Privacy Policy — BloodRivals

1

What we collect

Account

Your username and email address, and a securely hashed password. This identifies you and lets you sign in.

Precise location

With your permission, your device’s GPS location while you are using the app. Location is the core of the game — it places you on the live map and lets you claim and defend the turf around you. We do not track your location in the background.

Gameplay data

The turf you claim, your coins and score, team membership, and in-game events. This is what makes the game work and powers the leaderboards.

Visible to other players

BloodRivals is a territory game: the shops and lots you claim are shown on the live map to other players — the same way a game like Ingress shows claimed landmarks. Other players can also spend in-game coins on a “spy” to see your recent moves (claims, takeovers, upgrades, coin collections, attacks and Specials), your score and holdings, and the addresses of the places those moves touched, for a limited time — and you are notified when someone spies you. We never show your live, real-time position; only the fixed places you have claimed. Claim public spots like shops, not your home.

Chat messages

If in-game chat is enabled for you, the messages you send — curated phrases, which every player can use, or text you type yourself, which is for players aged 13 and over — are stored so chat works and so our moderators can act on a report. Every typed message is checked by an automatic filter before it is stored; it is aimed at phone numbers, email and street addresses, links and blocklisted words, and it applies at every age. It is an automatic check, not a guarantee — it will not catch everything, which is why reporting and moderation sit behind it. Any location attached to a chat line is coarsened to a wide grid, never a precise position. You can block another player and report a message at any time. Blocking hides their chat from you and yours from them, including replies, mentions and reactions — and it also hides their name elsewhere in your view of the game (leaderboards, rosters, alerts, world feed and the owner line on their houses). See the Terms for exactly what a block does and does not cover.

Age band

When you create an account with a username and password we ask what year you were born. Your device turns that year into a coarse age band (under 13 / 13–17 / 18+) and sends us only the band — the year itself never leaves your phone, and we never ask for or store a date of birth.

Signing in with Apple or Google, or with an emailed sign-in link, does not ask the age question today, so those accounts carry no band at all — and while the under-13 system is switched off there is no screen in the app to set one. Those accounts are treated as the younger one for chat, and otherwise like any other player. We are closing that gap; we would rather state it here than let the wording imply a check we do not yet make on every route.

We use the band for three things, and nothing else:

·to decide whether you can type your own text in chat — text someone has typed is never delivered to a player under 13, and an account that has not answered the age question is treated as the younger one for this purpose only;
·to keep an under-13 player’s name out of the game’s public world feed. This is live today;
·to hold an under-13 account until a parent or guardian confirms. This is live today — see “Children” below.

Treating an unanswered age question as “younger” is a chat rule: an account that has not told us a band cannot type in chat. Every sign-in route now asks for the band before you play, so an account without one is the exception, not the rule.

Technical data

Minimal logs and device information needed to operate the service and keep it secure (for example, to investigate crashes and abuse). We also measure how the game is used — which screens and features players open, and where they get stuck — so we can improve it. This is product analytics for our own use only. We do not show ads, do not use advertising or cross-app tracking, never sell your data, and never use it to profile a child.

2

Why we use it (legal basis)

· To provide the game (GDPR Art. 6(1)(b) — performance of a contract): your account, location and gameplay data.
· Player-versus-player visibility (Art. 6(1)(b) — performance of a contract; and Art. 6(1)(f) — legitimate interest in a competitive game): showing your claimed places on the map and the paid “spy” reveal of a rival’s recent public moves.
· Security & integrity (Art. 6(1)(f) — legitimate interest): preventing cheating, abuse and fraud.
· Location access (consent): you grant the OS location permission, and can revoke it at any time in your device settings.

3

Who we share it with

We do not sell your data, and we do not share it with advertisers. Never.

