Your account
You only need an account to play online. When you choose online play, you are asked to sign in with your Apple ID or your Google account. A display name in the form of “Challenger-1234” is assigned automatically, and you can change it to whatever you like.
Playing the CPU needs no account. Until you sign in, no account exists and the app sends nothing to the server — CPU matches are worked out entirely on your device, so no connection is involved.
Signing in gives us an identifier for your account, and nothing more. Your email address and your name are never stored on our server. (If you choose to share your name with an Apple ID, it is used only as the starting value of your display name, which you can change at any time.)
What is stored on the server
The following is kept on the server so that online play and spectating work. None of it is created unless you sign in.
- —A user ID (a UUID assigned by the server)
- —Which service you signed in with (apple or google), and the identifier that service assigns to your account
- —Your display name
- —Which set of card art you have chosen
- —Match records (the rules chosen, how the attack was spent, the hand played each turn, the damage dealt, HP, and the result)
- —An authentication token (it expires 30 days after it is issued, and a new one is taken when you sign in again)
- —Timestamps (when the account and the token were created, and when each match started and ended)
What other people can see
Your display name is shown to your opponent, to anyone watching, and on the match records. Every finished match can be opened by anyone, and your own match history is public the same way. Keep your real name and contact details out of your display name.
Anyone can watch a match in progress, but spectators are only sent turns that have already resolved. Unplayed hands and either player's allocation are never sent to them.
There is no chat. The only thing you send another player is a hand, and what you spent on it.
What is not collected
No name, email address, phone number, postal address, date of birth, or contacts are collected. The app never reads your device's location.
Our server keeps no request logs and no IP addresses, and no analytics or crash-reporting tools are built in. The only third-party component in the app is the advertising described below.
What stays on your device
Your device's local storage (iOS UserDefaults) holds four settings, plus the authentication token if you have signed in — nothing else.
- —Your display language
- —The rules you picked
- —The deck you built (how you spent your attack)
- —The set of card art you picked (also stored on the server, so your opponent and spectators see it)
Removing what is stored
Signing out removes the authentication token from your device. The account stays on the server, so signing in again with the same Apple ID or Google account brings your record back.
The account itself can be deleted from the app's settings screen. Deleting it removes the account and the display name from the server and cuts the link to the account you signed in with (signing in again starts you off as a new player).
The matches themselves remain. A match is also the other player's record, so the deleted player's name is withheld and the match can no longer be traced to anyone.
Deleting the app removes those settings and the authentication token from your device. That alone does not remove the account from the server, so delete it from the settings screen first.
Advertising
On the free plan, ads appear at the top of the screen and when you leave a finished match for the home screen. They are served by Google AdMob.
Only ads that are not based on your behaviour are served. Nothing is combined with your activity in other companies' apps or sites for targeting or measurement, so the app never asks for permission to track you.
To serve those ads, AdMob receives a device identifier, a coarse region inferred from your IP address, records of ads shown and tapped, and device performance and crash information. Google receives these; none of it reaches our server. How Google handles them follows Google's own privacy policy.
While you are on the Standard plan, no ads are shown.
Payment
Apple handles the purchase, renewal, and cancellation of the Standard plan. Card numbers and other payment details never reach us.
Whether you are subscribed is checked on your device alone; no record of the purchase is stored on our server.
You can cancel from iOS Settings or from the app's settings screen.
Third parties
Apart from the advertising described above, nothing is shared with third parties. Match records and display names are never used for advertising.
Changes to this policy
Before what is stored, or who can see it, changes, this page is revised first, and the date above is updated with it.