Privacy Policy

Playing as a guest

A guest gives us no name, no email and no account. The save sits in your browser's local storage, on your device; we receive nothing about it and cannot read it.

Two things can reach us even so, and we would rather say them plainly than let the sentence above imply otherwise. Any request your browser makes carries your IP address, which our host writes to a short-lived security log. And if you agree to gameplay measurement, the game sends us a small stream of gameplay events, described below; until you agree, it sends none.

What an account holds

An email address and a password. The password is never stored: what is stored is a salted hash of it, which cannot be turned back into the password. Session tokens are stored hashed for the same reason, so a stolen copy of the database does not hand over live sessions.

Alongside it: your chosen champion and alliance, your interface language, your cards, decks and match record, verified replays, reports and blocks, your progress through the Climb, season reward claims, and your purchase history.

Payment data

We do not see or store card numbers. Payments are handled by a payment provider; what reaches us is the amount, the currency, whether it succeeded, and a reference we can use to match it to your order.

For regional currency, the server may use a coarse country code from trusted hosting or edge infrastructure. We do not store the raw IP address in the order for this choice; the order stores the amount, currency and payment reference.

Why we are allowed to hold it

Your account and your game state are held to perform the contract you entered by creating an account. Purchase and payment records are held because tax and anti-money-laundering law requires it. Security logging rests on our legitimate interest in keeping accounts from being taken over. Optional analytics and gameplay measurements run with consent; the Account screen can also switch NIDDAK's own gameplay measurements off or on.

How long

Account and game data are kept while the account exists and for ninety days after you delete it, so a deletion made by mistake or by someone else can be undone. Financial, tax, compliance, and verification records are kept for the period UK law requires, generally six years after the relationship ends unless a longer period is needed for a dispute, investigation, or legal duty.

Who else sees it

Our hosting provider, which stores the database, and our payment provider, which handles the transaction. Google Analytics receives page and product usage signals only if analytics is accepted in the cookie banner. We do not sell personal data, run advertising, send card data or player-entered text to analytics, or collect an advertising identifier.

The web font is still served from this site. The sandbox checkout page does not load analytics scripts, so card fields stay outside that boundary.

Gameplay measurements

With consent, the game records what happens in it: that a duel started, was paused and how it ended, which round a Read was spent on and whether it was right, which floor of the Climb a run reached, whether a challenge was reported or blocked, when a screen threw an error, how smoothly a round's animation played and which of two versions of it was shown, and, only if you choose to answer the one question about it, whether you could follow the last round. It is how we find out that a card is a trap or that a tutorial step loses people, and there is no way to learn either of those from a game that measures nothing.

It is attached to a random identifier your browser generates for itself. It is not built from anything about your device, so two people with identical phones get different ones, and clearing your site data ends one and starts another. If you have an account, the events are attached to it as well.

While two ways of showing a round are being compared, your browser also keeps a number from 0 to 99, drawn at random the first time it is needed, that decides which of the two it gets. That number stays on your device and is never sent; only which version was shown is recorded. Clearing your site data draws a new one.

What is never in it: your IP address, your country or city, your device model, your browser's user agent, any advertising identifier, and anything you typed. The event names and the exact fields each one may carry are a fixed list in the game's source; anything not on that list is discarded rather than stored.

It is deleted after ninety days, automatically, by the server itself rather than by anyone remembering. You can switch it off entirely on the Account screen; switching it off also discards whatever has not been sent yet.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, restrict how we use it, object to how we use it, or ask for portable data where the right applies. Write to the address at the foot of this page and we will answer within one month. If our answer does not satisfy you, you can complain to the UK Information Commissioner's Office (ICO), or to the authority where you live.

Transfers outside the UK

Data may be stored or processed in the United Kingdom, the European Economic Area, or other countries where our providers operate. Where personal data is transferred outside the UK without adequacy protection, we use the UK International Data Transfer Agreement, an approved addendum, or another recognised safeguard.

How to reach us

Operator: a company registered in the United Kingdom (details pending)

game@niddak.com