Privacy Policy

Controller

Sören Dierkes
Gersteweg 18
26125 Oldenburg, Germany
Contact: contact@tactics-arena.xyz

Summary

Tactics Arena shows no ads, requires no registration and sends usage statistics and crash reports only if you agree on first launch (see “Usage statistics and crash reports”). On first launch the app creates an anonymous technical account on our game server, with a random account id and no name, email address or password. Your save lives on that server; the app keeps a display copy. Fights are opened and replayed by the server. If you sign in to Google Play Games, the server stores your Play Games player id so you can find your account again on a new device. Purchases are handled by Google Play; our server verifies each purchase with Google and credits the gems. The website itself sets no cookies and counts no visits; what still goes to third parties when a page loads is listed under “This website”.

Save game

On first launch the app creates an anonymous technical account on our game server, hosted on Supabase in the EU (Ireland region): a randomly generated account id with no name, email address, password or any other link to your identity. Your save lives on that server and only there: campaign, stars, Hero Trials, heroes and cards, unit levels and perks, gems, XP, Wild Cards, Sky Spire floor, Map Fragments, Valor Marks, Hollow streak and achievements. The app keeps a display copy, which it replaces from the server. Your settings stay on the device only.

Every change to gems, XP, cards and Valor Marks is written to a ledger with its time and reason, and once a day the server keeps a copy of the save. That is how we spot manipulation and protect purchases (Art. 6 (1)(b) and (f) GDPR). If you clear the app's data or uninstall without being signed in to Google Play Games, access to this account is gone. We delete it on request (see "Deleting your account").

Fights

Every fight in the campaign, the Sky Spire, the Arena and the Hollow is opened by the server and, at its end, reported by your device to the server. What is reported are your moves, not a result: which units you picked, when you rerolled, when you used your hero's abilities, and which relic you took in the Hollow. The server replays the fight with the same rules and credits the reward. These four modes therefore need an internet connection; the quick match runs without the server.

For the campaign, the Sky Spire and the Arena the moves are not stored. The fight itself is: which fight, hero, unit levels and perks, outcome, reward, app version and times. For the campaign and the Sky Spire we delete that record after 90 days. An Arena attack keeps its record as before (see "Arena (online)"), now with the attacker's roster and the settlement. A Hollow run is stored with its day, hero, band with unit levels and perks, the cave reached, relics, outcome, reward, app version and times; its moves are stored with the run and deleted after 90 days. The ledger entries (see "Save game") stay.

Arena (online)

When you enter the Arena, the following data is transferred to and stored on our game server (hosted on Supabase):

• a randomly generated player id (UUID, unrelated to your identity),
• the name you pick, plus the number the server appends to it,
• your Banner, once you design one: field color, trim, emblem and emblem color, stored as four numbers,
• your Rank, meaning your place on the ladder, a number from 1 to 100. There is no rating and there are no points,
• your Defense: five rounds of three units each, together with the hero, unit levels and perks from your save game,
• your Valor Mark balance,
• how many attacks and re-draws you have used today, and which two opponents you are currently being offered,
• one record per attack: who attacked whom at which place, the random seed of the fight, the week, the attacker's roster (hero, unit levels and perks), the settlement, the outcome, the app version and the time,
• at the end of each week (Sundays 18:00 UTC) your name, your place and the Valor Marks it paid you,
• when your entry was created and when you last changed your Defense.

How an attack is reported and replayed is described under "Fights".

Other players see your name, your Banner and your place on the ladder. Signed-in players can read your stored Defense as well; in the game it is shown to whoever attacks you. At the end of each week the whole ladder is recorded with names, places and Valor Marks, and stays readable for every player.

Reporting a name: if you report another player's name on the ladder, we store your account id, the reported player's id, the name as it was shown to you and the time, until the report is handled (Art. 6 (1)(f) GDPR, our legitimate interest in a game without abuse). A name that breaks the rules is reset to "Player". Hiding a player stays on your device and is not transmitted.

This data is used solely to run the game (Art. 6 (1)(b) GDPR). The server-side counters for attacks, re-draws and opponent offers also protect against manipulation (Art. 6 (1)(f) GDPR). The Arena data is tied to the anonymous technical account described above. You pick the name yourself: if you enter your real name there, other players will see it. No contact data is collected, the data is never linked to your identity, never used for advertising and never sold. We delete it on request (see "Deleting your account").

Google Play Games

If you sign in to Google Play Games on your device (that is Google's sign-in, not ours), the app sends a one-time code to our server. The server uses it to obtain your Play Games player id from Google and stores that id with your account. Purpose: finding your account again on a new device. When you sign in there with the same Google account, the server finds your account through the id and brings it to the new device. The previous device then loses access; a save is reachable from one device at a time. If the new device already has progress of its own, the app asks first which one to keep. Only the id is stored on our server, never your Play name or picture (Art. 6 (1)(b) GDPR). While you are signed in, the app also reports your achievements to Google Play Games: which ones you have earned and the counters of the rest. Google's privacy policy applies to that. Without this sign-in there is no recovery.

