Privacy Notice

• Account data: your email address, a password credential (stored only as a salted hash) or the profile your sign-in provider shares with us, such as name, email, and picture.
• Game data: your daily results, ranks, streaks and totals, your cloud saves, your custom hero's name, appearance, level, experience, and skill points.
• Purchase data: which product you bought, the amount, and the order reference. Card numbers and billing addresses are collected by our payment provider, not by us.
• Support messages: anything you write to us about a bug, a purchase, or an account.
• Usage and error data: pages and features used, when a fight starts and ends, and technical error reports that help us fix crashes.
• Device and network data: IP address, browser and device type, and approximate location derived from the IP address.

• To create your account, run the game, and deliver the subscription or credits you bought — performance of a contract.
• To keep the game fair and secure, prevent fraud and abuse, and debug crashes — legitimate interests.
• To answer your questions about an order or a bug — legitimate interests and, where needed, performance of a contract.
• To keep tax, accounting, and invoicing records — legal obligation.
• To send marketing or product news — consent, which you can withdraw at any time.

• Service providers that host the site, store the database, and report errors on our behalf, under contract.
• Paddle, our Merchant of Record, for sale of the product, subscription management, payments, tax compliance, and invoicing.
• Professional advisers such as lawyers and accountants, under confidentiality.
• Public authorities or courts, where the law requires it.

Account and game data is kept while your account is open. If you delete your account or ask us to, we delete or anonymise it within 30 days. Purchase, tax, and invoicing records are kept for as long as tax and company law require. Short-lived error and usage logs are kept for about 90 days.

We use essential cookies for your sign-in session so the site knows you are logged in. Your device also stores game progress in local storage so the daily fight works without a network. We do not use advertising or marketing cookies. You can clear cookies and local storage in your browser settings; clearing local storage can erase your unsaved progress.

Our providers may process data outside your country, including the United States. Where that happens, we rely on recognised safeguards such as standard contractual clauses or adequacy decisions.

Data is encrypted in transit, access is limited to what a task needs, and credentials are stored as salted hashes rather than readable text. No system is perfectly safe, so tell us promptly if you think your account is compromised.

You can ask to access your data, correct it, delete it, restrict or object to its use, or receive a copy of it in a portable format. Where we rely on consent, you can withdraw it. You can also complain to your local data protection authority. Send your request through the contact route at the bottom of this page; we answer within one month.

The Service is not aimed at children under 13. If we learn we hold a child's data without parental consent, we delete it.

If this notice changes in a way that matters to you, we will say so in the app or on this page before the change applies.