Privacy Policy

Data we collect

Game account: a random player ID created when you first open the game, and a session token to keep you signed in.

Sign-in (optional): if you choose "Save progress", the account identifier that Google or Apple gives us for this game. We do not receive your password, and we do not store your name or contacts from those services.

Web shop account (optional): your email address and a securely hashed password.

Profile: the nickname and avatar you choose, your friend code, your friends list and gifts you send or receive.

Game progress: board, items, orders, levels, coins, gems, energy, story choices and event progress.

Purchases: the product, price, date, store and the purchase receipt or token needed to validate it. Payments are processed by Google Play, the App Store or Stripe; we never see or store your card details.

Gameplay events: in-game actions such as finishing an order, a story step or a purchase, linked to your player ID, used to balance and improve the game.

Crash reports: when the app crashes or hits an error, Firebase Crashlytics collects the device model, operating system version, app version, an installation identifier and technical details of the error.

Technical data: like any online service, our servers process your IP address and basic request data to deliver the game and protect it from abuse. These logs are kept for a limited time.

What we do not collect

We do not collect your precise location, contacts, photos, microphone or camera. We do not sell your data, and we do not use it to track you across other companies' apps or websites. This version of the game shows no third-party advertising.

How we use your data

To run the game and keep your progress; to restore your progress on a new device; to validate purchases and deliver what you bought; to let you add friends and send gifts; to fix crashes and errors; to balance the game economy and improve the game; and to prevent cheating, fraud and abuse.

Who we share it with

Service providers that process data on our behalf only to run the game: Google Cloud (servers), MongoDB Atlas and Redis (database and cache), Cloudflare (network, security and content delivery) and Firebase Crashlytics (crash reports).

Google and Apple: to sign you in and to validate store purchases. On Android, the game can keep your session in your Google account backup (Block Store) so it survives reinstalling.

Stripe: to process web shop payments.

Other players: your nickname, avatar, level and friend code are visible to your friends.

We may also disclose data when required by law or to protect the rights and safety of our players and our service.

Retention and deletion

We keep your data while your game account exists. You can ask us to delete your account and all associated data at any time by writing to [email protected] (include your friend code, shown in Friends); the steps are at heirloom.kreate.games/delete-account. We delete it within 30 days, except records we must keep by law, such as purchase records for tax purposes. Crash reports are deleted automatically after 90 days and server logs within 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to or limit its processing. To exercise any of these rights, write to [email protected]. We will answer within the time required by applicable law.

Children

Heirloom is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has given us data, write to [email protected] and we will delete it.

Security

Data travels encrypted (HTTPS). Passwords are stored hashed, access to our systems is restricted, and each request is validated by our servers.

International transfers

Our providers may process data in the United States and other countries. We rely on them to protect it with safeguards equivalent to those described here.

Changes

If we change this policy we will update the date above, and for important changes we will let you know in the game.

Contact

Kreate · [email protected]