Privacy Policy

The short version

• You don't create a username or password. The game gives you an anonymous player account automatically.
• We use your player account to run online matches, keep your progress, and stop cheating.
• Analytics are off until you agree if you're in the EU, the EEA, the UK or Switzerland. Everywhere else they're on, and you can turn them off at any time in Profile → Analytics.
• Ads are optional: they only show when you tap a button to watch one for a reward.
• We don't sell your data.
• You can ask us to delete your account and data at any time: here's how.

What we collect and why

Your player account (Unity Authentication)

When you first open the game, it signs you in to Unity Gaming Services (UGS) with an anonymous player ID, a random identifier created for this installation. No name, email or phone number is needed.

Optional: Google Play Games. If you tap the account button, your player account is linked to your Google Play Games account, so you keep your progress on a new phone. The game then receives your Google Play Games player identity and your profile display name, which it uses as your in-game name (you can change it). Signing out unlinks this device, and the game continues as a new anonymous player.

Your profile and progress (Unity Cloud Save and Cloud Code)

Saved against your player ID:

• your display name: one you choose, your Google profile name, or a generated "Player 123". Other players see it in matches;
• your faction choices;
• your game progress: gold, gems, units, unit levels, decks, chests, missions, the season pass, campaign standing, and purchase records.

Your progress is changed by our server code (UGS Cloud Code), not by the app, so it can't be edited to cheat. Purchase records (order IDs and what they granted) are kept so refunds can be handled.

Online matches (our match server, Unity Relay and Lobby)

Online matches, including matches against the labelled AI, run on our own match server. Your phone reaches it through Unity Relay, and games are found through Unity Lobby.

• What the server receives: your player ID (checked with Unity's sign-in service), your display name, your deck and your picks.
• What it sends to Cloud Code: each match's result, signed so it can't be forged.
• What other players see: your display name. There's no chat.
• Server logs: the match server's logs include player IDs, display names and match events. We use them only to investigate bugs and cheating, and keep them for at most 30 days.
• Network addresses: Relay and Lobby process your IP address to connect you. We don't store it.

Analytics (Unity Analytics)

We record gameplay events to understand how the game is played and to balance it: the app starting and stopping; matches started and finished and their results; draft picks; connection drops; shop views, purchases and pack openings; rewards, chests, ads watched, the season pass and missions.

The Unity Analytics SDK also sends standard events: a new player, the game running, and the device's model, operating system and settings. Events use your pseudonymous player or installation ID. No names, emails or opponent identities are sent.

Your choice:

• In the EU, the EEA, the UK and Switzerland, analytics stay off until you agree in the first-run prompt.
• Elsewhere, they're on by default.
• Everywhere, you can turn them off at any time in Profile → Analytics. Turning them off stops collection and discards events not yet sent.

Rewarded ads (Unity LevelPlay)

The game shows rewarded video ads only, and only when you tap a button to watch one: doubling a match's gold, taking an hour off a chest, or the free daily item. There are no banner or pop-up ads, ads never change a match, and you can buy ad-free to turn ad requests off.

• Who serves them: Unity LevelPlay and the ad networks it works with (currently Unity Ads).
• What they collect: to show and measure ads and prevent ad fraud, they may collect your device's advertising ID, IP address, device and app information, and ad interactions.
• What we pass to LevelPlay: your player ID, so our server can confirm a watched ad's reward.
• Opting out: you can reset or delete your advertising ID, or opt out of personalised ads, in your Android settings (Settings → Google → Ads, or Settings → Privacy → Ads).

Ads in the current test versions are test ads. In the EU, the EEA, the UK and Switzerland, you'll be asked for consent to personalised ads before real ads are shown.

Purchases (Google Play Billing)

In-app purchases are processed by Google Play. We never see your card or payment details. We receive a purchase receipt (product, order ID, purchase token), which our server checks with Google before granting the item. We also receive notice of refunds, so refunded items can be removed.

Device integrity (Google Play Integrity)

To protect fair play and purchases, the game asks Google Play for an integrity verdict (whether the app and device appear genuine). Our server checks it and stores it with your player account. It's only used to flag possible cheating, and it doesn't block play.

What we don't collect

No precise location; no contacts, photos, microphone or camera; no health or financial account data; and no messages (there's no chat). We don't use a crash-reporting service.

Who processes your data

How long we keep it

• Player account, profile and progress: until you ask us to delete them.
• Analytics events: kept by Unity under its retention policy; deleted with your account on request.
• Server logs: at most 30 days.
• Encrypted backups of progress (for recovering from an outage): hourly ones 7 days, daily ones 90 days, weekly ones 365 days. A deleted account is never restored from them; they simply expire.
• Purchase and refund records: as long as needed to handle refunds and chargebacks, prevent fraud, and meet legal obligations, even after your account is deleted.

Deleting your account

You can ask us to delete your account and data at any time. See Delete your account for how, what's deleted, what's kept, and how long it takes.

Children

PIA is not directed to children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has used the game, contact us and we'll delete the account.

Security

Connections to Unity's services use HTTPS, and online matches use encrypted connections (DTLS) through Unity Relay. Progress and purchases are changed only by our server code.

Your rights

Depending on where you live (for example under the GDPR or the UK GDPR), you can ask to access, correct, delete or export your data, object to its use, or withdraw consent. Email flompo.support@gmail.com. You can also complain to your local data protection authority.

Changes

We'll post any change on this page and update the effective date above.