Effective: August 17, 2026 Developer: Maksym Kozlov ([email protected]) Application: Ironclash, package com.vinmara.ironclash
This document describes what data the game transmits or stores, why, and for how long it is kept. The list is drawn from the actual database schema and the production network path, not from future plans.
| Data | Why | Where it lives |
|---|---|---|
| Email address | The sign-in identifier for the account | accounts.email |
| Password | Sign-in | The plaintext is transmitted over HTTPS and processed only in memory. It is never stored; only an irreversible digest is kept (scrypt with a random salt) |
| Fighter name | Shown to other players in battle, in the rating and in chat | characters.name |
Game progress: level, experience, attributes, health, currencies, items, wins and losses, the chosen look and battle scheme, position in the campaign.
Messages you write in chat are stored together with their time and recipient. Public chat is visible to every player. Do not write anything there that you consider private.
Technical account and session data: internal account and fighter identifiers, an irreversible digest of the sign-in token, and the time it was issued and revoked.
Technical request metadata: your IP address and ordinary HTTP request metadata (such as the requested route and user-agent header) necessarily reach the Cloudflare reverse proxy/CDN and the hosting server. This metadata is processed transiently by the game application to route, secure and answer the request and is not stored in account or gameplay tables. It is not used for analytics, profiling or advertising. Infrastructure providers may retain limited operational or security logs under their own controls.
Chat safety data: the current Community Guidelines version you accepted, the time of consent, accounts you block, and reports you submit. A report records its category and may contain the reported message and optional details so the operator can investigate it even if the original message is deleted.
We do not request GPS location or infer and store location from the IP address. We collect no contacts, list of installed apps, persistent device or advertising identifiers, photos, microphone or camera data. The current application contains no ad networks, billing SDK or third-party analytics. Permissions that could enable those device data sources are stripped from the release build.
The reasons are to make the game work and keep it safe. The email identifies your account; progress survives between launches; the name lets opponents know whom they are fighting; consent, block and report records support moderation; technical request metadata routes and protects the connection. We do not use this data for analytics, profiling or advertising and build no decisions about you on top of it.
We do not sell data or pass it to advertisers, data brokers or business partners. Infrastructure service providers — the hosting provider and the reverse proxy/CDN — process only the data technically required to operate, secure and deliver the game on our behalf.
We will disclose data on a lawful request from an authorized body — and in no other way.
Account, progress, chat, consent and block data are kept for as long as your account exists. Sign-in tokens expire 30 days after being issued and are deleted.
Evidence attached to a safety report is kept for no more than 180 days from the report, unless a longer period is required by law. This bounded safety record may remain after the original message or account is deleted so an already-filed complaint cannot be erased before review.
Technical request metadata is not retained in the game's account or gameplay database. Infrastructure providers may keep limited operational or security logs for the periods set by their services and legal obligations.
You can request a copy of your data or deletion of the account together with the fighter link, progress and messages. The bounded safety-report exception described above still applies. Write to [email protected] from the address the account is registered to. We will fulfil the request within 30 days.
Deletion is irreversible: progress cannot be restored afterwards.
Passwords are stored only as an scrypt digest with a random salt. Traffic to the server goes over an encrypted channel (HTTPS); plain HTTP is forbidden in the release build at the level of the application's system network policy. The sign-in token on the device sits in the operating system's secure storage, not in an ordinary file.
No protection is absolute, and we do not claim otherwise.
The game is not intended for children under 13 and does not knowingly collect their data. If you discover that a child has created an account, write to us — we will delete it.
We will announce substantial changes to this policy inside the application before they take effect. The date at the top of the document always matches the edition in force.
Published at: https://ironclash.vinmara.com/privacy — this is the URL declared in Play Console. The page is served by the game server itself, reading this very file: there is no second copy of the text, so the published edition is always the one reviewed in the repository.