The short version
- No real name, email, phone number, contacts, precise location or advertising ID — ever.
- Your account is a random identifier created on your device. Our servers store only its SHA-256 hash.
- Your callsign, trophies, squad and chat messages are visible to other players, and raiders can see your base layout.
- No ads, no advertising or analytics SDKs, and we never sell your data or share it for advertising.
- Delete your account any time in the app (Profile → Delete account) or via our account deletion page.
1. Who we are
Prismfall is a base-building strategy game for Android, operated by the Prismfall team (“we”, “us”, “our”). This Privacy Policy covers the Prismfall app, our game servers and real-time services, and this website (together, the “Service”).
For the purposes of the EU and UK General Data Protection Regulation (GDPR), the Prismfall team is the controller of the personal data described here. You can reach us at support@prismfall.example.
2. Information we collect
Information you or your device give us
- Device identifier. The first time you open Prismfall, the app generates a random identifier and keeps it in the app's private storage on your device. It is not derived from your hardware, phone number, SIM or advertising ID. The app sends it to our servers to sign you in as a guest; our servers store only its SHA-256 hash, which lets us recognise your device without being able to recover the identifier itself.
- Callsign. The display name you choose for your pilot, or a default such as “Pilot4821”.
- Squad information. Squads you create or join, including a squad's name, tag, description and badge, and your role (leader or member).
- Chat messages. Messages you send in the global channel and in your squad channel.
- Reports and blocks. If you report a player, we store who you reported, the reason you picked and, when you report a chat message, a copy of that message, so a moderator can review it. If you block a player, we store your block list so their chat is hidden from you.
Information created when you play
- Gameplay data. Your base layout and building levels, resources (Flux, Aether and Prisms), army and training queue, upgrade timers, trophies, attack and defense win counts, daily-bonus status, shields, and when your account was created.
- Battle records and replays. For each raid you take part in: the opponent, stars, destruction percentage, loot and trophy changes, and the deployment data needed to replay the battle exactly. While a raid is in progress, this data is relayed live to permitted spectators (see section 6).
- Presence. Whether you are currently connected, used for “online” indicators shown to your squad mates and for an anonymous count of players online.
Technical and security information
- IP address and technical logs. When the app or this website talks to our servers, we automatically receive your IP address, request times, the endpoints requested, response codes, your app version or browser user agent, and error information. We use these for security, abuse prevention (for example rate limiting chat and blocking attacks on our servers) and troubleshooting. Our game server writes only a shortened form of your IP address to its logs (the network part: the first three numbers of an IPv4 address, or the first three groups of an IPv6 address) and uses the full address only briefly, in memory, to limit repeated sign-in attempts.
- Session tokens. After you sign in, our servers issue a signed session token that the app stores on your device and sends with each request.
Information stored on your device
The app stores your device identifier, your current session token and your in-app settings (such as sound and haptics) in Android's private app storage. The app opts out of Android backups and device-to-device transfers, so they never leave your device. Clearing the app's data or uninstalling it removes them — and with them, access to your guest account (see our Terms).
Website visitors
This website does not use cookies, analytics, advertising pixels or other trackers. Our server keeps the technical logs described above. The site loads the Chakra Petch and Inter typefaces from Google Fonts, so your browser connects to Google's servers, which receive your IP address and browser information; see Google's Privacy Policy. The home page also fetches anonymous public statistics (player count, raids in the last 24 hours, pilots online, top pilots) from our server.
3. What we don't collect
- Your real name, email address, phone number or postal address.
- Your contacts, photos, files, microphone or camera.
- Your precise location. We do not use your IP address to locate you.
- Your device's advertising ID (AAID) or any other cross-app tracking identifier.
- Payment information — there is nothing to buy in Prismfall.
Prismfall contains no advertising SDKs and no third-party analytics or tracking SDKs. We do not sell your personal information, and we do not share it with anyone for advertising, including cross-context behavioural advertising.
4. How we use your information & our legal bases
We only use personal data for the purposes below. If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR requires us to name a legal basis for each purpose:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and running your guest account; saving your citadel and progress | Hashed device identifier, callsign, gameplay data | Performance of our contract with you (Art. 6(1)(b)) |
| Multiplayer: matchmaking, raids, replays, live spectating and leaderboards | Callsign, gameplay data, battle records | Performance of contract (Art. 6(1)(b)) |
| Squads, chat and presence | Callsign, squad membership, chat messages, presence | Performance of contract (Art. 6(1)(b)) |
| Fair play: verifying battle results and detecting cheats, bots and exploits | Battle records, gameplay data, technical logs | Legitimate interests in fair competition for all players (Art. 6(1)(f)) |
| Security, abuse prevention, rate limiting and chat moderation | IP address, technical logs, chat messages | Legitimate interests in keeping the Service and its players safe (Art. 6(1)(f)) |
| Operating, troubleshooting, balancing and improving the game; publishing aggregate statistics | Technical logs, gameplay data in aggregated form | Legitimate interests in running a reliable, well-balanced game (Art. 6(1)(f)) |
| Complying with the law, responding to lawful requests and enforcing our Terms | Any of the above, as relevant | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced them against your rights and you can object at any time (see section 11). Our servers automatically check every submitted battle against the game rules and may reject results that break them; this affects only the outcome of that battle and has no legal or similarly significant effect on you.
