Privacy Policy

Who controls your data

The data controller is Fabio Angelucci, developer of Arcalia: The First Dawn (referred to as "Arcalia", "we", "us" or "our" in this policy).

Privacy questions and requests can be sent to privacy@arcaliagame.com.

Data we collect

• Account and profile data: display name, email address, internal user ID, password hash, authentication provider ID, language and profile preferences.
• Game data: progress, faction, level, inventory, creatures, currencies, rewards, missions, battles, teams, guild activity and other gameplay actions.
• Social and user-generated data: friend relationships, requests and blocks; guild names, tags and membership information; private, guild and world chat messages; reports and other content you submit.
• Search data: player, friend-code and guild searches sent to the service.
• Technical and security data: IP address, user-agent information, session and authentication records, request metadata, rate-limit events and security logs.
• Local app data: authentication tokens, language and limited preferences stored on your device or in the app WebView.

We do not request access to your phone contacts, precise or approximate location, photos, videos, microphone, SMS, calendar or files in the current Android release.

How data is collected

We receive data directly from you when you register, configure a profile, play, search or communicate. We also generate account, gameplay and security records when you use the service.

If you choose Google sign-in, Google provides your Google account identifier, name and email address after you authorize the sign-in. Your use of Google's service is also governed by the Google Privacy Policy.

Why we use data

• To create and manage accounts, authenticate users and maintain sessions.
• To provide and synchronize the persistent online game, including progress and social features.
• To deliver user-requested searches, friend, guild and chat functionality.
• To moderate user-generated content, investigate reports and enforce game rules.
• To prevent fraud, abuse, unauthorized access and technical attacks.
• To comply with legal obligations and establish, exercise or defend legal claims.

Where the GDPR applies, processing is based on performance of our service contract, our legitimate interests in operating and securing Arcalia, compliance with legal obligations, and consent where the law specifically requires it.

Who receives data

We do not sell personal data. Data may be processed by hosting, infrastructure and security providers acting on our behalf and under appropriate contractual safeguards. Google processes information when you choose Google sign-in.

Your display name, public profile, guild information and contributions may be visible to other players. Messages are delivered to the users or groups you choose. These disclosures are part of the social features you request.

We may disclose information when required by law, to protect users and the service, or in connection with a corporate reorganization where legally permitted.

Advertising and purchases

The current Android test release does not integrate an advertising SDK or Google Play Billing and does not process purchases. If advertising or in-app purchases are introduced, we will update this policy, the Google Play Data safety declaration and any required consent controls before activating that processing.

Future payments made through Google Play will be processed by Google. Arcalia will not receive full payment-card details, but may receive product, order, purchase-token and transaction-status information needed to provide purchases and prevent fraud.

Retention and deletion

Account, profile and game data is normally retained while your account is active. Messages, shared-world contributions and moderation records may be retained as needed to operate social features, protect users and resolve disputes.

You may request account deletion at any time through our account deletion page. Verified requests are completed within 30 days. Security and anti-fraud records may be retained in restricted or anonymized form for up to 180 days, and residual encrypted backups may remain for up to 90 days before expiry. Records that must be retained by law may be kept for the required legal period.

Security and international processing

We use encrypted HTTPS connections, access controls, password hashing, restricted administrative access and monitoring intended to protect data. No method of storage or transmission can be guaranteed to be completely secure.

Providers involved in authentication or infrastructure may process data outside your country. Where required, we use legally recognized safeguards for international transfers.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, receive a portable copy, and withdraw consent without affecting earlier lawful processing.

Send a request from the email associated with your account to privacy@arcaliagame.com. We may ask for information necessary to verify account ownership. EEA users may also lodge a complaint with their local supervisory authority; in Italy, this is the Garante per la protezione dei dati personali.

Age restrictions

Arcalia is directed to users aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us so that we can investigate and delete it where appropriate.

Changes to this policy

We may update this policy when the service, data practices or legal requirements change. We will publish the revised version on this page and update the date above. Where required, we will provide additional notice or request consent.