Privacy Policy — Kingdom Wars: Realm Rivals
Effective date: August 4, 2026 This Privacy Policy explains how Franco Rafael Campos Correa, located in Belo Horizonte, Minas Gerais, Brazil ("we", "us", or the "Publisher"), processes personal data when you use Kingdom Wars: Realm Rivals (the "Game"). For privacy questions, LGPD requests, support, or account deletion, contact frcc24@gmail.com.
1. Scope and intended audience
This Policy covers the Game, its ranked multiplayer services, account systems, purchases, advertising, support, and related online services. The Game is intended for people aged 13 or older and is not directed to children under 13. If you believe a child under 13 provided personal data, contact us so we can investigate and delete it when appropriate. A parent or guardian must participate whenever applicable law requires consent or authorization for a teenager.
2. Data we process
The categories below depend on the features you use, your device, your region, consent choices, and the version of the Game. 2.1 Data stored locally The Game may store language, audio and other settings, decks, local progress, collection, wallet balances, packs, quests, and local AI match state on your device. Removing the Game or clearing its storage may delete local-only data. 2.2 Google Sign-In and Firebase Authentication Online account creation uses Google Sign-In and Firebase Authentication. These services may process your email address, Google account identifier, Firebase user ID (UID), authentication metadata, IP address, user agent, authentication tokens, and security information needed to sign you in and protect the account. We do not receive your Google password. 2.3 Profile, collection, and progression We may process your nickname, account status, collection, wallet, packs, decks, quests, inbox, experience points, level, rank, match history, and lifetime statistics to maintain your account and synchronize progress. Your nickname is visible to matched opponents and may appear in rankings or match results. Do not use your legal name or other sensitive information as a nickname. 2.4 Ranked multiplayer Ranked matchmaking and authoritative gameplay may process matchmaking requests, connection information, gameplay commands, match state, results, ranking changes, opponent identifiers, security events, reports, and replay data. We use these records to operate matches, resolve disputes, detect cheating, investigate abuse, and improve reliability. 2.5 Google Play purchases Purchases are processed through Google Play Billing. We may receive product identifiers, purchase history, purchase tokens or receipts, transaction status, entitlements, and records of virtual currency, card packs, cosmetics, or playable content delivered to your account. Google processes payment details. We do not receive or store the full payment-card details you provide directly to Google Play. 2.6 Unity Ads When Unity Ads is enabled, it operates as a separate advertising provider. Depending on your consent, platform settings, region, and ad type, Unity Ads may process approximate location inferred from IP address, app interactions, ad views and clicks, diagnostics, device identifiers, and advertising identifiers to deliver, measure, limit, and protect ads. Unity's use of data is also governed by its own privacy notices and controls. 2.7 Security and anti-cheat Google Play Integrity and freeRASP by Talsec may process installation binding, integrity verdicts, device and app security state, tampering or rooting signals, anti-cheat signals, rate-limit data, and anomaly records. We use this information to protect accounts, matches, purchases, and the Game from fraud, abuse, automation, unauthorized clients, and security attacks. 2.8 Support communications If you contact us, we process the information in your message, your email address, and any files or account details you voluntarily provide so we can respond and keep an appropriate support record.
3. Why we process data
Depending on the context, we process data to: - create, authenticate, secure, and manage accounts; - provide local gameplay, ranked matchmaking, multiplayer matches, rankings, and synchronized progression; - deliver purchases, virtual items, currency, packs, cosmetics, and playable content; - display, personalize where permitted, measure, and protect advertising; - provide support and respond to privacy or account-deletion requests; - monitor performance, diagnose crashes and network problems, and improve reliability; - prevent fraud, cheating, harassment, unauthorized access, and violations of our Terms; - comply with legal, tax, accounting, consumer-protection, and regulatory obligations; and - establish, exercise, or defend legal claims. Under Brazil's General Data Protection Law (LGPD), the applicable legal basis may include performance of a contract or preliminary procedures requested by you, compliance with legal or regulatory obligations, our legitimate interests subject to your rights and reasonable expectations, protection against fraud, exercise of rights, and consent where the law requires it. You may withdraw consent through the available controls or by contacting us, without affecting processing already lawfully performed.
