Privacy Policy
Last updated 2026-08-22
This policy explains what Laravel (“the game”) collects about you, why, how long it is kept, and how to get it deleted. It describes the game as it actually works — every item listed below corresponds to something the game genuinely stores.
1. Who is responsible
JXD is the controller of the data described here.
- Postal address: REPLACE-ME — registered postal address
- Privacy contact: REPLACE-ME@example.com
- General contact: REPLACE-ME@example.com
2. Age requirement
The game is intended for players aged 13 and over. It is not directed at children under that age and we do not knowingly collect their data. If you believe a child under 13 has created an account, write to REPLACE-ME@example.com and we will delete it.
3. What we collect
You give us some of this directly; the rest is produced by playing. We do not ask for your real name, your phone number, your contacts, your photos, or your location.
| Data | Why we hold it |
|---|---|
| Account details Username, email address, password (stored only as a salted hash, never in readable form), optional display name |
To create your account, sign you in, and let other players see who they are playing against. Email is used to identify the account for support and recovery. |
| Device information A device identifier generated by the game, platform (e.g. Android), and device model |
To keep your progress attached to the right account and to reproduce bugs that only occur on particular hardware. |
| Game progress Level, experience, gold, gems, cards, decks, heroes, chests, quests, win/loss record, ladder points, clan membership |
This is your save file. It is held on our servers so that it survives reinstalling the game or changing device, and so that scores and rankings can be trusted. |
| Match data Opponents, results, and recorded replays of battles you played |
To run multiplayer matches, show match history and replays, and to detect cheating. |
| Clan chat messages | To deliver your messages to your clan, and to allow reports about them to be reviewed. See our Content Standards. |
| Moderation records Reports you file or that are filed about you (including a copy of the reported message), and the list of players you have blocked |
To act on abuse reports and to keep blocked players hidden from you. A copy of the reported message is kept because chat history is deleted automatically and the evidence would otherwise disappear before it is reviewed. |
| Diagnostic logs Technical log lines sent from the game, tagged with the device identifier and a session identifier |
To diagnose crashes and faults. These are engineering messages about what the game was doing — they are not a record of your chat or your personal content. |
| Purchase records Which product was bought, the amount, currency, status, and the store's transaction identifier |
To deliver what you paid for, to handle refunds and disputes, and to satisfy tax and accounting law. |
| Connection data IP address, and the time of your most recent activity |
Your IP address is processed to route your requests, to apply rate limits, and to blunt abuse such as password guessing; it may also appear in short-lived server logs. Last-activity time is what shows you as online to your clan. |
What we do not do
- We do not sell your personal data, and we do not share it for advertising.
- The game contains no advertising and no third-party advertising or analytics SDK.
- We do not track you across other apps or websites.
- We do not collect your location, contacts, photos, microphone, or camera.
4. Why we are allowed to hold it (legal bases)
If you are in the UK, EEA, or another region with equivalent law, our legal bases are:
- Performance of a contract — account details, progress, matches, chat delivery and purchases. Without these the game cannot be provided to you.
- Legitimate interests — diagnostic logs, rate limiting, anti-cheat, and moderation records. Our interest is running a game that works and is safe to play in; we hold only what those purposes need.
- Legal obligation — retaining purchase records for tax and accounting.
5. Who else sees it
We use a small number of service providers who process data on our behalf. They may only use it to provide their service to us.
| Provider | What it handles |
|---|---|
| REPLACE-ME — hosting provider and region | Hosting for the game servers and database — all of the data described above rests here. |
| Pusher | Real-time delivery of multiplayer battle events while a match is in progress. It carries in-match actions between the two players, not your account details. |
| Google Play | Processes purchases made through the Play Store and confirms them to us. We receive confirmation of the purchase; Google handles your payment details, which we never see. |
| PayPal | Used only in versions of the game distributed outside the Play Store, where it processes payment. It is disabled in the Play Store version. |
Other players see your display name, your level and ranking, your clan membership, and any chat message you send. We may also disclose data where the law requires it, or where it is necessary to investigate abuse, fraud, or a threat to someone's safety.
6. Where it is stored
Data is stored on our hosting provider's servers (REPLACE-ME — hosting provider and region). Where data leaves the UK or EEA, we rely on the safeguards offered by the provider concerned, such as standard contractual clauses.
7. How long we keep it
- Account, progress and match data — for as long as your account exists. Delete the account and it goes, as described in section 9.
- Clan chat — only the most recent 200 messages per clan are kept; older ones are deleted automatically as new ones arrive.
- Battle replays — only your most recent 20 are kept.
- Diagnostic logs — deleted after 30 days.
- Moderation records — kept while the report is open and for a period afterwards, so that repeat behaviour can be recognised.
- Purchase records — kept for 7 years, because tax and accounting law requires it. After account deletion these records remain but no longer identify you (see section 9).
8. Your rights
You can ask us to:
- give you a copy of the data we hold about you;
- correct anything that is wrong;
- delete your account and data (see section 9 — you can do this yourself);
- restrict or object to our processing where it relies on legitimate interests;
- provide your data in a portable form.
Write to REPLACE-ME@example.com. We will respond within one month. If you think we have handled your data badly you may also complain to your local data protection authority.
9. Deleting your account
There are two ways, and both erase the same things:
- In the game — open your player profile and choose to delete your account.
- On the web — use the account deletion page. This works even if you have already uninstalled the game; you will need your username and password.
Deletion is immediate and cannot be undone. When you delete your account:
- your username, email, display name and device information are erased;
- your progress, currency, cards, decks, heroes and ranking are erased, and you disappear from the leaderboard;
- your clan membership ends and your chat messages are deleted;
- your saved decks, battle sessions and diagnostic logs are deleted;
- every signed-in device is signed out immediately;
- your username and email become available for use again.
Two things deliberately survive, and neither identifies you afterwards:
- Finished matches and replays are kept, because they are also your opponents' history. Your name and device identifier are removed from them first.
- Purchase records are kept for the period in section 7 because accounting law requires it. They are detached from your erased account details.
10. Security
Traffic between the game and our servers uses encrypted connections. Passwords are stored only as salted hashes and cannot be read by us. Sign-in tokens are replaced regularly and are revoked the moment an account is deleted. Access to the administration tools is restricted to named administrators. No system is perfectly secure, but if a breach affects your data and puts you at risk, we will tell you and the relevant authority as required by law.
11. Changes to this policy
If this policy changes materially we will update the date at the top and, where the change is significant, tell you in the game before it takes effect.
12. Contact
JXD
REPLACE-ME — registered postal address
REPLACE-ME@example.com