Privacy Policy
In short: you play without giving us an email, phone number or real name. We keep only what the game needs to work: your account, the name you choose, your progress and your purchases. There are no ads, no analytics and no tracking, and we never sell data. You can delete your account in the game at any time.
Contact
Questions or requests: [email protected].
What we store and why
| Data | Why |
|---|---|
| A random account ID and a sign-in code | So the game recognises your device. The code is kept on your device; our server keeps only a one-way scrambled (hashed) copy. There is no password. |
| The player name you choose and your friend code | Shown to other players in matches, leaderboards, friend lists and clans. Offensive names are blocked. |
| Game progress: level, heroes, items, in-game currencies, stats, ranked rating, quests, friends, clan, friend/clan requests, and who invited you (for invite-a-friend rewards) | To run the game and keep your progress. |
| Your answer to “are you 18 or older?” | To limit purchases for players under 18 (see below). We do not ask for your birth date. |
| Purchases: item, price, time, status, and the Google Play order number and purchase code or the Stripe payment reference | To deliver what you bought exactly once, and to handle refunds. |
| Players you block, and reports you send (who, and whether it was about a name, cheating or griefing, or a clan name) | To keep players safe: blocked players can't send you friend requests, party invites or clan requests, and we review reports. Nobody is told who blocked or reported them. |
| Who you played with in the last 2 days | So you can find, report or block players from your recent matches. Kept only in the server's memory, for at most 2 days. |
| Your IP address | Used while you play to stop abuse (for example floods of new accounts) and to keep ranked matches fair. Our web server records it in access logs, which are deleted after 14 days. |
| Server logs | Errors and important events (for example “account X bought item Y”). They mention account IDs, not names, and are deleted after 30 days. |
During an online match, your moves are sent to our server so the match can run. They are not stored after the match.
We do not collect your location, contacts, photos, files, microphone, camera, advertising ID or device identifiers.
Payments
In the Android app, purchases are made through Google Play. Google handles the payment; we never see your card or bank details. We send Google a one-way coded tag of your account (not your name) so a purchase can only be claimed by the account that made it, and our server checks each purchase with Google before delivering it. Google's own privacy policy applies to the payment: policies.google.com/privacy.
In the web version, purchases are made through Stripe, on Stripe's own checkout page. Stripe handles the payment and the details you enter there (such as your card and email address); we never see your card details. We send Stripe your account ID and the item, so the purchase reaches the right account, and we receive the payment's status and reference for delivery and refunds. Stripe's privacy policy applies to the payment: stripe.com/privacy.
Everything for sale is shown with its exact contents and price before you buy. There are no random or “loot box” items.
Who else sees data
- Other players see your player name, level, rating, clan and match performance.
- Google (Google Play) and Stripe, for purchases, as described above.
- Cloudflare, which carries and protects traffic to our server, sees your IP address and the traffic itself.
- Our hosting provider, which runs the server where the data is stored.
We share data with no one else, unless the law requires it. We never sell or rent data, and we do not use it for advertising.
Notifications
If you turn on reminders, they are scheduled on your own device. No message is sent to us or to a push service.
How long we keep data
- Your account and game data: until you delete your account.
- Backup copies of the database: deleted after at most 4 days, so a deleted account is fully gone from backups within 4 days.
- Purchase records: kept after an account is deleted, because we must keep payment records for accounting and refunds. They are then no longer linked to any player name or game data.
- Reports: until we have reviewed them, then 90 more days. Blocks: until you unblock or delete your account.
- Web server logs: 14 days. Server logs: 30 days.
Your choices and rights
- Delete your account in the game: main menu → Friends → Account tab → Delete my account. More ways, including without the app: knockfall.lumadro.com/delete-account.
- Change your player name in the same Account tab.
- Get a copy of your data, or ask us to correct or delete it: email [email protected] with your friend code (shown in the Friends screen). Depending on where you live, you may also have the right to object or to complain to a data protection authority.
Children
Knockfall is not directed at children under 13, and we do not knowingly collect data from them. Players who say they are under 18 can spend at most $20 per month. If you believe a child under 13 has an account, email us and we will delete it.
Security
All connections to our server are encrypted (HTTPS and secure WebSockets). Sign-in codes are stored hashed, and access to the server is restricted to us.
Changes
If we change this policy, we will update this page and its effective date. For important changes, we will also tell players in the game.