Privacy Policy

This policy explains what data the game Wartales of Aerin (Android, iOS) and its website collect, why, for how long, and how to delete it. We try to collect only what the game cannot work without.

1. Who is responsible

The data controller is Silver Ventures OÜ, Estonia. For any privacy question, write to [email protected]. We follow the EU General Data Protection Regulation (GDPR) and Estonian law.

2. What data we process

Account

• Guest sign-in: a random identifier the game creates on your device on first launch. It is not a hardware ID or an advertising ID.
• E-mail sign-in: your e-mail address and password. The password is stored only as a cryptographic hash (bcrypt); we never see it in plain text. We do not send you e-mails.
• Profile: nickname, chosen portrait, player ID, registration date and date of the last nickname change.

Game data

• Progress, inventory, gold and crystals, appearance (banners, frames, themes), achievements, daily quests, “First win of the day”.
• Game settings synced to the server (for example language and in-game notifications).
• Referral codes, invited players, redeemed promo and creator codes.
• In-game mail (letters with rewards and gifts) and read marks.

Matches

• Battle history: opponents, mode, map, result, battle statistics and replay data.

Communication

• Your friends list and friend requests.
• Private messages to friends (up to 300 characters), stored so the conversation history can be shown.
• Party chat messages, visible to lobby members and kept only while the lobby exists.
• Messages sent via “Write to the developer” (links in them are replaced automatically).

Technical data

• IP address: for abuse protection (rate limiting, promo code protection) and in server logs.
• First and last sign-in time, game version, platform (Android/iOS), length of play sessions.
• Ban status and the administrator action log, if measures were taken against the account.

Purchases

There are currently no paid purchases in the game. If we add crystal purchases (in the app stores, on the website via Stripe, or via Telegram Stars), the payment is handled by that payment provider and your card details never reach us. We only receive the order details: pack, amount, time, the recipient’s player ID and, for a gift, the sender’s name and message.

We do not collect precise location, contacts, photos, microphone data, advertising IDs or data from other apps. The game only needs internet access.

3. Why and on what legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): your account, saving progress, online battles, friends, messages, mail, rewards, purchases.
• Legitimate interests (Art. 6(1)(f) GDPR): security, protection against cheating, spam and abuse, fixing bugs reported by players, anonymous online statistics for server planning.
• Legal obligation (Art. 6(1)(c) GDPR): accounting records of payments, once payments exist.

4. How long we keep data

• Account and game data: for as long as the account exists.
• Detailed battle statistics and replays: 90 days; after that only a short result record remains.
• Play sessions: 90 days. Anonymous online statistics (player counts only): up to 400 days.
• Rate-limiting records (IP, e-mail): 1 day.
• Server logs: automatically overwritten as they fill up (limited size).
• Database backups: 7 days.
• Payment records (once they exist): as long as Estonian accounting law requires (up to 7 years).

5. Who we share data with

• Other players can see your nickname, portrait, player ID, appearance, achievements and battle statistics.
• Hosting: the game servers run at DigitalOcean in Frankfurt (Germany, EU); network and DNS services are provided by Cloudflare. They process data only on our instructions.
• Payment providers (Apple, Google, Stripe, Telegram), only when you make a purchase, under their own privacy policies.
• Public authorities, only where the law requires it.

Where a provider is located outside the EEA (for example in the USA), the transfer is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How to delete your account

• In the game: Profile → gear icon (Account settings) → “Delete account”, then confirm. Your profile, progress, inventory, friends, messages to the developer, achievements and other data are deleted immediately; in other players’ match history you remain as an anonymous player.
• By e-mail: write to [email protected] from the address linked to your account, or include your player ID. We will reply within 30 days.

Deleted data disappears from backups within 7 days. Deletion is permanent: crystals and purchased items cannot be restored.

7. Your rights

You can request access to your data and a copy of it, rectification, erasure, restriction of processing and data portability, and you can object to processing based on legitimate interests. Write to [email protected].

You also have the right to lodge a complaint with the supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, [email protected]), or with the authority in your country of residence.

8. Children

The game is not directed at children under 13. In the EU you need to be at least 16, or the age set by your country’s law (13 in Estonia), to consent to data processing yourself. If you are younger, play only with your parents’ consent. If we learn that a child created an account without such consent, we will delete it; parents can contact us at [email protected].

9. Security

Passwords are stored only as hashes, server access is restricted, messages are checked for links and spam, and data is backed up regularly. No system is perfectly secure, but we respond quickly to vulnerability reports.

10. Changes to this policy

We update this page when the game changes. We will announce significant changes in the game or in our Telegram community.