Privacy Policy

This Privacy Policy explains how Ancient Battlegrounds ("we", "us", "our") collects, uses, shares and protects personal information when you use the Ancient Battlegrounds mobile game (the "Service"). It applies to the Android and iOS versions of the Service and should be read with our Terms and Conditions.

We are the controller (and, where POPIA applies, the responsible party) for the personal information described here. Our contact details are in section 14.

1. Summary

• We collect what we need to run an account-based, real-time multiplayer card battler: your account details, gameplay data, marketplace and purchase records, and technical information needed for security and operation.
• We do not sell your personal information and we do not use it for cross- context behavioural advertising. The current version of the Service contains no third-party advertising SDKs.
• We share information only with the service providers that make the Service work, principally Google Firebase, RevenueCat, and Apple or Google for store billing, and with other players where multiplayer, leaderboards and the marketplace require it.
• We do not collect or store your payment-card details.
• You can delete your account and associated gameplay data in-app at any time.

2. Information we collect

2.1 Account information.

To create and access an account you provide an email address, a password and a display name. Authentication is provided by Firebase Authentication. We do not receive or store your password in readable form.

2.2 Profile and gameplay information.

We store:

• your account identifier and display name;
• your selected faction;
• game progress, including campaign and progression state;
• card inventory, card levels and deck information;
• your virtual-currency balance;
• achievements, challenge progress and reward-ladder progress;
• leaderboard entries and rankings;
• matchmaking information, including queue state, rank or rating, and region or latency signals used to find suitable matches;
• battle state for in-progress and recent matches; and

• match history, including opponents, outcomes and timestamps.

Your display name, faction and certain game-related information may be visible to other players where needed for multiplayer matches, leaderboards or marketplace features. Treat your display name as public.

2.3 Marketplace information.

Where you use the player marketplace, we store your listings (item, quantity, asking price in in-game currency, listing time, expiry, status and relisting history), your purchase and sale history, your in-game currency balance changes arising from marketplace activity, and information used to detect fraud, manipulation and prohibited real-money trading. Marketplace transactions are conducted only in in-game currency and no payout or financial account details are collected.

2.4 Purchase and entitlement information.

If you make an in-app purchase, Apple or Google processes the payment. We do not collect or store your payment-card details. RevenueCat helps us identify the relevant store product, confirm purchase status, and deliver the corresponding in-game entitlement, using a pseudonymous account identifier and transaction-related information such as product identifier, transaction status, purchase timestamp, store, and renewal or refund events. From RevenueCat we receive entitlement and transaction data but not your card number.

2.5 Technical and service information.

Our service providers may process technical information needed to operate and secure the Service, including:

• app and device identifiers;
• IP address and network information (used for connectivity, regional matchmaking, abuse prevention and approximate location inference);
• operating system and version, device model, and app version;
• purchase and authentication events;
• crash logs, diagnostics and performance data;
• security signals such as login attempts, session data and integrity checks; and
• limited on-device preferences such as audio and visual-effect settings, stored locally on your device.

2.6 What we do not collect.

We do not knowingly collect precise GPS location, contacts, calendar, photos, health data, biometric data for identification, or advertising identifiers for behavioural advertising in the current version of the Service. If a future feature requires an additional category, for example a chat feature or an advertising SDK, we will update this policy and, where required, seek your consent or make platform-level disclosures before that feature goes live.

3. How we use information, and our legal bases

Legal basis (GDPR/UK Purpose Information used GDPR) Performance of a contract; Create, authenticate and Account info, technical legitimate interests secure accounts info (security) Save progress; enable multiplayer, leaderboards, Profile, gameplay, Performance of a contract; marketplace and marketplace info legitimate interests matchmaking Process and deliver in-app Performance of a contract; Purchase/entitlement purchases; prevent fraud legitimate interests (fraud info, technical info and chargeback abuse prevention); legal obligation Operate, troubleshoot, Legitimate interests; Technical, gameplay and maintain and improve the consent where required for diagnostic info Service optional analytics Detect and prevent cheating, Gameplay, technical, Legitimate interests; exploitation, RMT and abuse marketplace info performance of a contract Communicate service, Performance of a contract; Account info security and policy notices legal obligation Comply with legal Any of the above as Legal obligation; legitimate obligations and enforce our needed interests Terms

Where we rely on legitimate interests, we balance our interests against your rights and expect our interests to be overridden where your rights require it; you may object as described in section 9. Where we rely on consent, for example, if we introduce optional marketing or optional analytics, you may withdraw it at any time without affecting your use of the Service.

Under POPIA, we process information with your consent, or where processing is necessary to perform in terms of a contract, to comply with a legal obligation, to protect a legitimate interest, or for another ground permitted by law.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects. Matchmaking and anti-cheat systems use automated processing to select opponents and detect anomalies; these affect gameplay only and are not decisions of legal significance.

4. Cookies, local storage and SDKs

The Service is a mobile app and does not use browser cookies for its core operation. It uses local device storage for preferences and session state, and service-provider SDKs (Firebase, RevenueCat) that transmit the information described in section 2 to

our providers. We do not include third-party advertising SDKs in the current version, and we do not operate cross-app tracking for advertising.

5. How information is shared

We share information only as needed to run the Service:

5.1 Google Firebase — provides authentication (Firebase Authentication), game data storage (Cloud Firestore), and multiplayer presence (Realtime Database). Firebase processes account, gameplay and technical information on our behalf as our processor.