4. Sharing and service providers
We do not sell your personal data for money. We may disclose data only as needed to: - Google Firebase for authentication and related account infrastructure; - Cloudflare Workers, Durable Objects, and D1 for multiplayer sessions, matchmaking, authoritative match state, account data, security, and storage; - Google Play services and Google Play Billing for distribution, integrity checks, purchases, and entitlements; - Unity Ads for its separately operated advertising services; - Talsec/freeRASP for app and device security signals; - professional advisers and authorities when required by law or reasonably necessary to protect rights, users, and the service; and - a successor in a merger, acquisition, reorganization, or asset transfer, subject to applicable safeguards and notice requirements. These companies may act as service providers processing data on our instructions or as independent controllers for their own purposes, as explained in their documentation and privacy notices.
5. International transfers
Our providers may process data outside Brazil. When personal data is transferred internationally, we use applicable contractual, organizational, and technical safeguards and rely on lawful transfer mechanisms required by the LGPD.
6. Security
Data sent between the Game and online services is encrypted in transit using current secure protocols where supported. We also use access controls, integrity checks, rate limits, and anti-abuse measures appropriate to the data and risk. No storage or transmission method is completely secure. We cannot guarantee absolute security, and you should protect access to your Google account and device.
7. Retention
We keep account and progression data while your account is active and for the period reasonably needed to operate the Game. After account deletion, we delete or anonymize associated data unless limited retention is necessary for legal, tax, accounting, payment, security, fraud-prevention, dispute, or enforcement purposes. PvP replay data is retained for 30 days or the most recent 20 matches per player, whichever retains less data, unless a specific replay must be preserved for an active security, cheating, support, or legal investigation. Support records, purchase evidence, and security logs are kept only for periods proportionate to their purposes and legal obligations. Data controlled independently by Google, Unity, Cloudflare, or other providers follows their documented retention rules.
8. Account deletion
You can delete your account from inside the Game, at Settings > Account > Delete account. Deletion happens immediately and cannot be undone. If you no longer have the Game installed, request deletion by emailing frcc24@gmail.com from the address associated with your account, with the subject "Delete account". Writing from the registered address is how we confirm the request is yours; we may ask for further reasonable verification to protect the account from unauthorized deletion. Requests received by email are handled within 30 days. What deletion erases. Your Firebase identity and the associated account data stored in Cloudflare D1: account access, collection, decks, wallet, packs, level, experience, quests, rank, records of matches against the AI, internal counters, and usage history. Deletion is permanent and removes access to progress, virtual currency, packs, and other virtual items, including those obtained by purchase. What remains, with no link to you. Two categories are anonymized rather than erased, because they are not only about you: - Matches played against other players. A match belongs to two players: the result stays in your opponent's history and rating with your identity removed. Erasing it would retroactively alter another person's record. - Transaction records for real-money purchases. Kept to meet tax and accounting obligations, also with your identity removed. In neither case does an email address, nickname, account identifier, or any other datum that could associate the record with you remain. Beyond these, only short processing periods, backups that expire on their normal cycle, and any minimized records we must lawfully retain apply. Public account-deletion request resource: https://app-policies-hub.lovable.app/excluir-conta
9. Your LGPD rights
Subject to applicable law and verification, you may request: - confirmation that we process your data; - access to your personal data; - correction of incomplete, inaccurate, or outdated data; - anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data; - portability when legally available and technically applicable; - information about sharing and the consequences of refusing consent; - withdrawal of consent and deletion of data processed on consent, subject to lawful retention; - review of decisions based solely on automated processing when applicable; and - opposition or a complaint to Brazil's National Data Protection Authority (ANPD). Send requests to frcc24@gmail.com. We will respond within the time and format required by applicable law.
10. Children and teenagers
The Game is not directed to children under 13. We do not knowingly seek to collect their personal data. For users aged 13 to 17, we apply protections appropriate to the user and applicable law, including guardian involvement where required and restricted advertising treatment where mandated.
11. Changes to this Policy
We may update this Policy when the Game, providers, legal requirements, or data practices change. We will update the effective date and provide notice proportionate to the importance of the change. If consent is legally required for a new purpose, we will request it before that processing.
12. Contact
Controller and publisher: Franco Rafael Campos Correa Location: Belo Horizonte, Minas Gerais, Brazil Email: frcc24@gmail.com