Privacy Policy

1. Who is responsible

FingerForge Games, an independent studio in Poland, is the controller of personal data for the Site, Forge Castle, and our game API at api.fingerforge.games. Discord Inc. is the controller for what you do inside Discord itself.

2. What we collect — the game

Forge Castle can be played offline. When the game talks to our servers (ranking, seeds, cloud identity), we store:

• Player ID — a random identifier we create. This is the main key of your account.
• Display name — the name you pick, shown on leaderboards and your public card.
• Google account ID (sub) — if you sign in with Google. This is how we recognise the same person on a new device. We do not get your Google password.
• Email address — only if Google confirms it as verified. We keep it for account recovery and, if you ever pay, for that conversation. We do not show it to other players, we do not put it on leaderboards, and we do not send marketing. You can play without linking Google; then we have no email.
• Avatar URL — the picture Google provides, or one you set later. Public on your player card.
• Device token — a hashed token for the install, plus an optional device label. Used so the game can stay signed in. We do not sell a hardware fingerprint.
• Client version and build hash — so we know which game build sent a report.
• Run reports — realm, waves, duration, gold, party, kills, and related combat data. Used for ranking, anti-cheat review, and balancing. Flagged runs are reviewed by us; a flag does not take your local progress away.
• Progress — highest wave per realm, weekly scores, VIP status if you subscribe.

We collect this because the Service cannot work without it (contract, GDPR Art. 6(1)(b)) and, for anti-cheat and security, because we have a legitimate interest in a fair game (Art. 6(1)(f)).

3. What we collect — the website

• Contact form: name, email, message — only if you send one. Handled via Formspree to [email protected].
• Account portal: if you sign in with Google on the Site, the same game account data as above, shown back to you.
• Necessary storage: language and theme in localStorage on your device. Not sent to us.
• Analytics, only with consent: Google Analytics 4 (page views, roughly where in the world, device class). IP is anonymised. No ads, no ad-personalisation, no sale of data. If you reject, GA is not loaded.

4. What we do not collect

• Full card numbers — those stay with the payment provider (Adyen on the Site; Google Play if a purchase ever goes through the store)
• Precise GPS location
• Your contacts, photos, or files
• Marketing profiles for advertisers

4a. Payments on the Site

VIP, supporter tiers, and cosmetics bought on fingerforge.games are charged by Adyen. We never see your full card number or CVC. What we keep in our database:

• your player ID
• what you bought (VIP period, supporter tier, cosmetic SKU)
• amount, currency, status (paid / failed / refunded / cancelled)
• Adyen’s payment / subscription reference
• timestamps, and the email Google already gave us — used for the receipt

Legal basis: performing the purchase contract (GDPR Art. 6(1)(b)) and keeping invoices as Polish accounting law requires (Art. 6(1)(c)). Subscription records stay for as long as the sub is active, then for the statutory bookkeeping period (typically 5 years in Poland).

5. Who we share with

We do not sell personal data. Processors we use:

• Google — Sign-In (identity) and, if you consent, Analytics. Privacy Policy
• Adyen — card and subscription payments on the Site. Privacy Policy
• Cloudflare — DNS, CDN, and hosting of the Site. Privacy Policy
• Our game host — the API and database run on a server we control
• Formspree — contact form delivery. Privacy Policy

Google may process data in the United States. For Analytics that happens only after consent. For Sign-In it is required to log you in. Standard contractual clauses / Google’s GDPR terms apply.

6. How long we keep it

• Game account: for as long as the account exists. If you ask us to delete it, we erase or anonymise what the law lets us erase. Anti-cheat records needed to keep a ban honest may be kept in a minimal form.
• Contact messages: until we have answered, then deleted unless we must keep them for a dispute.
• Analytics: 14 months, then dropped by Google Analytics’ retention setting.

7. Your rights (GDPR)

You can ask to access, correct, delete, restrict, or export your data, and to object to legitimate-interest processing. Consent for analytics you can withdraw at any time via the Cookies control in the footer — you do not need to email us for that.

For game-account deletion or a copy of your data, write to [email protected] from the email on the account, or use the contact form.

You can complain to your data authority. In Poland that is UODO.

8. Children

The Services are not directed at children under 13. We do not knowingly collect their data. If you believe we have, contact us and we will delete it.

9. Cookies

The Site uses:

• Necessary: your language and theme choice, stored in the browser. Cloudflare may set a security cookie to keep the Site up. These are not used for ads.
• Analytics (opt-in): _ga and _ga_* from Google Analytics 4, only after you press Accept. Reject leaves them unset. You can change your mind in the footer under Cookies.

We do not use advertising cookies, social pixels, or cross-site tracking.

10. Changes

If we start collecting something new, we will update this page and the date at the top. If the change is material, we will say so on the Site or Discord.