5.2 RevenueCat — provides purchase-entitlement and in-app purchase infrastructure. RevenueCat processes pseudonymous account identifiers and transaction-related information to validate purchases and deliver entitlements.

5.3 Apple and Google — process purchases through their respective app stores and may process related transaction information under their own privacy policies.

5.4 Other players — may see your display name, faction, and gameplay, match, leaderboard or marketplace information made available through multiplayer, leaderboards or marketplace features.

5.5 Corporate transactions — we may disclose information in connection with a merger, acquisition, reorganisation, financing or transfer of assets, subject to appropriate confidentiality protections.

5.6 Legal and safety — we may disclose information where required by law, to respond to valid legal process, to enforce our Terms, to protect users or the Service, or to prevent harm or illegal activity.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. We do not share personal information with advertisers or data brokers.

6. International transfers

Our service providers may process information in countries other than the one where you live, including the United States, the European Economic Area, the United Kingdom and other locations where they or their sub-processors operate. Where required, we rely on appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and, where applicable, the EU–US Data Privacy Framework for transfers to certified US organisations. Where POPIA applies, we require operators to maintain comparable confidentiality and security protections. You may contact us for more information about the safeguards used.

7. Retention and deletion

We retain account and gameplay information while your account is active and for as long as reasonably necessary to operate the Service, resolve disputes, enforce agreements and meet legal obligations. We may retain limited purchase, fraud- prevention, transaction and security records where required by law or for legitimate accounting, dispute-resolution and security purposes. Where information is no longer needed, we delete it or de-identify it.

Typical retention periods:

Category Retention While the account is active; deleted on account Account and profile data deletion Gameplay, battle and match Limited rolling period, then deleted or aggregated history Marketplace listing and trade Retained for fraud-prevention and dispute purposes records Purchase and entitlement Retained as required for tax, accounting and records chargeback purposes Security, integrity and abuse- Retained for a limited period, extended where prevention logs needed for an active investigation

Deleting your account. You can permanently delete your account and associated gameplay data in the app: open the menu, choose "Account, support & legal," then choose "Delete account & game data." You can also use our account-deletion page to submit a request. We may need to verify your identity before acting. Deleting your account permanently removes access to game progress and virtual items that cannot be restored. Certain records (for example, purchase records required for tax, accounting or fraud prevention) may be retained after deletion as described above, and we will delete or de-identify them once no longer required.

8. Security

We use reasonable technical and organisational measures designed to protect information, including encryption in transit, access controls, and provider-side security features from Firebase, RevenueCat and the app stores. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you and creates a risk to your rights, we will notify you and the relevant regulator as required by applicable law.

9. Your choices and rights

Depending on where you live, you may have some or all of the following rights:

• Access — a copy of the personal information we hold about you;
• Correction — rectification of inaccurate or incomplete information;
• Deletion — erasure of your information in specified circumstances;
• Restriction — limitation of how we process your information;
• Objection — objection to processing based on legitimate interests, including profiling;
• Portability — receipt of information you provided in a structured, machine- readable format;
• Withdrawal of consent — where we rely on consent; and
• Non-discrimination — we will not deny you the Service or degrade it because you exercised a privacy right, though a deletion request removes your account and progress.

You can update your display name and faction in the Service. To make a privacy request, contact us using the details in section 14. We may ask for information needed to verify your request and will respond as required by applicable law.

California residents. Subject to the CCPA/CPRA thresholds, you may request to know, delete, or correct personal information, and to opt out of sale or sharing; we do not sell or share personal information as those terms are defined. You may authorise an agent to make a request on your behalf, subject to verification. South African residents have rights under POPIA, including to request access and correction and to object to processing, and may lodge a complaint with the Information Regulator.

You may also lodge a complaint with your local data-protection authority. In South Africa, that is the Information Regulator; in the EU/UK, your national supervisory authority; in California, the California Privacy Protection Agency or the Attorney General.

10. Children

The Service is not directed to children under the age at which they can lawfully consent to data processing in their country. We do not knowingly collect personal information from children in breach of applicable law. Where a platform's age rating or regional rules require a higher minimum age, that minimum applies. If you believe a child has provided us personal information, please contact us so that we can investigate and take appropriate action, which may include deleting the account and associated information.

11. Automated systems and analytics

We use automated processes for matchmaking between human players, game balance and rating calculation, and integrity and anti-cheat detection. Matchmaking processes gameplay and technical information to select human opponents. The current Service does not use an AI or computer-controlled opponent fallback. We may use aggregated or de-identified information for analytics, service improvement and reporting; where information is aggregated or de-identified we take steps to ensure it cannot reasonably be linked back to you.

12. Changes to this policy

We may update this Privacy Policy when the Service or applicable law changes. We will post the revised version here and update the "Last updated" date. Material changes may also be communicated through the Service or as otherwise required by law. Where a change requires your consent, we will ask for it before the change takes effect. Where we add features that involve new categories of personal information, for example a subscription, a chat system, or an advertising SDK, we will update this policy and make the required platform disclosures before those features are used.

13. Third-party policies

The privacy practices of Apple, Google, Firebase and RevenueCat are governed by their respective privacy policies, which we encourage you to read. Links are available in the app and on the relevant providers' websites.

14. Contact us

For privacy questions or requests, email ancientbattlegrounds11@gmail.com. If you are unsatisfied with our response, you may contact the data-protection regulator in your country.