We use a small number of trusted processors to run the service, bound by data-processing agreements:

· EU/EEA hosting provider — we run our own application and database servers on infrastructure located in the EU/EEA. The data centre operator provides the physical servers and network only; it does not access your data.
· Mapbox — the map you play on. Loading map tiles shares the map area you are viewing (and your IP address) with Mapbox so it can serve those tiles. We do not send your account to Mapbox.
· Email delivery provider — to send transactional emails (for example account and security messages), which processes your email address.
· Google Firebase (Google Ireland Ltd.) — push notifications, crash diagnostics, and privacy-safe product analytics (which screens and features are used). Advertising signals are turned off: no ads, no advertising identifiers, no cross-app tracking.
· Kids Web Services (KWS, operated by Epic Games) — our parental-verification partner, and this is in use today (see “Children”). A player who tells us they are under 13 passes their parent or guardian to KWS to confirm consent; KWS processes the grown-up’s contact details for that check and tells us only whether consent was given. It is used for nothing else, and not at all for players 13 and over.

Each processor handles only what its line describes. If we add another processor, we will update this page before relying on it.

4

How long we keep it

We keep your account and gameplay data for as long as your account is active. When you delete your account (see below), we delete your personal data, except where we must retain limited records to meet a legal obligation. Precise location is used live and we do not build a history of where you go — playing does not leave us a trail of the exact places you have been. There is one exception, and we would rather name it: anti-cheat . When a position looks impossible, or comes from a fake-location app, we record that exact position as evidence so staff can tell a cheat from a long train journey. Those records are kept for up to 180 days and are not used for anything else. Some things you DO are public and dated, and those carry an approximate position: a capture, a world-feed event, a post in a public chat channel. Those are rounded to about a 111 m grid before they leave our server (see “What we collect”). Deleting your account unlinks them from what other players can see: your handle is replaced, your chat lines lose their position, and world-feed events are either deleted or stripped of any link to your account. Staff-only anti-cheat and moderation records are the exception described above, and they age out on their own. The locations of the game objects you create — the places you claim, and where you place a Special — are part of the game itself and are kept as game state and anti-cheat records for as long as they matter to the game.

5

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or port it. To exercise any of these, email support@bloodrivals.com from your registered address — we respond within 30 days.

You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

6

Deleting your account

You can delete your account and its associated personal data at any time. See Support → Delete your account for how. We complete deletion within 30 days.

7

Children

BloodRivals is a general-audience game and is not specifically directed to children under 13. The minimum age for an account is 9. Separately, the app stores rate the game’s content 9+ on the App Store and Everyone 10+ on Google Play — a content rating and a minimum account age are different things, and we state both rather than blurring them.

What happens today. If a player tells us they are under 13, the account is held before play: we do not let them into the game until a parent or guardian confirms through our verification partner, and while the account is held the game refuses the requests that use a player’s position. The app shows the child how to ask. If the child played before telling us their age, we may already hold location data from that time — a parent or guardian can ask us to delete it at any time, and we will. Their answer changes two more things: an under-13 player’s handle is kept out of the game’s public world feed until a parent verifies, and they cannot type their own text in chat at all — typed text is a 13-and-over capability and is never delivered to a player under 13, verified or not. Under-13 players chat with ready-made phrases instead.

How the verification works. The hold and the parental-consent path run through our verification partner (see “Who we share it with”). We pass the parent or guardian’s contact details to them for that check and receive back only whether consent was given. We never receive a date of birth and never ask the child for one — the app collects a birth YEAR, reduces it to a band on the device, and sends only the band. A parent or guardian can withdraw that confirmation at any time by contacting us, and we will hold the account again.

Whatever else happens. A parent or guardian who does not want their child playing can contact us at any time and we will close the account and delete its data. Note that a parent’s confirmation does not hand a child typed chat: it lets the child play, and typed chat stays a 13-and-over capability.

We never show ads and never use advertising or cross-app tracking; we collect only the data the game needs, and we use it only to run, secure and improve the game — never to profile a child or for marketing. If you believe a child has provided us data you would like removed, contact us and we will delete it.

8

Changes & contact

We may update this policy as the game evolves; we will revise the date at the top and, for material changes, notify you in the app.

Questions? Contact the data controller, CreatorsJourney AS, at support@bloodrivals.com.