Aura Leveling – Privacy

1. Account and sign-in

Google Firebase Authentication provides your game account. It processes a unique account ID, sign-in method, authentication timestamps and technical connection data. Email sign-in also uses your email address and protected authentication credentials. Google or Apple sign-in uses identifiers and, where supplied, the email address from your chosen provider; Apple may provide a relay address. Guest accounts also have an account ID but do not require an email address. We do not ask for your Google/Apple password or store payment details.

2. Game progress and public features

Cloud Firestore and server-side Firebase functions store and validate characters, names, appearance, class, level, statistics, equipment, inventory, currencies, progress, rewards, settings and game actions. This includes friendships and requests, guild membership, roles, donations, guild chat, battle participation and replays. Character names, appearance, game statistics and ranking/guild information are visible to other players. Guild chat is visible to authorised guild members. Do not include confidential information in character names or messages.

3. Security and technical services

Firebase App Check, using Apple App Attest or Google Play Integrity, helps recognise genuine apps and prevent tampering. App/installation identifiers, integrity proofs and technical information are sent to Google or Apple. Servers validate game actions, purchase receipts and repeated requests. Technical logs may contain account/request identifiers, errors, timestamps and IP addresses. Firebase Remote Config supplies information such as maintenance status and version requirements, using technical app and installation data.

4. Purchases and refunds

In-app purchases are processed by the Apple App Store or Google Play. We receive product and transaction identifiers, receipts or purchase tokens and purchase/refund status to verify purchases on the server, grant game currency and prevent duplicate credit. Refunds may adjust previously granted currency and any outstanding balance. We do not receive full card or bank details. Store payment processing and statutory receipt retention are governed by the stores' own terms.

5. Notifications and local data

Push notifications use Firebase Cloud Messaging and, on iOS, Apple's push service. Processing may include a device/installation token, account ID, platform, language and app version. You can disable notifications in your device settings. The device also stores your sign-in session, preferences and technical identifiers for safely retrying interrupted operations. Uninstalling the app does not delete the server-side account.

6. Purposes and legal bases

Accounts, game saves, requested social features and purchases are processed to provide the game under Article 6(1)(b) GDPR. Security checks, abuse prevention, troubleshooting and necessary technical logs rely on Article 6(1)(f); our legitimate interest is a secure and fair game. Where consent is required, for example for optional notifications, Article 6(1)(a) applies. Legal obligations may require processing under Article 6(1)(c). Consent can be withdrawn for the future.

7. Recipients and processing locations

Google/Firebase processes technical and account data to operate the game. The game database is configured in the European Firestore region eur3 and server functions in europe-west1. This does not mean all data stays exclusively in the EU: Firebase Authentication operates in the United States; other services and Google or Apple infrastructure may process data globally. Their applicable privacy and processing terms provide transfer mechanisms, including applicable adequacy decisions or standard contractual clauses. Other recipients are your chosen sign-in/store provider and other players to the extent described above.

8. Retention and deletion

Active game progress is stored while the account exists. You can delete the whole account in the app or request deletion through the page linked below. Deletion removes the authentication account and associated active game, social, chat and purchase links. A technical completion marker containing the account ID is scheduled for automatic deletion after 30 days to prevent interrupted deletion from recreating the account. A minimised receipt hash with product/platform and blocking status, no longer linked to the game account, remains for as long as necessary to prevent receipt reuse. Providers may retain technical logs and backups under their published retention periods. Required legal records or data for specific legal claims are retained only for those purposes.

9. Your rights and contact

Where legally applicable, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Contact us at the address above. We verify account ownership for security; never send passwords, one-time codes or complete payment details. You may complain to a data protection authority, including the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Germany. Privacy requests are handled within the applicable statutory response periods.

10. Community safety and reports

Before creating new public names or posting chat, players must accept the community rules; we store the accepted version and time. A basic language/link filter and message-rate limits supplement human review, but do not replace it. A report stores the reporting and reported account IDs, character name/ID, reason and, where applicable, the original message with guild and timestamp. These records are private and used to investigate abuse and possible action such as removing a message or temporarily restricting chat. A report alone does not automatically punish a player. Reports, including review notes, are scheduled for automatic deletion after 90 days; technical deletion may occur later. Deleting either involved game account removes linked reports earlier. Server-side block lists store account/character identifiers and display names to hide messages and prevent friend requests. Account deletion also removes references to that account from other players' block lists. Contact the support address above with questions or an appeal about a moderation decision.

11. Changes

We update these notices when the game or its services change. The linked provider notices explain their own processing. These game notices supplement the general website privacy notice and do not replace Apple's or Google's terms.

Analytics and advertising

Google Analytics data collection is disabled in this version. The game displays no advertisements and performs no personalised advertising/marketing analytics. Optional Unity player diagnostics are also disabled. Necessary server-side security and error logs are still processed as described above.

Provider privacy information

• Firebase: Privacy and Security
• Firebase: Data Processing and Security Terms
• Google: Privacy Policy
• Apple: Privacy Policy
• Landesbeauftragte für Datenschutz und Informationsfreiheit NRW