Inviting friends

Every account has an invite code. Our server creates it the first time you open "Invite friends", and it never changes. When someone installs the game from Google Play through your link, Google Play hands the app the install source (the "install referrer") on its first start, and the code is in it. The app reads it on the device and sends only the code to our server; the same goes for a code someone types in. The server then stores which account invited which, when, and when the reward for it was paid, and books the gems in the ledger like any other credit (see "Save game"). The only purpose is paying the reward (Art. 6 (1)(b) GDPR). The player who invited sees the friend's Arena name once the friend plays, and the friend sees the Arena name of the player who invited them. The invite is deleted with the account, yours or your friend's (see "Deleting your account"). The page behind the link, tactics-arena.xyz/i/, reads the code from the address in your browser only and adds it to the link to Google Play.

Purchases

Gem pack purchases are processed by Google Play. We receive no payment data (no account numbers, no billing address). Our server verifies each purchase confirmation (purchase token) provided by Google Play against the Google Play Developer API; only then are the gems credited. Stored with the anonymous account are the purchase token, product, order number, time, whether it was a test purchase, and its state (credited or refunded) (Art. 6 (1)(b) and (f) GDPR). A hash of your account id travels with the purchase to Google, so the purchase can be matched to your account. Once a day the server asks Google for refunded purchases and takes the gems back. Purchase records stay after account deletion, then without the account id, for as long as tax law requires them to be kept (section 147 of the German Fiscal Code). Google Play's own privacy policy additionally applies.

Usage statistics and crash reports

On first launch the app asks whether it may send anonymous usage statistics and crash reports to Google. If you say no, nothing is sent; you can change the answer at any time in the settings under “Statistics and crash reports”. If you say yes, the app uses Google Analytics for Firebase and Firebase Crashlytics (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor). Sent are in-game events (for example first fight, shop opened, purchase completed), sessions, crash reports with device model, Android version, app version and the state of the app at the crash, and a random installation id that Firebase stores on the device. No advertising id, no name, no account id. The data may be processed in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (section 25 (1) TDDDG, Art. 6 (1)(a) GDPR). Withdrawing it takes effect at once; data already sent stays until its retention period ends: Analytics 14 months, Crashlytics 90 days.

Push notifications

The app sends no push notifications today and does not ask for the permission to do so. If an update adds them, this policy is updated first.

Permissions

The app never asks you for a permission. The package declares Internet and network state (save game, fights, Arena, purchase verification, Google Play Games, statistics and crash reports), wake lock (Firebase uses it to schedule the sending of statistics and crash reports), Google Play Billing and the binding to Google Play's install service. The app reads the install source through it on first start (see "Inviting friends"), and the Analytics SDK uses it too. No advertising-id permission is in the package.

Former beta signup on this website

Until 15 September 2026 you could voluntarily leave your email address on the start page to be notified once when the Tactics Arena test opens up for you. That form is gone and no new addresses are collected. The addresses left there are still on our server hosted on Supabase in the EU (Ireland region), together with the time of signup, the language chosen on the page and, if the entry came through an ad, the campaign tag from the address bar (UTM parameters). They are used solely for that one notification (Art. 6 (1)(a) GDPR), never shared with third parties and never used for any other advertising. You can withdraw your consent at any time: an informal email to the address above is enough, and we will delete the entry. Addresses are deleted at the latest twelve months after signup, or right after the notification.

This website

tactics-arena.xyz is hosted on GitHub Pages, operated by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When a page is requested, GitHub logs the visitor's IP address for security purposes. Without that transfer the page cannot be delivered; the legal basis is Art. 6 (1)(f) GDPR (providing and securing the website). GitHub is certified under the EU-U.S. Data Privacy Framework and also uses the European Commission's standard contractual clauses for transfers to the USA. Details are in GitHub's privacy statement.

Nothing else is processed on the website: no analytics, no ads, no cookies, no contact form. Fonts, images, stylesheets and the trailer come from the same server as the page; nothing is loaded from third parties. German and English are separate pages (tactics-arena.xyz and tactics-arena.xyz/en/), and you switch between them with the EN or DE link; the website remembers nothing about that.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. How to delete your account and its server data is described under "Deleting your account".

Deleting your account

From the version with Play Games sign-in you can delete your account in the app's settings. This removes the save, the ledger, the Arena entry (your seat goes to a bot and your chosen name is replaced), Hollow runs, the Google Play Games link and the technical account from the server. Attacks that point at your entry and the weekly results stay, under the replaced name. Purchase records stay without the account id (see "Purchases"). You can also request deletion by email to the address above; name your Arena name with its number or, from the version with Play Games sign-in, the account id from the settings. Both are also on the support page.

Changes

When the app's features change, this policy is updated; the current version is always at the URL stored in the Play Store listing.