date), including your consent to immediate delivery of digital content before purchases | Your account; providing the game; leaderboards; proving what you accepted | (b) contract; (f) being able to prove what you accepted |
| Age group (under 16 / 16–17 / 18 and over) and a parental-permission tick. We do not ask for or store your date of birth | Applying rules for minors | (b); (f) protecting minors |
| Country of your phone (from SIM, network or device settings) and of your connection (derived from your IP address) — held only for the current game session, not stored | Suggesting a region on first launch (on your device); complying with national restrictions (for example on paid random rewards in Belgium) | (c) legal obligation; (f) |
| E-mail address (stored encrypted) and password hash, if you sign in with e-mail | Sign-in, verification codes, security notices, notice before deletion of an inactive account | (b) contract; (f) legitimate interest in account security |
| Google account identifier, if you sign in with Google (we request only the "openid" scope — not your e-mail, name or profile) | Sign-in with Google | (b) contract |
| Guest identifier and a hash of its secret | Guest sign-in and recovery code | (b) contract |
| App installation ID, device model and OS version, device public key | List of your devices; protection against account takeover | (b); (f) security |
| IP address (in the database only as a keyed hash; in technical logs truncated to the network) | Protection against password guessing, bots and overload; technical logs | (f) security and stability of the service |
| Game progress, items, resource change log, in-game mail | Providing the game, support, preventing duplication exploits | (b); (f) |
| Chat messages, reports | Player communication; moderation | (b); (f) safe community |
| Support requests | Answering you | (b) |
| Purchase records: order number, item, store, purchase token, store order ID, amount, currency, status | Delivering purchases, refunds, accounting and tax | (b); (c) legal obligation |
| Total purchases of your character, its time in the game, VIP level | Choosing which in-game offers and promotions to show you (for example starter packs for new players or offers for players who have already bought something); VIP perks; retention period of inactive accounts | (b) for VIP perks; (f) our interest in showing relevant offers — you can object (section 7) |
| Automation signals (request rhythm), links between accounts by device and network (as irreversible hashes) | Protecting the game economy from bots and account farms | (f) fair play |
We do not rely on consent for any of the above and we do not process special categories of data. Where we rely on legitimate interests, our interest is keeping accounts safe and the game fair and running; you can object (section 7).
Automated decisions. Our anti-bot system may automatically slow down requests or ask you to pass a check. It never bans an account by itself — a person decides on restrictions. No decision with legal or similarly significant effects is made solely automatically (Art. 22 GDPR).
Offers. Which offers you see depends on simple rules (for example, whether you have bought anything and roughly how much, and how long your character has played). This does not change the price of any offer and has no legal or similarly significant effect on you.
Do you have to give us the data? The data above is needed to provide the game under our Terms; without it we cannot provide an account. E-mail (where offered) and Google sign-in are optional — you can play as a guest.
Sources (Art. 14). Besides you and your device: Google (account identifier when you sign in with Google) and Google Play (purchase confirmation).
3. Who receives the data
Processors acting on our instructions under Art. 28 GDPR agreements, all located in the EU/EEA:
- {{EU_HOSTING_PROVIDER}} — server hosting;
- {{EU_EMAIL_PROVIDER}} — sending verification codes and security e-mails;
- {{EU_BACKUP_STORAGE}} — encrypted backup storage.
Independent controllers you interact with under their own privacy policies: Google Ireland Limited / Google LLC (Sign in with Google, Google Play and Google Play billing). When you sign in with Google we receive only your Google account identifier; when you buy, Google receives only our order number from us.
Other players see your nickname, level, VIP level, power, avatar, achievements, chat messages and leaderboard positions. Please do not put your real name or contact details in your nickname or messages.
We do not sell personal data and do not share it for advertising. We may disclose data to authorities where the law requires.
4. International transfers
Your data is stored and processed on servers in Germany. We do not transfer Europe-region personal data to Russia: the game's Russia region has a separate database, and Russian sign-in and e-mail services are not used in the Europe region. Google, as an independent controller, may process data outside the EEA under its own safeguards. If our authorised staff need remote administrative access from outside the EEA, it is limited to what is strictly necessary, protected by encryption and access controls, and covered by the European Commission's Standard Contractual Clauses ({{TRANSFER_MECHANISM}}); you can request a copy at {{CONTACT_EMAIL}}.
5. How long we keep data
- Account data and game progress: while your account exists. You can delete your account in the game (it is erased after 7 days; signing in during this period cancels deletion). Accounts without sign-in for 2 years (3 years if total purchases are at least {{PAYER_THRESHOLD_EUR}}) are deleted; we warn you 30 days before by e-mail if one is linked.
- Verification codes: 2 days after expiry. Sessions: 7 days after expiry. Hashed networks you signed in from: 180 days. Hashed links between accounts by device and network: 180 days. Technical logs (IP truncated to the network): 14 days. Resource change log: 12 months. Closed support requests: 30 days. Chat reports: 90 days. A chat channel keeps only its latest messages (at most 100); older ones are overwritten. Purchase receipt in in-game mail: 365 days.
- Purchase records: {{EU_TAX_RETENTION}} to meet accounting and tax obligations; after account deletion they are no longer linked to an account.
- Log of staff actions in the administration panel (including viewing your data): 3 years.
- Backups: up to 14 days; deleted data disappears from backups as they rotate.
6. Security
Encrypted connections (TLS); e-mail addresses encrypted in the database (AES-256-GCM); passwords stored only as strong one-way hashes (Argon2id); IP addresses stored in the database only as keyed hashes; encryption keys kept separately from the database; internal services not reachable from the Internet; restricted and logged staff access; tested backups.
7. Your rights
You have the right to: access your data and receive a copy (Art. 15); rectify it (Art. 16); erase it (Art. 17); restrict processing (Art. 18); data portability in a machine-readable format (Art. 20); object to processing based on legitimate interests (Art. 21); and lodge a complaint with a data protection supervisory authority, in particular in the EU Member State where you live, work or where the alleged infringement occurred (Art. 77). A list of authorities is published by the European Data Protection Board (edpb.europa.eu).
How:
- in the game: Profile → Account → "My data" gives you an immediate copy of your account data held by the region's server, in a machine-readable format (JSON); there you can also see your devices, change your nickname, link or unlink sign-in methods and delete your account;
- without the app: the account deletion page {{EU_DOMAIN}}/api/v1/delete-account;
- via in-game Support (you are already identified by your account) or by e-mail to {{CONTACT_EMAIL}} from the address linked to your account. We do not ask for ID documents.
We reply within one month; for complex requests this may be extended by two months, and we will tell you why within the first month. Requests are free.
8. Children
The game is intended for players aged 12 and over. If you are under 16 (or the lower age set in your country), please play only with the permission of a parent or guardian, who should read this notice and our Terms. If you believe a child is using the game without such permission, contact us and we will delete the account.
9. Cookies and tracking
The game and these pages use no cookies, advertising identifiers, tracking pixels or third-party analytics or advertising SDKs. Your device stores only what is strictly necessary for the game to work: your session key, a device key (in Android's secure storage), the selected region and game settings. Notifications are local and not sent through third-party servers.
10. Changes
If we change this notice materially, we will publish the new version and show it in the game. The current version and date are at the top of this page.