Privacy policy

§ 1. Data controller

The data controller is Mikołaj Ślęzak, running the business Mikołaj Ślęzak Brickweavers, Polish tax ID (NIP) 5851447962. For privacy matters, write to contact@powderandcrown.com.

When you email us, we receive your address, the message and anything you include in it. We use them only to reply and deal with your matter (Article 6(1)(f) GDPR, our legitimate interest in handling correspondence) and keep them only as long as that requires. Email is handled for us by Google Ireland Limited (Google Workspace) as our processor.

§ 2. Data on your device

The game stores the following in the app’s storage: the current battle, your campaign progress, your settings (for example sound, music, unit voices and language) and what the computer opponent has learned about your playing style in previous battles. This data does not reach us. If you have Android backup turned on, the system may save it to your Google account. Uninstalling the app or clearing its data deletes it from the device. In the browser demo, the same data is kept in your browser’s storage for this site, and clearing the site’s data in the browser deletes it.

§ 3. Two-player mode

Two-player mode connects two devices directly (WebRTC). On one Wi-Fi network you pass the connection codes to each other yourselves, by any means you like, they go only to the other player, and the game itself does not pass through any server. The network access permission is needed only for this mode. You can also scan the other player’s code with the camera as a QR code: the phone asks for camera permission only when you tap “Scan code”, the image is analysed only on your device and is neither stored nor sent anywhere, and the camera turns off as soon as the code is read or you cancel. Without camera permission you can paste the code instead. Two-player mode is not part of the browser demo.

By default both devices must be on the same Wi-Fi network, and the code contains only their local network addresses. If the host turns on online play, both devices ask STUN servers run by Google (stun.l.google.com) and Cloudflare (stun.cloudflare.com) which public IP address they can be seen at. In the process, the operators of these servers see the device’s public IP address and the time of the request, under the terms described in their privacy policies. We pass them no other data. When online play is turned off, the game does not use these servers.

In online play, the devices connect with a room code through our game server (siec.powderandcrown.com). The server passes between them only the data needed to set up the connection: the WebRTC connection description and the devices’ network addresses. In the process it sees both players’ public IP addresses and the time of the connection. The battle runs directly between the devices or, when the network doesn’t allow that, through Cloudflare’s relay (TURN), which then carries the game data. A room on the server holds only its code, random entry tokens and the relay credentials, and it disappears after the battle, at the latest 10 minutes after both players leave (always after 6 hours). The guest’s device remembers the room token for 8 hours so that the guest can return to an interrupted battle. The server runs on Cloudflare, Inc. (Cloudflare Workers and Cloudflare Realtime), which processes this data under the terms of Cloudflare’s privacy policy and keeps the server’s technical logs (connections and errors, which may include an IP address) for 3 days. Swapping codes without the game server (a button in the panel) works as before, with codes and STUN servers only.

§ 4. Purchases

You buy the full version of the game on Google Play or the App Store. Payment is handled by the store, under the terms described in its privacy policy. We do not receive your card details or any other payment data. There are no purchases in the browser demo.

§ 5. Browser demo

The demo runs entirely in your browser and downloads the game’s files from this website. It has no account and no ads, and it does not connect to any other servers. Downloading the files works like any other visit to the website (§ 6).

To learn whether people enjoy the demo and where players get stuck, the demo sends anonymous counters to this website: that the game loaded (and in how many seconds), which tutorial step someone reached, that a battle started or ended (difficulty, result, length in minutes), what opened the full-game window, how many minutes the visit lasted, and the beginning of a game error message if one occurs. Each batch carries only the game language and the device type (phone, tablet or computer). The server immediately adds them to daily totals and stores no IP address, identifier or time of day, so the data cannot single out any person or visit. The demo uses no cookies or browser storage for this. If your browser has Global Privacy Control or “Do Not Track” turned on, the demo sends nothing. The totals are kept in Cloudflare D1 (§ 6).

§ 6. Website

The website uses no tracking cookies and no analytics tools, and it has no forms. Fonts and images are downloaded from the same server as the site itself, with no Google Fonts or other third-party services. The site is hosted by Cloudflare, Inc. (Cloudflare Workers), which processes visitors’ IP addresses and technical request data to deliver the site and protect it against attacks, under Cloudflare’s own privacy policy.

§ 7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing and to data portability. You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.

§ 8. Changes

If the game or the website starts processing other data (for example, if we add a newsletter), we will update this policy beforehand and give a new effective date.