NIDDAK
Privacy Policy
Last updated: 20 August 2026
This describes every category of personal data NIDDAK holds, why it is held, and how long. It is written from the database schema rather than from a template, so it lists what exists and not what a game like this might collect.
Playing without giving us anything
A guest gives us no personal data at all. The save sits in your browser's local storage, on your device. We receive nothing about it and cannot read it.
What an account holds
An email address and a password. The password is never stored: what is stored is a salted hash of it, which cannot be turned back into the password. Session tokens are stored hashed for the same reason, so a stolen copy of the database does not hand over live sessions.
Alongside it: your chosen champion and alliance, your interface language, your cards, decks and match record, your progress through the Climb, and your purchase history.
Payment data
We do not see or store card numbers. Payments are handled by a payment provider; what reaches us is the amount, the currency, whether it succeeded, and a reference we can use to match it to your order.
Why we are allowed to hold it
Your account and your game state are held to perform the contract you entered by creating an account. Purchase and payment records are held because tax and anti-money-laundering law requires it. Security logging rests on our legitimate interest in keeping accounts from being taken over.
How long
Account and game data are kept while the account exists and for ninety days after you delete it, so a deletion made by mistake or by someone else can be undone. Financial records are kept for the period Cypriot law requires, which is longer than that and outlives the account.
Who else sees it
Our hosting provider, which stores the database, and our payment provider, which handles the transaction. We do not sell personal data, we run no advertising, and there is no analytics or tracking script anywhere in the game or on this site.
One third party is reached by your browser and not by us: the web font used across the site is served by Google Fonts, which means your IP address is visible to Google when a page loads. Nothing else is fetched from anywhere else.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to the address at the foot of this page and we will answer within one month. If our answer does not satisfy you, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the authority where you live.
Transfers outside Europe
Data is stored inside the European Economic Area. If that ever changes we will use the European Commission's standard contractual clauses and say so here.
How to reach us
Operator: a company registered in Cyprus (details pending)