6. Information visible to other players
- To everyone: your callsign, trophies, Nexus Core level, squad name and tag, attack and defense win counts, leaderboard rank, when you joined (shown as “Pilot since” on your pilot card) and the messages you post in global chat. The top pilots' callsigns and trophy counts may also appear on this website.
- To players who raid you: your base layout, building levels and the loot available in your base.
- To your squad: your role, whether you are online, your squad chat messages, and the raids you are involved in — squad mates of either player can watch a raid live and view its replay.
- To your opponents: battle records and replays of raids they took part in.
Please don't put personal information in your callsign, squad details or chat messages.
7. How long we keep information
| Information | Retention |
|---|---|
| Account and gameplay data (hashed device identifier, callsign, base, resources, army, trophies, squad membership) | Until you delete your account |
| Chat messages | 30 days, then deleted automatically |
| Battle records and replays | 60 days, then deleted automatically |
| Player reports (including a copy of a reported chat message) | Until a moderator has reviewed them, then 90 days |
| Your block list | Until you unblock the player or delete your account |
| IP addresses and technical logs (game servers and website) | 30 days, then deleted automatically |
When you delete your account, we delete your account and gameplay data immediately (see section 12). We may keep specific information longer only where the law requires it or where it is needed to establish, exercise or defend legal claims — for example, records relating to a serious abuse investigation. Aggregated statistics that cannot identify you may be kept indefinitely.
8. Security
We protect your data with measures appropriate to its sensitivity, including encryption in transit (HTTPS/TLS) between the app, this website and our servers; storing device identifiers only as one-way SHA-256 hashes; signed, expiring session tokens; restricted, logged access to production systems; and keeping as little data as we can for as short a time as we can.
No system is perfectly secure. If a data breach affects your personal data, we will notify you and the relevant authorities where the law requires us to.
9. Children
Prismfall is not directed to children under 13, and we do not knowingly collect personal data from children under 13 (or under the minimum age for consenting to online services in your country, which may be up to 16). If you are a parent or guardian and believe your child has created an account, contact us at support@prismfall.example and we will delete it. You can also delete the account directly from the app on your child's device under Profile → Delete account.
10. International transfers
Our servers and our infrastructure providers may be located in countries other than yours, whose data protection laws may differ. When we transfer personal data out of the EEA, the UK or Switzerland, we rely on an adequacy decision for the destination country or on Standard Contractual Clauses approved by the European Commission (and their UK and Swiss equivalents), together with additional safeguards where needed. Contact us for more information about these safeguards.
11. Your rights
EEA, UK and Swiss residents (GDPR / UK GDPR)
You have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Correct inaccurate data — you can change your callsign in the app at any time.
- Delete your data (“right to be forgotten”) — instantly, from the app.
- Restrict how we process your data in certain circumstances.
- Portability — receive your account data in a structured, machine-readable format (JSON).
- Object to processing based on our legitimate interests.
- Lodge a complaint with your local data protection authority. We'd appreciate the chance to resolve your concern first.
California residents (CCPA / CPRA) and other US states
In the past 12 months we have collected the following categories of personal information, directly from you and your device: identifiers (hashed device identifier, player ID, callsign, IP address) and internet or other electronic network activity (gameplay and battle data, chat messages, technical logs). We use them for the business purposes described in section 4 and disclose them only to the service providers described in section 5. We do not collect sensitive personal information as defined by the CPRA.
You have the right to know and access the personal information we hold about you, to delete it, to correct it, to receive it in a portable format, and to opt out of its sale or sharing — although we do not sell or share personal information, and have not done so in the past 12 months. We will never discriminate against you for exercising any of these rights. Residents of other US states with comparable privacy laws (for example Virginia, Colorado, Connecticut and Utah) have similar rights, including the right to appeal a decision we make about your request.
How to exercise your rights
Deletion and correction of your callsign are available directly in the app. For anything else, email support@prismfall.example and include your Player ID, which is shown in the app under Profile. Because guest accounts have no email address or password, we verify requests by asking for details that only the account holder would know (for example your callsign, squad, trophy count or recent opponents). Authorised agents may submit requests on your behalf with your written permission.
We respond within one month (GDPR) or 45 days (US state laws), and may extend this where the law allows, letting you know why. Requests are free of charge. To appeal a decision, reply to our response with “Appeal” in the subject line; if you are not satisfied with the outcome, you may contact your state Attorney General.
12. Deleting your account
You can permanently delete your account at any time in the app under Profile → Delete account. Deletion takes effect immediately and removes your account, hashed device identifier, callsign, base, resources, army and squad membership, and your block list, deletes reports about you and chat announcements that name you, and deletes or permanently de-identifies your chat messages, battle records, replays and the reports you filed. Technical logs expire within 30 days.
Uninstalling the app or clearing its data does not delete your account on our servers — it only removes your access to it. If you can no longer open the app, follow the steps on our account deletion page.
13. Changes to this policy
We may update this policy as Prismfall evolves or the law changes. We will post the new version here and update the “Last updated” date. If a change materially affects how we use your personal data, we will tell you in the app before it takes effect.
14. Contact us
Questions, requests or concerns about your privacy? Contact the Prismfall team at support@prismfall.example. Please include your Player ID if your message is about your account.